A computer network security prediction method, system and medium based on big data analysis

Abstract

The present invention relates to the field of computer network security prediction technology, and specifically to a computer network security prediction method, system and medium based on big data analysis. First, based on the login account entered by the user in the login interface of the educational system, the identity information, real-time login information and historical login information corresponding to the user are obtained; secondly, the current login abnormality level of the user is obtained based on the identity information, the real-time login information and the historical login information; thirdly, the identity of the user is authenticated based on the current login abnormality level; then, when the identity authentication is passed, the user's operating behavior in the educational system is monitored; finally, the user's current abnormal behavior level is obtained based on the operating behavior and the current login abnormality level and an early warning is issued. Through this method, the present invention can accurately identify the abnormal behavior of the user when logging into the educational system and after logging in, thereby ensuring the network security of the educational system.

Description

Technical Field

[0001] The present invention relates to the technical field of computer network security prediction, and in particular to a computer network security prediction method, system and medium based on big data analysis. Background Art

[0002] With the rapid development of information technology and the advancement of educational informatization, the network security issues of the teaching system, as an important platform for student information services, have received increasing attention. The teaching system stores information such as students' course schedules, course grades and credits, and is vulnerable to network attacks. Traditional network security protection measures, such as firewalls, intrusion detection systems and virus scanning, although they have certain protection capabilities against known attack methods, are often not flexible and effective enough for new or complex security threats.

[0003] In recent years, computer network security prediction based on big data analysis has gradually become an important means to improve network security protection capabilities, including traffic anomaly monitoring and user behavior analysis. Among them, User Behavior Analytics (UBA) is an emerging security protection technology that can effectively identify abnormal behaviors and potential security threats by deeply analyzing and modeling user behavior patterns. The core of this technology is that it no longer relies solely on known attack features or static rules, but instead monitors users' actual operating behaviors in real time to dynamically identify abnormal activities that do not conform to normal patterns.

[0004] Existing literature based on user behavior analysis can achieve network security prediction, but it does not fully consider the unique behavior patterns of different users in the educational system (such as students, teachers, and educational system administrators), resulting in a relatively generalized understanding of user behavior. Therefore, the existing network security prediction methods based on user behavior cannot effectively predict the network security of the educational system, thereby reducing the network security of the educational system.

[0005] To this end, a computer network security prediction method, system and medium based on big data analysis are proposed. Summary of the invention

[0006] The purpose of the present invention is to provide a computer network security prediction method, system and medium based on big data analysis. First, according to the login account entered by the user in the login interface of the educational system, the identity information, real-time login information and historical login information corresponding to the user are obtained; secondly, according to the identity information, the real-time login information and the historical login information, the current login abnormality level of the user is obtained; thirdly, according to the current login abnormality level, the identity of the user is authenticated; then, when the identity authentication is passed, the user's operating behavior in the educational system is monitored; finally, according to the operating behavior and the current login abnormality level, the user's current abnormal behavior level is obtained and an early warning is issued.

[0007] To achieve the above object, the present invention provides the following technical solutions:

[0008] A computer network security prediction method based on big data analysis, comprising:

[0009] According to the login account entered by the user in the login interface of the educational system, the identity information, real-time login information and historical login information corresponding to the user are obtained.

[0010] Furthermore, the identity information, real-time login information and historical login information corresponding to the user include:

[0011] The identity information includes the user's name, position and initial authority; the real-time login information includes the real-time time, real-time IP address and real-time login device of the user logging into the educational system; the positions include teachers, students and educational system administrators;

[0012] The historical login information includes the login information corresponding to each time the user logged into the academic affairs system and passed the identity authentication before the real-time time; the historical login information includes historical normal login information and historical abnormal login information; the login information in the historical login information includes the login time, IP address, login device and login abnormality level.

[0013] The current login abnormality level of the user is obtained according to the identity information, the real-time login information and the historical login information.

[0014] Furthermore, the process of obtaining the current login abnormality level of the user includes:

[0015] Obtaining the real-time IP address in the real-time login information and determining whether the real-time IP address is an abnormal IP address, the specific process includes:

[0016] Compare the real-time IP address with the IP addresses in the abnormal IP address library stored in the educational system; when the real-time IP address belongs to the abnormal IP address library, determine that the real-time IP address is an abnormal IP address; otherwise, determine that the real-time IP address is not an abnormal IP address;

[0017] When the IP address is an abnormal IP address, the user's login is not allowed;

[0018] Otherwise, obtaining the historical login information corresponding to the user; when the number of the historical login information is not less than a set first threshold, constructing a historical login information set according to the historical login information of the user;

[0019] When the number of the historical login information is less than a set first threshold, the historical login information of all users with the same position as the user is obtained to construct a historical login information set;

[0020] Obtain the login information similarity between the real-time login information and each piece of the historical login information in the historical login information set; obtain the real-time login anomaly value based on the login information similarity, the number of login requests and the number of login failures within a set time period; obtain the current login anomaly level corresponding to the user based on the real-time login anomaly value.

