Effective network security event monitoring method and system based on big data model

Abstract

The invention relates to the technical field of network security monitoring, in particular to an effective network security event monitoring method and system based on a big data model, and the method comprises the steps: automatically collecting data activity records from a plurality of data sources in an enterprise network; cleaning and formatting the data activity records; leakage characteristics related to the data leakage behaviors are extracted from the data activity records, a data leakage event monitoring model is constructed based on the leakage characteristics, and a data leakage event is monitored in real time; a monitoring threshold value is set according to the historical data leakage condition, and when the monitoring result exceeds the threshold value, an early warning mechanism is triggered; the data leakage event is tracked and traced, and the source of data leakage is searched. Therefore, enterprises can effectively monitor and prevent data leakage events, and sensitive data of the enterprises are protected from being threatened by unauthorized access and leakage.

Description

Technical Field

[0001] The present invention relates to the field of network security monitoring technology, and in particular to an effective network security event monitoring method and system based on a big data model. Background Art

[0002] A cybersecurity incident refers to any accidental or malicious behavior that may endanger network systems, damage data security, affect the normal operation of systems and services, or cause information assets to be leaked, tampered with, or lost. Such incidents cover a wide range from minor phishing attacks and malware infections to complex advanced persistent threats (APT attacks), data leaks, and even large-scale denial of service attacks (DDoS). With the rapid development of information technology, the frequency and complexity of cybersecurity incidents are increasing, posing a severe challenge to personal privacy, corporate operations, and even national security. Therefore, establishing an effective cybersecurity protection system, including but not limited to intrusion detection systems, incident response mechanisms, data encryption technology, user education, and regular security audits, has become a necessary measure to maintain a secure environment in the digital age.

[0003] Data leakage in network security incidents can easily lead to information asset leakage, thereby causing corporate losses. The existing data leakage monitoring thresholds are mainly set manually, which cannot be adjusted according to actual conditions, reducing monitoring efficiency. Summary of the invention

[0004] The purpose of the present invention is to provide an effective network security incident monitoring method and system based on a big data model, aiming to set thresholds according to historical data, so as to effectively monitor and prevent data leakage incidents and protect sensitive data from unauthorized access and leakage.

[0005] To achieve the above-mentioned object, in a first aspect, the present invention provides an effective network security incident monitoring method based on a big data model, comprising automatically collecting data activity records from multiple data sources in an enterprise network;

[0006] Clean and format data activity records;

[0007] Extract leakage features related to data leakage behavior from data activity records, build a data leakage event monitoring model based on the leakage features, and monitor data leakage events in real time;

[0008] Set monitoring thresholds based on historical data leakage situations, and trigger an early warning mechanism when the monitoring results exceed the thresholds;

[0009] Track and trace data leakage incidents to find the source of data leakage.

[0010] The data activity record includes data source identification information, data type information, data volume information and data leakage time information.

[0011] The specific steps of cleaning and formatting the data activity records include:

[0012] Identify and remove records with missing values;

[0013] Use box plot analysis to identify and remove outliers in data activity records;

[0014] Identify and remove duplicate records in the data;

[0015] Convert unstructured data into structured data table format.

[0016] The specific steps of extracting leakage features related to data leakage behavior from data activity records, building a data leakage event monitoring model based on the leakage features, and performing real-time monitoring of data leakage events include:

[0017] Define breach characteristics associated with data breaches;

[0018] Extract leakage feature data from raw data using character matching;

[0019] Use historical data to train a random forest model based on leaked signature data;

[0020] Deploy the trained random forest model to the real-time monitoring system, connect it to the real-time data stream, and apply the random forest model to each new data to make predictions to determine whether data leakage has occurred.

[0021] Among them, the leakage characteristics include abnormal access time, abnormal data volume transmission, number of unauthorized access attempts and frequency of access to specific sensitive files.

[0022] The specific steps of extracting leakage feature data from original data by using character matching include:

[0023] Make a list of keywords that indicate a data breach;

[0024] Design regular expressions based on the keyword list to fuzzy match keywords;

[0025] The original data is matched line by line or segment by segment, and for the successfully matched lines or segments, the matching positions and related data are recorded.

