Computer network information security management method, system and electronic equipment

Abstract

The present invention relates to the field of data processing technology, and specifically to a computer network information security management method, system and electronic device, including: obtaining the historical access data of each account, the usage time of each function in each project, the usage time of each function in each day, and the current access data of each account currently accessing the system, obtaining the initial access abnormality of each account currently accessing the system at each abnormality detection, obtaining the abnormal access manifestation degree of each account currently accessing the system under each function at each abnormality detection, and then obtaining the final abnormal manifestation degree of each account currently accessing the system at each abnormality detection; obtaining the account to be verified. The present invention aims to solve the problem that when judging whether the account currently accessing is an abnormal access based on the historical access data, some accounts with normal access will be identified as accounts with abnormal access.

Description

Technical Field

[0001] The present invention relates to the technical field of data processing, and in particular to a computer network information security management method, system and electronic equipment. Background Art

[0002] Computer network information security management refers to a series of technical and management measures to ensure that computer networks and the information resources therein can operate safely, reliably and continuously, and to prevent information from being illegally accessed, tampered with or leaked; among them, secondary verification of accounts accessing the system is part of computer network information security management.

[0003] When performing secondary verification on accounts accessing the system, the behavior data of the account currently accessing the system is compared with the historical access data of the account to obtain the abnormality of the account currently accessing the system and determine whether to perform secondary verification on the account currently accessing the system. This method ignores the fact that when an enterprise is operating under emergency conditions, the current behavior of some accounts may be different from their historical behavior. As a result, the existing method will treat some accounts with normal access as abnormal access and perform secondary verification on some accounts with normal access, which reduces the verification efficiency of the computer network information security management platform. Summary of the invention

[0004] The present invention provides a computer network information security management method, system and electronic equipment to solve the existing problem that the traditional method performs secondary verification on all data, resulting in low verification efficiency.

[0005] A computer network information security management method, system and electronic device of the present invention adopt the following technical solutions:

[0006] The present invention proposes a computer network information security management method, which comprises the following steps:

[0007] Obtain the historical access data of each account, the usage time of each function of each account in each project, the usage time of each function of each account on each day, and the current access data of each account currently accessing the system. The historical access data of each account includes the login time, login IP address, and usage time of each function after login when the account logs into the system once; the current access data of each account currently accessing the system includes the login time, login IP address, and usage time of each function after login when the account currently accessing the system logs into the system for the last time;

[0008] According to the historical access data of each account and the current access data of each account currently accessing the system, the initial access abnormality degree of each account currently accessing the system at each abnormality detection is obtained, wherein each abnormality detection is to perform an abnormality detection on the account currently accessing the system at a fixed time interval;

[0009] Based on the usage time of each function by each account every day, the initial importance of each account to each function and the trend change degree of each account to each function are obtained, and then the final importance of each account to each function is obtained; combined with the initial access abnormality of each account accessing the system at each abnormal detection, the abnormal access manifestation degree of each account accessing the system under each function at each abnormal detection is obtained;

[0010] According to the usage time of each account for each function in each project, the final relevance of each account to another account regarding a function is obtained;

[0011] Based on the final correlation of each account to another account regarding each function and the abnormal access manifestation degree of each account accessing the system under each function during each abnormal detection, the final abnormal manifestation degree of each account accessing the system during each abnormal detection is obtained, and then the account to be verified is obtained, and abnormal verification is performed.

[0012] Furthermore, the initial access abnormality degree of each account currently accessing the system at each abnormality detection is obtained based on the historical access data of each account and the current access data of each account currently accessing the system, including the specific method of:

[0013] Login time, login IP, and before and after login The usage time of each function within minutes is used as the dimension of the multidimensional coordinate system to obtain a multidimensional coordinate system, in which Indicates the detection interval, Indicates that an account that is accessing the system is being The rank value of the anomaly detection;

[0014] The first All historical access data of the account currently accessing the system are mapped into a multi-dimensional coordinate system to obtain multiple historical access data points;

[0015] The first The current access data of the account currently accessing the system is mapped into a multi-dimensional coordinate system to obtain a current access data point;

[0016] Jordi If the login IP of the historical access data point is different from the login IP of the current access data point, then The distance between the historical access data and the current access data point in the login IP dimension is 1; if If the login IP address of the historical access data point is the same as the login IP address of the current access data point, then The distance between the historical access data point and the current access data point in the login IP dimension is 0;

[0017] Get the The account currently accessing the system is in The specific calculation formula for the initial access abnormality during the first abnormal detection is as follows:

[0018]

[0019] In the formula, Indicates The account currently accessing the system is in The initial access abnormality during the anomaly detection, Indicates The number of historical access data of accounts currently accessing the system, Indicates the number of dimensions in the multidimensional coordinate system. Represents the first The historical access data point and the current access data point are the same outside the non-login IP dimension. The distance in dimensions, Indicates The distance between the historical access data point and the current access data point in the login IP dimension, Represents the sigmoid function.

