A method and system for intelligent processing of Internet data security

Abstract

The present invention relates to the field of data security technology, and specifically discloses an Internet data security intelligent processing method and system, comprising: step one: analyzing the network status when Internet data is lost, and obtaining abnormal performance data of the network status each time the Internet data is lost; step two: calculating the traffic abnormality performance value based on the abnormal performance data; step three: evaluating whether the Internet data loss is synchronized with the network traffic anomaly, and generating a synchronization evaluation signal; step four: evaluating the correlation between the Internet data loss and the network traffic anomaly based on the synchronization signal, and generating an optimization judgment signal; step five: analyzing the potential causes of the data loss based on the signal to be optimized; the present invention provides a scientific basis and practical guidance for effectively reducing Internet data loss by quantitative synchronization analysis, optimization judgment and exploration of potential causes, which is helpful to improve network operation efficiency and data protection capabilities.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and in particular to an Internet data security intelligent processing method and system. Background Art

[0002] With the rapid development of Internet technology, data has become an important asset for enterprises and society. However, data security issues have become increasingly prominent, such as data leakage, illegal access, malicious attacks, etc., which have brought huge losses to enterprises and individuals.

[0003] However, existing technologies often rely on empirical judgment or simple rule matching, and lack quantitative indicators to accurately evaluate the correlation between data loss and traffic anomalies, resulting in low accuracy and efficiency in problem identification, making it difficult to timely discover and deal with potential network problems. Existing technologies often only focus on the surface phenomenon of data loss, lack in-depth exploration of potential causes, resulting in the inability to fundamentally solve the data loss problem, which easily leads to the recurrence of similar problems. Summary of the invention

[0004] The purpose of the present invention is to provide a method and system for intelligently processing Internet data security to solve the technical problems in the above background.

[0005] The purpose of the present invention can be achieved through the following technical solutions:

[0006] A method for intelligently processing Internet data security comprises the following steps:

[0007] Step 1: Based on historical data, analyze the network status when Internet data is lost, and obtain abnormal performance data of the network status each time Internet data is lost;

[0008] Step 2: Calculate the traffic abnormality performance value based on the abnormal performance data of the network status;

[0009] Step 3: Evaluate whether Internet data loss and network traffic anomaly are synchronized, and generate a synchronization evaluation signal;

[0010] Wherein, the synchronous evaluation signal includes: a synchronous signal and an asynchronous signal;

[0011] Step 4: Based on the synchronization signal, evaluate the correlation between Internet data loss and network traffic anomaly, and generate an optimization judgment signal;

[0012] Among them, the optimization judgment signal includes: a non-optimization signal and a signal to be optimized;

[0013] Step 5: Analyze potential causes of data loss based on the signal to be optimized.

[0014] As a further technical solution of the present invention, the process of obtaining abnormal performance data is as follows:

[0015] Abnormal performance data include: congestion time ratio and congestion number ratio;

[0016] Based on historical data, extract the total congestion time and congestion times of the network status each time Internet data is lost;

[0017] The total congestion time is calculated by ratioing the transmission time to obtain the congestion time ratio;

[0018] The congestion times are calculated by comparing the congestion times threshold to obtain the congestion times ratio.

[0019] As a further technical solution of the present invention, the process of obtaining the flow abnormality performance value is as follows:

[0020] By formula: , calculate the traffic anomaly performance value YC, where a1 and a2 are preset proportional factors, and both are greater than 0, SJ is the congestion time ratio, and CS is the congestion number ratio.

[0021] As a further technical solution of the present invention, the process of generating the synchronous evaluation signal is:

[0022] Based on any loss of Internet data;

[0023] Obtain the amount of data loss when Internet data is lost, calculate the ratio of the data loss amount to the total data amount, and obtain the data loss ratio;

[0024] Based on the data loss ratio and traffic abnormality performance value when Internet data is lost, determine whether the Internet data loss is both a data loss abnormality state and a traffic abnormality state;

[0025] If the Internet data loss is in both a data loss abnormal state and a traffic abnormal state, a synchronization signal is generated; otherwise, an asynchronous signal is generated.