[0021] The user's identity is authenticated according to the current login abnormality level.

[0022] When the identity verification is passed, monitoring the user's operation behavior in the educational affairs system;

[0023] Furthermore, monitoring the user's operation behavior in the educational system includes abnormal click path monitoring and abnormal interface operation monitoring:

[0024] When the user's click path is abnormal and / or the interface operation is abnormal, the user's operation behavior is judged to be abnormal; the process of clicking path abnormality monitoring is:

[0025] After passing the identity authentication, the user records the pages clicked in the education system in chronological order and the click times, and constructs an education system click set;

[0026] A real-time click path is obtained according to the educational system click set; the real-time click path includes a plurality of path nodes, and the plurality of path nodes are sequentially connected; the first path node is the first clicked page in the educational system click set; the second path node is the second clicked page in the educational system click set; and so on, the last path node is the last clicked page in the educational system click set; the path length of two adjacent path nodes is the click time difference between the pages corresponding to the two path nodes;

[0027] The real-time click path is adjusted, specifically comprising: when the path length of two adjacent path nodes is less than a set threshold, deleting the previous path node of the two adjacent path nodes;

[0028] The educational system click set is updated in real time; the real-time click path and the educational system click set are updated synchronously; after the user passes the identity authentication, the real-time click path of the user is identified at intervals T to determine whether the click path of the user is abnormal. The specific steps include:

[0029] Obtain a historical user click path set corresponding to the user; the historical user click path set includes multiple historical click paths; calculate the similarity between the real-time click path identified each time and each of the historical click paths, and obtain the maximum similarity; the value range of the similarity is [0, 1];

[0030] When the maximum similarity value obtained by the i-th recognition is less than the set similarity threshold, and the K maximum similarity values ​​obtained by the K consecutive recognitions before the i-th recognition are all less than the set similarity threshold, it is judged that the operation behavior of the user obtained by the i-th recognition is abnormal; otherwise, it is judged that the operation behavior of the user is normal.

[0031] Furthermore, the historical user click path set includes:

[0032] Record the click paths of the user from the time of logging into the educational affairs system to the time of logging out before the real time, and record them as historical click paths; when the number of the historical click paths is not less than the set path number threshold; construct a historical user click path set according to the historical click paths of the user;

[0033] When the number of the historical click paths is less than the set path number threshold; obtaining the historical click paths corresponding to all target position users and constructing a historical user click path set;

[0034] The position of the target position user is the same as the position of the user.

[0035] Furthermore, the abnormal interface operation monitoring includes:

[0036] Obtain the interface operation behavior of the user in each interface of the educational system; determine the category of the interface operation behavior based on the initial authority of the user; the category includes super-authority operation and non-super-authority operation; when the category is super-authority operation, determine the interface operation behavior as abnormal; otherwise, determine the interface operation behavior as normal.

[0037] Obtaining the user's current abnormal behavior level according to the operation behavior and the current login abnormality level;

[0038] Furthermore, the step of obtaining the current abnormal behavior level includes:

[0039] According to the operation behavior of the user, an operation behavior abnormality value is obtained; when the operation behavior of the user is identified as abnormal, the operation behavior abnormality value is set to a fixed value ,and ;

[0040] When it is identified that the operation behavior of the user is normal, the average of the maximum similarities obtained from this identification and K+1 consecutive identifications before this is taken as the abnormal value of the operation behavior;

[0041] The user's current abnormal behavior level is obtained based on the operation behavior abnormal value and the current login abnormal level, and an early warning is issued.

[0042] A computer network security prediction system based on big data analysis, comprising:

[0043] The first information acquisition unit is used to acquire the login account entered by the user in the login interface of the educational affairs system;

[0044] The second information acquisition unit is used to acquire the identity information, real-time login information and historical login information corresponding to the user according to the login account entered by the user in the login interface of the educational affairs system;

[0045] A current login abnormality level acquisition unit: used to acquire the current login abnormality level of the user according to the identity information, the real-time login information and the historical login information;

[0046] Identity verification unit: used for verifying the identity of the user according to the current login abnormality level;

[0047] Operation behavior monitoring unit: when the identity authentication is passed, monitoring the operation behavior of the user;

[0048] A current abnormal behavior level acquisition unit: acquires the user's current abnormal behavior level according to the operation behavior and the current login abnormal level;

[0049] Early warning unit: used to issue an early warning based on the current abnormal behavior level.

[0050] Furthermore, the identity information, real-time login information and historical login information corresponding to the user include:

[0051] The identity information includes the user's name, position and initial authority; the real-time login information includes the real-time time, real-time IP address and real-time login device of the user logging into the educational system; the positions include teachers, students and educational system administrators;

[0052] The historical login information includes the login information corresponding to each time the user logged into the academic affairs system and passed the identity authentication before the real-time time; the historical login information includes historical normal login information and historical abnormal login information; the login information in the historical login information includes the login time, IP address, login device and login abnormality level.