[0026] The specific steps of using historical data to train the random forest model based on the leakage feature data include:

[0027] Organizing historical data, wherein the historical data includes normal data access records and known data leakage event records;

[0028] Divide the dataset into training, validation and test sets;

[0029] Initialize the random forest model and set the model parameters;

[0030] The features of the training set and the label of whether the data is leaked or not are input into the model to train the random forest model.

[0031] The specific steps of setting a monitoring threshold according to the historical data leakage and triggering the early warning mechanism when the monitoring result exceeds the threshold include:

[0032] Collect all historical leak feature data;

[0033] Setting a threshold based on the statistical value of the leakage feature data;

[0034] When the monitoring results exceed the threshold, the early warning mechanism is triggered.

[0035] The specific steps of tracking and tracing the data leakage incident and finding the source of the data leakage include:

[0036] Analyze the propagation path of data breach incidents;

[0037] Analyze database access logs to identify all operation records that interact with sensitive data before and after the data breach;

[0038] Generate traceability information based on transmission paths and operation records.

[0039] In a second aspect, the present invention also provides an effective network security event monitoring system based on a big data model, including a data collection module, a data processing module, a data leakage monitoring module, a threshold setting module and a tracing module:

[0040] The data collection module is used to automatically collect data activity records from multiple data sources in the enterprise network;

[0041] The data processing module is used to clean and format the data activity records;

[0042] The data leakage monitoring module is used to extract leakage features related to data leakage behavior from the data activity records, build a data leakage event monitoring model based on the leakage features, and monitor the data leakage events in real time;

[0043] The threshold setting module is used to set the monitoring threshold according to the historical data leakage situation, and trigger the early warning mechanism when the monitoring result exceeds the threshold;

[0044] The tracing module is used to track and trace the data leakage incident and find the source of the data leakage.

[0045] The present invention discloses an effective network security incident monitoring method and system based on a big data model, comprising: automatically collecting data activity records from multiple data sources in an enterprise network; cleaning and formatting the data activity records; extracting leakage features related to data leakage behavior from the data activity records, building a data leakage incident monitoring model based on the leakage features, and monitoring data leakage incidents in real time; setting a monitoring threshold according to the historical data leakage situation, and triggering an early warning mechanism when the monitoring result exceeds the threshold; tracking and tracing the data leakage incident to find the source of the data leakage. The system automatically collects data activity records from multiple data sources in the enterprise network, and these data sources may include network traffic, log files, database operation records, application activity records, etc. The diversity of data ensures the comprehensiveness of monitoring. The collected data activity records need to be cleaned and formatted to remove irrelevant information, correct erroneous data, fill in missing values, etc., to ensure the accuracy and consistency of the data. In the pre-processed data, the system will extract features related to data leakage behavior, which may be user behavior patterns, data access frequency, abnormal traffic patterns, etc. Feature extraction is a key step in building an effective monitoring model. Using the extracted leakage features, the system builds a data leakage incident monitoring model. The built monitoring model monitors the real-time data flow and analyzes the data activity records to identify potential leakage behaviors. Real-time monitoring ensures that a quick response can be made when a data leakage occurs. According to the historical data leakage situation, the system sets the monitoring threshold. When the monitoring result exceeds the threshold, the system will trigger the early warning mechanism and send an alarm to the network security administrator to indicate that a data leakage incident may have occurred. Once the early warning is triggered, the system will track and trace the data leakage incident, and find the source of the data leakage by analyzing the data flow path, access log and other information, so as to take appropriate remedial measures. Through this method and system, enterprises can effectively monitor and prevent data leakage incidents and protect their sensitive data from the threat of unauthorized access and leakage. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0047] Figure 1 This is a structural diagram of an effective network security event monitoring method and system based on a big data model according to the first embodiment of the present invention.

[0048] Figure 2 It is a flowchart of cleaning and formatting data activity records according to the first embodiment of the present invention.