[0026] As a further technical solution of the present invention, the process of determining the abnormal state of data loss is as follows:

[0027] A data loss ratio threshold is preset, and the data loss ratio is compared and analyzed with the data loss ratio threshold;

[0028] If the data loss ratio is less than or equal to the data loss ratio threshold, a data normal state signal is generated;

[0029] If the data loss ratio is greater than the data loss ratio threshold, a data abnormal state signal is generated, and the Internet data loss is marked as a data loss abnormal state.

[0030] As a further technical solution of the present invention, the process of determining the abnormal flow state is as follows:

[0031] Preset a traffic anomaly performance threshold, and compare and analyze the traffic anomaly performance value of the Internet data loss with the traffic anomaly performance threshold;

[0032] If the traffic abnormality performance value is less than or equal to the preset traffic abnormality performance threshold, a traffic normal state signal is generated;

[0033] If the traffic anomaly performance value is greater than the preset traffic anomaly performance threshold, a traffic anomaly status signal is generated, and the Internet data loss is marked as a traffic anomaly status.

[0034] As a further technical solution of the present invention, the process of generating the optimization judgment signal is:

[0035] Based on the synchronization signal, a correlation ratio is obtained;

[0036] Preset a correlation ratio threshold, and compare and analyze the correlation ratio with the correlation ratio threshold;

[0037] If the correlation ratio ≤ the correlation ratio threshold, it means that the correlation between Internet data loss and network traffic anomaly is small, that is, a no-optimization signal is generated;

[0038] If the correlation ratio is greater than the correlation ratio threshold, it means that there is a large correlation between Internet data loss and network traffic anomaly, and a signal to be optimized is generated.

[0039] As a further technical solution of the present invention, the process of obtaining the correlation ratio is:

[0040] Extract the number of times the synchronization signal is generated in the historical data and mark it as the number of synchronization times;

[0041] The correlation ratio is obtained by calculating the ratio of the number of synchronizations to the total number of Internet data losses.

[0042] As a further technical solution of the present invention, the process of analyzing the potential causes of data loss is as follows:

[0043] Based on the signal to be optimized, the number of abnormalities caused by the reasons to be analyzed when all synchronization data are lost is extracted to obtain the number of abnormalities to be analyzed;

[0044] The associated data loss is the Internet data loss corresponding to the generation of the synchronization signal;

[0045] The ratio of the number of times to be analyzed to the total number of associated data losses is calculated to obtain the ratio to be analyzed;

[0046] Preset a threshold value of the ratio to be analyzed, and compare and analyze the ratio to be analyzed with the preset threshold value of the ratio to be analyzed;

[0047] If the ratio to be analyzed is less than or equal to the preset ratio to be analyzed threshold, a signal of no concern is generated;

[0048] If the ratio to be analyzed is greater than the preset ratio threshold to be analyzed, a focus signal is generated and the cause to be analyzed is marked as a potential cause.

[0049] An Internet data security intelligent processing system, comprising:

[0050] Data collection module: Based on historical data, analyze the network status when Internet data is lost, and obtain abnormal performance data of the network status each time Internet data is lost;

[0051] Data processing module: calculates the traffic abnormality performance value based on the abnormal performance data of the network status;

[0052] Synchronous evaluation module: evaluates whether Internet data loss and network traffic anomaly are synchronized, and generates a synchronous evaluation signal;

[0053] Wherein, the synchronous evaluation signal includes: a synchronous signal and an asynchronous signal;

[0054] Optimization analysis module: Based on synchronization signals, it evaluates the correlation between Internet data loss and network traffic anomalies and generates optimization judgment signals;

[0055] Among them, the optimization judgment signal includes: a non-optimization signal and a signal to be optimized;

[0056] Cause analysis module: Analyzes potential causes of data loss based on the signal to be optimized.

