Network security protection method and system based on big data

Abstract

The embodiment of the invention provides a network security protection method and system based on big data, and belongs to the technical field of network security. The method comprises the following steps: obtaining target encrypted data corresponding to a target object, and decrypting the target encrypted data to obtain target security data; performing event association analysis on the target security data to obtain abnormal event information corresponding to the target object; performing intention analysis on the abnormal event information to obtain target threat information corresponding to the target object; and performing strategy making according to the target threat information to determine a target protection strategy corresponding to the target object. The problems that increasingly complex and diversified network threats are difficult to effectively defend and the security operation and maintenance cost is increased in the prior art are solved. And the quality and efficiency of network security protection are improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a network security protection method and system based on big data. Background Art

[0002] In the modern network environment, the rapid development of information technology has not only promoted the digitalization process, but also brought about a significant increase in the frequency and complexity of network attacks. Traditional network security protection methods, including firewalls, intrusion detection systems, and intrusion prevention systems, have shown many shortcomings in dealing with these new attacks. With the continuous evolution of attack technology, these traditional methods have gradually become incapable of effectively resisting increasingly complex and diverse network threats. In addition, in the process of dealing with complex attacks, existing network security protection technologies often face problems such as high false alarm rate, slow response speed, and high resource consumption. These problems not only reduce the efficiency of the protection system, but also increase the cost of security operation and maintenance. Summary of the invention

[0003] The main purpose of the embodiments of the present invention is to provide a network security protection method and system based on big data, aiming to solve the problem that related technologies are difficult to effectively resist increasingly complex and diverse network threats, thereby increasing security operation and maintenance costs.

[0004] In a first aspect, an embodiment of the present invention provides a network security protection method based on big data, including:

[0005] Obtain target encrypted data corresponding to the target object, and decrypt the target encrypted data to obtain target security data;

[0006] Performing event correlation analysis on the target security data to obtain abnormal event information corresponding to the target object;

[0007] Performing intent analysis on the abnormal event information to obtain target threat information corresponding to the target object;

[0008] A strategy is formulated based on the target threat information to determine a target protection strategy corresponding to the target object.

[0009] In a second aspect, an embodiment of the present invention provides a network security protection system based on big data, including:

[0010] A data acquisition module is used to obtain target encrypted data corresponding to the target object, and decrypt the target encrypted data to obtain target security data;

[0011] An abnormality analysis module, used to perform event correlation analysis on the target security data to obtain abnormal event information corresponding to the target object;

[0012] An intention analysis module, used to perform intention analysis on the abnormal event information to obtain target threat information corresponding to the target object;

[0013] The strategy determination module is used to formulate a strategy based on the target threat information to determine the target protection strategy corresponding to the target object.

[0014] In a third aspect, an embodiment of the present invention further provides a terminal device, comprising a processor, a memory, a computer program stored in the memory and executable by the processor, and a data bus for realizing connection and communication between the processor and the memory, wherein when the computer program is executed by the processor, the steps of any one of the big data-based network security protection methods provided in the specification of the present invention are implemented.

[0015] In a fourth aspect, an embodiment of the present invention further provides a storage medium for computer-readable storage, characterized in that the storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the steps of any one of the big data-based network security protection methods provided in the specification of the present invention.

[0016] The embodiment of the present invention provides a network security protection method and system based on big data, which includes: obtaining encrypted data of a target object, ensuring that the data remains secure during transmission and storage, and preventing sensitive information from being accessed by unauthorized third parties. Subsequently, the target encrypted data is decrypted to obtain target security data. Next, event correlation analysis is performed on the target security data, and independent security events can be associated to reveal potential attack patterns and abnormal behaviors, thereby improving the threat detection capability. Further, intention analysis is performed on abnormal event information, which can identify the target threat information faced by the target object, deeply understand the motives and strategies of the attacker, and provide an important reference for formulating effective protection measures. Based on the target threat information, a targeted protection strategy is formulated to ensure the effectiveness and pertinence of the strategy and enhance the network security protection effect. In addition, by real-time updating and analysis of the target threat information, the protection strategy can be flexibly adjusted to cope with the ever-changing network threat environment. This method effectively solves the problem that traditional technologies are difficult to resist increasingly complex and diverse network threats, reduces the cost of security operation and maintenance, and improves the overall security management effect. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0018] Figure 1 A flowchart of a network security protection method based on big data provided by an embodiment of the present invention;

[0019] Figure 2 A schematic diagram of the module structure of a network security protection system based on big data provided by an embodiment of the present invention;

[0020] Figure 3 A schematic block diagram of the structure of a terminal device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0021] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0022] The flowcharts shown in the accompanying drawings are only examples and do not necessarily include all the contents and operations / steps, nor must they be executed in the order described. For example, some operations / steps may also be decomposed, combined or partially merged, so the actual execution order may change according to actual conditions.

[0023] It should be understood that the terms used in this specification of the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention. As used in the specification of the present invention and the appended claims, unless the context clearly indicates otherwise, the singular forms "a", "an" and "the" are intended to include plural forms.

[0024] The embodiment of the present invention provides a network security protection method and system based on big data. The network security protection method based on big data can be applied to a terminal device, which can be an electronic device such as a tablet computer, a laptop computer, a desktop computer, a personal digital assistant, and a wearable device. The terminal device can be a server or a server cluster.

