Computer network security anomaly detection method and system

Abstract

The invention discloses a computer network security anomaly detection method and system, and particularly relates to the technical field of network security. When a computer detects remote login, a preliminary network security state is firstly judged; if the state is temporarily normal, acquiring action state data of the user to calculate an access abnormal coefficient, comparing the access abnormal coefficient with a preset threshold value, and if the access abnormal coefficient exceeds the threshold value, analyzing the state of replying the first login questionnaire by the user to obtain a reply state coefficient; generating a second login questionnaire according to the coefficient and the access abnormity coefficient, and judging whether the network security is abnormal or not according to the reply state of the user to the questionnaire; therefore, when the computer network logs in at different places, whether the computer network security is normal or not can be judged according to actual conditions, misjudgment on the computer network security state is reduced, normal use of a user is not affected, and meanwhile, the security of the computer network can be detected.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a computer network security anomaly detection method and system. Background Art

[0002] Computer network security refers to protecting computer systems and networks from unauthorized access, tampering, destruction or data leakage; its goal is to ensure the confidentiality, integrity and availability of data, while ensuring the normal operation of the network and the reliability of services; therefore, preventing unauthorized access to computer networks is one of the key links in ensuring computer network security;

[0003] For computers, a relatively safe login range is usually set. When the computer network login address is outside the relatively safe login range, the possibility of network security anomalies is relatively high. However, when the computer network is logged in from a different location, it may be the user logging in by himself, or it may be attacked, causing network security anomalies. If it is simply determined to be a computer network security anomaly and corresponding measures are taken, it may lead to misjudgment of network security and affect the normal use of users. Summary of the invention

[0004] The purpose of the present invention is to solve the problem and propose a computer network security anomaly detection method and system.

[0005] In a first aspect of the present invention, a computer network security anomaly detection method is first proposed, the method comprising:

[0006] When the computer detects that a remote login has been made, the login location is obtained, and a first login questionnaire is issued according to the corresponding preset login location security level, and a preliminary network security status is determined according to the answer results of the first login questionnaire;

[0007] If the user successfully passes all questions in the first login questionnaire, the preliminary network security status is determined to be temporarily normal, and the user is allowed to access the computer network;

[0008] When a user accesses a computer, the action state data of the user accessing the computer is obtained, and an access abnormality coefficient is obtained according to the action state data; the action state data includes a file access abnormality coefficient, an access time abnormality coefficient and an access network signal unqualified coefficient;

[0009] The access anomaly coefficient is compared with a preset access anomaly coefficient threshold. If the access anomaly coefficient is not less than the preset access anomaly coefficient threshold, the questionnaire response status data of the user when answering the first login questionnaire is obtained to obtain the response status coefficient of the first login questionnaire; the questionnaire response status data includes a response time coefficient and a response operation number coefficient;

[0010] A login questionnaire coefficient is obtained according to the response status coefficient and the access abnormality coefficient of the first login questionnaire, and a second login questionnaire is generated according to the questionnaire information corresponding to the login questionnaire coefficient, and the computer network security abnormality state is determined according to the user's response status coefficient to the second login questionnaire.

[0011] Optionally, the file access anomaly coefficient includes:

[0012] The total number of files accessed by the user during computer access is obtained, and the total number of operation types for each access file is obtained. The access risk coefficient of each access file is obtained according to the preset risk value corresponding to each operation type. The calculation formula is: Where PL is the access risk factor of each access file, RG i is the preset risk value corresponding to the i-th operation type, n is the total number of operation types corresponding to each access file, and n is a positive integer;

[0013] The file access anomaly coefficient is obtained based on the access risk coefficient of each access file and the corresponding preset file importance weight value. The calculation formula is: Where Gsx is the file access anomaly coefficient, PL k is the access risk coefficient of the kth file, RG k is the preset file importance weight value corresponding to k files, t is the total number of files accessed, and t is a positive integer.