[0057] Beneficial effects of the present invention:

[0058] Based on historical data, the present invention conducts an in-depth analysis of the network status at each Internet data loss, including the total congestion time and the number of congestion times. The former refers to the sum of the time from the first time the network traffic drops below the preset threshold to the time when it is fully recovered, and the latter records the number of times the traffic drops below the threshold and recovers. This threshold is set by the technician based on the historical network traffic, capacity and business needs, and is used to define the network congestion status; then, the traffic anomaly performance value is calculated using a formula; finally, by comparing the data loss ratio (the ratio of data loss to total data volume) with the preset threshold, and the traffic anomaly performance value with another preset threshold, the severity of each data loss and its correlation with the traffic anomaly are evaluated. If the data loss ratio and the traffic anomaly performance value both exceed their respective thresholds, it is determined that the data loss is synchronized with the traffic anomaly; otherwise, it is considered to be out of sync; the present invention effectively combines information on data loss and traffic anomaly through quantitative analysis, provides a scientific basis for timely discovery and handling of potential network problems, and helps to improve network stability and data security;

[0059] The present invention is based on the generated synchronization signal, counts the occurrence frequency of such signals in historical data (i.e., the number of synchronizations), and calculates its ratio to the total number of Internet data losses (correlation ratio); compares by a preset correlation ratio threshold, if the correlation ratio is lower than or equal to the threshold, a no optimization signal is issued, indicating that the correlation between the two is weak; conversely, if the correlation ratio is higher than the threshold, a signal to be optimized is issued, which means that further analysis is required; then, for the signal to be optimized, in-depth analysis is performed on the network traffic factors in the associated data loss event, including potential causes such as the source of traffic, the network nodes and paths through which the traffic flows, and the frequency of these causes occurring in the associated data loss (number of times to be analyzed) is counted, and the ratio to the total number of associated data losses (ratio to be analyzed) is calculated; compares by a preset ratio to be analyzed threshold, if the ratio to be analyzed is lower than or equal to the threshold, it is regarded as a non-main cause and a signal of no concern is issued; if the ratio to be analyzed is higher than the threshold, it is regarded as a key cause, a signal of focus is issued, and it is marked as a potential cause so that preventive measures can be taken later; the present invention provides a scientific basis and practical guidance for effectively reducing Internet data loss through quantitative synchronization analysis, optimization judgment and exploration of potential causes, which helps to improve network operation efficiency and data protection capabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] The present invention will be further described below in conjunction with the accompanying drawings.

[0061] Figure 1 It is a flowchart of the present invention;

[0062] Figure 2 It is a system block diagram of the present invention. DETAILED DESCRIPTION

[0063] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0064] Example 1: Please refer to Figure 1 As shown, a method for intelligently processing Internet data security according to an embodiment of the present invention comprises the following steps:

[0065] Step 1: Based on historical data, analyze the network status when Internet data is lost, and obtain abnormal performance data of the network status each time Internet data is lost;

[0066] Among them, the abnormal performance data include: congestion time ratio and congestion number ratio;

[0067] In some embodiments, based on historical data, the total congestion time and congestion times of the network status are extracted each time Internet data is lost;

[0068] It should be explained that the total congestion time refers to the total duration of network traffic in a congested state. Specifically, the total congestion time can be defined as: the total duration of the continuous time period from when the network traffic first drops below the traffic threshold until the traffic recovers to above the traffic threshold.