[0020] Furthermore, the method of obtaining the initial importance of each account to each function and the trend change degree of each account to each function according to the usage time of each account for each function in each day includes the following specific methods:

[0021] Calculate the Accounts to The formula for the initial importance of a function is as follows:

[0022]

[0023] In the formula, Indicates Accounts to The initial importance of each function, Indicates the preset number of days for collection. Indicates the time before the current time Tianzhongdi The usage time of each function, Indicates the time before the current time Tianzhongdi Accounts to The usage time of each function, represents the weight normalization function, represents the symbolic function, To prevent hyperparameters with denominators equal to zero, Indicates the time before the current time The ordinal value of the day;

[0024] like ,Will Recorded as the first Tianzhongdi Accounts to The initial importance of each function;

[0025] The horizontal axis is the number of days from the current time, and the vertical axis is the Accounts to The initial importance of each function is used to obtain a two-dimensional coordinate system;

[0026] All days before the current time Accounts to The initial importance of each function is mapped into a two-dimensional coordinate system to obtain multiple importance data points; a straight line is obtained by linear fitting the importance data points in the two-dimensional coordinate system, and the fitting slope of the straight line is recorded as Accounts to The trend change degree of a function.

[0027] Furthermore, the specific method of obtaining the final importance of each account to each function includes:

[0028]

[0029] In the formula, Indicates Accounts to The ultimate importance of each function, Indicates Accounts to The initial importance of each function, Indicates Accounts to The trend change of each function, is an exponential function with a natural constant as its base.

[0030] Furthermore, the specific method of obtaining the abnormal access manifestation degree of each account accessing the system under each function during each abnormal detection includes:

[0031]

[0032] In the formula, Indicates The account currently accessing the system is in The first anomaly detection is The abnormal access performance under each function, Indicates The account currently accessing the system The initial abnormality, Indicates The account currently accessing the system is The ultimate importance of each function, Represents the sigmoid function.

[0033] Furthermore, the method of obtaining the final relevance of each account to another account regarding a function according to the usage time of each account for each function in each project includes the following specific methods:

[0034]

[0035] In the formula, Indicates account number For account About The final relevance of the functions, Indicates account number With account All used The number of items with each function, Indicates account number With account All used Function The end time of the project, Indicates account number With account All used Function Accounts in the project For The usage time of each function, Indicates account number With account All used Function Accounts in the project For Function usage time, is an exponential function with a natural constant as base, represents the weight normalization function.

[0036] Furthermore, the method of obtaining the final abnormality manifestation degree of each account accessing the system at each abnormality detection according to the final correlation of each account to another account with respect to each function and the abnormal access manifestation degree of each account accessing the system under each function at each abnormality detection includes the following specific methods:

[0037]

[0038] In the formula, Indicates The account currently accessing the system is in The first anomaly detection is The abnormal performance of each function, Indicates The account currently accessing the system is in The first anomaly detection is The degree of abnormal access under each function, Indicates that for Accounts currently accessing the system About The number of accounts accessing the system among the accounts whose final relevance of the function is less than 1. Indicates that for Accounts currently accessing the system About The number of accounts whose final relevance of each function is less than 1, Indicates that for Accounts currently accessing the system About The sum of the final relevance of all accounts accessing the system whose final relevance of the functions is less than 1, Indicates that for Accounts currently accessing the system About The sum of the final relevance of all accounts whose final relevance of the functions is less than 1, To prevent hyperparameters with denominators equal to zero, To prevent hyperparameters with denominators equal to 0;

[0039] Based on the abnormal performance degree of each account accessing the system under each function at each anomaly detection, the access duration of each account accessing the system at each anomaly detection, and the number of other accounts accessing the system during the current access of each account accessing the system, the final abnormal performance degree of each account accessing the system at each anomaly detection is obtained.

[0040] Furthermore, the method of obtaining the final abnormal manifestation degree of each account currently accessing the system at each abnormal detection according to the abnormal manifestation degree of each account currently accessing the system under each function at each abnormal detection, the access duration of each account currently accessing the system at each abnormal detection, and the number of other accounts currently accessing the system during the current access of each account currently accessing the system includes the following specific methods:

[0041]

[0042] In the formula, Indicates The account currently accessing the system is in The final abnormality manifestation degree during the abnormality detection, Indicates The number of other accounts that are accessing the system during the current access to the system. Indicates The accounts currently accessing the system are listed in the front Use the first The duration of a function, Indicates the preset sampling interval, Indicates the number of functions included in the system. Indicates The order value of the anomaly detection, Indicates The account currently accessing the system is in The first anomaly detection is The abnormal performance of each function, represents the weight normalization function, Represents the sigmoid function.