[0053] Furthermore, the process of obtaining the current login abnormality level includes:

[0054] Obtaining the real-time IP address in the real-time login information, and determining whether the real-time IP address is an abnormal IP address;

[0055] When the IP address is an abnormal IP address, the user's login is not allowed;

[0056] Otherwise, obtaining the historical login information corresponding to the user; when the number of the historical login information is not less than a set first threshold, constructing a historical login information set according to the historical login information of the user;

[0057] When the number of the historical login information is less than a set first threshold, the historical login information of all users with the same position as the user is obtained to construct a historical login information set;

[0058] The login information similarity between the real-time login information and each piece of the historical login information in the historical login information set is obtained, and the current login abnormality level corresponding to the user is determined in combination with the number of login requests and the number of login failures within a set time period.

[0059] A computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the above method are implemented.

[0060] Compared with the prior art, the present invention has the following beneficial effects:

[0061] 1. The present invention determines the current login abnormality level of the user who is about to log in to the educational affairs system, obtains the user's real-time login information, and compares the real-time login information with the historical login information, including login time comparison, IP address comparison and login device comparison, and combines the historical login abnormality level corresponding to the historical login information to obtain the current login abnormality level. This method can accurately determine the current login abnormality level of the user when logging in to the educational affairs system by combining various information logged in by the user, thereby improving the network security of the educational affairs system.

[0062] 2. New or newly employed teachers and administrators of the educational system log into the educational system less frequently, which will result in insufficient data in the corresponding historical user click path set, thereby affecting the judgment result of the user's operation behavior. Therefore, for users with less data, the present invention constructs a historical user click path set through the historical user click paths of users in the same position, and performs click path anomaly monitoring and interface operation anomaly monitoring on the user's behavior after successful identity authentication. The click path is obtained through the interface clicked by the user and the time of stay, and the click path is compared with the historical click paths in the historical user click path set at fixed intervals to determine whether the click path of the user is abnormal. At the same time, the user's interface operations on each interface are monitored to determine whether there are interface operation anomalies. This method can combine the user's various behaviors after entering the educational system, and then accurately obtain whether the user's operation behavior is abnormal, thereby improving the network security of the educational system.

[0063] 3. The present invention combines the user's operation behavior and the current login abnormality level to obtain the operation behavior abnormality value and the user's current abnormal behavior level. This method can accurately measure the security risks of different users' various behaviors to the teaching system after logging into the teaching system according to the user's specific behavior pattern and login status, thereby improving the network security of the teaching system. BRIEF DESCRIPTION OF THE DRAWINGS

[0064] Figure 1 A flowchart of a computer network security prediction method based on big data analysis provided by an embodiment of the present invention;

[0065] Figure 2 A structural diagram of a computer network security prediction system based on big data analysis provided by an embodiment of the present invention;

[0066] Figure 3 A schematic diagram of a process for obtaining the current login abnormality level provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0067] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0068] The present invention provides a computer network security prediction method based on big data analysis. This method is applied to a computer network security prediction system based on big data analysis. For specific method flow charts and system structure diagrams, refer to Figure 1 and Figure 2 .

[0069] Embodiment 1

[0070] This embodiment predicts the network security of the school A's educational system through big data analysis.

[0071] Reference Figure 1 S10, based on the login account entered by the user in the login interface of the educational affairs system, obtain the identity information, real-time login information and historical login information corresponding to the user; S10 is applied to a first information acquisition unit and a second information acquisition unit of a computer network security prediction system based on big data analysis; the first information acquisition unit is used to obtain the login account entered by the user in the login interface of the educational affairs system; the second information acquisition unit is used to obtain the identity information, real-time login information and historical login information corresponding to the user based on the login account entered by the user in the login interface of the educational affairs system.

[0072] Furthermore, when the user needs to log in to the educational affairs system, the login account entered by the user in the login interface of the educational affairs system is received, and the identity information, real-time login information and historical login information corresponding to the user are obtained according to the login account.

[0073] Furthermore, the identity information, real-time login information and historical login information corresponding to the user include:

[0074] The identity information includes the user's name, position and initial authority; the real-time login information includes the real-time time, real-time IP address and real-time login device of the user logging into the educational system; the positions include teachers, students and educational system administrators;

[0075] The historical login information includes the login information corresponding to each time the user logged into the academic affairs system and passed the identity authentication before the real-time time; the historical login information includes historical normal login information and historical abnormal login information; the login information in the historical login information includes the login time, IP address, login device and login abnormality level.

[0076] Furthermore, this embodiment obtains the identity information and real-time login information of user 1 and user 2 when they log in to the educational affairs system, as shown in Table 1.

[0077] Table 1 Identity information and real-time login information

[0078]

[0079] This step of the present embodiment obtains the identity information, real-time login information and historical login information corresponding to the user, providing a data basis for the subsequent calculation of the current login abnormality level and the current abnormal behavior level.