[0069] It should also be explained that the number of congestion times refers to the number of times the network traffic falls into a congested state and then returns to normal; specifically, each time the network traffic drops below the traffic threshold and then recovers above the traffic threshold, it is recorded as a congestion event, and the number of congestion times is the total number of these events;

[0070] It should be further explained that the traffic threshold is set in advance by those skilled in the art based on factors such as historical traffic data of the network, network capacity, and service requirements, and the threshold is used to determine whether the network is in a congested state;

[0071] The total congestion time is calculated by ratioing the transmission time (the transmission time is the total time of Internet data transmission when Internet data is lost) to obtain the congestion time ratio;

[0072] Calculate the ratio of the number of congestion times to the number threshold to obtain the congestion number ratio;

[0073] It should be explained that the number threshold is preset in advance by those skilled in the art based on the data size and transmission time of Internet data transmission, and the value is an empirical value;

[0074] Step 2: Calculate the traffic abnormality performance value based on the abnormal performance data of the network status;

[0075] In some embodiments, by the formula: , calculate the traffic anomaly performance value YC, where a1 and a2 are preset proportional factors, and both are greater than 0, SJ is the congestion time ratio, and CS is the congestion number ratio;

[0076] Step 3: Evaluate whether Internet data loss and network traffic anomaly are synchronized, and generate a synchronization evaluation signal;

[0077] Wherein, the synchronous evaluation signal includes: a synchronous signal and an asynchronous signal;

[0078] In some embodiments, based on any Internet data loss;

[0079] Obtain the amount of data loss when Internet data is lost, calculate the ratio of the data loss amount to the total data amount, and obtain the data loss ratio;

[0080] A data loss ratio threshold is preset, and the data loss ratio is compared and analyzed with the data loss ratio threshold;

[0081] If the data loss ratio is less than or equal to the data loss ratio threshold, it means that the data loss situation when the Internet data is lost is not serious, and a data normal state signal is generated;

[0082] If the data loss ratio is greater than the data loss ratio threshold, it indicates that the data loss situation during the Internet data loss is serious, that is, a data abnormal state signal is generated, and the Internet data loss is marked as a data loss abnormal state;

[0083] At the same time, a traffic anomaly performance threshold is preset, and the traffic anomaly performance value of Internet data loss is compared with the traffic anomaly performance threshold;

[0084] If the preset traffic abnormality performance value is ≤ the preset traffic abnormality performance threshold, it means that the network traffic congestion during the Internet data loss is not serious, and a traffic normal state signal is generated;

[0085] If the preset traffic abnormality performance value is greater than the preset traffic abnormality performance threshold, it indicates that the network traffic congestion is serious when the Internet data is lost, and a traffic abnormality state signal is generated, and the Internet data loss is marked as a traffic abnormality state;

[0086] If the Internet data loss is in both data loss abnormal state and traffic abnormal state, a synchronization signal is generated, otherwise, an asynchronous signal is generated;

[0087] The technical solution of the embodiment of the present invention is mainly as follows: based on historical data, an in-depth analysis is conducted on the network status each time Internet data is lost, including the total congestion time and the number of congestion times. The former refers to the sum of the time from when the network traffic first drops below a preset threshold to when it is fully recovered, and the latter records the number of times the traffic drops below the threshold and recovers. This threshold is set by the technical personnel based on the historical network traffic, capacity and business needs, and is used to define the network congestion state; then, a formula is used to calculate the traffic anomaly performance value; finally, by comparing the data loss ratio (the ratio of data loss to total data volume) with a preset threshold, and the traffic anomaly performance value with another preset threshold, the severity of each data loss and its correlation with the traffic anomaly are evaluated. If both the data loss ratio and the traffic anomaly performance value exceed their respective thresholds, it is determined that the data loss is synchronized with the traffic anomaly; otherwise, it is deemed to be out of sync. The embodiment of the present invention effectively combines information on data loss and traffic anomaly through quantitative analysis, provides a scientific basis for timely discovery and handling of potential network problems, and helps to improve network stability and data security.