[0014] Optionally, the access time anomaly coefficient includes:

[0015] Obtaining the access time period of each access file during the user's access to the computer, and comparing the access time range of each access file with a preset normal access time range. If the access time range is within the preset normal access time range, the access time range of the corresponding file is recorded as the normal access time period;

[0016] If it is not within the preset normal access time range, the access time range of the corresponding file is recorded as an abnormal access time period; the access time period abnormal coefficient is calculated, and the calculation formula is: PU = PF / PW, where PU is the access time period abnormal coefficient, PF is the total number of abnormal access time periods, and PW is the access time period of all access files;

[0017] Obtain the access time length of each access file, and extract the average access time length of each access file from the historical data, and divide the access time length of each access file by the historical average access time length to obtain the access time length deviation coefficient of the corresponding access file, and add the access time length deviation coefficients of all access files to obtain the access time length deviation coefficient PH,

[0018] The access time length deviation coefficient Bza is calculated according to the access time period anomaly coefficient and the access time length deviation coefficient, and the calculation formula is Bza=a1×PU+a2×PH; wherein a1 and a2 are the preset weight coefficients of the access time period anomaly coefficient and the access time length deviation coefficient, respectively, and a1 and a2 are both greater than 0.

[0019] Optionally, the access network signal unqualified coefficient includes:

[0020] Obtain the signal strength value at each moment during the user's access to the computer, and mark the signal strength value as RNx, where x represents the sequence number of the signal strength value, x∈[1,c], c is the total number of signal strength values, and c is a positive integer;

[0021] Compare the signal strength value at each moment with the preset minimum normal signal strength threshold, and record the signal strength value less than the preset minimum normal signal strength threshold as an unqualified signal strength value, and mark it as HBy, where y represents the sequence number of the unqualified signal strength value, y∈[0,u], u is the total number of unqualified signal strength values, and u is an integer;

[0022] Calculate the access network signal unqualified coefficient Kbv, the calculation formula is: Kbv = u / C, where QS is the preset normal signal strength.

[0023] Optionally, the access abnormality coefficient is obtained according to the file access abnormality coefficient, the access time abnormality coefficient and the access network signal unqualified coefficient, and the calculation formula is:

[0024]

[0025] Wherein, Bfs is the access anomaly coefficient, Gsx, Bza and Kbv are the file access anomaly coefficient, access time anomaly coefficient and access network signal unqualified coefficient respectively, b1, b2 and b3 are the preset proportional coefficients of the file access anomaly coefficient, access time anomaly coefficient and access network signal unqualified coefficient respectively, and b1, b2 and b3 are all greater than 0.

[0026] Optionally, the response time coefficient includes:

[0027] In the process of users answering the first login questionnaire, the time spent by the users to complete each question in the first login questionnaire is obtained, and the time spent coefficient is obtained by combining the preset weight value corresponding to each question. The calculation formula is: Where DF is the time consumption coefficient, EDm is the time consumed by the mth question, WDm is the preset weight value corresponding to the mth question, e is the total number of questions in the first login questionnaire, and e is a positive integer;

[0028] The response time coefficient is obtained according to the time consumption coefficient and the preset time consumption coefficient threshold, and the calculation formula is: Dwq=DF / DC, where Dwq is the response time coefficient and DC is the preset time consumption coefficient threshold.

[0029] Optionally, the reply operation number coefficient includes:

[0030] In the process of users answering the first login questionnaire, the number of user's answer operations for each question is obtained, and the corresponding preset weight value and the maximum preset operation number are combined to obtain the answer operation number coefficient. The calculation formula is: In the formula, GHd is the reply operation number coefficient, WDm is the preset weight value corresponding to the mth question, e is the total number of questions in the first login questionnaire, and e is a positive integer; YHm is the reply operation number corresponding to the mth question, and YBm is the maximum preset operation number corresponding to the mth question.

[0031] Optionally, the reply status coefficient includes:

[0032] The reply status coefficient is obtained according to the reply time coefficient and the reply operation number coefficient. The calculation formula is:

[0033]

[0034] Wherein, Edf is the reply state coefficient, Dwq and GHd are the reply time coefficient and the reply operation number coefficient respectively, c1 and c2 are the preset proportional coefficients of the reply time coefficient and the reply operation number coefficient respectively, and c1 and c2 are both greater than 0.