[0043] The present invention also proposes a computer network information security management electronic device, the device comprising:

[0044] A data collection module, a data processing module and a verification module; wherein the data collection module is used to collect the historical access data of each account and the current access data of the account being accessed, the data processing module obtains abnormal accounts by calling a computer program to implement the steps of a computer network information security management method, and the verification module verifies the abnormal accounts.

[0045] The present invention also proposes a computer network information security management, including a memory, a processor, and a computer program stored in the memory and running on the processor, and the processor executes the computer program to implement the steps of the above method.

[0046] The beneficial effects of the technical solution of the present invention are as follows: based on the feature that the job responsibilities of an employee in an enterprise will not change frequently, based on the difference between the current access data and the historical access data of each employee, the present invention obtains the initial abnormality degree of each employee, so that the initial abnormality degree of each employee reflects the difference between the historical access data when the employee logs into the system this time; based on the feature that the longer an account uses a function, the more important the account is to the function, that is, the greater the possibility that the account works overtime on the function, according to the importance of each account to each function, the initial access abnormality degree of each account accessing the system at each abnormality detection is corrected, and the abnormal access manifestation degree of each account accessing the system under each function at each abnormality detection is obtained, so that the abnormal access manifestation degree of the account with a greater possibility of overtime is smaller; according to the use time of an account for a function in each day, a weight is given to the abnormal manifestation degree of each account accessing the system under each function, so that the weight of the function with a longer use time is larger, so that the final abnormal manifestation degree of each account accessing the system at each abnormality detection is more credible; and an accurate abnormal access account is obtained. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0048] Figure 1 The present invention is a flowchart of the steps of a computer network information security management method, system and electronic equipment. DETAILED DESCRIPTION

[0049] In order to further explain the technical means and effects adopted by the present invention to achieve the predetermined invention purpose, the following is a detailed description of a computer network information security management method, system and electronic device proposed by the present invention, its specific implementation method, structure, features and effects, in combination with the accompanying drawings and preferred embodiments. In the following description, different "one embodiment" or "another embodiment" does not necessarily refer to the same embodiment. In addition, specific features, structures or characteristics in one or more embodiments may be combined in any suitable form.

[0050] Unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs.

[0051] The following is a detailed description of a computer network information security management method, system and electronic device provided by the present invention in conjunction with the accompanying drawings.

[0052] See also Figure 1 , which shows a flowchart of a method for computer network information security management provided by an embodiment of the present invention, the method comprising the following steps:

[0053] Step S001: Obtain the historical access data of each account, the usage time of each account for each function in each project, the usage time of each account for each function in each day, and the current access data of each account currently accessing the system.

[0054] Specifically, through the system background, get the current time before The login time, login IP address, and usage time of each function after login of each account in the day are collected to obtain the historical access data sequence of each account. The historical access data of an account includes the login time, login IP address, and usage time of each function after login of the account. The collection days preset in this embodiment , this is used as an example for description, and other values ​​may be set in other implementation modes.

[0055] Furthermore, through the system background, the login time, login IP, and usage time of each function after login of the account currently accessing the system are obtained; the current access data of the account currently accessing the system is obtained. Among them, the current access data of the account currently accessing the account system includes the login time, login IP, and usage time of each function after login of the account. Among them, every The detection interval preset in this embodiment is , this is used as an example for description, and other values ​​may be set in other implementation modes.

[0056] Furthermore, through the system background, obtain the time before the current time The usage time of each function in each project for each account within a day, and the usage time of each function for each account within a day.

[0057] Step S002: According to the historical access data of each account and the current access data of each account currently accessing the system, the initial access abnormality degree of each account currently accessing the system at each abnormality detection is obtained.

[0058] Specifically, according to The historical access data and current access data of the account currently accessing the system are obtained. The account currently accessing the system is in The method for obtaining the initial access abnormality during abnormal detection is as follows:

[0059] Furthermore, the login time, login IP, and the time before and after login are used. The usage time of each function within a minute is used as the dimension of the multidimensional coordinate system to obtain a multidimensional coordinate system. Map all historical access data of the account currently accessing the system into a multidimensional coordinate system to obtain multiple historical access data points. The current access data of the account currently accessing the system is mapped into the multidimensional coordinate system to obtain a current access data point. If the login IP of the historical access data point is different from the login IP of the current access data point, then The distance between the historical access data and the current access data point in the login IP dimension is 1; if the If the login IP address of the historical access data point is the same as the login IP address of the current access data point, then The distance between the historical access data point and the current access data point in the login IP dimension is 0. Indicates the preset detection interval, Indicates that an account that is accessing the system is being The ordinal value of the anomaly detection.