[0088] Example 2: Based on Example 1, please refer to Figure 1As shown, the method for intelligently processing Internet data security according to the embodiment of the present invention further includes the following steps:

[0089] Step 4: Based on the synchronization signal, evaluate the correlation between Internet data loss and network traffic anomaly, and generate an optimization judgment signal;

[0090] Among them, the optimization judgment signal includes: a non-optimization signal and a signal to be optimized;

[0091] In some implementation schemes, the number of times the synchronization signal is generated in the historical data is extracted and marked as the synchronization number;

[0092] The correlation ratio is calculated by comparing the number of synchronizations with the total number of Internet data losses;

[0093] Preset a correlation ratio threshold, and compare and analyze the correlation ratio with the correlation ratio threshold;

[0094] If the correlation ratio ≤ the correlation ratio threshold, it means that the correlation between Internet data loss and network traffic anomaly is small, that is, a no-optimization signal is generated;

[0095] If the correlation ratio is greater than the correlation ratio threshold, it means that the correlation between Internet data loss and network traffic anomaly is relatively large, and a signal to be optimized is generated;

[0096] Step 5: Analyze the potential causes of data loss based on the signal to be optimized, so as to prevent the subsequent loss of Internet data;

[0097] In some implementation schemes, based on the signal to be optimized, the number of abnormalities of the reasons to be analyzed contained in all synchronization data losses (synchronization data loss is the loss of Internet data corresponding to the generation of the synchronization signal) is extracted to obtain the number of abnormalities to be analyzed;

[0098] It should be explained that the reasons to be analyzed include but are not limited to: the source, network nodes, and paths of network traffic;

[0099] It should also be noted that the abnormality of the reason to be analyzed means that when the synchronization data is lost, the reason to be analyzed also has an abnormality. For example, when the synchronization data is lost, the network node also has an abnormality. Each reason to be analyzed corresponds to a number of abnormalities to be analyzed.

[0100] The ratio of the number of abnormalities to be analyzed to the total number of associated data losses is calculated to obtain the ratio to be analyzed;

[0101] Preset a threshold value of the ratio to be analyzed, and compare and analyze the ratio to be analyzed with the preset threshold value of the ratio to be analyzed;

[0102] If the ratio to be analyzed is less than or equal to the preset ratio threshold, it means that the corresponding reason to be analyzed has a low impact on Internet data loss and is not the main cause of data loss, that is, a signal of no concern is generated;

[0103] If the ratio of unanalyzed data is greater than the preset ratio threshold, it means that the corresponding unanalyzed data has a high impact on the Internet data loss and is the main cause of the data loss. That is, a focus signal is generated and the corresponding unanalyzed cause is marked as a potential cause, so as to prevent the subsequent Internet data loss.

[0104] The technical solution of the embodiment of the present invention is mainly as follows: based on the generated synchronization signal, the frequency of occurrence of such signals in historical data (i.e., the number of synchronizations) is counted, and its ratio to the total number of Internet data losses (correlation ratio) is calculated; a comparison is made through a preset correlation ratio threshold, and if the correlation ratio is lower than or equal to the threshold, a non-optimization signal is issued, indicating that the correlation between the two is weak; conversely, if the correlation ratio is higher than the threshold, a signal to be optimized is issued, which means that further analysis is required; then, for the signal to be optimized, the network traffic factors in the associated data loss event are deeply analyzed, including potential causes such as the source of traffic, the network nodes and paths through which it flows, and the correlation numbers are counted. The frequency of these reasons occurring in data loss (number of times to be analyzed) is calculated, and its ratio to the total number of associated data losses (ratio to be analyzed) is calculated; a comparison is made through a preset threshold of the ratio to be analyzed; if the ratio to be analyzed is lower than or equal to the threshold, it is regarded as a non-main reason and a signal of no concern is issued; if the ratio to be analyzed is higher than the threshold, it is regarded as a key reason, a signal of key attention is issued, and it is marked as a potential reason so that preventive measures can be taken later; the embodiments of the present invention provide a scientific basis and practical guidance for effectively reducing Internet data loss through quantitative synchronization analysis, optimized judgment and exploration of potential causes, which helps to improve network operation efficiency and data protection capabilities.