[0080] Reference Figure 1 , S20, obtaining the current login abnormality level of the user according to the identity information, the real-time login information and the historical login information; S20 is applied to a current login abnormality level obtaining unit of a computer network security prediction system based on big data analysis

[0081] Further, refer to Figure 3 , the process of obtaining the current login abnormality level includes:

[0082] Obtaining the real-time IP address in the real-time login information, and determining whether the real-time IP address is an abnormal IP address;

[0083] When the IP address is an abnormal IP address, the user's login is not allowed;

[0084] Otherwise, obtain the historical login information corresponding to the user;

[0085] When the number of historical login information is not less than a set first threshold, a historical login information set is constructed based on the historical login information of the user; when the number of historical login information is less than a set first threshold, the historical login information of all users with the same position as the user is obtained to construct a historical login information set; the first threshold can be set to 30 and 40, etc.; the login information similarity between the real-time login information and each of the historical login information in the historical login information set is obtained; based on the login information similarity, the number of login requests and the number of login failures within a set time period, a real-time login anomaly value is obtained; the set time period is ,in, It is represented as the real-time time, t is the set time interval, which can be 1 hour or 2 hours, etc. The specific calculation process of the real-time login abnormal value is:

[0086] The maximum value of the login information similarity is obtained; when the maximum value of the login information similarity corresponds to historical normal login information, the calculation formula of the real-time login abnormal value is:

[0087] ;

[0088] in, Represented as real-time login anomaly value; It is expressed as the maximum value of login information similarity; It is expressed as the number of login requests within the set time period; It is expressed as the number of failed logins within the set time period; , and They are respectively represented as the first login information similarity coefficient, the first login times coefficient and the first failed login coefficient, , and The default is , which can also be changed according to the actual application;

[0089] When the maximum value of the login information similarity corresponds to the historical abnormal login information, the calculation formula of the real-time login abnormal value is:

[0090] ;

[0091] in, , and They are respectively represented as the second login information similarity coefficient, the second login times coefficient, and the second failed login coefficient, , and The default is , which can also be changed according to the actual application;

[0092] Further, when obtaining the current login abnormality level corresponding to the user according to the real-time login abnormality value, the specific steps include setting multiple login abnormality thresholds , the login abnormality threshold is obtained based on experience; when the real-time login abnormality value is less than When the real-time login abnormality value belongs to the interval When the real-time login abnormality value belongs to the interval When the real-time login abnormality value is greater than or equal to When , the corresponding current login exception level is q+1;

[0093] This step of the present embodiment determines the current login abnormality level of the user who is about to log in to the educational affairs system, obtains the user's real-time login information, and compares the real-time login information with the historical login information, including login time comparison, IP address comparison, and login device comparison, to obtain the current login abnormality level. This method can accurately determine the current login abnormality level of the user when logging in to the educational affairs system by combining various information logged in by the user.

[0094] Reference Figure 1 , S30, authenticating the user according to the current login abnormality level; S30 is applied to an identity authentication unit of a computer network security prediction system based on big data analysis.

[0095] Furthermore, the degree of impact on the network security of the teaching system after the user logs in can be predicted based on the current login anomaly level; the higher the current login anomaly level, the higher the degree of impact on the network security of the teaching system after the corresponding user logs in; therefore, the identity authentication method needs to be adjusted based on the current login anomaly level; the higher the current login anomaly level, the more complex the corresponding identity authentication method. School A’s teaching system has 4 current login anomaly levels set, and the corresponding identity authentication methods refer to Table 2.

[0096] Table 2 Reference table for identity verification methods of the school A teaching system

[0097]

[0098] Reference Figure 1 , S40, when the identity authentication is passed, monitoring the user's operation behavior in the educational system; S40 is applied to an operation behavior monitoring unit of a computer network security prediction system based on big data analysis.

[0099] Furthermore, monitoring the operation behavior of the user in the educational affairs system includes abnormal click path monitoring and abnormal interface operation monitoring: when the click path of the user is abnormal and / or the interface operation is abnormal, the operation behavior of the user is judged to be abnormal; the process of abnormal click path monitoring is:

[0100] After passing the identity authentication, the user records the pages clicked in the education system in chronological order and the click times, and constructs an education system click set;

[0101] A real-time click path is obtained according to the educational system click set; the real-time click path includes a plurality of path nodes, and the plurality of path nodes are sequentially connected; the first path node is the first clicked page in the educational system click set; the second path node is the second clicked page in the educational system click set; and so on, the last path node is the last clicked page in the educational system click set; the path length of two adjacent path nodes is the click time difference between the pages corresponding to the two path nodes;

[0102] The real-time click path is adjusted, specifically including: when the path length of two adjacent path nodes is less than a set threshold, the previous path node of the two adjacent path nodes is deleted, and the threshold can be set to 0.5s and 1s, etc.;

[0103] The educational system click set is updated in real time; the real-time click path and the educational system click set are updated synchronously; after the user passes the identity authentication, the real-time click path of the user is identified at intervals T to determine whether the click path of the user is abnormal. The specific steps include:

[0104] Obtain a historical user click path set corresponding to the user; the historical user click path set includes multiple historical click paths; calculate the similarity between the real-time click path identified each time and each of the historical click paths, and obtain the maximum similarity; the value range of the similarity is [0, 1];

[0105] When the maximum similarity value obtained by the i-th recognition is less than the set similarity threshold, and the K maximum similarity values ​​obtained by the K consecutive recognitions before the i-th recognition are all less than the set similarity threshold, it is judged that the operation behavior of the user obtained by the i-th recognition is abnormal, and the similarity threshold is obtained based on experience; otherwise, it is judged that the operation behavior of the user is normal; K can be set to 3, 4, etc.

[0106] This step of the present embodiment monitors the abnormal click path and interface operation of the user after the identity authentication is successful. The click path is obtained by the interface clicked by the user and the time of staying, and the click path is compared with the historical click path at fixed intervals to determine whether the click path of the user is abnormal. At the same time, the user's interface operation on each interface is monitored to determine whether there is an abnormal interface operation. This method can combine the various behaviors of the user after entering the educational affairs system, and then accurately obtain whether the user's operation behavior is abnormal.

[0107] Furthermore, the historical user click path set includes:

[0108] Record the click paths of the user from the time of logging into the educational affairs system to the time of logging out before the real time, and record them as historical click paths; when the number of the historical click paths is not less than the set path number threshold; construct a historical user click path set according to the historical click paths of the user;

[0109] When the number of the historical click paths is less than the set path number threshold; obtaining the historical click paths corresponding to all target position users and constructing a historical user click path set;

[0110] The position of the target position user is the same as the position of the user.

[0111] New or newly hired teachers and administrators of the teaching system log into the teaching system less frequently, which will lead to insufficient data in the corresponding historical user click path set, thereby affecting the judgment results of user operation behaviors. For users with less data, this step in this embodiment constructs a historical user click path set through the historical user click paths of users in the same position, thereby accurately obtaining the judgment results of user operation behaviors.

[0112] Furthermore, the abnormal interface operation monitoring includes:

[0113] Obtain the interface operation behavior of the user in each interface of the educational system; determine the category of the interface operation behavior based on the initial authority of the user; the category includes super-authority operation and non-super-authority operation; when the category is super-authority operation, determine the interface operation behavior as abnormal; otherwise, determine the interface operation behavior as normal; the super-authority operation is the interface operation behavior of the user that does not belong to the initial authority of the user.

[0114] This step of the present embodiment monitors the user's interface operations on each interface, and determines whether there is an over-authority operation based on the user's initial authority. This method can identify users who perform over-authority operations, providing a basis for subsequent determination of the current abnormal behavior level.

[0115] Reference Figure 1 , S50, obtaining the user's current abnormal behavior level based on the operation behavior and the current login abnormality level and issuing an early warning; S50 is applied to a current abnormal behavior level obtaining unit and an early warning unit of a computer network security prediction system based on big data analysis.

[0116] Furthermore, the step of obtaining the current abnormal behavior level includes:

[0117] According to the operation behavior of the user, an operation behavior abnormality value is obtained; when the operation behavior of the user is identified as abnormal, the operation behavior abnormality value is set to a fixed value ,and ; When it is identified that the operation behavior of the user is normal, the average of the K+1 maximum similarity values ​​obtained from this identification and the previous K consecutive identifications is taken as the abnormal value of the operation behavior;

[0118] The current abnormal value of the user is obtained according to the abnormal value of the operation behavior and the current login abnormal level, and the calculation formula is:

[0119] ;

[0120] in, Indicates the current abnormal behavior level; It is indicated as an abnormal value of operation behavior; Indicates the current login exception level; and They are respectively expressed as the operation behavior coefficient and the login abnormality coefficient, and The default value is 0.5, which can be changed according to the actual application;

[0121] Set multiple abnormal behavior thresholds , when the current abnormal value is less than When the current abnormal behavior level is level 1, the corresponding current abnormal value is within the range When the current abnormal behavior level is level 2, the corresponding abnormal value is level 2. Similarly, when the current abnormal value belongs to the interval When the current abnormal behavior level is greater than or equal to When , the corresponding current abnormal behavior level is p+1 level; the abnormal behavior threshold is obtained based on experience.

[0122] Furthermore, the current abnormal behavior level can be used to predict the impact of future user operations on the network security of the educational system. The higher the current abnormal behavior level of the user, the greater the threat to the network security of the educational system if the user continues to operate. Therefore, it is necessary to issue corresponding warnings based on the current abnormal behavior levels. This embodiment sets two abnormal behavior thresholds, and obtains three abnormal behavior levels based on the two abnormal behavior thresholds. Different abnormal behavior levels correspond to different warning methods, and refer to Table 3 for details.

