A data analysis method and system for data asset access management platform

Abstract

The present invention discloses a data analysis method and system for a data asset access management platform, and relates to the technical field of network security. The present invention extracts data from the historical access records of access users to generate a user periodic data set; extracts and marks the access feature data in each user periodic data set to generate a user feature extract set; calculates the access feature value of each access user in different data monitoring cycles to construct an access feature fluctuation model; generates a fluctuation anomaly set for the marked data monitoring cycle, calculates the abnormal correlation between any two access users in the fluctuation anomaly set; generates an abnormal access user set, analyzes the real-time access data of the access users in the abnormal access user set, generates a list of dangerous access users, and sends it to an administrator. The accuracy of the access feature value can be improved, which is conducive to discovering hidden rules and avoiding the occurrence of information leakage risks.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a data analysis method and system for a data asset access management platform. Background Art

[0002] With the advent of the information age and the rapid development of network and computer technology, more and more devices are connected to the Internet, and more and more information is shared on the Internet. In the digital age, data assets have become the core resources of enterprises. As enterprises operate, a large amount of data is constantly generated and accumulated. How to deal with the loss of data and assets caused by information security issues has become the most concerned issue for enterprises.

[0003] When a large amount of information is stolen from the data asset access management platform, multiple dangerous access collaboration actions may occur. However, the existing technology does not analyze the correlation between access users, and cannot identify potential collaborative behaviors in historical access records, which can easily lead to data asset leakage.

[0004] Therefore, the present invention discloses a data analysis method and system for a data asset access management platform to solve the above problems. Summary of the invention

[0005] The purpose of the present invention is to provide a data analysis method and system for a data asset access management platform to solve the problems raised in the prior art.

[0006] To achieve the above object, the present invention provides the following technical solution: a data analysis method and system for a data asset access management platform, the method comprising the following steps:

[0007] S1: Setting a data monitoring cycle for the management platform, storing and extracting historical access records of access users; extracting data from historical access records of access users according to the data monitoring cycle, and generating a user cycle data set;

[0008] S2: extract and mark the access feature data in each user periodic data set to generate a user feature excerpt set; calculate the access feature value of each access user in different data monitoring periods according to the user feature excerpt set, and construct an access feature fluctuation model according to the access feature value;

[0009] S3: Based on the access feature fluctuation value calculated by the access feature fluctuation model, the marked data monitoring period is used to generate a fluctuation anomaly set, and the anomaly correlation between any two access users in the fluctuation anomaly set is calculated;

[0010] S4: Analyze the abnormal correlation between access users according to the abnormal correlation degree, generate an abnormal access user set, analyze the real-time access data of access users in the abnormal access user set, generate a list of dangerous access users, and send it to the administrator.

[0011] According to the above scheme, S1 includes the following contents:

[0012] The visiting users are uniformly numbered and the i-th visiting user is denoted as U i ; Set a data monitoring cycle for the management platform, store and extract the historical access records of the access users; extract the historical access record data for the jth data monitoring cycle to generate a periodic data set; extract the access user U i The historical access record data is used to generate a user periodic data set, denoted as U (i，j) ={FW (i，j) 1 , FW (i，j) 2 , ..., FW (i，j) N}, where FW (i，j) 1 , FW (i，j) 2 , ..., FW (i，j) N Respectively represent the access user U i The 1st, 2nd, ..., Nth historical access record data monitored in the jth data monitoring cycle.

[0013] According to the above scheme, S2 includes the following contents:

[0014] S201: extracting access feature data from a user periodic data set corresponding to each access user, and generating a user feature extract set; the access feature data includes a single access duration, a single access data volume, and an access frequency; extracting access feature data corresponding to all access users in the jth data monitoring period;

[0015] S202: Calculate the number of visiting users U according to the user feature excerpt set i Access characteristic value AFV in the jth data monitoring cycle (i，j) , the specific calculation formula is as follows:

[0016]

[0017] Where T represents the total duration of the jth data monitoring cycle; T (i，j) n Indicates the access user U iThe single access duration of the nth historical access record data in the jth data monitoring cycle; n∈[1,N]; DV (i，j) n Indicates the access user U i The single access data capacity of the nth historical access record data in the jth data monitoring cycle; DV (i，j) N-n Indicates the access user U i The total access data capacity excluding the nth historical access record data in the jth data monitoring cycle; DV (i，j) n ∩DV (i，j) N-n Indicates the data capacity of the overlapped portion between the single access data capacity of the nth historical access record data and the total access data capacity excluding the nth historical access record data;