[0105] Example 3: Based on Example 1 and Example 2, please refer to Figure 2 As shown, an Internet data security intelligent processing system according to an embodiment of the present invention includes:

[0106] Data collection module: Based on historical data, analyze the network status when Internet data is lost, and obtain abnormal performance data of the network status each time Internet data is lost;

[0107] Data processing module: calculates the traffic abnormality performance value based on the abnormal performance data of the network status;

[0108] Synchronous evaluation module: evaluates whether Internet data loss and network traffic anomaly are synchronized, and generates a synchronous evaluation signal;

[0109] Wherein, the synchronous evaluation signal includes: a synchronous signal and an asynchronous signal;

[0110] Optimization analysis module: Based on synchronization signals, it evaluates the correlation between Internet data loss and network traffic anomalies and generates optimization judgment signals;

[0111] Among them, the optimization judgment signal includes: a non-optimization signal and a signal to be optimized;

[0112] Cause analysis module: Analyzes potential causes of data loss based on the signal to be optimized.

[0113] The above thresholds are set for the convenience of comparison. The thresholds depend on the amount of sample data and the number of bases set by technicians in this field for each set of sample data.

[0114] The above formulas are obtained by collecting a large amount of data and performing software simulation to select a formula close to the actual value. The factors in the formula are set by technicians in this field according to actual conditions; for example: Formula ; A technician in this field collects multiple groups of flow abnormality performance data and sets a corresponding flow abnormality performance value for each group of flow abnormality performance data; Substitute the set flow abnormality performance value and the collected flow abnormality performance data into the formula, any three formulas constitute a three-variable linear equation system, screen the calculated factors and take the average, and obtain the values ​​of a1 and a2 as 2.25 and 2.43 respectively;

[0115] The size of the factor is to quantify each parameter to obtain a specific value for subsequent comparison. The size of the factor depends on the amount of traffic anomaly performance data and the initial setting of the corresponding traffic anomaly performance value for each set of traffic anomaly performance data by technical personnel in this field; as long as it does not affect the proportional relationship between the parameter and the quantized value, such as the traffic anomaly performance value is proportional to the total congestion time.

[0116] The above is a detailed description of an embodiment of the present invention, but the content is only a preferred embodiment of the present invention and cannot be considered to limit the scope of implementation of the present invention. All equivalent changes and improvements made within the scope of the present invention should still fall within the scope of the patent coverage of the present invention.

Claims

1. A method for intelligent processing of Internet data security, characterized in that: The following steps are involved: Step 1: Based on historical data, analyze the network status when Internet data is lost, and obtain abnormal performance data of the network status each time Internet data is lost; Step 2: Calculate the traffic abnormality performance value based on the abnormal performance data of the network status; Step 3: Evaluate whether Internet data loss and network traffic anomaly are synchronized, and generate a synchronization evaluation signal; Wherein, the synchronous evaluation signal includes: a synchronous signal and an asynchronous signal; The process of generating the synchronous evaluation signal is: Based on any loss of Internet data; Obtain the amount of data loss when Internet data is lost, calculate the ratio of the amount of data loss to the total amount of data, and obtain the data loss ratio; Based on the data loss ratio and traffic abnormality performance value when Internet data is lost, determine whether the Internet data loss is both a data loss abnormality state and a traffic abnormality state; If the Internet data loss is in both data loss abnormal state and traffic abnormal state, a synchronization signal is generated, otherwise, an asynchronous signal is generated; Step 4: Based on the synchronization signal, extract the number of times the synchronization signal is generated in the historical data and mark it as the synchronization number; The correlation ratio is calculated by comparing the number of synchronizations with the total number of Internet data losses; Preset a correlation ratio threshold, compare and analyze the correlation ratio with the correlation ratio threshold, evaluate the correlation between Internet data loss and network traffic anomalies, and generate an optimization judgment signal; Among them, the optimization judgment signal includes: a non-optimization signal and a signal to be optimized; Step 5: Analyze the potential causes of data loss based on the signal to be optimized; The process of analyzing potential causes of data loss is: Based on the signal to be optimized, the number of abnormalities caused by the reasons to be analyzed when all synchronization data are lost is extracted to obtain the number of abnormalities to be analyzed; The associated data loss is the Internet data loss corresponding to the generation of the synchronization signal; The ratio of the number of times to be analyzed to the total number of associated data losses is calculated to obtain the ratio to be analyzed; Preset a threshold value of the ratio to be analyzed, and compare and analyze the ratio to be analyzed with the preset threshold value of the ratio to be analyzed; If the ratio to be analyzed is less than or equal to the preset ratio to be analyzed threshold, a signal of no concern is generated; If the ratio to be analyzed is greater than the preset ratio threshold to be analyzed, a focus signal is generated and the cause to be analyzed is marked as a potential cause.