[0025] Some embodiments of the present invention are described in detail below in conjunction with the accompanying drawings. In the absence of conflict, the following embodiments and features in the embodiments can be combined with each other.

[0026] Please refer to Figure 1 , Figure 1 A flowchart of a network security protection method based on big data provided by an embodiment of the present invention.

[0027] like Figure 1As shown, the network security protection method based on big data includes steps S101 to S104.

[0028] Step S101: Obtain target encrypted data corresponding to a target object, and decrypt the target encrypted data to obtain target security data.

[0029] Exemplarily, a target object is determined, and the target object may be a target website, a target company, or other objects that may be attacked.

[0030] Exemplarily, the target encrypted data corresponding to the target object is obtained from a database, network transmission, or other storage medium, and then the corresponding decryption algorithm is selected according to the encryption algorithm used for the encrypted data (such as symmetric encryption algorithm AES, asymmetric encryption algorithm RSA, etc.). The encrypted data is decrypted using the decryption key and the selected algorithm to obtain the target security data. The decryption process needs to be performed in a secure environment to prevent the decrypted data from being leaked.

[0031] In some embodiments, obtaining the target encrypted data corresponding to the target object includes: collecting initial security data corresponding to the target object, and identifying sensitive information on the initial security data to obtain user privacy data corresponding to the initial security data; obtaining a target position corresponding to the user privacy data, and desensitizing the initial security data according to the target position to obtain the target security data; determining a target public key, and using the target public key to encrypt the user privacy data to obtain a target encryption result; determining the target encrypted data corresponding to the target object based on the target security data and the target encryption result.

[0032] Exemplarily, the initial security data of the target object is collected from a specified data source or system. This may include data obtained from databases, log files, sensors, etc. The initial security data includes but is not limited to network traffic data, user behavior data, threat intelligence data, etc. Then, the initial security data is preprocessed and cleaned to remove noise data and redundant data to ensure the quality and integrity of the data. The preprocessed initial security data is then used to identify sensitive information and obtain the user privacy data corresponding to the initial security data.

[0033] For example, the initial security data is classified to identify sensitive information that may be contained therein. This usually involves analyzing the data content to find sensitive data such as personal identity information and financial data. For example, sensitive information identification tools or algorithms are used to automatically detect and mark sensitive data to reduce manual intervention, thereby extracting user privacy data from the identified sensitive information.

[0034] For example, the target location corresponding to the user's private data in the initial security data is determined, and then the user's private data extracted from the initial security data is desensitized to ensure the security of the private data during use. This may include data masking, data generalization or other desensitization techniques to obtain the target security data.

[0035] Exemplarily, a target public key for encryption is obtained from a key management system or a public key infrastructure, and the target public key is used to encrypt user privacy data to obtain a target encryption result, thereby ensuring the security of data during transmission and storage.

[0036] Exemplarily, the final target encrypted data is composed based on the processed target security data and the encrypted user privacy data.

[0037] Specifically, by identifying sensitive information in the initial security data, potential user privacy data can be effectively identified, reducing the risk of sensitive information leakage. After desensitizing the user privacy data, the data can be used and analyzed without exposing sensitive information, ensuring the security of the data during sharing and use. Encrypting user privacy data further enhances the data protection capability. Even if the data is illegally obtained, the attacker cannot directly access the sensitive information, thereby effectively protecting user privacy and data security.

[0038] In some embodiments, decrypting the target encrypted data to obtain target security data includes: determining a target private key, using the target private key to decrypt the target encrypted data to obtain target decrypted data; and performing data preprocessing on the target decrypted data to obtain the target security data corresponding to the target object.

[0039] For example, the private key is usually provided by a key management system or a secure storage solution and needs to be securely stored to prevent leakage, so as to obtain the target private key corresponding to the target public key. In addition, it is also necessary to check whether the target private key is valid and has not expired to ensure that it can be used for decryption operations.

[0040] Exemplarily, according to the encryption algorithm (such as RSA, DSA, etc.) used for the encrypted data, a suitable decryption algorithm is selected. The target encrypted data is decrypted using the target private key. During the decryption process, it is necessary to ensure that the operation is performed in a secure environment to prevent the decrypted data from being leaked, thereby obtaining the target decrypted data.

[0041] Exemplarily, the target decrypted data obtained by decryption is cleaned and invalid or duplicate data is deleted to ensure data quality. Then, according to the needs of subsequent processing, the data is formatted to ensure that it meets the standards for analysis or use, such as unified date format, numerical format, etc. Subsequently, data standardization is performed to meet specific standards or specifications. Finally, the pre-processed data is integrated to form the final target security data.

[0042] Specifically, by using the correct target private key for decryption, it can be ensured that only authorized personnel or systems can access the encrypted data, thereby protecting the security and privacy of the data. After decryption, the data is cleaned to remove invalid or duplicate data, which helps to improve the accuracy and completeness of the data and ensure the effectiveness of subsequent analysis or processing. Next, the data is formatted into a structure suitable for analysis or use, making it more standardized and consistent for subsequent processing and analysis. Standardizing the data to make it conform to specific standards or specifications helps maintain data consistency and facilitates integration and comparison. Through these steps, the security and quality of the data are guaranteed, and the use of the data is optimized, thereby improving the efficiency of overall data management and analysis.