[0018] When a large amount of information is stolen on the data asset access management platform, multiple dangerous access coordinated actions may occur, and the data stolen between two access users generally does not overlap; using the overlapping part of the access data capacity between the access user and other access users in the access feature value calculation can improve the accuracy of the access feature value and help discover hidden patterns;

[0019] S203: According to the access user U i The access characteristic value in each data monitoring cycle is used to construct an access characteristic fluctuation model. The specific calculation formula is as follows:

[0020] F[AFV (i，j) ]=[exp(AFV (i，j) ÷σ)]÷[σ×(2π) 1 / 2 ];

[0021] where F[AFV (i，j) ] indicates access to characteristic value AFV (i，j) The access characteristic fluctuation value, σ represents the access characteristic value AFV (i，j) The standard deviation of .

[0022] The access characteristics of access users in different data monitoring cycles are different. Further analysis of the access characteristic values ​​and analysis of the access characteristic fluctuation values ​​using the standard deviation of the access characteristic values ​​can effectively find the access characteristics with obvious fluctuations, providing data support for analyzing dangerous access users.

[0023] According to the above scheme, S3 includes the following:

[0024] S301: according to the access feature fluctuation value calculated by the access feature fluctuation model, a fluctuation value threshold is preset; if the access feature value AFV (i，j)The access characteristic fluctuation value F[AFV (i，j) ] is greater than or equal to the fluctuation value threshold, then the access feature value AFV is marked (i，j) Corresponding data monitoring cycle; if access characteristic value AFV (i，j) If the access feature fluctuation value is less than the fluctuation value threshold, no processing is performed;

[0025] Will access user U i All the marked data monitoring periods generate a set of fluctuation anomalies, denoted as DMC(U i ) = {DMC1, DMC2, ..., DMC Q}, where DMC1, DMC2, ..., DMC Q Respectively represent the access user U i The marked 1st, 2nd, ..., Qth data monitoring cycles;

[0026] S302: Calculate the abnormal correlation between any two visiting users according to the fluctuation abnormality set. The specific calculation formula is as follows:

[0027] A(U i →U v )=num 2 [DMC(U i )∩DMC(U v )]÷(Q×P);

[0028] Among them, A(U i →U v ) indicates the access user U i Access user U v The abnormal correlation between 2 [DMC(U i )∩DMC(U v )] represents the fluctuation anomaly set DMC(U i ) and the fluctuation anomaly set DMC(U v ) The square of the number of data monitoring cycles in the intersection set, P represents the fluctuation anomaly set DMC (U v ), where v represents the number of accessing users and i≠v.

[0029] If there are fluctuation anomalies with the same frequency and amount between two visiting users, then the corresponding access features between the two visiting users are closely related, and then the abnormal correlation degree is calculated;

[0030] According to the above scheme, S4 includes the following contents:

[0031] S401: Analyze the abnormal correlation between the access users according to the abnormal correlation, and preset the abnormal correlation threshold; if the access user Ui Access user U v The abnormal correlation between i →U v ) is greater than or equal to the abnormal correlation threshold, it means that the access user U i Access user U v There is an abnormal correlation between the two; if the access user U i Access user U v The abnormal correlation between i →U v ) is less than the abnormal correlation threshold, it means that the access user U i Access user U v There is no abnormal relationship between them;

[0032] S402: extract all access users with abnormal association relationships and generate a set of abnormal access users; obtain real-time access data of access users in the set of abnormal access users, extract the single access duration and single access data volume of the real-time access data; calculate the single access duration change rate and single access data volume change rate of each access user in the set of abnormal access users; the single access duration change rate is equal to the single access duration of the real-time access data divided by the standard deviation of the single access duration of the historical access records; the single access data volume change rate is equal to the single access data volume of the real-time access data divided by the standard deviation of the single access data volume of the historical access records;

[0033] S403: Set thresholds for the change rate of a single visit duration and the change rate of a single visit data volume respectively, and record any access user with a change rate greater than or equal to the corresponding threshold as a dangerous access user. Dynamically adjust the authority level of the dangerous access user and the access users with abnormal association with the dangerous access users according to the size of the change rate, encrypt the real-time access data of the dangerous access users, generate a list of dangerous access users, and send it to the administrator.

