Visual data security analysis method and system based on big data

Abstract

The invention discloses a visual data security analysis method and system based on big data, and relates to the technical field of visual data analysis, and the system comprises a data collection end, a node distribution state value acquisition module, a standard distribution value acquisition module, a node deviation value acquisition module, a real-time deviation value acquisition module and a distribution abnormity mark acquisition module. Generating standard deviation distribution and real-time deviation distribution of the network by using the node deviation value and the real-time deviation value, and comparing the standard deviation distribution and the real-time deviation distribution; according to the method, whether abnormity exists or not is judged, by collecting and analyzing the flow data distribution of the network nodes in real time, the flow distribution state of each node can be obtained in real time, potential safety risks can be found in time, potential network attacks can be found and coped with in time, the network safety protection capacity is effectively improved, and the safety risks are reduced.

Description

Technical Field

[0001] The present invention relates to the technical field of visual data analysis, and in particular to a visual data security analysis method and system based on big data. Background Art

[0002] The visual data security analysis method and system based on big data is a technology that collects, processes and analyzes a large amount of data to display the data security status in an intuitive way. It can help enterprises and individuals better understand data security risks and take corresponding measures to protect data security. With the explosive growth of data volume, traditional methods are difficult to effectively process and analyze these massive traffic data. Through big data technology, this system realizes the rapid collection, storage and processing of massive data, thereby improving the efficiency and accuracy of data analysis;

[0003] However, traditional security monitoring systems can often only provide post-analysis and cannot reflect the security status of the network in real time. They cannot collect and analyze the distribution of traffic data of network nodes in real time, and cannot monitor the traffic distribution status of each node in real time to promptly discover potential security risks. Based on this, a visual data security analysis method and system based on big data is proposed. Summary of the invention

[0004] The purpose of the present invention is to provide a visual data security analysis method and system based on big data, which solves the technical problems of being unable to collect and analyze the distribution of traffic data of network nodes in real time, being unable to monitor the traffic distribution status of each node in real time, and timely discovering potential security risks.

[0005] The purpose of the present invention can be achieved through the following technical solutions:

[0006] Visual data security analysis system based on big data, including:

[0007] The data collection terminal is used to collect the longitudinal flow and transverse flow data corresponding to each node in the monitoring network every day within a preset time T, T≥1;

[0008] The node distribution state value acquisition module is used to analyze the longitudinal flow and transverse flow data corresponding to each node in the monitoring network every day within a preset time length T, and then obtain the distribution state value corresponding to each node every day;

[0009] The standard distribution value acquisition module is used to analyze the distribution state value corresponding to each node in the monitoring network every day within a preset time length T, and then obtain the standard distribution value corresponding to each node;

[0010] The node deviation value acquisition module is used to comprehensively analyze the distribution state value corresponding to each node every day within the preset time length T and the standard distribution value corresponding to each node, and then obtain the node deviation value corresponding to each node;

[0011] The real-time deviation value acquisition module obtains the real-time longitudinal flow and lateral flow data of each node in the monitoring network on the same day, analyzes them, and then obtains the real-time deviation value corresponding to each node;

[0012] The distribution anomaly mark acquisition module obtains the standard deviation distribution value of the monitoring network according to the node deviation value corresponding to each node in the monitoring network, and then obtains the real-time deviation distribution value of the monitoring network according to the real-time deviation value corresponding to each node in the monitoring network. Based on the analysis and calculation results of the two, the distribution anomaly mark is generated.

[0013] As a further solution of the present invention: the specific method of obtaining the distribution state value corresponding to each node every day is:

[0014] The longitudinal traffic and transverse traffic data include the traffic transmission state values ​​and their corresponding maintenance duration values ​​corresponding to the longitudinal traffic and transverse traffic data of each node every day;

[0015] Calculate the product of each traffic transmission state value and its corresponding maintenance duration value in the longitudinal traffic and lateral traffic data corresponding to each node every day within the preset duration T, and mark it as the state flow value corresponding to each transmission state quantity corresponding to each node every day, analyze the state flow value corresponding to each transmission state quantity corresponding to each node every day, and then obtain the convergence and divergence values ​​between each state flow, and use it as the distribution state value corresponding to each node every day within the preset duration T.