[0049] Figure 3 It is a flowchart of the first embodiment of the present invention, which extracts leakage features related to data leakage behavior from data activity records, builds a data leakage event monitoring model based on the leakage features, and monitors data leakage events in real time.

[0050] Figure 4 It is a flowchart of extracting leakage feature data from original data by using character matching according to the first embodiment of the present invention.

[0051] Figure 5 It is a flowchart of the first embodiment of the present invention for training a random forest model using historical data based on leakage feature data.

[0052] Figure 6 This is a flowchart of the first embodiment of the present invention, which sets a monitoring threshold according to historical data leakage situations and triggers an early warning mechanism when the monitoring result exceeds the threshold.

[0053] Figure 7 This is a flowchart of the first embodiment of the present invention for tracking and tracing a data leakage event and finding the source of the data leakage. DETAILED DESCRIPTION

[0054] Embodiments of the present invention are described in detail below, examples of which are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present invention, and should not be construed as limiting the present invention.

[0055] First embodiment

[0056] See also Figure 1 to Figure 7 The present invention provides an effective network security incident monitoring method based on a big data model, comprising:

[0057] S101 automatically collects data activity records from multiple data sources in the enterprise network;

[0058] The data activity record includes data source identification information, data type information, data volume information and data leakage time information.

[0059] Through the data collection system, continuous and real-time monitoring and data capture of multiple key data sources are achieved. These data sources are widely distributed within the enterprise, including but not limited to email servers, file sharing services, database management systems, cloud computing platforms, application server logs, network traffic records, and terminal device behavior logs. The system is designed with a highly flexible interface and protocol adaptation layer that is compatible with the characteristics and formats of different data sources to ensure the comprehensiveness and seamless integration of data collection.

[0060] Each record is accompanied by a clear data source identifier, such as server IP address, database name, application ID or log file path, etc. This helps to trace the source of data activities, understand the flow path of data in the enterprise network, and identify potential leakage points.

[0061] The records detail the types of data involved, such as documents, images, videos, database records, email content, etc. Identification of data types is critical to assessing the risk of a breach, as different types of data may require different security controls and priority levels.

[0062] In addition to the data type, the system also records the amount of data involved in each data operation, including the number of bytes read, written, deleted, or transferred. Abnormal large-scale data transfers often indicate potential data breaches, so data volume information is extremely important for detecting abnormal activities.

[0063] Accurate timestamps record the moment when data activities occur, including the specific time of access, modification, and transmission. Time information is essential for tracking event sequences, identifying attack patterns, and evaluating response timeliness. At the same time, by analyzing the time pattern of data operations, abnormal activities during non-working hours can be discovered, further improving the sensitivity and accuracy of monitoring.

[0064] S102 cleans and formats the data activity records;

[0065] The specific steps include:

[0066] S201 identifies and deletes records with missing values;

[0067] The first step in data cleaning is to deal with the missing value problem, which involves identifying those records where there are blanks in key fields or where data cannot be obtained. Different strategies are adopted according to the nature of the missing values ​​and the importance of the data: for non-key fields or a small number of missing values, you can choose to delete the record; for key fields with a large number of missing values, you may need to consider using data interpolation techniques (such as mean and median filling) or model prediction to fill in the missing values, but in this step, directly delete the records with missing values ​​in important fields to ensure the purity of the data and the reliability of subsequent analysis.

[0068] S202 uses box plot analysis to identify and remove outliers in the data activity record;

[0069] In order to ensure the accuracy of the data, statistical methods are used to identify and process outliers. Box plot analysis is an intuitive and effective method that defines the normal value range by displaying a five-number summary of the data (minimum value, lower quartile, median, upper quartile, maximum value). Values ​​outside this range are considered outliers. The identified outliers need to be analyzed based on the specific situation to determine whether they are caused by data entry errors or real abnormal events. If confirmed to be abnormal data, they are deleted to reduce their interference with subsequent analysis.