[0035] Optionally, the login questionnaire coefficient obtained according to the response status coefficient and the access abnormality coefficient of the first login questionnaire includes: TYH=f1×Bfs+f2×Edf, wherein TYH is the login questionnaire coefficient, Bfs and Edf are the access abnormality coefficient and the response status coefficient, respectively, f1 and f2 are preset proportional coefficients of the access abnormality coefficient and the response status coefficient, respectively, and f1 and f2 are both greater than 0.

[0036] Optionally, judging the final abnormal network security state of the computer according to the state coefficient of the user's response to the second login questionnaire includes:

[0037] Comparing the answer status coefficient of the second login questionnaire with a preset threshold, when the answer status coefficient of the second login questionnaire is not less than the preset threshold, the current computer final network security status is judged to be an abnormal state;

[0038] When the response status coefficient of the second login questionnaire is not less than a preset threshold, the current computer final network security status is judged to be a normal state.

[0039] In a second aspect of the present invention, a computer network security anomaly detection system is provided, comprising:

[0040] Preliminary judgment module: when the computer detects that a remote login has been made, the login location is obtained, and a first login questionnaire is issued according to the corresponding preset login location security level, and the preliminary network security status is judged according to the answer results of the first login questionnaire;

[0041] Access permission module: If the user successfully passes all questions in the first login questionnaire, the preliminary network security status is determined to be temporarily normal, and the user is allowed to access the computer network;

[0042] Access anomaly module: when a user accesses a computer, obtains the action state data of the user accessing the computer, and obtains the access anomaly coefficient according to the action state data; the action state data includes the file access anomaly coefficient, the access time anomaly coefficient and the access network signal unqualified coefficient;

[0043] Response status module: compare the access anomaly coefficient with the preset access anomaly coefficient threshold. If the access anomaly coefficient is not less than the preset access anomaly coefficient threshold, obtain the questionnaire response status data of the user when responding to the first login questionnaire to obtain the response status coefficient of the first login questionnaire; the questionnaire response status data includes the response time coefficient and the response operation number coefficient;

[0044] Final judgment module: obtain the login questionnaire coefficient according to the response status coefficient and access anomaly coefficient of the first login questionnaire, generate the second login questionnaire according to the questionnaire information corresponding to the login questionnaire coefficient, and judge the final network security anomaly status of the computer according to the user's response status coefficient to the second login questionnaire.

[0045] Beneficial effects of the present invention:

[0046] The present invention proposes a computer network security anomaly detection method and system. When a computer detects that it is logged in from a different location, a first login questionnaire is issued, and a preliminary network security status is determined according to the answer result of the first login questionnaire; when the preliminary network security status is temporarily normal, the action status data of the user when accessing the computer is obtained to obtain an access anomaly coefficient, and the access anomaly coefficient is compared with a preset access anomaly coefficient threshold. If the access anomaly coefficient is not less than the preset access anomaly coefficient threshold, the questionnaire answer status data of the user when answering the first login questionnaire is obtained to obtain the answer status coefficient of the first login questionnaire; the login questionnaire coefficient is obtained according to the answer status coefficient of the first login questionnaire and the access anomaly coefficient, and a second login questionnaire is generated according to the questionnaire information corresponding to the login questionnaire coefficient, and the computer network security anomaly status is determined according to the user's answer status coefficient to the second login questionnaire; in this way, when the computer network is logged in from a different location, it is possible to determine whether the computer network security is normal according to the actual situation, reduce the misjudgment of the computer network security status, and detect the security of the computer network without affecting the normal use of the user. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] The present invention will be further described below in conjunction with the accompanying drawings.

[0048] Figure 1 A flowchart of a computer network security anomaly detection method;

[0049] Figure 2 A framework diagram of a computer network security anomaly detection system. DETAILED DESCRIPTION

[0050] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0051] Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in the field without making any creative work shall fall within the scope of protection of the present invention.