[0060] Further, get the The account currently accessing the system is in The specific calculation formula for the initial access abnormality during the first abnormal detection is as follows:

[0061]

[0062] In the formula, Indicates The account currently accessing the system is in The initial access abnormality during the anomaly detection, Indicates The number of historical access data of accounts currently accessing the system, Indicates the number of dimensions in the multidimensional coordinate system. Represents the first The historical access data point and the current access data point are the same outside the non-login IP dimension. The distance in dimensions, Indicates The distance between the historical access data point and the current access data point in the login IP dimension, represents a sigmoid function, which is used for normalization processing in this embodiment.

[0063] It should be noted that The larger the value, the greater the Euclidean distance is. The greater the difference, the greater the Euclidean distance is. The greater the difference between the performance of the account currently accessing the system and its historical performance, the greater the difference between the performance of the account currently accessing the system and its historical performance. The more accounts that are accessing the system, the more likely they are to make abnormal accesses. The larger the value of .

[0064] At this point, the initial access abnormality degree of each account accessing the system at each abnormality detection is obtained.

[0065] Step S003: According to the usage time of each account for each function in each day, the initial importance of each account to each function and the trend change degree of each account to each function are obtained, and then the final importance of each account to each function is obtained; combined with the initial access abnormality of each account accessing the system at each abnormal detection, the abnormal access manifestation degree of each account accessing the system under each function at each abnormal detection is obtained;

[0066] It should be noted that when the enterprise is operating under normal conditions, the initial abnormality of the account accessing the system is relatively small; however, the enterprise may also have emergency operating conditions. For example, under normal circumstances, some department accounts are logged in and used during the day. However, when the enterprise needs to perform emergency overtime on some functions, some accounts will be logged in at night. Because it is an emergency overtime, the operation after the user logs in to the account is also quite different from the historical operation after the user previously logged in to the system, which makes the initial access abnormality of some accounts that normally access the system larger. Therefore, the initial access abnormality of the account accessing the system is corrected.

[0067] It should be further explained that when an enterprise needs to work overtime on a function, accounts that are more proficient in the function are given priority to work overtime, thereby obtaining the importance of each account to each function.

[0068] It should be further explained that the longer an account uses a function, the more proficient the account is in the function, that is, the greater the importance of the function to the account. Therefore, the importance of each account to each function is calculated on each day based on the importance of each account using each function on each day. Since the importance calculated on days closer to the current time is more reliable, when calculating the final importance of each account to each function, different weights are assigned to the importance of the same function to accounts on different days.

[0069] It should be further explained that the work content of each employee in the company will be adjusted dynamically. Therefore, according to the changing trend of the importance of an account to a function over multiple days, it is judged whether the account is becoming more or less important to the function. Therefore, the changing trend of the importance of an account to a function is obtained, and the final importance of each account to each function is obtained.

[0070] It should be further explained that when an account accesses the system, it may access multiple functions in the system in sequence. Therefore, according to the final importance of each account to each function, the abnormal access manifestation degree of each account accessing the system under each function is obtained.

[0071] Specifically, calculate Accounts to The formula for the initial importance of a function is as follows:

[0072]

[0073] In the formula, Indicates Accounts to The initial importance of each function, Indicates the preset number of days for collection. Indicates the time before the current time Tianzhongdi The usage time of each function, Indicates the time before the current time Tianzhongdi Accounts to The usage time of each function, Indicates the time before the current time The ordinal value of the day, Represents the weight normalization function, whose input object is the first The usage time of each function ; Represents a sign function, when the input is 0, the output is 0, when the input is a positive number, the output is 1; To prevent the hyperparameter from having a denominator of 0. , can be set to other values ​​in other implementations.

[0074] It should be noted that when the enterprise Tianzhong Duidi If a function is used, ,at this time , , the hyperparameters are not correct Make an impact; when the enterprise is in the No. 1 in the sky If you use a function, , , , to prevent the denominator from being 0, then , the hyperparameters are not correct Make an impact; The larger the value, the more Tianzhongdi Accounts to The longer the function is used, the more Accounts to The more important the function is; Indicates the time before the current time Tianzhongdi Accounts to The importance of each function to the Accounts to The impact of the initial importance of each function, The closer the day is to the current time, the The larger the value of; In order to make the enterprise Tianzhong did not When the function is used, the time before the current time Tianzhongdi Accounts to The importance of each function to the Accounts to The initial importance of each function is set to a weight of 0.

[0075] Furthermore, if ,Will Recorded as the first Tianzhongdi Accounts to The horizontal axis is the number of days from the current time, and the vertical axis is the number of days from the current time. Accounts to The starting importance of each function is used to obtain a two-dimensional coordinate system. Accounts to The initial importance of each function is mapped into a two-dimensional coordinate system to obtain multiple importance data points. The least squares method is used to perform a straight line fit on the importance data points in the two-dimensional coordinate system to obtain a straight line. The fitting slope of the straight line is recorded as Accounts to The least square method is a well-known technology and will not be described in detail in this embodiment.