[0034] In the case of abnormal correlation, there is a high probability of multiple interactions between the access users. These abnormally associated access users are classified, and the permission levels of dangerous access users and access users with abnormal correlation with dangerous access users are dynamically adjusted according to the change rate. The real-time access data of dangerous access users is encrypted to avoid the risk of information leakage.

[0035] Another aspect of the present application provides a data analysis system for a data asset access management platform, the system is applied to the implementation of the above-mentioned data analysis method for a data asset access management platform, the system includes an access data monitoring preprocessing module, an access feature analysis module, an access anomaly association module and a real-time access analysis control module;

[0036] The access data monitoring preprocessing module is used to set a data monitoring cycle for the management platform, store and extract historical access records of access users; extract data from the historical access records of access users according to the data monitoring cycle, and generate a user periodic data set;

[0037] The access feature analysis module is used to extract and mark the access feature data in each user periodic data set to generate a user feature extract set; based on the user feature extract set, calculate the access feature value of each access user in different data monitoring periods, and construct an access feature fluctuation model based on the access feature value;

[0038] The access anomaly association module generates a fluctuation anomaly set for the tag data monitoring period according to the access feature fluctuation value calculated by the access feature fluctuation model, and calculates the anomaly association degree between any two access users in the fluctuation anomaly set;

[0039] The real-time access analysis and control module is used to analyze the abnormal correlation between access users according to the abnormal correlation degree, generate an abnormal access user set, analyze the real-time access data of the access users in the abnormal access user set, generate a list of dangerous access users, and send it to the administrator.

[0040] According to the above solution, the access data monitoring preprocessing module includes an access data monitoring unit and an access data preprocessing unit;

[0041] The access data monitoring unit is used to uniformly number the access users, set a data monitoring cycle for the management platform, and store and extract the historical access records of the access users;

[0042] The access data preprocessing unit is used to extract data from the historical access records of the access users according to the data monitoring cycle, and generate a user periodic data set.

[0043] According to the above scheme, the access feature analysis module includes an access feature extraction unit and an access feature fluctuation analysis unit;

[0044] The access feature extraction unit is used to extract access feature data from the user periodic data set corresponding to each access user and generate a user feature extraction set; the access feature data includes a single access duration, a single access data volume and an access frequency;

[0045] The access feature fluctuation analysis unit is used to calculate the access feature value of the access user in each data monitoring period according to the user feature excerpt set; and to construct an access feature fluctuation model according to the access feature value of the access user in each data monitoring period.

[0046] According to the above scheme, the access anomaly association module includes a fluctuation anomaly extraction unit and a correlation degree analysis unit;

[0047] The fluctuation anomaly extraction unit is used to preset a fluctuation value threshold according to the access feature fluctuation value calculated by the access feature fluctuation model; if the access feature fluctuation value of the access feature value is greater than or equal to the fluctuation value threshold, then mark the data monitoring period corresponding to the access feature value; and generate a fluctuation anomaly set for all the data monitoring periods marked by the access user;

[0048] The correlation degree analysis unit is used to calculate the abnormal correlation degree between any two visiting users according to the fluctuation abnormality set.

[0049] According to the above solution, the real-time access analysis and control module includes an abnormal access user analysis unit and an encryption control unit;

[0050] The abnormal access user analysis unit is used to analyze the abnormal correlation between access users according to the abnormal correlation degree, generate an abnormal access user set, and analyze the real-time access data of the access users in the abnormal access user set;

[0051] The encryption control unit is used to encrypt the real-time access data of dangerous access users, generate a dangerous access user list, and send it to the administrator.