[0052] The embodiment of the present invention provides a method for detecting anomalies in computer network security. Figure 1 , Figure 1 A flowchart of a computer network security anomaly detection method provided by an embodiment of the present invention. The method comprises the following steps:

[0053] When the computer detects that a remote login has been made, the login location is obtained, and a first login questionnaire is issued according to the corresponding preset login location security level, and a preliminary network security status is determined according to the answer results of the first login questionnaire;

[0054] If the user successfully passes all questions in the first login questionnaire, the preliminary network security status is determined to be temporarily normal, and the user is allowed to access the computer network;

[0055] When a user accesses a computer, the action state data of the user accessing the computer is obtained, and the access abnormality coefficient is obtained according to the action state data; the action state data includes the file access abnormality coefficient, the access time abnormality coefficient and the access network signal unqualified coefficient;

[0056] The access anomaly coefficient is compared with a preset access anomaly coefficient threshold. If the access anomaly coefficient is not less than the preset access anomaly coefficient threshold, the questionnaire response status data of the user when answering the first login questionnaire is obtained to obtain the response status coefficient of the first login questionnaire; the questionnaire response status data includes the response time coefficient and the response operation number coefficient;

[0057] A login questionnaire coefficient is obtained according to the response status coefficient and the access abnormality coefficient of the first login questionnaire, and a second login questionnaire is generated according to the questionnaire information corresponding to the login questionnaire coefficient, and the computer network security abnormality state is determined according to the user's response status coefficient to the second login questionnaire.

[0058] Based on a computer network security anomaly detection method provided by an embodiment of the present invention, through the above-mentioned method, when a computer network is logged in remotely, it is possible to judge whether the computer network security is normal according to the actual situation, thereby reducing misjudgment of the computer network security status, and detecting the security of the computer network without affecting the normal use of the user.

[0059] It should be noted that when the computer system detects that a user logs in from a new or remote device or network, it will immediately obtain the geographical location of the login. This can be achieved through IP address positioning, GPS data, Wi-Fi or network information, etc. The computer system will obtain its approximate geographical location based on the IP address at the time of login, which is the most common method; in some cases, the system can confirm the precise coordinates of the login location through the GPS information of the device (such as a mobile device), or infer the login location through the Wi-Fi network or mobile data network base station information. The specific location of the remote login can be obtained according to the actual situation, without limitation;

[0060] It should be noted that the security level of the preset login location is set by professionals based on actual conditions. For example, high-security locations are such as the user's home, office, and frequently visited Wi-Fi networks. These places are marked as the user's frequently used login locations, so the risk is relatively low; medium-security locations are such as other public places in the same city (such as cafes, airports, etc.), which are not frequently used but are still in the area where users often move around; low-security locations are such as other cities, countries, or devices or networks that have never been logged in. Logins from these places are considered high-risk logins and may be potential attacks; the specific security level of the preset login location is determined according to the actual situation and is not limited or elaborated here;

[0061] It should be noted that when the security level of the login location is different, the content of the questionnaire issued is also different. For example, for low-security locations, a more stringent questionnaire will be sent. For example, the user needs to enter the password, verification code, and answer security questions at the same time, and may even be asked to confirm certain recent operations, such as "Have you recently changed the mobile phone number associated with the account?" Therefore, for different login location security levels, the difficulty and questions of the first login questionnaire issued are also different. The specific first login questionnaire can be set by professionals based on the actual login location security level, and will not be limited or elaborated here.

[0062] In one embodiment, judging the preliminary network security status according to the answer results of the first login questionnaire includes:

[0063] If the user successfully passes all questions in the first login questionnaire, the preliminary network security status is determined to be temporarily normal, and the user is allowed to access the computer network;

[0064] If the user cannot pass all the questions in the first login questionnaire, the preliminary network security status is determined to be abnormal. At this time, the user is not allowed to access the computer network, and a network security abnormality instruction is issued to the computer, and the computer takes corresponding network security abnormality protection measures.