[0016] As a further solution of the present invention: the specific calculation and analysis method is:

[0017] S1: Select one day from the preset time period T as the analysis day;

[0018] S2: Select one of the nodes as the target point;

[0019] S3: Obtain the state flow value and the corresponding maintenance duration value of the target point on the analysis day, and mark them as Aj and Bj respectively, where j is the number of state flow values ​​corresponding to the target point on the analysis day, j≥1;

[0020] The product of each flow transmission state value and its corresponding maintenance duration value is marked as the state flow value Cj corresponding to each transmission state quantity. The convergence and divergence values ​​between each state flow value Cj are obtained through the discrete value formula, and used as the distribution state value Z11 corresponding to the target point within the analysis day;

[0021] S4: Repeat the above steps S1-S3 to obtain the distribution state value Z1a corresponding to each node in the analysis day, where a refers to the number of nodes in the monitoring network and is used as the label corresponding to the node, a≥1;

[0022] S5: Repeat the above steps S1-S4 to obtain the distribution state value ZTa corresponding to each node every day within the preset time length T.

[0023] As a further solution of the present invention: the specific method of obtaining the standard distribution value corresponding to each node is:

[0024] S01: Select the same node as in step S2 as the target point;

[0025] S02: Obtain the distribution state values ​​corresponding to the target point every day within the preset time T, and mark them as DT, obtain the value Gf that meets the preset conditions in DT, where f is the number of values ​​that meet the preset conditions in DT, analyze them, and obtain the standard distribution value BZ1 corresponding to the target point, f≥1;

[0026] S03: Repeat steps S01-S02 to obtain the standard distribution value BZa corresponding to each node in the monitoring network.

[0027] As a further solution of the present invention: the specific method of obtaining the standard distribution value BZ1 corresponding to the target point is:

[0028] When f≥Y2, the mean of DT is used as the standard distribution value BZ1 corresponding to the target point. When f<Y2, the mean of the maximum and minimum values ​​in DT is used as the standard distribution value BZ1 corresponding to the target point, where Y2 is a preset value.

[0029] As a further solution of the present invention: the preset conditions are:

[0030] The preset conditions are met: Y1≥|De-Dp|, Y1 is the preset value, Dp is the mean value of DT, T≥e≥1.

[0031] As a further solution of the present invention: the specific method of obtaining the node deviation value corresponding to each node is:

[0032] S11: Select the same node as in step S2 as the target point;

[0033] S12: Obtain the distribution state value DT corresponding to the target point every day within the preset time period T and the standard distribution value BZ1 corresponding to the target point;

[0034] Obtain the difference between the distribution state value DT corresponding to the target point each day and its corresponding standard distribution value BZ1, and mark it as BCT, and mark the mean value of BCT as the node deviation E1 corresponding to the target point;

[0035] S13: Repeat steps S11-S12 to obtain the node deviation value Ea corresponding to each node in the monitoring network.

[0036] As a further solution of the present invention: the specific analysis method for obtaining the real-time deviation value corresponding to each node is:

[0037] At each interval of preset duration Y3, the real-time longitudinal flow and lateral flow data of each node in the monitoring network are obtained, where Y3 is a preset value;

[0038] Substitute the corresponding flow transmission state value and its corresponding maintenance duration value in the real-time longitudinal flow and lateral flow data of each node in the monitoring network on that day into the node distribution state value acquisition module, and adopt the same method as the distribution state value Z1 a corresponding to each node in the analysis day to obtain the real-time distribution state value corresponding to each node in the monitoring network and mark it as Ma;

[0039] The difference between the real-time distribution state value Ma corresponding to each node in the monitoring network and the standard distribution value corresponding to each node is obtained, and is used as the real-time deviation value PCa corresponding to each node.

[0040] As a further solution of the present invention: the specific method of determining and generating the distribution abnormality mark is:

[0041] The label a corresponding to each node is used as the horizontal coordinate, and the node deviation value corresponding to each node is used as the vertical coordinate to obtain the deviation line graph of the monitoring network, and the coordinates corresponding to each node on the deviation line graph are marked as K1 a(a,Ea);

[0042] The label a corresponding to each node is used as the horizontal coordinate, and the real-time deviation value corresponding to each node is used as the vertical coordinate to obtain the real-time deviation line graph of the monitoring network, and the coordinates corresponding to each node of the real-time deviation line graph are marked K2a (a, PCa);

[0043] According to the formula, Calculate the divergence value L between the deviation line graph and the real-time deviation line graph of the monitoring network; where “||” represents the divergence, K1(a) is the coordinate corresponding to each node on the deviation line graph, and K2(a) is the coordinate corresponding to each node on the real-time deviation line graph. When the divergence value L is greater than the preset value Y4, an abnormal signal is generated, otherwise, no processing is performed, where Y4 is the preset value.