[0052] Compared with the prior art, the present invention has the following beneficial effects: the data stolen between two access users generally do not overlap, and the overlapping part of the access data capacity of the access user and other access users is used in the calculation of the access characteristic value, which can improve the accuracy of the access characteristic value and is conducive to discovering hidden rules; there are differences in the access characteristics of the access users in different data monitoring cycles, and then the access characteristic values ​​are further analyzed, and the standard deviation of the access characteristic values ​​is used to analyze the access characteristic fluctuation value, which can effectively find the access characteristics with obvious fluctuations, and provide data support for analyzing dangerous access users; when a large amount of data is stolen, there may be multiple dangerous access users. If there is an abnormal fluctuation of the same frequency and amount between two access users, the corresponding access characteristics between the two access users are closely related, and then the abnormal correlation is calculated; for the case of abnormal correlation, there is a high probability of multiple interactive influences between the access users, and these abnormally related access users are classified, and the authority levels of dangerous access users and access users with abnormal correlation with dangerous access users are dynamically adjusted according to the size of the change rate, and the real-time access data of dangerous access users are encrypted to avoid the risk of information leakage. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings:

[0054] Figure 1 A flow chart of a data analysis method for a data asset access management platform according to the present invention;

[0055] Figure 2 The present invention is a structural schematic diagram of a data analysis system for a data asset access management platform. DETAILED DESCRIPTION

[0056] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0057] See also Figure 1 The present invention provides a technical solution: a data analysis method and system for a data asset access management platform, the method comprising the following steps:

[0058] S1: Setting a data monitoring cycle for the management platform, storing and extracting historical access records of access users; extracting data from historical access records of access users according to the data monitoring cycle, and generating a user cycle data set;

[0059] According to the above scheme, S1 includes the following contents:

[0060] The visiting users are uniformly numbered and the i-th visiting user is denoted as U i ; Set a data monitoring cycle for the management platform, store and extract the historical access records of the access users; extract the historical access record data for the jth data monitoring cycle to generate a periodic data set; extract the access user U i The historical access record data is used to generate a user periodic data set, denoted as U (i，j) ={FW (i，j) 1 , FW (i，j) 2 , ..., FW (i，j) N}, where FW (i，j) 1 , FW (i，j) 2 , ..., FW (i，j) N Respectively represent the access user Ui The 1st, 2nd, ..., Nth historical access record data monitored in the jth data monitoring cycle.

[0061] S2: extract and mark the access feature data in each user periodic data set to generate a user feature excerpt set; calculate the access feature value of each access user in different data monitoring periods according to the user feature excerpt set, and construct an access feature fluctuation model according to the access feature value;

[0062] According to the above scheme, S2 includes the following contents:

[0063] S201: extracting access feature data from a user period data set corresponding to each access user, and generating a user feature extract set; the access feature data includes a single access duration, a single access data volume, and an access frequency; extracting access feature data corresponding to all access users in the jth data monitoring period;

[0064] S202: Calculate the number of visiting users U according to the user feature excerpt set i Access characteristic value AFV in the jth data monitoring cycle (i，j) , the specific calculation formula is as follows:

[0065]

[0066] Where T represents the total duration of the jth data monitoring cycle; T (i，j) n Indicates the access user U i The single access duration of the nth historical access record data in the jth data monitoring cycle; n∈[1,N]; DV (i，j) n Indicates the access user U i The single access data capacity of the nth historical access record data in the jth data monitoring cycle; DV (i，j) N-n Indicates the access user U i The total access data capacity excluding the nth historical access record data in the jth data monitoring cycle; DV (i，j) n ∩DV (i，j) N-n Indicates the data capacity of the overlapped portion between the single access data capacity of the nth historical access record data and the total access data capacity excluding the nth historical access record data;

[0067] S203: According to the access user U i The access characteristic value in each data monitoring cycle is used to construct an access characteristic fluctuation model. The specific calculation formula is as follows:

[0068] F[AFV (i，j) ]=[exp(AFV (i，j) ÷σ)]÷[σ×(2π) 1 / 2 ];

[0069] where F[AFV (i，j) ] indicates access to characteristic value AFV (i，j) The access characteristic fluctuation value, σ represents the access characteristic value AFV (i，j) The standard deviation of .