[0065] In one implementation, through the above method, if the user successfully passes all questions, the computer system can quickly confirm the legitimacy of his identity and allow him to access the network, which can not only reduce unnecessary interference but also improve user satisfaction; if the user fails to pass the verification, the computer system can promptly identify potential security threats and take corresponding protective measures to prevent possible attacks or data leaks; this two-way verification mechanism not only improves the security of the system, but also can intelligently balance the user's normal operation and network security needs, ensuring that only legitimate users can access information while protecting the system from the risk of unauthorized access.

[0066] In one embodiment, the file access anomaly coefficient includes:

[0067] The total number of files accessed by the user during computer access is obtained, and the total number of operation types for each access file is obtained. The access risk coefficient of each access file is obtained according to the preset risk value corresponding to each operation type. The calculation formula is: Where PL is the access risk factor of each access file, RG i is the preset risk value corresponding to the i-th operation type, n is the total number of operation types corresponding to each access file, and n is a positive integer;

[0068] The file access anomaly coefficient is obtained based on the access risk coefficient of each access file and the corresponding preset file importance weight value. The calculation formula is: Where Gsx is the file access anomaly coefficient, PL k is the access risk coefficient of the kth file, RG k is the preset file importance weight value corresponding to k files, t is the total number of files accessed, and t is a positive integer.

[0069] It should be noted that the types of operations performed when accessing files include reading, editing, deleting, copying, etc., which are determined according to the actual situation; in addition, the preset risk value corresponding to each operation type is determined by professionals based on the actual situation. For example, the deletion operation may have a higher risk value, such as 0.8, while the risk value of the reading operation is relatively low, such as 0.2. Copying files, especially sensitive files, may have a higher risk, so it can be set to 0.6 or higher. Editing operations are usually between the two and may be assigned a medium risk value of 0.5; it depends on the actual situation and is not limited or elaborated here;

[0070] It should be noted that the preset file importance weight values ​​corresponding to each accessed file are determined by professionals based on actual circumstances. For example, highly sensitive files, such as financial statements, confidential contracts, or personal data, may be assigned higher weight values, such as 0.9 or above. Some more common work documents or non-critical data files may have lower weight values, such as 0.3, depending on the actual circumstances, which are not limited or elaborated here. In addition, during the user's access to the computer, the total number of files accessed and the type of operation during the access can be directly obtained from the monitoring system in the computer system, or in other ways, which are not limited or elaborated here.

[0071] It should be noted that the larger the file access anomaly coefficient is, the greater the possibility of computer network security anomaly is. The reason is that a high coefficient may indicate that the user has performed a large number of high-risk operations, such as frequently deleting or editing sensitive files, which may be a sign of data leakage or malicious behavior; therefore, the increase in the file access anomaly coefficient directly points to potential network security risks, suggesting that the computer system needs to further monitor such behaviors or take protective measures.

[0072] In one embodiment, the access time anomaly coefficient includes:

[0073] Obtaining the access time period of each access file during the user's access to the computer, and comparing the access time range of each access file with a preset normal access time range. If the access time range is within the preset normal access time range, the access time range of the corresponding file is recorded as the normal access time period;

[0074] If it is not within the preset normal access time range, the access time range of the corresponding file is recorded as an abnormal access time period; the access time period abnormal coefficient is calculated, and the calculation formula is: PU = PF / PW, where PU is the access time period abnormal coefficient, PF is the total number of abnormal access time periods, and PW is the access time period of all access files;

[0075] Obtain the access time length of each access file, and extract the average access time length of each access file from the historical data, and divide the access time length of each access file by the historical average access time length to obtain the access time length deviation coefficient of the corresponding access file, and add the access time length deviation coefficients of the accessed files to obtain the access time length deviation coefficient PH,

[0076] The access time length deviation coefficient Bza is calculated according to the access time period anomaly coefficient and the access time length deviation coefficient, and the calculation formula is Bza=a1×PU+a2×PH; wherein a1 and a2 are the preset weight coefficients of the access time period anomaly coefficient and the access time length deviation coefficient, respectively, and a1 and a2 are both greater than 0.