[0044] The visual data security analysis method based on big data includes the following steps:

[0045] Step 1: Collect and monitor the longitudinal and lateral flow data of each node in the network;

[0046] Step 2: Analyze the longitudinal flow and transverse flow data corresponding to each node in the monitoring network every day within the preset time length T, and obtain the distribution state value corresponding to each node every day;

[0047] Step 3: Analyze the distribution state values ​​corresponding to each node in the monitoring network every day within the preset time length T to obtain the standard distribution value corresponding to each node;

[0048] Step 4: Comprehensively analyze the distribution state value corresponding to each node every day within the preset time length T and the standard distribution value corresponding to each node, and then obtain the node deviation value corresponding to each node;

[0049] Step 5: Analyze the real-time longitudinal flow and lateral flow data of each node in the monitoring network on that day to obtain the real-time deviation value corresponding to each node;

[0050] Step 6: According to the standard deviation distribution value of the monitoring network and the real-time deviation value corresponding to each node in the monitoring network, a distribution anomaly mark is generated.

[0051] Beneficial effects of the present invention:

[0052] The present invention records the daily flow state value of each node and the duration of its maintenance, analyzes the flow data of each node, calculates the state flow values ​​corresponding to different flow state quantities, obtains the distribution state value of the node through convergence and divergence analysis, analyzes the distribution state value of the node to determine the standard distribution value of each node, obtains the node deviation value by comparing the distribution state value of each node with the standard distribution value, regularly obtains the real-time flow data of the node, calculates its real-time distribution state value, compares it with the standard distribution value, obtains the real-time deviation value, uses the node deviation value and the real-time deviation value to generate the standard deviation distribution and real-time deviation distribution of the network, and compares the two to determine whether there is an abnormality. By real-time collection and analysis of the flow data distribution of network nodes, the flow distribution state of each node can be monitored in real time, potential security risks can be discovered in time, and potential network attacks can be discovered and responded to in time, effectively improving the network security protection capability and reducing security risks. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] The present invention will be further described below in conjunction with the accompanying drawings.

[0054] Figure 1 It is a schematic diagram of the system framework structure of the system of the present invention;

[0055] Figure 2 It is a schematic diagram of the framework structure of the method of the present invention. DETAILED DESCRIPTION

[0056] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0057] Embodiment 1

[0058] See also Figure 1 As shown, the present invention is a visual data security analysis system based on big data, including:

[0059] The data collection end is used to collect the longitudinal flow and transverse flow data corresponding to each node in the monitoring network every day within the preset time T from the log of the security monitoring system. The longitudinal flow and transverse flow data include the flow transmission state value corresponding to the longitudinal flow and transverse flow data of each node every day and the corresponding maintenance time value;

[0060] It should be noted that in a data center, network traffic can be divided into two main types: one is the traffic between external users and internal servers in the data center, which is usually called north-south traffic or vertical traffic; the other is the traffic between servers inside the data center, which is called east-west traffic or horizontal traffic;

[0061] The preset time length T refers to the time length of 270 days from now, and the current time of obtaining data is not included, that is, T = 270;

[0062] The node distribution state value acquisition module is used to analyze the longitudinal flow and transverse flow data corresponding to each node in the monitoring network within a preset time T every day, and then obtain the distribution state value corresponding to each node every day. The specific method is as follows:

[0063] Calculate the product between each flow transmission state value and its corresponding maintenance duration value in the longitudinal flow and transverse flow data corresponding to each node every day within the preset duration T, and mark it as the state flow value corresponding to each transmission state quantity corresponding to each node every day, analyze the state flow value corresponding to each transmission state quantity corresponding to each node every day, and then obtain the convergence and divergence values ​​between each state flow, and use it as the distribution state value corresponding to each node every day within the preset duration T;

[0064] The specific calculation and analysis method is:

[0065] S1: Select one day from the preset time period T as the analysis day;

[0066] S2: Select one of the nodes as the target point;