[0070] S3: Based on the access feature fluctuation value calculated by the access feature fluctuation model, the marked data monitoring period is used to generate a fluctuation anomaly set, and the anomaly correlation between any two access users in the fluctuation anomaly set is calculated;

[0071] According to the above scheme, S3 includes the following:

[0072] S301: according to the access feature fluctuation value calculated by the access feature fluctuation model, a fluctuation value threshold is preset; if the access feature value AFV (i，j) The access characteristic fluctuation value F[AFV (i，j) ] is greater than or equal to the fluctuation value threshold, then the access feature value AFV is marked (i，j) Corresponding data monitoring cycle; if access characteristic value AFV (i，j) If the access feature fluctuation value is less than the fluctuation value threshold, no processing is performed;

[0073] Will access user U i All the marked data monitoring periods generate a set of fluctuation anomalies, denoted as DMC(U i ) = {DMC1, DMC2, ..., DMC Q}, where DMC1, DMC2, ..., DMC Q Respectively represent the access user U i The marked 1st, 2nd, ..., Qth data monitoring cycles;

[0074] S302: Calculate the abnormal correlation between any two visiting users according to the fluctuation abnormality set. The specific calculation formula is as follows:

[0075] A(U i →U v )=num 2 [DMC(U i )∩DMC(U v )]÷(Q×P);

[0076] Among them, A(U i →U v ) indicates the access user U i Access user Uv The abnormal correlation between 2 [DMC(U i )∩DMC(U v )] represents the fluctuation anomaly set DMC(U i ) and the fluctuation anomaly set DMC(U v ) The square of the number of data monitoring cycles in the intersection set, P represents the fluctuation anomaly set DMC (U v ), where v represents the number of accessing users and i≠v.

[0077] Embodiment 1: DMC(U1)={DMC1, DMC2, DMC3}, DMC(U2)={DMC3, DMC4, DMC5};

[0078] Therefore, DMC(U i )∩DMC(U v )={DMC1, DMC2, DMC3, DMC4, DMC5};

[0079] Then A(U1→U2)=num 2 [DMC(U1)∩DMC(U2)]÷(Q×P)=5 2 ÷(3×3)≈2.78;

[0080] S4: Analyze the abnormal correlation between access users according to the abnormal correlation degree, generate an abnormal access user set, analyze the real-time access data of access users in the abnormal access user set, generate a list of dangerous access users, and send it to the administrator.

[0081] According to the above scheme, S4 includes the following contents:

[0082] S401: Analyze the abnormal correlation between the access users according to the abnormal correlation, and preset the abnormal correlation threshold; if the access user U i Access user U v The abnormal correlation between i →U v ) is greater than or equal to the abnormal correlation threshold, it means that the access user U i Access user U v There is an abnormal correlation between the two; if the access user U i Access user U v The abnormal correlation between i →U v ) is less than the abnormal correlation threshold, it means that the access user U i Access user U v There is no abnormal relationship between them;

[0083] S402: extract all access users with abnormal associations and generate a set of abnormal access users; obtain real-time access data of access users in the set of abnormal access users, extract single access duration and single access data volume of real-time access data; calculate the single access duration change rate and single access data volume change rate of each access user in the set of abnormal access users; the single access duration change rate is equal to the single access duration of real-time access data divided by the standard deviation of the single access duration of historical access records; the single access data volume change rate is equal to the single access data volume of real-time access data divided by the standard deviation of the single access data volume of historical access records;

[0084] S403: Set thresholds for the change rate of a single visit duration and the change rate of a single visit data volume respectively, and record any access user with a change rate greater than or equal to the corresponding threshold as a dangerous access user. Dynamically adjust the authority level of the dangerous access user and the access users with abnormal association with the dangerous access users according to the size of the change rate, encrypt the real-time access data of the dangerous access users, generate a list of dangerous access users, and send it to the administrator.

[0085] Embodiment 2: The change rate is graded. In this embodiment, the threshold value of the change rate of the single access data volume is 3. The change rate of the single access data volume is [3,5] for the first level, and the change rate of the single access data volume is (5,10] for the second level; and so on.

[0086] If the access user U i The change rate of the single access data volume is 4, then the access user U i The single access data volume change rate of U is greater than the single access data volume change rate threshold and is at the first level, then the access user U i As a dangerous access user, the access user U i The permission level is reduced by two levels and will be associated with the access user U i The permission level of access users with abnormal associations will be reduced by one level, and each permission level corresponds to an upper limit on the amount of data accessed at a single time.