[0076] Further, get the Accounts to The specific calculation formula for the final importance of each function is as follows:

[0077]

[0078] In the formula, Indicates Accounts to The ultimate importance of each function, Indicates Accounts to The initial importance of each function, Indicates Accounts to The trend change of each function, is an exponential function with a natural constant as the base. The model shows an inverse proportional relationship. As the input of the model, the implementer can set the inverse proportional function according to the actual situation.

[0079] All that is explained is that due to obtaining the Accounts to When the trend change of a function is shown, the horizontal axis of the two-dimensional coordinate system is the number of days from the current time, that is, the number of days before the current time. Tianzhongdi Accounts to The horizontal axis of the initial importance of each function is , so that when The larger the value, the closer it is to the current time. Accounts to The greater the decrease in the initial importance of each function; The smaller the value, the closer it is to the current time. Accounts to The greater the initial importance of each function, the greater the growth rate. For Accounts to Adjust the initial importance of each function; The larger the value of Accounts to The more important the function.

[0080] Further, get the The account currently accessing the system is in The first anomaly detection is The calculation formula for the abnormal access manifestation degree under each function is as follows:

[0081]

[0082] In the formula, Indicates The account currently accessing the system is in The first anomaly detection is The abnormal access performance under each function, Indicates The account currently accessing the system The initial abnormality, Indicates The account currently accessing the system is The ultimate importance of each function, represents a sigmoid function, which is used for normalization processing in this embodiment.

[0083] It should be noted that The larger the value, the The account currently accessing the system is The greater the final importance of a function, the more important it is to use the When the function is working overtime, select The more likely the account accessing the system is to work overtime, the more likely the The lower the probability of abnormal access by the account currently accessing the system, the lower the probability of abnormal access by the account currently accessing the system. The smaller the value of .

[0084] At this point, the abnormal access performance of each account accessing the system under each function during each abnormal detection is obtained.

[0085] Step S004: According to the usage time of each account for each function in each project, the final association of each account with another account regarding a function is obtained.

[0086] It should be noted that when an enterprise is working overtime, the amount of tasks that need to be completed may be relatively large, so that only employees with more important functions cannot complete the overtime tasks on time. Therefore, the enterprise will also let employees with less important functions work overtime. Since some accounts working overtime are less important to the functions, the abnormal access manifestation of some accounts that normally access the system is relatively large. Therefore, the abnormal access manifestation of each account accessing the system under each function will continue to be corrected.

[0087] It should be further explained that when an enterprise performs overtime work, it will complete the overtime task as soon as possible, so that both users with a high possibility of overtime and users with a low possibility of overtime work overtime, and when selecting overtime users, users with a high possibility of overtime, that is, users with more important functions, are given priority to work overtime. Therefore, the possibility of another user working overtime when one user works overtime is obtained based on historical access data, that is, the final correlation of one account to another account regarding a function.

[0088] It should be further explained that, since the enterprise divides its employees into several parts during operation, and each part is responsible for a project, when an employee in charge of a function in a part works overtime, other employees in charge of the function in the part are also likely to work overtime. Therefore, the final relevance of one account to another account regarding a function is calculated based on the usage time of the same function by different accounts in a project.

[0089] It should be further explained that due to the account in a project For account About the function The relevance reflects the need for the function in this project. To work overtime, then when the account When working overtime, the account There is also the possibility of overtime. Use the function The longer the time, the more accounts in the project For the function The more important it is, the more functions are needed in this project. When working overtime, select the account Therefore, according to the employees in the same project With employees The usage time of the same function is used to calculate the relevance of one account to another account in a project regarding a function.

[0090] It should be further explained that, as the enterprise is running, it will constantly end old projects and start new projects, which may cause the accounts in multiple projects to With account There is a correlation with the same function. Therefore, according to the account number in all projects With account About the relevance of a function, get the account With account Regarding the relevance of a function. Since the closer the end time of a project is, the more reliable the relevance of the project is. Therefore, according to the end time of each project, the weight of the relevance obtained under each project on the final relevance is given, and the account number is obtained. For account About the ultimate relevance of each function.

[0091] Specifically, get the account For account About the function The final correlation is calculated as follows:

[0092]

[0093] In the formula, Indicates account number For account About The final relevance of the functions, Indicates account number With account All used The number of items with each function, Indicates account number With account All used Function The end time of the project, Indicates account number With account All used Function Accounts in the project For The usage time of each function, Indicates account number With account All used Function Accounts in the project For the function Use time, is an exponential function with a natural constant as the base. model to prevent the output from being negative, is the input of the model; Represents the weight normalization function, whose input object is the account number With account All used The end time of each item of each function.