[0077] It should be noted that a1 and a2 are set by professionals according to actual conditions. Generally, the sum of a1 and a2 is 1. For example, a1 and a2 can be 0.5 and 0.5 respectively, or other numbers, which are not specifically limited.

[0078] It should be noted that the access time range and access time length of each access file can be monitored in real time through the system's log recording function, recording the user's access behavior to each file and the start and end time of the access. Many operating systems and applications support this audit log function; the preset normal access time range is set by professionals based on the organization's work time policy and historical data. The specific time range depends on the actual situation and will not be limited or elaborated here;

[0079] It should be noted that the larger the access time anomaly coefficient, the greater the possibility of computer network security anomaly. The reason is that when the access time anomaly coefficient is larger, it means that the user's behavior when accessing files deviates from the normal access mode, which may indicate that the user performs sensitive operations in unusual time periods, or the length of access time is significantly different from the historical average. This inconsistency may be an indicator of potential security threats, such as the computer network may be experiencing malicious activities. Therefore, an increase in the access time anomaly coefficient usually represents a greater possibility of computer network security anomaly.

[0080] In one embodiment, the access network signal disqualification coefficient includes:

[0081] Get the signal strength value at each moment when the user accesses the computer, and mark the signal strength value as RN x , x represents the sequence number of the signal strength value, x∈[1,c], c is the total number of signal strength values, and c is a positive integer;

[0082] Compare the signal strength value at each moment with the preset minimum normal signal strength threshold, and record the signal strength value less than the preset minimum normal signal strength threshold as an unqualified signal strength value and mark it as HB y , y represents the order number of the unqualified signal strength value, y∈[0,u], u is the total number of unqualified signal strength values, and u is an integer;

[0083] Calculate the access network signal unqualified coefficient Kbv, the calculation formula is: Kbv = u / c, where QS is the preset normal signal strength.

[0084] It should be noted that the preset minimum normal signal strength threshold is determined by professionals based on actual conditions, and is not limited or elaborated here; in addition, when a user accesses a computer, the signal strength value at each moment can be obtained through a network adapter or a wireless access point (AP), which usually provides real-time signal strength information. In an operating system, network settings or monitoring tools can display signal strength (usually in dBm), or in other ways, which are not limited or elaborated here.

[0085] It should be noted that the greater the unqualified coefficient of the access network signal, the greater the possibility of computer network security anomalies. The reason is that unstable network signals may cause data transmission interruptions, delays or errors, which provides opportunities for malicious activities. For example, hackers may use unqualified connections to conduct man-in-the-middle attacks, data interception or other forms of attacks. In addition, an unqualified network environment may cause users to lose control of the system when performing sensitive operations, increasing the risk of tampering with operations or unauthorized access. Therefore, unqualified signals not only affect the user experience, but also increase potential security threats.

[0086] In one embodiment, obtaining the access abnormality coefficient according to the action state data includes:

[0087] The access anomaly coefficient is obtained according to the file access anomaly coefficient, access time anomaly coefficient and access network signal unqualified coefficient. The calculation formula is:

[0088]

[0089] Wherein, Bfs is the access anomaly coefficient, Gsx, Bza and Kbv are the file access anomaly coefficient, access time anomaly coefficient and access network signal unqualified coefficient respectively, b1, b2 and b3 are the preset proportional coefficients of the file access anomaly coefficient, access time anomaly coefficient and access network signal unqualified coefficient respectively, and b1, b2 and b3 are all greater than 0.

[0090] It should be noted that b1, b2, and b3 are set by professionals according to actual conditions. Generally, the sum of b1, b2, and b3 is 1. For example, b1, b2, and b3 can be 0.3, 0.3, and 0.4, respectively, or other numbers, without specific limitation.

[0091] In one embodiment, the access anomaly coefficient is compared with a preset access anomaly coefficient threshold, and if the access anomaly coefficient is not less than the preset access anomaly coefficient threshold, the questionnaire response status data of the user when responding to the first login questionnaire is obtained to obtain the response status coefficient of the first login questionnaire;

[0092] If the access anomaly coefficient is not less than the preset access anomaly coefficient threshold, the computer network is judged to be safe and normal, and the user continues to access the computer.