[0043] Step S102: Perform event correlation analysis on the target security data to obtain abnormal event information corresponding to the target object.

[0044] Exemplarily, a pre-trained event extraction model is used or a suitable model is designed to identify and extract relevant target events from target security data. This model can be based on natural language processing, information extraction and other technologies. Then set the type of relationship to be identified, such as causal relationship, correlation relationship, influence relationship, etc. Use the labeled data or design a suitable classification model to classify the relationship between any two target events. This model can be based on machine learning or deep learning methods, so as to apply the relationship classification model to determine the target relationship between any two target events.

[0045] Exemplarily, how to connect target events is determined based on the target relationship. For example, how to connect events can be determined based on the time series or the logical relationship of events. Thus, according to the target relationship, the target events are connected to form target-related events. Thus, a suitable abnormal classification model is designed to analyze the target-related events. The model can be based on statistical analysis, rule engine or machine learning technology. Apply the abnormal classification model to classify the target-related events and identify the abnormal event information therein.

[0046] In some embodiments, the event association analysis of the target security data to obtain abnormal event information corresponding to the target object includes: determining a target trigger word corresponding to the target security data; performing event extraction on the target security data based on the target trigger word to obtain target event information; performing relationship classification on the target event information using a relationship classification model to obtain a target relationship; and obtaining the abnormal event information corresponding to the target object from the target event information based on the target relationship.

[0047] Exemplarily, based on the identified target trigger words, develop an event extraction model. This model can use information extraction (IE) technology, combined with keyword matching, pattern recognition or machine learning algorithms to identify events containing trigger words. Apply the event extraction model to the target security data to extract the target event information related to the target trigger words. Ensure that the extracted target event information contains the necessary context, such as time, location, participants, etc. Organize the extracted target event information and ensure its structured storage for subsequent analysis.

[0048] Exemplarily, the existing labeled data is used for training. The model can use machine learning methods (such as support vector machines, random forests, etc.) or deep learning methods (such as LSTM, BERT, etc.) to classify relationships according to event features, and then apply the trained relationship classification model to analyze the target event information, identify the relationship between events, and obtain the target relationship.

[0049] Exemplarily, based on the target relationship obtained, the interaction and logic between events are analyzed. This process involves understanding how the relationship affects the connection between events. Define the criteria for abnormal events. This may include baselines of normal behavior, statistical thresholds, etc. Anomaly detection models (such as clustering-based or rule-based methods) can be used to identify abnormal events. Based on the target relationship, the abnormal event information related to the target object is filtered out from the target event information. This process requires applying the target relationship to the event set to identify those events that significantly deviate from the normal pattern.

[0050] Specifically, by determining the target trigger words and performing event extraction, events related to specific trigger words can be quickly located from a large amount of security data. This helps to more accurately identify and focus on possible security issues. By identifying abnormal events based on target relationships, it is possible to more accurately locate real abnormal situations and reduce the possibility of false positives (normal events are mistaken for abnormalities) and missed negatives (abnormal events are not identified). This helps prevent potential attacks or security vulnerabilities and improves the system's defense capabilities.

[0051] In some embodiments, determining the target trigger word corresponding to the target safety data includes: performing dependency syntactic analysis on the target safety data to obtain the corresponding data dependency relationship; using the text representation layer of the trigger word extraction model to perform semantic conversion on the target safety data to obtain a semantic representation vector; using the position representation layer of the trigger word extraction model to convert the position information of the target safety data to obtain a position representation vector; using the dependency representation layer of the trigger word extraction model to vector represent the data dependency relationship to obtain a dependency representation vector; using the first fusion layer of the trigger word extraction model to perform feature fusion on the semantic representation vector, the position representation vector and the dependency representation vector to obtain a target representation vector; using the target convolution layer of the trigger word extraction model to perform convolution processing on the target representation vector to obtain a first feature vector; using the attention layer of the trigger word extraction model to capture important information on the target representation vector to obtain a second feature vector; using the second fusion layer of the trigger word extraction model to perform feature fusion on the first feature vector and the second feature vector to obtain a fused representation vector; using the word classification layer of the trigger word extraction model to semantically classify the fused representation vector to obtain the target trigger word corresponding to the target safety data.

[0052] For example, the target security data is subjected to syntactic analysis using a dependency syntactic analysis method in natural language processing technology, which identifies how words in a sentence depend on and connect to each other, thereby establishing data dependency relationships between words.

[0053] For example, the text representation layer in the trigger word extraction model is applied to convert the target security data into a semantic representation vector. The text representation layer usually performs deep learning processing on the input text to capture the semantic information of the text and convert it into a vector representation. The semantic representation vector will retain the main semantic features of the text for subsequent processing.

[0054] Exemplarily, the position representation layer of the trigger word extraction model is used to convert position information, such as the position of the word in the target security data, into a position representation vector. The position representation vector is usually used to capture the relative and absolute position of the word in the target security data. The generated position information vector will help the trigger word extraction model understand the context of the word and the influence of the position on the semantics.