[0070] S203 identifies and removes duplicate records in the data;

[0071] Duplicate data can distort analysis results and add unnecessary data processing burden. This step identifies identical or highly similar records by comparing key fields in the records (such as data source identifier, timestamp, etc.), removes redundant copies, and retains one copy as valid data. This process may involve complex hash matching, sorting, or the use of specialized deduplication algorithms to ensure the uniqueness of the data set.

[0072] S204 converts the unstructured data into a structured data table format.

[0073] Data activity records in enterprise networks may exist in many forms, including unstructured text logs, email content, or social media posts. In order to facilitate subsequent analysis, this data must be converted into a structured format, such as CSV or a database table. This conversion process involves text parsing, regular expression matching, natural language processing technology, etc., to extract key information from the raw data and organize it into a standard table structure according to predefined columns (such as time, source, operation type, data volume, etc.). This formatting not only improves the readability and processing efficiency of the data, but also provides a friendly input format for machine learning models and traditional analysis tools.

[0074] S103 extracts leakage features related to data leakage behavior from the data activity record, builds a data leakage event monitoring model based on the leakage features, and monitors the data leakage event in real time;

[0075] The specific steps include:

[0076] S301 defines leakage characteristics related to data leakage;

[0077] The leakage characteristics include abnormal access time, abnormal data volume transmission, number of unauthorized access attempts and frequency of access to specific sensitive files.

[0078] Abnormal access times refer to data access activity during non-business hours or unusual time periods, which may indicate activity by unauthorized personnel.

[0079] Abnormal data volume transmission refers to the data transmission volume significantly exceeding the normal level, especially when a large amount of data flows out in a short period of time, indicating that the data may be illegally exported.

[0080] Unauthorized access attempts refer to the frequency of unauthorized access attempts to restricted areas or sensitive data. Multiple attempts may point to targeted data theft attempts.

[0081] The frequency of access to specific sensitive files refers to the frequent access to files containing sensitive information, especially by users who do not handle these files on a daily basis, which may indicate the risk of data leakage.

[0082] S302 extracts leakage feature data from the original data by using character matching;

[0083] The specific steps include:

[0084] S401 lists keywords indicating data leakage;

[0085] First, based on the understanding of data leakage behavior, a set of keywords are listed, such as "unauthorized", "access denied", "large data transfer", "out-of-hours", and specific sensitive file names or directory paths.

[0086] S402 designs a regular expression according to the keyword list to fuzzy match the keywords;

[0087] Next, for the keyword list, regular expressions are designed to achieve fuzzy matching to capture keyword variations and context-dependent forms, thus enhancing matching flexibility and accuracy.

[0088] S403 matches the original data line by line or segment by segment, and records the matching position and related data for the successfully matched line or segment.

[0089] Apply the designed regular expression to scan the original data line by line or segment by segment, record the successful matching location and its surrounding context information, and extract data records related to data leakage characteristics.

[0090] S303 uses historical data to train a random forest model based on the leakage feature data;

[0091] The specific steps include:

[0092] S501 organizes historical data, where the historical data includes normal data access records and known data leakage event records;

[0093] Integrate historical data, covering normal daily data access records and known data breach cases, to ensure the comprehensiveness and representativeness of the data set.

[0094] S502 divides the data set into a training set, a validation set, and a test set;

[0095] The integrated historical dataset is randomly divided into a training set (for model learning), a validation set (for parameter adjustment and model selection), and a test set (for final performance evaluation) to avoid overfitting and evaluate the model generalization ability.

[0096] S503 initializes the random forest model and sets model parameters;

[0097] The random forest algorithm is selected as the monitoring model. When initializing the model, it is necessary to reasonably set parameters according to the data characteristics and resource limitations, such as the number of trees, the proportion of random feature selection, the maximum depth of the tree, etc.

[0098] S504 inputs the features of the training set and the label of whether the data is leaked into the model to train the random forest model.

[0099] The random forest model is trained using the feature data in the training set (such as the mark of abnormal access time, the quantitative value of data transmission volume, etc.) and the corresponding label of whether the data has been leaked or not (binary classification label), so that the model can learn how to predict the occurrence of data leakage incidents based on the feature data.