[0094] It should be noted that The larger the value, the higher the account With account All used Function The end time of the project is closest to the current time, so Account For account About The greater the influence weight of the final relevance of a function; , indicating that in the account With account All used Function Projects, Account Use the function The time is greater than the account Use The time of the function, that is, in the account With account All used Function Accounts in the project For The importance of a function is greater than the account For The importance of a function, that is, the need to Select an account when working overtime The possibility of working overtime is greater than choosing an account The possibility of overtime work further explains when the account About When a function is working overtime, the account There is a high possibility that it is also about Functions to work overtime; The larger the value, the more Use When a function is working overtime, the account Also use The greater the possibility that a function will be worked on overtime.

[0095] At this point, the final association of each account with another account regarding each function is obtained.

[0096] Step S005: Based on the final correlation of each account to another account regarding each function and the abnormal access manifestation degree of each account currently accessing the system under each function during each abnormal detection, the final abnormal manifestation degree of each account currently accessing the system during each abnormal detection is obtained, and then the account to be verified is obtained, and abnormal verification is performed.

[0097] It should be noted that, through the final correlation of each account with another account on each function, the abnormal access manifestation degree of each account accessing the system under each function is adjusted at each abnormal detection. For account About the function The greater the value of the final correlation is than 1, the more Use the function When working overtime, the account Also use the function The greater the possibility of overtime work. When accessing the system, the account For other accounts about the function Are the accounts with a final correlation greater than 1 also in the account The system is also accessed during the access process. The abnormal access performance of each account accessing the system under each function is adjusted during each abnormal detection, and the first The account currently accessing the system is in The first anomaly detection is The abnormal performance of each function.

[0098] It should be further explained that the longer a function is used, the more reliable the access anomaly degree obtained under this function is. Therefore, when the final access anomaly degree of each account currently accessing the system is obtained by using multiple access anomaly degrees of each account currently accessing the system, the weight of the impact of each access anomaly degree on the final access anomaly is assigned according to the access time of the function corresponding to each access anomaly degree.

[0099] It should be further explained that when an enterprise works overtime, it completes the overtime task as quickly as possible, resulting in either a short overtime time for one account or a long overtime time for multiple accounts at the same time. Therefore, considering the time factor, the final access anomaly degree of each account accessing the system is obtained during each anomaly detection.

[0100] Specifically, get the The account currently accessing the system is in The calculation formula for abnormal performance under each function is as follows:

[0101]

[0102] In the formula, Indicates The account currently accessing the system is in The first anomaly detection is The abnormal performance of each function, Indicates The account currently accessing the system is in The first anomaly detection is The abnormal access performance under each function, Indicates that for Accounts currently accessing the system About The number of accounts accessing the system among the accounts whose final relevance of the function is less than 1. Indicates that for Accounts currently accessing the system About The number of accounts whose final relevance of each function is less than 1, Indicates that for Accounts currently accessing the system About The sum of the final relevance of all accounts accessing the system whose final relevance of the functions is less than 1, Indicates that for Accounts currently accessing the system About The sum of the final relevance of all accounts whose final relevance of the functions is less than 1, To prevent the hyperparameter from having a denominator of 0, this embodiment sets ; To prevent the hyperparameter from having a denominator of 0, this embodiment sets .

[0103] It should be noted that The larger the value, the When an account is accessing the system, there are multiple users who are more likely to work overtime than the account that is accessing the system. The account currently accessing the system is likely to be working overtime. The account currently accessing the system is likely to be a normal access. The value of is small; The larger the value of The user who is accessing the system with a high probability of overtime is also accessing the system, indicating that The account currently accessing the system is likely to be working overtime. The account currently accessing the system is likely to be a normal access. The value of is smaller.

[0104] Further, get the The account currently accessing the system is in The calculation formula for the final abnormality manifestation degree during the abnormality detection is as follows:

[0105]

[0106] In the formula, Indicates The account currently accessing the system is in The final abnormality manifestation degree during the abnormality detection, Indicates The number of other accounts that are accessing the system during the current access to the system. Indicates The accounts currently accessing the system are listed in the front Use the first The duration of a function, Indicates the preset sampling interval, Indicates The account currently accessing the system is in The first anomaly detection is The abnormal performance of each function, Indicates The order value of the anomaly detection, express Function, this embodiment is used for normalization processing; Represents a weight normalization function, whose input object is each account accessing the system in front The duration of use of each function in minutes.

[0107] It should be noted that The larger the value is, the longer the account has accessed the system, which does not meet the characteristic that the account will complete the overtime task as early as possible when working overtime. The more accounts that are accessing the system, the more likely it is that they are accessing abnormally. The larger the value of ; The larger the value, the more it means that when this account accesses the system, there are multiple accounts that also log in to the system, which does not meet the characteristic of abnormal access in a period of time when login is not frequent. The less likely the account accessing the system is abnormal, the less likely it is that The smaller the value of; The larger the value, the When accessing the system, use the The longer the time of a function, the The account currently accessing the system is in The first anomaly detection is The abnormal performance of the function The account currently accessing the system is in The greater the influence weight of the final abnormality manifestation degree during the second abnormality detection.