[0055] Exemplarily, the dependency representation vector is obtained by vectorizing the data dependency using the dependency representation layer of the trigger word extraction model. The dependency representation layer converts the syntactic dependency into a vector representation to help capture the structural relationship between words. Thus, the dependency representation vector reflects the position and relationship of words in the syntactic structure.

[0056] For example, the first fusion layer of the trigger word extraction model is used to fuse the semantic representation vector, the position representation vector, and the dependency representation vector. The fusion layer creates a comprehensive target representation vector by combining these different representation vectors. Common fusion methods include vector concatenation and weighted averaging to ensure that the fused vector can effectively express a variety of information.

[0057] Exemplarily, the target convolution layer of the trigger word extraction model is used to perform a convolution operation on the fused target representation vector. This step can extract local features in the vector and generate a first feature vector.

[0058] For example, the attention layer of the trigger word extraction model is used to capture important information, and the attention mechanism is applied to the target representation vector to focus on the important information part and generate the second feature vector. The attention mechanism can automatically identify and strengthen the most important features for the target task.

[0059] Exemplarily, the first feature vector and the second feature vector are further fused using the second fusion layer of the trigger word extraction model to generate a fused representation vector. The purpose of the second fusion layer is to combine the advantages of different feature layers to provide a more accurate representation. The fused fusion feature vector contains all the important information extracted by the convolution layer and the attention layer.

[0060] For example, the word classification layer of the trigger word extraction model is used to semantically classify the fused representation vector, and finally obtain the target trigger word corresponding to the target security data. The classification layer usually uses a classification algorithm (such as a fully connected layer of a neural network) to map the fused representation to the trigger word category.

[0061] Specifically, dependency syntactic analysis and semantic representation can provide a deeper understanding of the intrinsic meaning and contextual relationships of the target security data, which helps to identify potential security incidents and attack patterns. The text representation layer, position representation layer, and dependency representation layer extract different dimensional information of the data, respectively, to form a comprehensive feature representation. In particular, the integration of position information enables the model to understand the relative position of words in the text, which is crucial for dealing with semantic ambiguity and understanding context. After multi-layer fusion processing, the final target representation vector combines multiple aspects of information such as semantics, position information, and dependency relationships. This comprehensive feature representation improves the expressiveness of the model, enabling it to more accurately capture the intrinsic characteristics of the data. Therefore, the target trigger words finally obtained through these steps can help the security system more accurately identify and classify potential security threats, reduce false positives and false negatives, and thus improve the accuracy of anomaly detection.

[0062] Step S103: perform intent analysis on the abnormal event information to obtain target threat information corresponding to the target object.

[0063] For example, specific goals of intent analysis are determined, such as identifying the attacker's motivation, understanding potential threat types, assessing the likelihood of an attack, etc. Possible threat categories or types are set so that they can be classified and identified during the analysis process.

[0064] Exemplarily, select a suitable intent analysis method according to the target. Common methods include natural language processing (NLP), machine learning models (such as classification models), rule engines, etc. Extract key features from abnormal event information. These features may include a description of the event, the time of occurrence, the users and systems involved, etc. If a machine learning method is used, the model needs to be trained with labeled data to ensure that the model can identify various potential threat intentions. Input the abnormal event information into the intent analysis model for processing. The model will classify the events and identify potential threat intentions. Based on the analysis results, extract the target threat information of the target object. This may include the attacker's intentions, the nature of the threat, the target of the attack, etc.

[0065] In some embodiments, the performing intent analysis on the abnormal event information to obtain target threat information corresponding to the target object includes: using the information representation layer of the intent classification model to perform information representation on the abnormal event information to obtain an event representation vector corresponding to the abnormal event information; using the relationship representation layer of the intent classification model to perform data representation on the target relationship to obtain a relationship representation vector corresponding to the target relationship; using the vector fusion layer of the intent classification model to perform data fusion on the event representation vector and the relationship representation vector to obtain a target fusion vector; using the data classification layer of the intent classification model to perform intent classification on the target fusion vector to obtain a target intent; and determining the target threat information corresponding to the target object according to the target intent and a threat mapping table.

[0066] Exemplarily, abnormal event information includes event description, timestamp, event type, etc. The abnormal event information is cleaned and formatted for further processing. This may involve removing noise, processing missing values, and unifying data formats. The abnormal event information is processed using the information representation layer of the intent classification model. The information representation layer usually extracts and encodes the event information through deep learning technology to generate a vector (event representation vector) representing the abnormal event information. The vector will contain the main features and semantic information of the event, which is convenient for subsequent processing.

[0067] Exemplarily, the target relationship is processed using the relationship representation layer of the intent classification model. The relationship representation layer encodes the target relationship and generates a relationship representation vector. The relationship representation vector captures the structure and semantic information of the target relationship. The event representation vector and the relationship representation vector are then fused using the vector fusion layer of the intent classification model. The fusion layer combines the two vectors to generate a comprehensive target fusion vector. The fusion process can be simple vector concatenation, weighted averaging, or a more complex fusion mechanism, with the goal of integrating event information and relationship information into a comprehensive representation.

[0068] Exemplarily, the target fusion vector is classified using the data classification layer of the intent classification model. The classification layer will classify the fusion vector into predefined intent categories based on its features. The output of this step is the target intent for the abnormal event intent, such as attack intent, information theft intent, etc.