[0100] S304 deploys the trained random forest model to the real-time monitoring system, connects to the real-time data stream, and applies the random forest model to predict each new data to determine whether data leakage has occurred.

[0101] After completing the training and verification of the random forest model and ensuring that it has the ability to identify data leakage behavior, the next step is to put the model into practical use to achieve uninterrupted monitoring and early warning of real-time data activities in the network environment. Specifically, the trained random forest model is serialized or packaged to facilitate lossless migration and deployment in different system environments. At the same time, according to the actual hardware resources and performance requirements, the model is optimized as necessary, such as pruning and quantization, to ensure that the model can run efficiently in real-time data streams while maintaining prediction accuracy.

[0102] In the enterprise network architecture, establish or optimize the data collection pipeline to ensure that all relevant data sources (such as server logs, network traffic, application logs, etc.) can be transmitted to the monitoring system in real time and stably. Deploy the packaged model to a high-performance computing node or cloud service and run it as a prediction service. This service needs to be able to receive real-time data from the data stream, extract features for each data record, and then input the extracted features into the model for instant prediction.

[0103] S104 sets a monitoring threshold based on historical data leakage situations, and triggers an early warning mechanism when the monitoring result exceeds the threshold;

[0104] The specific steps include:

[0105] S601 collects all historical leakage feature data;

[0106] First, the system needs to comprehensively collect and integrate the characteristic data of all known data leakage incidents in history. This includes but is not limited to abnormal access time, abnormal data transmission volume, frequency of unauthorized access attempts, sensitive file access records, etc. The data source can be security logs, audit reports, post-analysis materials, etc., to ensure the comprehensiveness and diversity of the data to accurately reflect the characteristics of the leakage incident.

[0107] S602 sets a threshold value according to the statistical value of the leakage characteristic data;

[0108] Analyze statistical distribution: Statistically analyze the collected historical leakage feature data to identify its distribution characteristics, such as mean, median, standard deviation, percentile, etc., as well as the distribution of outliers. Specifically, the threshold can be set above the 95th percentile of the historical data volume transmission, which means that only a very small number of abnormally high data volume transmissions will trigger an alert.

[0109] Then, backtesting can be done by using historical data to simulate runs to verify whether the set thresholds can effectively distinguish between normal and abnormal behaviors, and adjustments can be made to achieve the best balance.

[0110] S603 When the monitoring result exceeds the threshold, the early warning mechanism is triggered.

[0111] Apply the trained model to the real-time data stream, extract and calculate the features of each data, and compare them with the preset threshold. When the calculation result of any one or more features exceeds the corresponding threshold, the system immediately starts the early warning logic. The warning can be graded according to the severity, such as warning, concern, emergency, etc., and associated with the corresponding response measures. Send warning information through pre-configured notification channels (email, SMS, system notification, security team collaboration platform, etc.), and trigger the pre-defined emergency response process, including but not limited to data source isolation, emergency audit, further investigation, security reinforcement, etc. Record the detailed information of each warning, including trigger time, feature value, response process and results, for later analysis and continuous optimization of the model.

[0112] S105 tracks and traces data leakage incidents to find the source of data leakage.

[0113] The specific steps include:

[0114] S701 Analyze the propagation path of data leakage incidents;

[0115] Use the logs and intrusion detection systems of network security devices to analyze network traffic during a breach and identify abnormal data flows, including outbound requests, abnormal data packets, and periods of high bandwidth usage.

[0116] Check all terminal activity records that may have been exposed to the leaked data, such as file downloads, emails, USB usage records, etc., to find the direct path for data outflow.

[0117] If the data leak involves integration or cloud services, it is necessary to collaborate with third-party suppliers to review API call logs and SaaS platform access records to confirm whether there is a third-party interface that becomes a leakage channel.