[0067] S3: Obtain the state flow value and the corresponding maintenance duration value of the target point on the analysis day, and mark them as Aj and Bj respectively, where j is the number of state flow values ​​corresponding to the target point on the analysis day, j≥1;

[0068] The product of each flow transmission state value and its corresponding maintenance duration value is marked as the state flow value Cj corresponding to each transmission state quantity, that is, Aj×Bj=Cj;

[0069] By formula The convergence and divergence value ABC1 between each state flow value Cj can be obtained, and it is used as the distribution state value Z11 corresponding to the target point within the analysis day, where j≥i≥1, and Cp is the mean value of Cj;

[0070] S4: Repeat the above steps S1-S3 to obtain the distribution state value Z1a corresponding to each node in the analysis day, where a refers to the number of nodes in the monitoring network and is used as the label corresponding to the node, a≥1;

[0071] S5: Repeat the above steps S1-S4 to obtain the distribution state value ZTa corresponding to each node every day within the preset time length T;

[0072] The standard distribution value acquisition module is used to analyze the distribution state value corresponding to each node in the monitoring network every day within a preset time length T, and then obtain the standard distribution value corresponding to each node. The specific method is as follows:

[0073] S01: Select the same node as in step S2 as the target point;

[0074] S02: Obtain the distribution state value corresponding to the target point every day within the preset time T, mark it as DT, analyze it and obtain the standard distribution value BZ1 corresponding to the target point in the monitoring network. The specific analysis method is:

[0075] Obtain the value Gf in DT that meets the preset condition: Y1≥|De-Dp|, where f is the number of values ​​in DT that meet the preset condition, f≥1, Dp is the mean value of DT, T≥e≥1;

[0076] When f≥Y2, the mean of DT is used as the standard distribution value BZ1 corresponding to the target point. When f<Y2, the mean of the maximum and minimum values ​​in DT is used as the standard distribution value BZ1 corresponding to the target point, that is, (D max +D min ) / 2=BZ1, where D max is the maximum value in DT, D min is the minimum value in , where Y1 and Y2 are preset values, and the specific values ​​are formulated by relevant personnel according to actual needs;

[0077] S03: Repeat steps S01-S02 to obtain the standard distribution value BZa corresponding to each node in the monitoring network;

[0078] The node deviation value acquisition module is used to comprehensively analyze the distribution state value corresponding to each node every day within the preset time length T and the standard distribution value corresponding to each node, and then obtain the node deviation value corresponding to each node. The specific method is as follows:

[0079] S11: Select the same node as in step S2 as the target point;

[0080] S12: Obtain the distribution state value DT corresponding to the target point every day within the preset time period T and the standard distribution value BZ1 corresponding to the target point;

[0081] Obtain the difference between the distribution state value DT corresponding to the target point each day and its corresponding standard distribution value BZ1, and mark it as BCT, and mark the mean value of BCT as the node deviation E1 corresponding to the target point;

[0082] S13: Repeat steps S11-S12 to obtain the node deviation value Ea corresponding to each node in the monitoring network;

[0083] The real-time deviation value acquisition module obtains the real-time longitudinal flow and lateral flow data of each node in the monitoring network at each preset interval Y3, and analyzes them to obtain the real-time distribution state value corresponding to each node in the monitoring network, obtains the difference between the real-time distribution state value corresponding to each node and the standard distribution value corresponding to each node, and uses it as the real-time deviation value corresponding to each node. The specific analysis method is as follows:

[0084] Y3 is a preset value. The specific value is determined by relevant personnel based on actual needs. Here, Y3 is set to 15 minutes.

[0085] Substitute the corresponding flow transmission state value and its corresponding maintenance duration value in the real-time longitudinal flow and lateral flow data of each node in the monitoring network on that day into the node distribution state value acquisition module, and adopt the same method as the distribution state value Z1 a corresponding to each node in the analysis day to obtain the real-time distribution state value corresponding to each node in the monitoring network and mark it as Ma;

[0086] Obtain the difference between the real-time distribution state value Ma corresponding to each node in the monitoring network and the standard distribution value corresponding to each node, and use it as the real-time deviation value PCa corresponding to each node;

[0087] The distribution anomaly mark acquisition module is used to obtain the standard deviation distribution value of the monitoring network according to the node deviation value corresponding to each node in the monitoring network, and then obtain the real-time deviation distribution value of the monitoring network according to the real-time deviation value corresponding to each node in the monitoring network. According to the analysis and calculation results of the two, the distribution anomaly mark is generated. The specific method is as follows:

[0088] The label a corresponding to each node is used as the horizontal coordinate, and the node deviation value corresponding to each node is used as the vertical coordinate to obtain the deviation line graph of the monitoring network, and the coordinates corresponding to each node on the deviation line graph are marked as K1 a(a,Ea);

[0089] The label a corresponding to each node is used as the horizontal coordinate, and the real-time deviation value corresponding to each node is used as the vertical coordinate to obtain the real-time deviation line graph of the monitoring network, and the coordinates corresponding to each node of the real-time deviation line graph are marked K2a (a, PCa);

[0090] According to the formula, Calculate the divergence value L between the deviation line graph of the monitoring network and the real-time deviation line graph;

[0091] Where “||” represents divergence, K1(a) is the coordinate corresponding to each node on the deviation line graph, K2(a) is the coordinate corresponding to each node on the real-time deviation line graph, and the divergence value L is used to quantify the difference between the distribution of the real-time deviation value of each node in the real-time deviation line graph and the distribution of the deviation value of each node in the deviation line graph;

[0092] When the divergence value L is greater than the preset value Y4, it means that there is a large difference between the distribution of the real-time deviation values ​​of each node in the monitoring network in the real-time deviation value line graph and the distribution state of the deviation values ​​of each node in the deviation line graph, then an abnormal signal is generated, otherwise no processing is performed, where Y4 is a preset value, and the specific value is formulated by relevant personnel according to actual needs;

[0093] Record the daily traffic status value of each node and the duration of its maintenance. By analyzing the traffic data of each node, calculate the state traffic values ​​corresponding to different traffic status quantities, and obtain the distribution state value of the node through convergence and divergence analysis. Analyze the distribution state value of the node to determine the standard distribution value of each node. By comparing the distribution state value of each node with the standard distribution value, obtain the node deviation value. Regularly obtain the real-time traffic data of the node, and calculate its real-time distribution state value, compare it with the standard distribution value, and obtain the real-time deviation value. Use the node deviation value and real-time deviation value to generate the standard deviation distribution and real-time deviation distribution of the network, and compare the two; determine whether there is anomaly. By real-time collection and analysis of the traffic data distribution of network nodes, the traffic distribution status of each node can be real-time, potential security risks can be discovered in a timely manner, and potential network attacks can be discovered and responded to in a timely manner, effectively improving network security protection capabilities and reducing security risks.

[0094] Embodiment 2

[0095] As the second embodiment of the present invention, when the present application is implemented, compared with the first embodiment, the technical solution of the present embodiment is different from that of the first embodiment only in the present embodiment;

[0096] The abnormal node marking module, when an abnormal signal is generated, obtains the absolute value of the difference between the node deviation value corresponding to each node and the real-time deviation value corresponding to each node, and when the absolute value is greater than the preset value Y5, marks the corresponding node as an abnormal node;

[0097] That is, by |Ea-Ma|=Va, the absolute value of the difference Va corresponding to each node is calculated. When Va>Y5, the corresponding node is marked as an abnormal node, otherwise no processing is performed;

[0098] Display terminal, used to display abnormal signals, abnormal nodes, deviation line graphs and deviation line graphs, which is conducive to visual data security management;

[0099] When an anomaly is detected, the absolute value of the difference between the node deviation value and the real-time deviation value is calculated. If this value exceeds the preset threshold Y5, the node is marked as an abnormal node.

[0100] Embodiment 3

[0101] See also Figure 2 As shown, the visual data security analysis method based on big data includes the following steps:

[0102] Step 1: Collect and monitor the longitudinal and lateral flow data of each node in the network;

[0103] Step 2: Analyze the longitudinal flow and transverse flow data corresponding to each node in the monitoring network every day within the preset time length T, and obtain the distribution state value corresponding to each node every day;

[0104] Step 3: Analyze the distribution state values ​​corresponding to each node in the monitoring network every day within the preset time length T to obtain the standard distribution value corresponding to each node;

[0105] Step 4: Comprehensively analyze the distribution state value corresponding to each node every day within the preset time length T and the standard distribution value corresponding to each node, and then obtain the node deviation value corresponding to each node;

[0106] Step 5: Analyze the real-time longitudinal flow and lateral flow data of each node in the monitoring network on that day to obtain the real-time deviation value corresponding to each node;

[0107] Step 6: According to the standard deviation distribution value of the monitoring network and the real-time deviation value corresponding to each node in the monitoring network, a distribution anomaly mark is generated.