[0069] Exemplarily, create a threat mapping table, which should contain two columns: one is the intent category and the other is the corresponding threat information. The intent category should cover all possible intent classification results, while the threat information describes in detail the security threats that each intent category may bring. Find the entry corresponding to the target intent in the threat mapping table. This can be done by direct comparison or by using fuzzy matching technology (if the statement of the intent classification is not exactly the same as the statement in the mapping table). Once an entry matching the target intent is found in the threat mapping table, the corresponding target threat information can be extracted from the entry. The target threat information may include threat type, potential impact, recommended countermeasures, etc.

[0070] Specifically, by fusing the event representation vector and the relationship representation vector, the event information and the relationship information can be combined to generate a comprehensive target fusion vector. This comprehensive representation can more comprehensively reflect the complexity and diversity of abnormal events. Using the target fusion vector for intent classification can effectively identify the true intention of abnormal events and improve the ability to understand and handle abnormal events. The target intent obtained through intent classification can accurately indicate the potential threat type and nature of abnormal events, which helps to clarify specific security threats. It improves the understanding of abnormal events, the accuracy of threat identification, and the effectiveness of security protection, providing the system with more intelligent and reliable security protection.

[0071] Step S104: formulate a strategy based on the target threat information to determine a target protection strategy corresponding to the target object.

[0072] For example, based on the target threat information, we first need to assess the severity of the threat and the risk it may pose to the target object. Based on the risk assessment and the severity of the threat, we determine the priority level and select appropriate protective measures. Specific protective measures include: technical protection measures such as firewalls, intrusion detection systems, encryption technology, vulnerability scanning, etc., management control measures such as formulating access control policies, conducting employee training, establishing emergency response processes, etc., physical security measures such as data center security, equipment protection, physical access control, etc.

[0073] In some implementations, the method further includes: determining a visualization tool, and performing risk display of the target threat information in the visualization tool to obtain a risk display result corresponding to the target object.

[0074] For example, big data visualization tools (such as Kibana and Grafana) are used to display network security trends, and security status is monitored in real time through charts and dashboards. Based on big data analysis, the risk level of network assets is assessed and prioritized.

[0075] Exemplarily, organize the target threat information into a format suitable for processing by a visualization tool. It is usually necessary to convert the data into a structured format, such as a table or database record. Clean up errors or inconsistencies in the data to ensure the accuracy and completeness of the data. Import the organized data into the selected visualization tool. This can be achieved by directly uploading files, connecting to databases, or using APIs. According to the characteristics of the data and presentation requirements, select the appropriate chart type and presentation method. For example, use a pie chart to display the classification of threats, and use a bar chart to display the severity of risks. Configure the parameters of the chart, including titles, labels, colors, data series, etc., to ensure that the chart is clear and easy to understand. In this way, the target threat information is displayed in the visualization tool for risk display, and the risk display results corresponding to the target object are obtained.

[0076] Specifically, visualization tools present complex data and information in the form of charts, graphs or dashboards, making the information more intuitive and easy to understand, helping to quickly understand the type, severity and impact of threats. Through visualization, it is easier to identify key risk points and high-risk areas, thereby helping to prioritize the most pressing security threats.

[0077] The embodiment of the present invention provides a network security protection method and system based on big data, which includes: obtaining encrypted data of a target object, ensuring that the data remains secure during transmission and storage, and preventing sensitive information from being accessed by unauthorized third parties. Subsequently, the target encrypted data is decrypted to obtain target security data. Next, event correlation analysis is performed on the target security data, and independent security events can be associated to reveal potential attack patterns and abnormal behaviors, thereby improving the threat detection capability. Further, intention analysis is performed on abnormal event information, which can identify the target threat information faced by the target object, deeply understand the motives and strategies of the attacker, and provide an important reference for formulating effective protection measures. Based on the target threat information, a targeted protection strategy is formulated to ensure the effectiveness and pertinence of the strategy and enhance the network security protection effect. In addition, by real-time updating and analysis of the target threat information, the protection strategy can be flexibly adjusted to cope with the ever-changing network threat environment. This method effectively solves the problem that traditional technologies are difficult to resist increasingly complex and diverse network threats, reduces the cost of security operation and maintenance, and improves the overall security management effect.

[0078] See also Figure 2 , Figure 2 A network security protection system 200 based on big data is provided for the embodiment of the present application. The network security protection system 200 based on big data includes a data acquisition module 201, an anomaly analysis module 202, an intent analysis module 203, and a policy determination module 204, wherein the data acquisition module 201 is used to obtain target encrypted data corresponding to the target object, and decrypt the target encrypted data to obtain target security data; the anomaly analysis module 202 is used to perform event correlation analysis on the target security data to obtain abnormal event information corresponding to the target object; the intent analysis module 203 is used to perform intent analysis on the abnormal event information to obtain target threat information corresponding to the target object; and the policy determination module 204 is used to formulate a policy according to the target threat information to determine the target protection policy corresponding to the target object.