2. The method for intelligently processing Internet data security according to claim 1, characterized in that: The process of obtaining abnormal performance data is as follows: Abnormal performance data include: congestion time ratio and congestion number ratio; Based on historical data, extract the total congestion time and congestion times of the network status each time Internet data is lost; The total congestion time is calculated by ratioing the transmission time to obtain the congestion time ratio; The congestion times are calculated by comparing the congestion times threshold to obtain the congestion times ratio.

3. The method for intelligently processing Internet data security according to claim 1, characterized in that: The process of obtaining the traffic anomaly performance value is as follows: By formula: , calculate the traffic anomaly performance value YC, where a1 and a2 are preset proportional factors, and both are greater than 0, SJ is the congestion time ratio, and CS is the congestion number ratio.

4. The method for intelligently processing Internet data security according to claim 1, characterized in that: The determination process of data loss abnormal state is as follows: A data loss ratio threshold is preset, and the data loss ratio is compared and analyzed with the data loss ratio threshold; If the data loss ratio is less than or equal to the data loss ratio threshold, a data normal state signal is generated; If the data loss ratio is greater than the data loss ratio threshold, a data abnormal state signal is generated, and the Internet data loss is marked as a data loss abnormal state.

5. The method for intelligently processing Internet data security according to claim 1, characterized in that: The process of determining abnormal traffic status is as follows: Preset a traffic anomaly performance threshold, and compare and analyze the traffic anomaly performance value of the Internet data loss with the traffic anomaly performance threshold; If the traffic abnormality performance value is less than or equal to the preset traffic abnormality performance threshold, a traffic normal state signal is generated; If the traffic anomaly performance value is greater than the preset traffic anomaly performance threshold, a traffic anomaly status signal is generated, and the Internet data loss is marked as a traffic anomaly status.

6. The method for intelligently processing Internet data security according to claim 1, characterized in that: The process of presetting the correlation ratio threshold, comparing and analyzing the correlation ratio with the correlation ratio threshold, evaluating the correlation between Internet data loss and network traffic anomaly, and generating an optimization judgment signal is as follows: If the correlation ratio ≤ the correlation ratio threshold, it means that the correlation between Internet data loss and network traffic anomaly is small, that is, a no-optimization signal is generated; If the correlation ratio is greater than the correlation ratio threshold, it means that there is a large correlation between Internet data loss and network traffic anomaly, and a signal to be optimized is generated.

7. An Internet data security intelligent processing system, characterized in that: The system is used to execute the method described in any one of claims 1 to 6, and the system comprises: Data collection module: Based on historical data, analyze the network status when Internet data is lost, and obtain abnormal performance data of the network status each time Internet data is lost; Data processing module: calculates the traffic abnormality performance value based on the abnormal performance data of the network status; Synchronous evaluation module: evaluates whether Internet data loss and network traffic anomaly are synchronized, and generates a synchronous evaluation signal; Wherein, the synchronous evaluation signal includes: a synchronous signal and an asynchronous signal; Optimization analysis module: Based on synchronization signals, it evaluates the correlation between Internet data loss and network traffic anomalies and generates optimization judgment signals; Among them, the optimization judgment signal includes: a non-optimization signal and a signal to be optimized; Cause analysis module: Analyzes potential causes of data loss based on the signal to be optimized.

Images