[0118] S702 analyzes database access logs to identify all operation records that interact with sensitive data before and after the data leak;

[0119] Collect all relevant access logs from the database server, including login records, query operations, modification records, data exports, etc., with special attention to operations on sensitive data tables. Use data analysis tools to identify all abnormal or non-conforming operations before and after the data breach, such as large-scale data queries during non-working hours, access attempts by unauthorized users, frequent large-scale data exports, etc. Use logs to string together user operation sequences and reconstruct the complete operation path of specific users before and after the data breach, especially those users involved in sensitive data access and operations.

[0120] S703 generates traceability information based on the transmission path and operation records.

[0121] Integrate the analyzed propagation paths and operation records in chronological order to construct a detailed event timeline, mark key nodes and suspicious activities, and help intuitively understand the development process of the leakage incident. Draw a flow chart of data leakage, showing every link from the initial access to the final leakage of data, including the devices used, IP addresses, accounts, etc., to form a complete data leakage chain. Through the above analysis, determine which operations are most likely to cause data leakage, evaluate the causal relationship and impact weight of each factor, and provide conclusive evidence for the final determination of the source of the leakage.

[0122] Second embodiment

[0123] On the basis of the first embodiment, the present invention also provides an effective network security event monitoring system based on a big data model, including a data collection module, a data processing module, a data leakage monitoring module, a threshold setting module and a tracing module: the data collection module is used to automatically collect data activity records from multiple data sources in the enterprise network; the data processing module is used to clean and format the data activity records; the data leakage monitoring module is used to extract leakage features related to data leakage behavior in the data activity records, build a data leakage event monitoring model based on the leakage features, and monitor data leakage events in real time; the threshold setting module is used to set a monitoring threshold according to historical data leakage situations, and when the monitoring result exceeds the threshold, trigger an early warning mechanism; the tracing module is used to track and trace data leakage events to find the source of data leakage.

[0124] In this embodiment, the data collection module adopts a distributed deployment strategy to ensure comprehensive coverage of various data sources in the network, including but not limited to server logs, network traffic records, database access records, application logs, terminal behavior records, etc. Automated collection technologies, such as API interface docking, log capture scripts, etc., are used to achieve real-time and uninterrupted data activity record collection, providing a rich and real-time data foundation for subsequent analysis. The data processing module first cleans the data to eliminate invalid, duplicate or erroneous data entries, and then standardizes and formats the data to convert it into a unified and easy-to-analyze format. In addition, data reduction technology is used to reduce data dimensions and improve the efficiency and accuracy of subsequent analysis. This process may also include feature extraction to prepare high-quality input data for the monitoring model.

[0125] The data leakage monitoring module learns the characteristics of historical leakage events, and the model can identify abnormal behavior patterns in data activity records, such as abnormal large-scale data outbound transmission, unusual access time or location, and abuse of authority. The monitoring module implements real-time monitoring, and once a behavior matching the characteristics of data leakage is found, it immediately triggers a preliminary judgment before the alarm.

[0126] The threshold setting module allows administrators to flexibly set monitoring thresholds based on statistical analysis of historical leakage events. These thresholds include not only the threshold of data transmission volume, but also multi-dimensional indicators such as access frequency and duration of abnormal behavior. When the intensity or frequency of monitored activities exceeds the preset threshold, the system automatically activates the early warning mechanism and sends an immediate notification to the security team so that emergency response measures can be taken.

[0127] After a data leak occurs, the traceability module is activated to analyze the flow of leaked data, identify the initial point of the leak, the intermediate transmission node and the final destination, and associate the key information involved, such as the user account, device IP, and timestamp, to quickly locate the source of the leak, assess the extent of the damage, and provide a detailed chain of evidence for subsequent legal liability. This enables all-round, real-time monitoring and response to network security incidents, especially data leaks, significantly improves the company's network security defense level, reduces the risk of data leaks, and protects the company's data assets.

[0128] What is disclosed above is only a preferred embodiment of the present invention, and it certainly cannot be used to limit the scope of rights of the present invention. Ordinary technicians in this field can understand that all or part of the processes of the above embodiment and equivalent changes made according to the claims of the present invention still fall within the scope of the invention.