[0079] In some implementations, during the process of obtaining the target encrypted data corresponding to the target object, the data acquisition module 201 executes:

[0080] Collecting initial security data corresponding to the target object, and performing sensitive information identification on the initial security data to obtain user privacy data corresponding to the initial security data;

[0081] Obtaining a target location corresponding to the user privacy data, and desensitizing the initial security data according to the target location to obtain target security data;

[0082] Determine a target public key, and use the target public key to encrypt the user's private data to obtain a target encryption result;

[0083] The target encrypted data corresponding to the target object is determined according to the target security data and the target encryption result.

[0084] In some implementations, the data acquisition module 201, during the process of decrypting the target encrypted data to obtain the target security data, executes:

[0085] Determine a target private key, and use the target private key to decrypt the target encrypted data to obtain target decrypted data;

[0086] The target decrypted data is preprocessed to obtain the target security data corresponding to the target object.

[0087] In some implementations, the abnormality analysis module 202, during the process of performing event correlation analysis on the target security data to obtain abnormal event information corresponding to the target object, executes:

[0088] Determine a target trigger word corresponding to the target security data;

[0089] Performing event extraction on the target security data according to the target trigger word to obtain target event information;

[0090] Using a relation classification model to classify the target event information, and obtain a target relationship;

[0091] The abnormal event information corresponding to the target object is obtained from the target event information according to the target relationship.

[0092] In some implementations, during the process of determining the target trigger word corresponding to the target security data, the abnormality analysis module 202 performs:

[0093] Performing dependency syntax analysis on the target security data to obtain corresponding data dependency relationships;

[0094] Using the text representation layer of the trigger word extraction model to perform semantic transformation on the target security data to obtain a semantic representation vector;

[0095] Using the position representation layer of the trigger word extraction model, the position information of the target security data is converted to obtain a position representation vector;

[0096] Using the dependency representation layer of the trigger word extraction model to perform vector representation on the data dependency relationship to obtain a dependency representation vector;

[0097] Using the first fusion layer of the trigger word extraction model, the semantic representation vector, the position representation vector and the dependency representation vector are feature-fused to obtain a target representation vector;

[0098] Using the target convolution layer of the trigger word extraction model to perform convolution processing on the target representation vector to obtain a first feature vector;

[0099] Using the attention layer of the trigger word extraction model to capture important information of the target representation vector to obtain a second feature vector;

[0100] Using the second fusion layer of the trigger word extraction model to perform feature fusion on the first feature vector and the second feature vector to obtain a fused representation vector;

[0101] The word classification layer of the trigger word extraction model is used to perform semantic classification on the fused representation vector to obtain the target trigger word corresponding to the target security data.

[0102] In some implementations, the intention analysis module 203 performs, during the process of performing intention analysis on the abnormal event information and obtaining target threat information corresponding to the target object:

[0103] Using the information representation layer of the intent classification model to represent the abnormal event information, obtaining an event representation vector corresponding to the abnormal event information;

[0104] Using the relationship representation layer of the intention classification model to perform data representation on the target relationship to obtain a relationship representation vector corresponding to the target relationship;

[0105] Using the vector fusion layer of the intention classification model to perform data fusion on the event representation vector and the relationship representation vector to obtain a target fusion vector;

[0106] Using the data classification layer of the intent classification model to perform intent classification on the target fusion vector to obtain the target intent;

[0107] The target threat information corresponding to the target object is determined according to the target intent and the threat mapping table.

[0108] In some implementations, the big data-based network security protection system 200 further performs:

[0109] A visualization tool is determined, and the target threat information is displayed in the visualization tool for risk presentation, to obtain a risk presentation result corresponding to the target object.

[0110] In some implementations, the big data-based network security protection system 200 may be applied to terminal devices.

[0111] It should be noted that technical personnel in the relevant field can clearly understand that, for the convenience and conciseness of description, the specific working process of the big data-based network security protection system 200 described above can refer to the corresponding process in the aforementioned big data-based network security protection method embodiment, and will not be repeated here.

[0112] See also Figure 3 , Figure 3 A schematic block diagram of the structure of a terminal device provided in an embodiment of the present invention.

[0113] like Figure 3 As shown, the terminal device 300 includes a processor 301 and a memory 302, and the processor 301 and the memory 302 are connected via a bus 303, such as an I2C (Inter-integrated Circuit) bus.

[0114] Specifically, the processor 301 is used to provide computing and control capabilities to support the operation of the entire terminal device. The processor 301 can be a central processing unit (CPU), and the processor 301 can also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. Among them, the general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc.

[0115] Specifically, the memory 302 may be a Flash chip, a read-only memory (ROM) disk, an optical disk, a USB flash drive, or a mobile hard disk.

[0116] Those skilled in the art will understand that Figure 3 The structure shown in the figure is only a block diagram of a partial structure related to the embodiment of the present invention, and does not constitute a limitation on the terminal device to which the embodiment of the present invention is applied. The specific server may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0117] The processor is used to run a computer program stored in the memory, and implement any one of the big data-based network security protection methods provided by the embodiments of the present invention when executing the computer program.

[0118] In one embodiment, the processor is used to run a computer program stored in the memory, and implements the following steps when executing the computer program:

[0119] Obtain target encrypted data corresponding to the target object, and decrypt the target encrypted data to obtain target security data;

[0120] Performing event correlation analysis on the target security data to obtain abnormal event information corresponding to the target object;

[0121] Performing intent analysis on the abnormal event information to obtain target threat information corresponding to the target object;

[0122] A strategy is formulated based on the target threat information to determine a target protection strategy corresponding to the target object.