[0108] Embodiment 4

[0109] As the fourth embodiment of the present invention, when the present application is specifically implemented, compared with the first, second and third embodiments, the technical solution of this embodiment is to combine and implement the solutions of the first, second and third embodiments.

[0110] The above formulas are all dimensionless and numerical calculations. The formula is a formula for the most recent real situation obtained by collecting a large amount of data and performing software simulation. The preset parameters and thresholds in the formula are set by technicians in this field according to actual conditions.

[0111] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A visual data security analysis system based on big data, characterized by: include: The data collection terminal is used to collect the longitudinal flow and transverse flow data corresponding to each node in the monitoring network every day within a preset time T, T≥1; The node distribution state value acquisition module is used to analyze the longitudinal flow and transverse flow data corresponding to each node in the monitoring network every day within a preset time length T, and then obtain the distribution state value corresponding to each node every day; The standard distribution value acquisition module is used to analyze the distribution state value corresponding to each node in the monitoring network every day within a preset time length T, and then obtain the standard distribution value corresponding to each node; The node deviation value acquisition module is used to comprehensively analyze the distribution state value corresponding to each node every day within the preset time length T and the standard distribution value corresponding to each node, and then obtain the node deviation value corresponding to each node; The real-time deviation value acquisition module obtains the real-time longitudinal flow and lateral flow data of each node in the monitoring network on the same day, analyzes them, and then obtains the real-time deviation value corresponding to each node; The distribution anomaly mark acquisition module obtains the standard deviation distribution value of the monitoring network according to the node deviation value corresponding to each node in the monitoring network, and then obtains the real-time deviation distribution value of the monitoring network according to the real-time deviation value corresponding to each node in the monitoring network. Based on the analysis and calculation results of the two, the distribution anomaly mark is generated.

2. The visual data security analysis system based on big data according to claim 1 is characterized in that: The specific method to obtain the distribution status value corresponding to each node every day is: The longitudinal traffic and transverse traffic data include the traffic transmission state values ​​and their corresponding maintenance duration values ​​corresponding to the longitudinal traffic and transverse traffic data of each node every day; Calculate the product of each traffic transmission state value and its corresponding maintenance duration value in the longitudinal traffic and lateral traffic data corresponding to each node every day within the preset duration T, and mark it as the state flow value corresponding to each transmission state quantity corresponding to each node every day, analyze the state flow value corresponding to each transmission state quantity corresponding to each node every day, and then obtain the convergence and divergence values ​​between each state flow, and use it as the distribution state value corresponding to each node every day within the preset duration T.

3. The visual data security analysis system based on big data according to claim 2 is characterized in that: The specific calculation and analysis method is: S1: Select one day from the preset time period T as the analysis day; S2: Select one of the nodes as the target point; S3: Obtain the state flow value and the corresponding maintenance duration value of the target point on the analysis day, and mark them as Aj and Bj respectively, where j is the number of state flow values ​​corresponding to the target point on the analysis day, j≥1; The product of each flow transmission state value and its corresponding maintenance duration value is marked as the state flow value Cj corresponding to each transmission state quantity. The convergence and divergence values ​​between each state flow value Cj are obtained through the discrete value formula, and used as the distribution state value Z11 corresponding to the target point within the analysis day; S4: Repeat the above steps S1-S3 to obtain the distribution state value Z1 a corresponding to each node in the analysis day, where a refers to the number of nodes in the monitoring network and is used as the label corresponding to the node, a≥1; S5: Repeat the above steps S1-S4 to obtain the distribution state value ZTa corresponding to each node every day within the preset time length T.

4. The visual data security analysis system based on big data according to claim 3 is characterized in that: The specific method of obtaining the standard distribution value corresponding to each node is: S01: Select the same node as in step S2 as the target point; S02: Obtain the distribution state values ​​corresponding to the target point every day within the preset time T, and mark them as DT, obtain the value Gf that meets the preset conditions in DT, where f is the number of values ​​that meet the preset conditions in DT, analyze them, and obtain the standard distribution value BZ1 corresponding to the target point, f≥1; S03: Repeat steps S01-S02 to obtain the standard distribution value BZa corresponding to each node in the monitoring network.