[0087] See also Figure 2 , the present invention provides a technical solution: a data analysis system for a data asset access management platform, the system comprising an access data monitoring preprocessing module, an access feature analysis module, an access anomaly association module and a real-time access analysis control module;

[0088] The access data monitoring preprocessing module is used to set a data monitoring cycle for the management platform, store and extract historical access records of access users; according to the data monitoring cycle, extract data from the historical access records of access users to generate a user periodic data set;

[0089] The access feature analysis module is used to extract and mark the access feature data in each user periodic data set to generate a user feature excerpt set; based on the user feature excerpt set, the access feature value of each access user in different data monitoring periods is calculated, and based on the access feature value, an access feature fluctuation model is constructed;

[0090] The access anomaly association module generates a fluctuation anomaly set based on the access feature fluctuation value calculated by the access feature fluctuation model, and calculates the anomaly correlation between any two access users in the fluctuation anomaly set;

[0091] The real-time access analysis and control module is used to analyze the abnormal correlation between access users according to the abnormal correlation, and generate a set of abnormal access users, analyze the real-time access data of access users in the set of abnormal access users, generate a list of dangerous access users, and send it to the administrator.

[0092] According to the above scheme, the access data monitoring preprocessing module includes an access data monitoring unit and an access data preprocessing unit;

[0093] The access data monitoring unit is used to uniformly number access users, set data monitoring cycles for the management platform, and store and extract historical access records of access users;

[0094] The access data preprocessing unit is used to extract data from the historical access records of the access users according to the data monitoring cycle and generate a user periodic data set.

[0095] According to the above scheme, the access feature analysis module includes an access feature extraction unit and an access feature fluctuation analysis unit;

[0096] The access feature extraction unit is used to extract the access feature data in the user periodic data set corresponding to each access user and generate a user feature extraction set; the access feature data includes a single access duration, a single access data volume and an access frequency;

[0097] The access feature fluctuation analysis unit is used to calculate the access feature value of the access user in each data monitoring period according to the user feature excerpt set; and to construct an access feature fluctuation model according to the access feature value of the access user in each data monitoring period.

[0098] According to the above scheme, the access anomaly association module includes a fluctuation anomaly extraction unit and a correlation degree analysis unit;

[0099] The fluctuation anomaly extraction unit is used to preset a fluctuation value threshold according to the access feature fluctuation value calculated by the access feature fluctuation model; if the access feature fluctuation value of the access feature value is greater than or equal to the fluctuation value threshold, then mark the data monitoring period corresponding to the access feature value; generate a fluctuation anomaly set for all the data monitoring periods marked by the access user;

[0100] The correlation degree analysis unit is used to calculate the abnormal correlation degree between any two visiting users according to the fluctuation abnormality set.

[0101] According to the above scheme, the real-time access analysis and control module includes an abnormal access user analysis unit and an encryption control unit;

[0102] The abnormal access user analysis unit is used to analyze the abnormal correlation between access users according to the abnormal correlation degree, generate an abnormal access user set, and analyze the real-time access data of the access users in the abnormal access user set;

[0103] The encryption control unit is used to encrypt the real-time access data of dangerous access users, generate a list of dangerous access users, and send it to the administrator.

[0104] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

[0105] It will be apparent to those skilled in the art that the invention is not limited to the details of the exemplary embodiments described above and that the invention can be implemented in other specific forms without departing from the spirit or essential features of the invention. Therefore, the embodiments should be considered exemplary and non-limiting in all respects, and the scope of the invention is defined by the appended claims rather than the foregoing description, and it is intended that all variations falling within the meaning and scope of the equivalent elements of the claims be included in the invention. Any reference numeral in a claim should not be considered as limiting the claim to which it relates.