[0123] Table 3 Reference table of warning methods of school A's teaching system

[0124]

[0125] Furthermore, if the current abnormal behavior level is level two, the educational affairs system will authenticate the user again based on the identity authentication method used during login; when the identity authentication fails M times, the current abnormal behavior level will be set to level three; if the current abnormal behavior level is level three, the educational affairs system will confirm the user's identity to the user and receive feedback from the user; when the user's feedback is that the user is not logged in, the corresponding login account will be forced to log out, and the real-time login information corresponding to the login account will be classified as the historical abnormal login information corresponding to the user, and the real-time IP address will be added to the abnormal IP address library; otherwise, the real-time login information corresponding to the login account will be classified as historical normal login information.

[0126] In this embodiment, it is obtained that the current abnormal behavior level of user 1 is level 1, and the current abnormal behavior level of user 2 is level 3, so user 1 is not warned, and identity verification of user 2 is performed again and the identity of user 2 is confirmed through email.

[0127] This step of the present embodiment combines the user's operation behavior and the current login abnormality level to obtain the operation behavior abnormality value and obtain the user's current abnormal behavior level. This method can accurately measure the security risks of different users' various behaviors to the educational system after logging into the educational system according to the user's specific behavior pattern and login situation, and issue a timely warning.

[0128] This embodiment also provides a computer-readable storage medium storing a computer program that can be loaded by a processor and execute the above-mentioned computer network security prediction method based on big data analysis.

[0129] Furthermore, the computer storage readable medium includes: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and other media that can store program codes.

[0130] Embodiment 2

[0131] In the first embodiment, the method of the present invention is combined with the system to realize the prediction of the network security of the teaching system. In the embodiment of the present application, the method of the present invention will be described again, and the specific implementation process includes:

[0132] According to the login account entered by the user in the login interface of the educational system, the identity information, real-time login information and historical login information corresponding to the user are obtained.

[0133] Furthermore, the identity information, real-time login information and historical login information corresponding to the user include:

[0134] The identity information includes the user's name, position and initial authority; the real-time login information includes the real-time time, real-time IP address and real-time login device of the user logging into the educational system; the positions include teachers, students and educational system administrators;

[0135] The historical login information includes the login information corresponding to each time the user logged into the academic affairs system and passed the identity authentication before the real-time time; the historical login information includes historical normal login information and historical abnormal login information; the login information in the historical login information includes the login time, IP address, login device and login abnormality level.

[0136] The current login abnormality level of the user is obtained according to the identity information, the real-time login information and the historical login information.

[0137] Furthermore, the process of obtaining the current login abnormality level of the user includes:

[0138] Obtaining the real-time IP address in the real-time login information and determining whether the real-time IP address is an abnormal IP address, the specific process includes:

[0139] Compare the real-time IP address with the IP addresses in the abnormal IP address library stored in the educational system; when the real-time IP address belongs to the abnormal IP address library, determine that the real-time IP address is an abnormal IP address; otherwise, determine that the real-time IP address is not an abnormal IP address;

[0140] When the IP address is an abnormal IP address, the user's login is not allowed;

[0141] Otherwise, obtaining the historical login information corresponding to the user; when the number of the historical login information is not less than a set first threshold, constructing a historical login information set according to the historical login information of the user;

[0142] When the number of the historical login information is less than a set first threshold, the historical login information of all users with the same position as the user is obtained to construct a historical login information set;

[0143] Obtain the login information similarity between the real-time login information and each piece of the historical login information in the historical login information set; obtain the real-time login anomaly value based on the login information similarity, the number of login requests and the number of login failures within a set time period; obtain the current login anomaly level corresponding to the user based on the real-time login anomaly value.

[0144] The user's identity is authenticated according to the current login abnormality level.

[0145] When the identity verification is passed, monitoring the user's operation behavior in the educational affairs system;

[0146] Furthermore, monitoring the user's operation behavior in the educational system includes abnormal click path monitoring and abnormal interface operation monitoring:

[0147] When the user's click path is abnormal and / or the interface operation is abnormal, the user's operation behavior is judged to be abnormal; the process of clicking path abnormality monitoring is:

[0148] After passing the identity authentication, the user records the pages clicked in the education system in chronological order and the click times, and constructs an education system click set;

[0149] A real-time click path is obtained according to the educational system click set; the real-time click path includes a plurality of path nodes, and the plurality of path nodes are sequentially connected; the first path node is the first clicked page in the educational system click set; the second path node is the second clicked page in the educational system click set; and so on, the last path node is the last clicked page in the educational system click set; the path length of two adjacent path nodes is the click time difference between the pages corresponding to the two path nodes;

[0150] The real-time click path is adjusted, specifically comprising: when the path length of two adjacent path nodes is less than a set threshold, deleting the previous path node of the two adjacent path nodes;

[0151] The educational system click set is updated in real time; the real-time click path and the educational system click set are updated synchronously; after the user passes the identity authentication, the real-time click path of the user is identified at intervals T to determine whether the click path of the user is abnormal. The specific steps include:

[0152] Obtain a historical user click path set corresponding to the user; the historical user click path set includes multiple historical click paths; calculate the similarity between the real-time click path identified each time and each of the historical click paths, and obtain the maximum similarity; the value range of the similarity is [0, 1];

[0153] When the maximum similarity value obtained by the i-th recognition is less than the set similarity threshold, and the K maximum similarity values ​​obtained by the K consecutive recognitions before the i-th recognition are all less than the set similarity threshold, it is judged that the operation behavior of the user obtained by the i-th recognition is abnormal; otherwise, it is judged that the operation behavior of the user is normal.