[0093] It should be noted that the preset access anomaly coefficient threshold is determined by professionals according to actual conditions and is not limited or elaborated herein;

[0094] It should be noted that when the access anomaly coefficient is not less than the preset access anomaly coefficient threshold, it means that the user's operation behavior may be abnormal, and further verification may be required to ensure the legitimacy of their identity and access. Therefore, the system will obtain the questionnaire response status data of the user when answering the first login questionnaire to calculate the response status coefficient of the first login questionnaire, so as to evaluate the user's credibility and determine whether there is an abnormality in computer network security; if the access anomaly coefficient is less than the preset access anomaly coefficient threshold, it means that the user's operation behavior is within the normal range, and the system believes that the current network security status is normal. In this case, the user can continue to access the computer network without additional verification or restriction.

[0095] In one implementation, the above method can effectively balance security and user experience. When the access anomaly coefficient is not less than the preset threshold, additional verification measures will be taken to prevent potential security risks and protect sensitive data. When the access anomaly coefficient is lower than the threshold, users can continue to operate seamlessly, avoiding unnecessary delays and troubles, thereby improving user experience and work efficiency. This dynamically adjusted security mechanism can minimize interference with normal users while ensuring network security.

[0096] In one embodiment, the response time factor includes:

[0097] In the process of users answering the first login questionnaire, the time spent by the users to complete each question in the first login questionnaire is obtained, and the time spent coefficient is obtained by combining the preset weight value corresponding to each question. The calculation formula is: In the formula, DF is the time consumption coefficient, ED is m The time spent on the mth question, WD m is the preset weight value corresponding to the mth question, e is the total number of questions in the first login questionnaire, and e is a positive integer;

[0098] The response time coefficient is obtained according to the time consumption coefficient and the preset time consumption coefficient threshold, and the calculation formula is: Dwq=DF / DC, where Dwq is the response time coefficient and DC is the preset time consumption coefficient threshold.

[0099] It should be noted that the preset time coefficient threshold and the preset weight value corresponding to each question are determined by professionals based on actual circumstances and are not limited or elaborated upon here; in addition, the time spent by the user to complete each question in the first login questionnaire can be obtained directly through the monitoring system in the computer system, or in other ways, which are not limited or elaborated upon here.

[0100] It should be noted that when the response time coefficient is larger, it means that the user may be hesitant, confused or uncertain when completing the first login questionnaire, which may indicate a reduced credibility of their identity or a potential security risk. Therefore, even if the user successfully passes all questions, the system will increase the login questionnaire coefficient, making the generated second login questionnaire more difficult. This measure is intended to strengthen security, ensure the rigor of further verifying the user's identity, reduce potential network security threats, and protect the overall security and stability of the computer network.

[0101] In one embodiment, the reply operation number coefficient includes:

[0102] In the process of users answering the first login questionnaire, the number of user's answer operations for each question is obtained, and the corresponding preset weight value and the maximum preset operation number are combined to obtain the answer operation number coefficient. The calculation formula is: Where GHd is the response operation frequency coefficient, WD m is the preset weight value corresponding to the mth question, e is the total number of questions in the first login questionnaire, and e is a positive integer; YH m is the number of answer operations corresponding to the mth question, YB m is the maximum preset number of operations corresponding to the mth question.

[0103] It should be noted that the maximum number of preset operations corresponding to each question is determined by professionals based on actual circumstances, and is not limited or elaborated upon here; in addition, the number of operations for the user to answer each question can be obtained directly through the monitoring system in the computer system, or in other ways, which are not limited or elaborated upon here.

[0104] It should be noted that when the coefficient of the number of response operations is larger, it means that the user may show uncertainty or hesitation when answering the questionnaire, which may be due to insufficient understanding of the questions or unclear information. This state may affect the credibility of their identity, causing the system to believe that the user has potential risks during this login process. Therefore, even if the user successfully answers all questions, the login questionnaire coefficient will still increase. The system needs to increase the difficulty when generating the second login questionnaire based on this coefficient to further verify the user's identity, thereby ensuring network security and data integrity and reducing potential security risks.