Claims

1. An effective network security incident monitoring method based on big data model, It is characterized in that Includes: Automatically collect data activity records from multiple data sources within the enterprise network; Clean and format data activity records; Extract leakage features related to data leakage behavior from data activity records, build a data leakage event monitoring model based on the leakage features, and monitor data leakage events in real time; Set monitoring thresholds based on historical data leakage situations, and trigger an early warning mechanism when the monitoring results exceed the thresholds; Track and trace data leakage incidents to find the source of data leakage.

2. The effective network security incident monitoring method based on big data model as claimed in claim 1 is characterized in that: The data activity record includes data source identification information, data type information, data volume information and data leakage time information.

3. An effective network security incident monitoring method based on a big data model as claimed in claim 2, characterized in that: The specific steps of cleaning and formatting the data activity records include: Identify and remove records with missing values; Use box plot analysis to identify and remove outliers in data activity records; Identify and remove duplicate records in the data; Convert unstructured data into structured data table format.

4. The effective network security incident monitoring method based on big data model as claimed in claim 3 is characterized in that: The specific steps of extracting leakage features related to data leakage behavior from the data activity record, building a data leakage event monitoring model based on the leakage features, and performing real-time monitoring of data leakage events include: Define breach characteristics associated with data breaches; Extract leakage feature data from raw data using character matching; Use historical data to train a random forest model based on leaked signature data; Deploy the trained random forest model to the real-time monitoring system, connect it to the real-time data stream, and apply the random forest model to each new data to make predictions to determine whether data leakage has occurred.

5. The effective network security incident monitoring method based on big data model as claimed in claim 4 is characterized in that: The leakage characteristics include abnormal access time, abnormal data volume transmission, number of unauthorized access attempts and frequency of access to specific sensitive files.

6. The effective network security incident monitoring method based on big data model as claimed in claim 5 is characterized in that: The specific steps of extracting leakage feature data from original data by using character matching include: Make a list of keywords that indicate a data breach; Design regular expressions based on the keyword list to fuzzy match keywords; The original data is matched line by line or segment by segment, and for the successfully matched lines or segments, the matching positions and related data are recorded.

7. The effective network security incident monitoring method based on big data model as claimed in claim 6 is characterized in that: The specific steps of using historical data to train the random forest model based on the leakage feature data include: Organizing historical data, wherein the historical data includes normal data access records and known data leakage event records; Divide the dataset into training, validation and test sets; Initialize the random forest model and set the model parameters; The features of the training set and the label of whether the data is leaked or not are input into the model to train the random forest model.

8. The effective network security incident monitoring method based on big data model as claimed in claim 7 is characterized in that: The specific steps of setting a monitoring threshold according to the historical data leakage situation and triggering the early warning mechanism when the monitoring result exceeds the threshold include: Collect all historical leak feature data; Setting a threshold based on the statistical value of the leakage feature data; When the monitoring results exceed the threshold, the early warning mechanism is triggered.

9. An effective network security incident monitoring method based on a big data model as claimed in claim 8, characterized in that: The specific steps of tracking and tracing the data leakage incident and finding the source of the data leakage include: Analyze the propagation path of data breach incidents; Analyze database access logs to identify all operation records that interact with sensitive data before and after the data breach; Generate traceability information based on transmission paths and operation records.

10. An effective network security incident monitoring system based on big data model, characterized in that: It includes data collection module, data processing module, data leakage monitoring module, threshold setting module and tracing module: The data collection module is used to automatically collect data activity records from multiple data sources in the enterprise network; The data processing module is used to clean and format the data activity records; The data leakage monitoring module is used to extract leakage features related to data leakage behavior from the data activity records, build a data leakage event monitoring model based on the leakage features, and monitor the data leakage events in real time; The threshold setting module is used to set the monitoring threshold according to the historical data leakage situation, and trigger the early warning mechanism when the monitoring result exceeds the threshold; The tracing module is used to track and trace the data leakage incident and find the source of the data leakage.

Images