[0154] Furthermore, the historical user click path set includes:

[0155] Record the click path of the user from each login to the academic affairs system to each logout before the real time, and record it as the historical click path; when the number of the historical click paths is not less than the set path number threshold; construct a historical user click path set based on the historical click paths of the user; when the number of the historical click paths is less than the set path number threshold; obtain the historical click paths corresponding to all target position users, and construct a historical user click path set; the position of the target position user is the same as the position of the user.

[0156] Furthermore, the abnormal interface operation monitoring includes:

[0157] Obtain the interface operation behavior of the user in each interface of the educational system; determine the category of the interface operation behavior based on the initial authority of the user; the category includes super-authority operation and non-super-authority operation; when the category is super-authority operation, determine the interface operation behavior as abnormal; otherwise, determine the interface operation behavior as normal.

[0158] Obtaining the user's current abnormal behavior level according to the operation behavior and the current login abnormality level;

[0159] Furthermore, the step of obtaining the current abnormal behavior level includes:

[0160] According to the operation behavior of the user, an operation behavior abnormality value is obtained; when the operation behavior of the user is identified as abnormal, the operation behavior abnormality value is set to a fixed value ,and ; When it is identified that the operation behavior of the user is normal, the average of the K+1 maximum similarity values ​​obtained from this identification and the previous K consecutive identifications is taken as the abnormal value of the operation behavior;

[0161] The user's current abnormal behavior level is obtained based on the operation behavior abnormal value and the current login abnormal level, and an early warning is issued.

[0162] This embodiment judges the current login abnormality level for the user who is about to log in to the educational affairs system, obtains the user's real-time login information, and compares the real-time login information with the historical login information, including login time comparison, IP address comparison and login device comparison, and combines the historical login abnormality level corresponding to the historical login information to obtain the current login abnormality level. This method can accurately judge the current login abnormality level when the user logs in to the educational affairs system in combination with various information logged in by the user. This embodiment monitors the click path abnormality and interface operation abnormality for the user's behavior after successful identity authentication, obtains the click path through the interface clicked by the user and the time of stay, and compares the click path with the historical click path at fixed intervals to determine whether the user's click path is abnormal. At the same time, monitor the user's interface operation on each interface to determine whether there is an interface operation abnormality. This method can combine the user's various behaviors after entering the educational affairs system, and then accurately obtain whether the user's operation behavior is abnormal. This embodiment combines the user's operation behavior and the current login abnormality level to obtain the operation behavior abnormality value, and obtains the user's current abnormal behavior level. This method can accurately measure the security risks of different users' various behaviors to the educational affairs system after logging in to the educational affairs system according to the user's specific behavior pattern and login situation.

[0163] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A computer network security prediction method based on big data analysis, characterized in that: include: According to the login account entered by the user on the login interface of the educational system, the identity information, real-time login information and historical login information corresponding to the user are obtained; The identity information includes position; The current login abnormality level of the user is obtained according to the identity information, the real-time login information and the historical login information, and the obtaining process includes: Obtaining the real-time IP address in the real-time login information, and determining whether the real-time IP address is an abnormal IP address; When the real-time IP address is an abnormal IP address, the user's login is not allowed; Otherwise, obtaining the historical login information corresponding to the user; when the number of the historical login information is not less than a set first threshold, constructing a historical login information set according to the historical login information of the user; When the number of the historical login information is less than a set first threshold, the historical login information of all users with the same position as the user is obtained to construct a historical login information set; Obtaining the login information similarity between the real-time login information and each piece of the historical login information in the historical login information set, and determining the current login abnormality level corresponding to the user in combination with the number of login requests and the number of login failures within a set time period; authenticating the user according to the current login abnormality level; When the identity authentication is passed, monitoring the user's operation behavior in the educational affairs system; The user's current abnormal behavior level is obtained based on the operation behavior and the current login abnormality level and an early warning is issued.

2. A computer network security prediction method based on big data analysis according to claim 1, characterized in that: The user's corresponding identity information, real-time login information and historical login information include: The identity information also includes the user's name and initial authority; the real-time login information includes the real-time time, real-time IP address and real-time login device of the user logging into the educational system; the positions include teachers, students and educational system administrators; The historical login information includes the login information corresponding to each time the user logged into the educational system and passed the identity authentication before the real-time time; the historical login information includes historical normal login information and historical abnormal login information; the login information in the historical login information includes the login time, IP address, login device and login abnormality level.