[0108] Furthermore, a preset abnormality threshold , will be in The account that is accessing the system and whose final abnormal manifestation degree is greater than the manifestation degree threshold during the first abnormal detection is recorded as the account to be verified; The account that is accessing the system and whose final abnormality manifestation degree is greater than the manifestation degree threshold during the abnormality detection is recorded as a normal access account. , this is used as an example for description, and other values ​​may be set in other implementation modes.

[0109] Furthermore, a verification code is sent to the mobile phone number corresponding to the account to be verified, and the account to be verified is asked to enter the received verification code on the system. If the verification code generated by the mobile phone number corresponding to the account to be verified is exactly the same as the verification code entered by the account to be verified on the system, the account to be verified is allowed to continue to access the system; if the verification code generated by the mobile phone number corresponding to the account to be verified is different from the verification code entered by the account to be verified on the system, the account is forcibly logged out of the system.

[0110] At this point, this embodiment is completed.

[0111] Another embodiment of the present invention provides a computer network information security management method, the system includes a memory, a processor, and a computer program stored in the memory and running on the processor, when the processor executes the computer program, the above method steps S001 to S005 are implemented.

[0112] Another embodiment of the present invention provides a computer network information security management electronic device, the device comprising a data acquisition module, a data processing module and a mechanical control module; wherein the data acquisition module is used to collect historical access data of each account and current access data of the account being accessed, the data processing module obtains abnormal accounts by calling a computer program to implement the steps of a computer network information security management method, and the verification module verifies the abnormal accounts.

[0113] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A computer network information security management method, characterized in that: The method comprises the following steps: Obtain the historical access data of each account, the usage time of each function of each account in each project, the usage time of each function of each account on each day, and the current access data of each account currently accessing the system. The historical access data of each account includes the login time, login IP address, and usage time of each function after login when the account logs into the system once; the current access data of each account currently accessing the system includes the login time, login IP address, and usage time of each function after login when the account currently accessing the system logs into the system for the last time; According to the historical access data of each account and the current access data of each account currently accessing the system, the initial access abnormality degree of each account currently accessing the system at each abnormality detection is obtained, wherein each abnormality detection is to perform an abnormality detection on the account currently accessing the system at a fixed time interval; Based on the usage time of each function by each account every day, the initial importance of each account to each function and the trend change degree of each account to each function are obtained, and then the final importance of each account to each function is obtained; combined with the initial access abnormality of each account accessing the system at each abnormal detection, the abnormal access manifestation degree of each account accessing the system under each function at each abnormal detection is obtained; The specific method of obtaining the initial importance of each account to each function and the trend change degree of each account to each function according to the usage time of each account for each function in each day includes: Calculate the Accounts to The formula for the initial importance of a function is as follows: In the formula, Indicates Accounts to The initial importance of each function, Indicates the preset number of days for collection. Indicates the time before the current time Tianzhongdi The usage time of each function, Indicates the time before the current time Tianzhongdi Accounts to The usage time of each function, represents the weight normalization function, represents the symbolic function, To prevent hyperparameters with denominators equal to zero, Indicates the time before the current time The ordinal value of the day; like ,Will Recorded as the first time before the current time Tianzhongdi Accounts to The initial importance of each function; The horizontal axis is the number of days from the current time, and the vertical axis is the Accounts to The initial importance of each function is used to obtain a two-dimensional coordinate system; All days before the current time Accounts to The initial importance of each function is mapped into a two-dimensional coordinate system to obtain multiple importance data points; a straight line is obtained by linear fitting the importance data points in the two-dimensional coordinate system, and the fitting slope of the straight line is recorded as Accounts to The trend change degree of each function; The specific method of obtaining the abnormal access manifestation degree of each account accessing the system under each function during each abnormal detection includes: In the formula, Indicates The account currently accessing the system is in The first anomaly detection is The degree of abnormal access under each function, Indicates The account currently accessing the system The initial abnormality, Indicates The account currently accessing the system is The ultimate importance of each function, Represents the sigmoid function; According to the usage time of each account for each function in each project, the final relevance of each account to another account regarding a function is obtained; Based on the final correlation of each account to another account regarding each function and the abnormal access manifestation degree of each account accessing the system under each function during each abnormal detection, the final abnormal manifestation degree of each account accessing the system during each abnormal detection is obtained, and then the account to be verified is obtained, and abnormal verification is performed.