5. The visual data security analysis system based on big data according to claim 4 is characterized in that: The specific method of obtaining the standard distribution value BZ1 corresponding to the target point is: When f≥Y2, the mean of DT is used as the standard distribution value BZ1 corresponding to the target point. When f<Y2, the mean of the maximum and minimum values ​​in DT is used as the standard distribution value BZ1 corresponding to the target point, where Y2 is a preset value.

6. The visual data security analysis system based on big data according to claim 5 is characterized in that: The default conditions are: The preset conditions are met: Y1≥|De-Dp|, Y1 is the preset value, Dp is the mean value of DT, T≥e≥1.

7. The visual data security analysis system based on big data according to claim 6 is characterized in that: The specific method of obtaining the node deviation value corresponding to each node is: S11: Select the same node as in step S2 as the target point; S12: Obtain the distribution state value DT corresponding to the target point every day within the preset time period T and the standard distribution value BZ1 corresponding to the target point; Obtain the difference between the distribution state value DT corresponding to the target point each day and its corresponding standard distribution value BZ1, and mark it as BCT, and mark the mean value of BCT as the node deviation E1 corresponding to the target point; S13: Repeat steps S11-S12 to obtain the node deviation value Ea corresponding to each node in the monitoring network.

8. The visual data security analysis system based on big data according to claim 7 is characterized in that: The specific analysis method for obtaining the real-time deviation value corresponding to each node is as follows: At each interval of preset duration Y3, the real-time longitudinal flow and lateral flow data of each node in the monitoring network are obtained, where Y3 is a preset value; Substitute the corresponding flow transmission state value and its corresponding maintenance duration value in the real-time longitudinal flow and lateral flow data of each node in the monitoring network on that day into the node distribution state value acquisition module, and adopt the same method as the distribution state value Z1 a corresponding to each node in the analysis day to obtain the real-time distribution state value corresponding to each node in the monitoring network and mark it as Ma; The difference between the real-time distribution state value Ma corresponding to each node in the monitoring network and the standard distribution value corresponding to each node is obtained, and is used as the real-time deviation value PCa corresponding to each node.

9. The visual data security analysis system based on big data according to claim 8 is characterized in that: The specific method for determining the generation of distribution anomaly markers is as follows: The label a corresponding to each node is used as the horizontal coordinate, and the node deviation value corresponding to each node is used as the vertical coordinate to obtain the deviation line graph of the monitoring network, and the coordinates corresponding to each node on the deviation line graph are marked as K1 a(a,Ea); The label a corresponding to each node is used as the horizontal coordinate, and the real-time deviation value corresponding to each node is used as the vertical coordinate to obtain the real-time deviation line graph of the monitoring network, and the coordinates corresponding to each node of the real-time deviation line graph are marked K2a (a, PCa); According to the formula, Calculate the divergence value L between the deviation line graph and the real-time deviation line graph of the monitoring network; where "||" represents the divergence, K1(a) is the coordinate corresponding to each node on the deviation line graph, and K2(a) is the coordinate corresponding to each node on the real-time deviation line graph. When the divergence value L is greater than the preset value Y4, an abnormal signal is generated, otherwise, no processing is performed, where Y4 is the preset value.

10. A visual data security analysis method based on big data for implementing the system according to any one of claims 1 to 9, characterized in that: The following steps are involved: Step 1: Collect and monitor the longitudinal and lateral flow data of each node in the network; Step 2: Analyze the longitudinal flow and transverse flow data corresponding to each node in the monitoring network every day within the preset time length T, and obtain the distribution state value corresponding to each node every day; Step 3: Analyze the distribution state values ​​corresponding to each node in the monitoring network every day within the preset time length T to obtain the standard distribution value corresponding to each node; Step 4: Comprehensively analyze the distribution state value corresponding to each node every day within the preset time length T and the standard distribution value corresponding to each node, and then obtain the node deviation value corresponding to each node; Step 5: Analyze the real-time longitudinal flow and lateral flow data of each node in the monitoring network on that day to obtain the real-time deviation value corresponding to each node; Step 6: According to the standard deviation distribution value of the monitoring network and the real-time deviation value corresponding to each node in the monitoring network, a distribution anomaly mark is generated.

Images