Claims

1. A data analysis method for a data asset access management platform, characterized in that: The method comprises the following steps: S1: Setting a data monitoring cycle for the management platform, storing and extracting historical access records of access users; extracting data from historical access records of access users according to the data monitoring cycle, and generating a user cycle data set; S2: extract and mark the access feature data in each user periodic data set to generate a user feature excerpt set; calculate the access feature value of each access user in different data monitoring periods according to the user feature excerpt set, and construct an access feature fluctuation model according to the access feature value; S3: Based on the access feature fluctuation value calculated by the access feature fluctuation model, the marked data monitoring period is used to generate a fluctuation anomaly set, and the anomaly correlation between any two access users in the fluctuation anomaly set is calculated; S4: Analyze the abnormal correlation between access users according to the abnormal correlation degree, generate an abnormal access user set, analyze the real-time access data of access users in the abnormal access user set, generate a list of dangerous access users, and send it to the administrator; In S2, the following are included: S201: extracting access feature data from a user periodic data set corresponding to each access user, and generating a user feature extract set; the access feature data includes a single access duration, a single access data volume, and an access frequency; extracting access feature data corresponding to all access users in the jth data monitoring period; S202: Calculate the number of visiting users U according to the user feature excerpt set i Access characteristic value AFV in the jth data monitoring cycle (i，j) , the specific calculation formula is as follows: Where T represents the total duration of the jth data monitoring cycle; T (i，j) n Indicates the access user U i The single access duration of the nth historical access record data in the jth data monitoring cycle; n∈[1,N];DV (i，j) n Indicates the access user U i The single access data capacity of the nth historical access record data in the jth data monitoring cycle; DV (i，j) N-n Indicates the access user U i The total access data capacity excluding the nth historical access record data in the jth data monitoring cycle; DV (i，j) n ∩DV (i，j) N-n Indicates the data capacity of the overlapped portion between the single access data capacity of the nth historical access record data and the total access data capacity excluding the nth historical access record data; S203: According to the access user U i The access characteristic value in each data monitoring cycle is used to construct an access characteristic fluctuation model. The specific calculation formula is as follows: F[AFV (i，j) ]=[exp(AFV (i，j) ÷σ)]÷[σ×(2π) 1 / 2 ]; where F[AFV (i，j) ] indicates access to characteristic value AFV (i，j) The access characteristic fluctuation value, σ represents the access characteristic value AFV (i，j) The standard deviation of .

2. A data analysis method for a data asset access management platform according to claim 1, characterized in that: In S1, the following are included: The visiting users are uniformly numbered and the i-th visiting user is denoted as U i ; Set a data monitoring cycle for the management platform, store and extract the historical access records of the access users; extract the historical access record data for the jth data monitoring cycle to generate a periodic data set; extract the access user U i The historical access record data is used to generate a user periodic data set, denoted as U (i，j) ={FW (i，j) 1 , FW (i，j) 2 , ..., FW (i，j) N }, where FW (i，j) 1 , FW (i，j) 2 , ..., FW (i，j) N Respectively represent the access user U i The 1st, 2nd, ..., Nth historical access record data monitored in the jth data monitoring cycle.

3. A data analysis method for a data asset access management platform according to claim 2, characterized in that: In S3, include the following: S301: according to the access feature fluctuation value calculated by the access feature fluctuation model, a fluctuation value threshold is preset; if the access feature value AFV (i，j) The access characteristic fluctuation value F[AFV (i，j) ] is greater than or equal to the fluctuation value threshold, then the access feature value AFV is marked (i，j) Corresponding data monitoring cycle; if access characteristic value AFV (i，j) If the access feature fluctuation value is less than the fluctuation value threshold, no processing is performed; Will access user U i All the marked data monitoring periods generate a set of fluctuation anomalies, denoted as DMC(U i ) = {DMC1, DMC2, ..., DMC Q }, where DMC1, DMC2, ..., DMC Q Respectively represent the access user U i The marked 1st, 2nd, ..., Qth data monitoring cycles; S302: Calculate the abnormal correlation between any two visiting users according to the fluctuation abnormality set. The specific calculation formula is as follows: A(U i →U v )=num 2 [DMC(U i )∩DMC(U v )]÷(Q×P); Among them, A(U i →U v ) indicates the access user U i Access user U v The abnormal correlation between 2 [DMC(U i )∩DMC(U v )] represents the fluctuation anomaly set DMC(U i ) and the fluctuation anomaly set DMC(U v ) The square of the number of data monitoring cycles in the intersection set, P represents the fluctuation anomaly set DMC (U v ), where v represents the number of accessing users and i≠v.