2. A computer network information security management method according to claim 1, characterized in that: The method of obtaining the initial access abnormality degree of each account accessing the system at each abnormality detection based on the historical access data of each account and the current access data of each account accessing the system includes: Login time, login IP, and before and after login The usage time of each function within minutes is used as the dimension of the multidimensional coordinate system to obtain a multidimensional coordinate system, in which Indicates the detection interval, Indicates that an account that is accessing the system is being The rank value of the anomaly detection; The first All historical access data of the account currently accessing the system are mapped into a multi-dimensional coordinate system to obtain multiple historical access data points; The first The current access data of the account currently accessing the system is mapped into a multi-dimensional coordinate system to obtain a current access data point; Jordi If the login IP of the historical access data point is different from the login IP of the current access data point, then The distance between the historical access data and the current access data point in the login IP dimension is 1; if If the login IP address of the historical access data point is the same as the login IP address of the current access data point, then The distance between the historical access data point and the current access data point in the login IP dimension is 0; Get the The account currently accessing the system is in The specific calculation formula for the initial access abnormality during the first abnormal detection is as follows: In the formula, Indicates The account currently accessing the system is in The initial access abnormality during the anomaly detection, Indicates The number of historical access data of accounts currently accessing the system, Indicates the number of dimensions in the multidimensional coordinate system. Represents the first The historical access data point and the current access data point are the same outside the non-login IP dimension. The distance in dimensions, Indicates The distance between the historical access data point and the current access data point in the login IP dimension, Represents the sigmoid function.

3. A computer network information security management method according to claim 1, characterized in that: The specific method for obtaining the final importance of each account to each function is as follows: In the formula, Indicates Accounts to The ultimate importance of each function, Indicates Accounts to The initial importance of each function, Indicates Accounts to The trend change of each function, is an exponential function with a natural constant as its base.

4. A computer network information security management method according to claim 1, characterized in that: The method of obtaining the final relevance of each account to another account regarding a function according to the usage time of each account for each function in each project includes: In the formula, Indicates account number For account About The final relevance of the functions, Indicates account number With account All used The number of items with each function, Indicates account number With account All used Function The end time of the project, Indicates account number With account All used Function Accounts in the project For The usage time of each function, Indicates account number With account All used Function Accounts in the project For Function usage time, is an exponential function with a natural constant as base, represents the weight normalization function.

5. A computer network information security management method according to claim 2, characterized in that: The method of obtaining the final abnormality manifestation degree of each account accessing the system at each abnormality detection according to the final correlation of each account to another account with respect to each function and the abnormal access manifestation degree of each account accessing the system under each function at each abnormality detection includes the following specific methods: In the formula, Indicates The account currently accessing the system is in The first anomaly detection is The abnormal performance of each function, Indicates The account currently accessing the system is in The first anomaly detection is The degree of abnormal access under each function, Indicates that for Accounts currently accessing the system About The number of accounts accessing the system among the accounts whose final relevance of the function is less than 1. Indicates that for Accounts currently accessing the system About The number of accounts whose final relevance of each function is less than 1, Indicates that for Accounts currently accessing the system About The sum of the final relevance of all accounts accessing the system whose final relevance of the functions is less than 1, Indicates that for Accounts currently accessing the system About The sum of the final relevance of all accounts whose final relevance of the functions is less than 1, To prevent hyperparameters with denominators equal to zero, To prevent hyperparameters with denominators equal to 0; Based on the abnormal performance degree of each account accessing the system under each function at each anomaly detection, the access duration of each account accessing the system at each anomaly detection, and the number of other accounts accessing the system during the current access of each account accessing the system, the final abnormal performance degree of each account accessing the system at each anomaly detection is obtained.

6. A computer network information security management method according to claim 5, characterized in that: The method of obtaining the final abnormal manifestation degree of each account currently accessing the system at each abnormal detection according to the abnormal manifestation degree of each account currently accessing the system under each function at each abnormal detection, the access duration of each account currently accessing the system at each abnormal detection, and the number of other accounts currently accessing the system during the current access of each account currently accessing the system includes the following specific methods: In the formula, Indicates The account currently accessing the system is in The final abnormality manifestation degree of the abnormality detection, Indicates The number of other accounts that are accessing the system during the current access to the system. Indicates The accounts currently accessing the system are listed in the front Use the first The duration of a function, Indicates the preset sampling interval, Indicates the number of functions included in the system. Indicates The order value of the anomaly detection, Indicates The account currently accessing the system is in The first anomaly detection is The abnormal performance of each function, represents the weight normalization function, Represents the sigmoid function.

7. An electronic device for computer network information security management, characterized in that: The electronic device comprises: A data collection module, a data processing module and a verification module; wherein the data collection module is used to collect the historical access data of each account and the current access data of the account being accessed, the data processing module obtains the account to be verified by calling a computer program to implement the steps of a computer network information security management method described in any one of claims 1-6, and the verification module verifies the account to be verified.

8. A computer network information security management system, comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that: When the processor executes the computer program, the steps of a computer network information security management method as described in any one of claims 1 to 6 are implemented.

Images