3. A computer network security prediction method based on big data analysis according to claim 2, characterized in that: Monitoring the user's operation behavior in the educational system includes abnormal click path monitoring and abnormal interface operation monitoring: When the user's click path is abnormal and / or the interface operation is abnormal, the user's operation behavior is judged to be abnormal; the process of clicking path abnormality monitoring is as follows: After passing the identity authentication, the user records the pages clicked in the education system in chronological order and the time of the clicks, and constructs an education system click set; The real-time click path is obtained according to the educational system click set; the educational system click set is updated in real time; the real-time click path and the educational system click set are updated synchronously; after the user passes the identity authentication, the real-time click path of the user is identified at intervals T to determine whether the click path of the user is abnormal. The specific steps include: Obtain a historical user click path set corresponding to the user; the historical user click path set includes multiple historical click paths; calculate the similarity between the real-time click path identified each time and each of the historical click paths, and obtain the maximum similarity; the value range of the similarity is [0, 1]; When the maximum similarity value obtained in the i-th recognition is less than the set similarity threshold, and the K maximum similarity values ​​obtained in the K consecutive recognitions before the i-th recognition are all less than the set similarity threshold, it is judged that the click path of the user obtained in the i-th recognition is abnormal; otherwise, it is judged that the click path of the user is normal.

4. A computer network security prediction method based on big data analysis according to claim 3, characterized in that: The historical user click path set includes: Record the click paths of the user from the time of logging into the educational affairs system to the time of logging out before the real time, and record them as historical click paths; when the number of the historical click paths is not less than the set path number threshold; construct a historical user click path set according to the historical click paths of the user; When the number of the historical click paths is less than the set path number threshold; obtaining the historical click paths corresponding to all target position users and constructing a historical user click path set; The position of the target position user is the same as the position of the user.

5. A computer network security prediction method based on big data analysis according to claim 3, characterized in that: The interface operation abnormality monitoring includes: Obtain the interface operation behavior of the user in each interface of the educational system; determine the category of the interface operation behavior based on the initial authority of the user; the category includes super-authority operation and non-super-authority operation; when the category is super-authority operation, determine the interface operation behavior as abnormal; otherwise, determine the interface operation behavior as normal.

6. A computer network security prediction method based on big data analysis according to claim 3, characterized in that: The step of obtaining the current abnormal behavior level includes: According to the operation behavior of the user, an operation behavior abnormality value is obtained; when the operation behavior of the user is identified as abnormal, the operation behavior abnormality value is set to a fixed value ,and ; When it is identified that the operation behavior of the user is normal, the average of the maximum similarities obtained from this identification and K+1 consecutive identifications before this is taken as the abnormal value of the operation behavior; The user's current abnormal behavior level is obtained according to the operation behavior abnormal value and the current login abnormal level.

7. A computer network security prediction system based on big data analysis, characterized in that: include: The first information acquisition unit is used to acquire the login account entered by the user in the login interface of the educational affairs system; The second information acquisition unit is used to acquire the identity information, real-time login information and historical login information corresponding to the user according to the login account entered by the user in the login interface of the educational affairs system; the identity information includes the position; A current login abnormality level acquisition unit: used to acquire the current login abnormality level of the user according to the identity information, the real-time login information and the historical login information; Identity verification unit: used for verifying the identity of the user according to the current login abnormality level; Operation behavior monitoring unit: when the identity authentication is passed, monitoring the operation behavior of the user; A current abnormal behavior level acquisition unit: acquires the user's current abnormal behavior level according to the operation behavior and the current login abnormal level; The process of obtaining the current login abnormality level includes: Obtaining the real-time IP address in the real-time login information, and determining whether the real-time IP address is an abnormal IP address; When the real-time IP address is an abnormal IP address, the user's login is not allowed; Otherwise, obtaining the historical login information corresponding to the user; when the number of the historical login information is not less than a set first threshold, constructing a historical login information set according to the historical login information of the user; When the number of the historical login information is less than a set first threshold, the historical login information of all users with the same position as the user is obtained to construct a historical login information set; Obtain the login information similarity between the real-time login information and each piece of the historical login information in the historical login information set, and determine the current login abnormality level corresponding to the user based on the number of login requests and the number of login failures within a set time period. Early warning unit: used to issue an early warning based on the current abnormal behavior level.

8. A computer network security prediction system based on big data analysis according to claim 7, characterized in that: The user's corresponding identity information, real-time login information and historical login information include: The identity information also includes the user's name and initial authority; the real-time login information includes the real-time time, real-time IP address and real-time login device of the user logging into the educational system; the positions include teachers, students and educational system administrators; The historical login information includes the login information corresponding to each time the user logged into the academic affairs system and passed the identity authentication before the real-time time; the historical login information includes historical normal login information and historical abnormal login information; the login information in the historical login information includes the login time, IP address, login device and login abnormality level.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images