4. A data analysis method for a data asset access management platform according to claim 3, characterized in that: In S4, the following are included: S401: Analyze the abnormal correlation between the access users according to the abnormal correlation, and preset the abnormal correlation threshold; if the access user U i Access user U v The abnormal correlation between i →U v ) is greater than or equal to the abnormal correlation threshold, it means that the access user U i Access user U v There is an abnormal correlation between the two; if the access user U i Access user U v The abnormal correlation between i →U v ) is less than the abnormal correlation threshold, it means that the access user U i Access user U v There is no abnormal relationship between them; S402: extract all access users with abnormal association relationships and generate a set of abnormal access users; obtain real-time access data of access users in the set of abnormal access users, extract the single access duration and single access data volume of the real-time access data; calculate the single access duration change rate and single access data volume change rate of each access user in the set of abnormal access users; the single access duration change rate is equal to the single access duration of the real-time access data divided by the standard deviation of the single access duration of the historical access records; the single access data volume change rate is equal to the single access data volume of the real-time access data divided by the standard deviation of the single access data volume of the historical access records; S403: Set thresholds for the change rate of a single visit duration and the change rate of a single visit data volume respectively, and record any access user with a change rate greater than or equal to the corresponding threshold as a dangerous access user. Dynamically adjust the authority level of the dangerous access user and the access users with abnormal association with the dangerous access users according to the size of the change rate, encrypt the real-time access data of the dangerous access users, generate a list of dangerous access users, and send it to the administrator.

5. A data analysis system for a data asset access management platform, the system being applied to a data analysis method for a data asset access management platform as claimed in any one of claims 1 to 4, characterized in that: The system includes an access data monitoring preprocessing module, an access feature analysis module, an access anomaly association module and a real-time access analysis and control module; The access data monitoring preprocessing module is used to set a data monitoring cycle for the management platform, store and extract historical access records of access users; extract data from the historical access records of access users according to the data monitoring cycle, and generate a user periodic data set; The access feature analysis module is used to extract and mark the access feature data in each user periodic data set to generate a user feature extract set; based on the user feature extract set, calculate the access feature value of each access user in different data monitoring periods, and construct an access feature fluctuation model based on the access feature value; The access anomaly association module generates a fluctuation anomaly set for the tag data monitoring period according to the access feature fluctuation value calculated by the access feature fluctuation model, and calculates the anomaly association degree between any two access users in the fluctuation anomaly set; The real-time access analysis and control module is used to analyze the abnormal correlation between access users according to the abnormal correlation degree, generate an abnormal access user set, analyze the real-time access data of the access users in the abnormal access user set, generate a list of dangerous access users, and send it to the administrator.

6. A data analysis system for a data asset access management platform according to claim 5, characterized in that: The access data monitoring preprocessing module includes an access data monitoring unit and an access data preprocessing unit; The access data monitoring unit is used to uniformly number the access users, set a data monitoring cycle for the management platform, and store and extract the historical access records of the access users; The access data preprocessing unit is used to extract data from the historical access records of access users according to the data monitoring cycle, and generate a user periodic data set.

7. The data analysis system for a data asset access management platform according to claim 5, characterized in that: The access feature analysis module includes an access feature extraction unit and an access feature fluctuation analysis unit; The access feature extraction unit is used to extract access feature data from the user periodic data set corresponding to each access user and generate a user feature extraction set; the access feature data includes a single access duration, a single access data volume and an access frequency; The access feature fluctuation analysis unit is used to calculate the access feature value of the access user in each data monitoring period according to the user feature excerpt set; and to construct an access feature fluctuation model according to the access feature value of the access user in each data monitoring period.

8. The data analysis system for a data asset access management platform according to claim 5, characterized in that: The access anomaly association module includes a fluctuation anomaly extraction unit and a correlation degree analysis unit; The fluctuation anomaly extraction unit is used to preset a fluctuation value threshold according to the access feature fluctuation value calculated by the access feature fluctuation model; if the access feature fluctuation value of the access feature value is greater than or equal to the fluctuation value threshold, then mark the data monitoring period corresponding to the access feature value; and generate a fluctuation anomaly set for all the data monitoring periods marked by the access user; The correlation degree analysis unit is used to calculate the abnormal correlation degree between any two visiting users according to the fluctuation abnormality set.

9. The data analysis system for a data asset access management platform according to claim 5, characterized in that: The real-time access analysis and control module includes an abnormal access user analysis unit and an encryption control unit; The abnormal access user analysis unit is used to analyze the abnormal correlation between access users according to the abnormal correlation degree, generate an abnormal access user set, and analyze the real-time access data of the access users in the abnormal access user set; The encryption control unit is used to encrypt the real-time access data of dangerous access users, generate a dangerous access user list, and send it to the administrator.

Images