[0123] In some implementations, during the process of obtaining the target encrypted data corresponding to the target object, the processor 301 executes:

[0124] Collecting initial security data corresponding to the target object, and performing sensitive information identification on the initial security data to obtain user privacy data corresponding to the initial security data;

[0125] Obtaining a target location corresponding to the user privacy data, and desensitizing the initial security data according to the target location to obtain target security data;

[0126] Determine a target public key, and use the target public key to encrypt the user's private data to obtain a target encryption result;

[0127] The target encrypted data corresponding to the target object is determined according to the target security data and the target encryption result.

[0128] In some implementations, the processor 301, during the process of decrypting the target encrypted data to obtain the target security data, executes:

[0129] Determine a target private key, and use the target private key to decrypt the target encrypted data to obtain target decrypted data;

[0130] The target decrypted data is preprocessed to obtain the target security data corresponding to the target object.

[0131] In some implementations, during the process of performing event correlation analysis on the target security data to obtain abnormal event information corresponding to the target object, the processor 301 executes:

[0132] Determine a target trigger word corresponding to the target security data;

[0133] Performing event extraction on the target security data according to the target trigger word to obtain target event information;

[0134] Using a relation classification model to classify the target event information, and obtain a target relationship;

[0135] The abnormal event information corresponding to the target object is obtained from the target event information according to the target relationship.

[0136] In some implementations, during the process of determining the target trigger word corresponding to the target security data, the processor 301 executes:

[0137] Performing dependency syntax analysis on the target security data to obtain corresponding data dependency relationships;

[0138] Using the text representation layer of the trigger word extraction model to perform semantic transformation on the target security data to obtain a semantic representation vector;

[0139] Using the position representation layer of the trigger word extraction model, the position information of the target security data is converted to obtain a position representation vector;

[0140] Using the dependency representation layer of the trigger word extraction model to perform vector representation on the data dependency relationship to obtain a dependency representation vector;

[0141] Using the first fusion layer of the trigger word extraction model, the semantic representation vector, the position representation vector and the dependency representation vector are feature-fused to obtain a target representation vector;

[0142] Using the target convolution layer of the trigger word extraction model to perform convolution processing on the target representation vector to obtain a first feature vector;

[0143] Using the attention layer of the trigger word extraction model to capture important information of the target representation vector to obtain a second feature vector;

[0144] Using the second fusion layer of the trigger word extraction model to perform feature fusion on the first feature vector and the second feature vector to obtain a fused representation vector;

[0145] The word classification layer of the trigger word extraction model is used to perform semantic classification on the fused representation vector to obtain the target trigger word corresponding to the target security data.

[0146] In some implementations, the processor 301, in the process of performing intent analysis on the abnormal event information and obtaining target threat information corresponding to the target object, executes:

[0147] Using the information representation layer of the intent classification model to represent the abnormal event information, obtaining an event representation vector corresponding to the abnormal event information;

[0148] Using the relationship representation layer of the intention classification model to perform data representation on the target relationship to obtain a relationship representation vector corresponding to the target relationship;

[0149] Using the vector fusion layer of the intention classification model to perform data fusion on the event representation vector and the relationship representation vector to obtain a target fusion vector;

[0150] Using the data classification layer of the intent classification model to perform intent classification on the target fusion vector to obtain the target intent;

[0151] The target threat information corresponding to the target object is determined according to the target intent and the threat mapping table.

[0152] In some implementations, the processor 301 further executes:

[0153] A visualization tool is determined, and the target threat information is displayed in the visualization tool for risk presentation, to obtain a risk presentation result corresponding to the target object.

[0154] It should be noted that technical personnel in the relevant field can clearly understand that, for the convenience and conciseness of description, the specific working process of the terminal device described above can refer to the corresponding process in the aforementioned big data-based network security protection method embodiment, and will not be repeated here.

[0155] An embodiment of the present invention also provides a storage medium for computer-readable storage, wherein the storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the steps of any one of the big data-based network security protection methods provided in the description of the embodiment of the present invention.

[0156] The storage medium may be an internal storage unit of the terminal device in the aforementioned embodiment, such as a hard disk or memory of the terminal device. The storage medium may also be an external storage device of the terminal device, such as a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (SecureDigital, SD) card, a flash card (Flash Card), etc. equipped on the terminal device.

[0157] It will be appreciated by those skilled in the art that all or some of the steps, systems, and functional modules / units in the methods disclosed above may be implemented as software, firmware, hardware, and appropriate combinations thereof. In a hardware embodiment, the division between the functional modules / units mentioned in the above description does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may be performed by several physical components in cooperation. Some or all physical components may be implemented as software executed by a processor, such as a central processing unit, a digital signal processor, or a microprocessor, or implemented as hardware, or implemented as an integrated circuit, such as an application-specific integrated circuit. Such software may be distributed on a computer-readable medium, which may include a computer storage medium (or non-transitory medium) and a communication medium (or temporary medium). As known to those skilled in the art, the term computer storage medium includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information and can be accessed by a computer. In addition, it is well known to those of ordinary skill in the art that communication media typically contain computer-readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media.

[0158] It should be understood that the term "and / or" used in the present specification and the appended claims refers to any combination of one or more of the associated listed items and all possible combinations, including these combinations. It should be noted that, in this article, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or system including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or system. In the absence of further restrictions, an element defined by the sentence "including a..." does not exclude the presence of other identical elements in the process, method, article or system including the element.

[0159] The serial numbers of the embodiments of the present invention are only for description and do not represent the advantages and disadvantages of the embodiments. The above are only specific embodiments of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed by the present invention, and these modifications or replacements should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be based on the protection scope of the claims.

Claims

1. A network security protection method based on big data, characterized in that: The method comprises: Obtain target encrypted data corresponding to the target object, and decrypt the target encrypted data to obtain target security data; Performing event correlation analysis on the target security data to obtain abnormal event information corresponding to the target object; Performing intent analysis on the abnormal event information to obtain target threat information corresponding to the target object; A strategy is formulated based on the target threat information to determine a target protection strategy corresponding to the target object.

2. The method according to claim 1, characterized in that The obtaining of target encrypted data corresponding to the target object includes: Collecting initial security data corresponding to the target object, and performing sensitive information identification on the initial security data to obtain user privacy data corresponding to the initial security data; Obtaining a target location corresponding to the user privacy data, and desensitizing the initial security data according to the target location to obtain target security data; Determine a target public key, and use the target public key to encrypt the user's private data to obtain a target encryption result; The target encrypted data corresponding to the target object is determined according to the target security data and the target encryption result.

3. The method according to claim 1, characterized in that The decrypting the target encrypted data to obtain target security data includes: Determine a target private key, and use the target private key to decrypt the target encrypted data to obtain target decrypted data; The target decrypted data is preprocessed to obtain the target security data corresponding to the target object.

4. The method according to claim 1, characterized in that: The performing event correlation analysis on the target security data to obtain abnormal event information corresponding to the target object includes: Determine a target trigger word corresponding to the target security data; Performing event extraction on the target security data according to the target trigger word to obtain target event information; Using a relation classification model to classify the target event information, and obtain a target relationship; The abnormal event information corresponding to the target object is obtained from the target event information according to the target relationship.

5. The method according to claim 4, characterized in that The determining the target trigger word corresponding to the target security data includes: Performing dependency syntax analysis on the target security data to obtain corresponding data dependency relationships; Using the text representation layer of the trigger word extraction model to perform semantic transformation on the target security data to obtain a semantic representation vector; Using the position representation layer of the trigger word extraction model, the position information of the target security data is converted to obtain a position representation vector; Using the dependency representation layer of the trigger word extraction model to perform vector representation on the data dependency relationship to obtain a dependency representation vector; Using the first fusion layer of the trigger word extraction model, the semantic representation vector, the position representation vector and the dependency representation vector are feature-fused to obtain a target representation vector; Using the target convolution layer of the trigger word extraction model to perform convolution processing on the target representation vector to obtain a first feature vector; Using the attention layer of the trigger word extraction model to capture important information of the target representation vector to obtain a second feature vector; Using the second fusion layer of the trigger word extraction model to perform feature fusion on the first feature vector and the second feature vector to obtain a fused representation vector; The word classification layer of the trigger word extraction model is used to perform semantic classification on the fused representation vector to obtain the target trigger word corresponding to the target security data.

6. The method according to claim 4, characterized in that The performing intention analysis on the abnormal event information to obtain target threat information corresponding to the target object includes: Using the information representation layer of the intent classification model to represent the abnormal event information, obtaining an event representation vector corresponding to the abnormal event information; Using the relationship representation layer of the intention classification model to perform data representation on the target relationship to obtain a relationship representation vector corresponding to the target relationship; Using the vector fusion layer of the intention classification model to perform data fusion on the event representation vector and the relationship representation vector to obtain a target fusion vector; Using the data classification layer of the intent classification model to perform intent classification on the target fusion vector to obtain the target intent; The target threat information corresponding to the target object is determined according to the target intent and the threat mapping table.

7. The method according to any one of claims 1 to 6, characterized in that The method further comprises: A visualization tool is determined, and the target threat information is displayed in the visualization tool for risk presentation, to obtain a risk presentation result corresponding to the target object.

8. A network security protection system based on big data, characterized in that: include: A data acquisition module is used to obtain target encrypted data corresponding to the target object, and decrypt the target encrypted data to obtain target security data; An abnormality analysis module, used to perform event correlation analysis on the target security data to obtain abnormal event information corresponding to the target object; An intention analysis module, used to perform intention analysis on the abnormal event information to obtain target threat information corresponding to the target object; The strategy determination module is used to formulate a strategy based on the target threat information to determine the target protection strategy corresponding to the target object.

9. A terminal device, characterized in that: The terminal device includes a processor and a memory; The memory is used to store computer programs; The processor is used to execute the computer program and implement the big data-based network security protection method as described in any one of claims 1 to 7 when executing the computer program.

10. A computer storage medium for computer storage, characterized in that: The computer storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the steps of the big data-based network security protection method described in any one of claims 1 to 7.

Images