[0105] In one embodiment, the reply status coefficients include:

[0106] The reply status coefficient is obtained according to the reply time coefficient and the reply operation number coefficient. The calculation formula is:

[0107]

[0108] Wherein, Edf is the reply state coefficient, Dwq and GHd are the reply time coefficient and the reply operation number coefficient respectively, c1 and c2 are the preset proportional coefficients of the reply time coefficient and the reply operation number coefficient respectively, and c1 and c2 are both greater than 0.

[0109] It should be noted that c1 and c2 are set by professionals according to actual conditions. Generally, the sum of c1 and c2 is 1. For example, c1 and c2 can be 0.5 and 0.5 respectively, or other numbers, which are not specifically limited.

[0110] In one embodiment, the login questionnaire coefficient obtained according to the response status coefficient and the access abnormality coefficient of the first login questionnaire includes: TYH=f1×Bfs+f2×Edf, wherein TYH is the login questionnaire coefficient, Bfs and Edf are the access abnormality coefficient and the response status coefficient respectively, f1 and f2 are the preset proportional coefficients of the access abnormality coefficient and the response status coefficient respectively, and f1 and f2 are both greater than 0.

[0111] It should be noted that f1 and f2 are set by professionals according to actual conditions. Generally, the sum of f1 and f2 is 1. For example, f1 and f2 can be 0.7 and 0.3 respectively, or other numbers, which are not specifically limited.

[0112] In one embodiment, a second login questionnaire is generated based on the questionnaire information corresponding to the login questionnaire coefficient. Specifically, based on the login questionnaire coefficient, the computer system will evaluate the user's risk level and generate a second login questionnaire. The design of the questionnaire will be adjusted according to the login questionnaire coefficient. For example, when the login questionnaire coefficient is high, the computer system will set more challenging questions to increase the strictness of the verification and ensure the legitimacy of the user's identity. The questionnaire may include more complex personal information verification, behavioral pattern review, or answers to sensitive questions to ensure that the user's identity is strengthened in potential abnormal situations. In this way, the system can flexibly respond to different security needs to ensure that network security and data protection are always maintained during user operations.

[0113] In one embodiment, judging the final abnormal network security state of the computer according to the state coefficient of the user's response to the second login questionnaire includes:

[0114] Comparing the answer status coefficient of the second login questionnaire with a preset threshold, when the answer status coefficient of the second login questionnaire is not less than the preset threshold, the current computer final network security status is judged to be an abnormal state;

[0115] When the response status coefficient of the second login questionnaire is not less than a preset threshold, the current computer final network security status is judged to be a normal state.

[0116] It should be noted that the preset threshold is determined by professionals according to actual conditions and is not limited or elaborated herein;

[0117] It should be noted that when the response status coefficient of the second login questionnaire is not less than the preset threshold, the system will determine that the computer network security status is abnormal, because it usually means that the user has shown potentially suspicious behavior during the answering process, such as taking too long to answer, making too many mistakes, or not understanding the questions clearly. In this case, the computer system may take further security measures, such as temporarily restricting user access, requiring additional identity verification, or notifying the security team for review to prevent potential security threats.

[0118] On the contrary, when the response status coefficient of the second login questionnaire is lower than the preset threshold, the computer system will consider the current network security status to be normal; this indicates that the user's response is logical and in line with expectations, indicating that their identity may be legitimate; in this case, the computer system can continue to allow the user to access the computer network without additional verification, thereby improving the user experience and avoiding unnecessary interference and delays. Overall, this questionnaire-based dynamic evaluation mechanism effectively balances security and user convenience, ensuring the security protection of the computer network without affecting normal use.

[0119] Based on the same inventive concept, the present invention also provides a computer network security anomaly detection system. Figure 2 , Figure 2 A framework diagram of a computer network security anomaly detection system provided in an embodiment of the present invention, the system comprising:

[0120] Preliminary judgment module: when the computer detects that a remote login has been made, the login location is obtained, and a first login questionnaire is issued according to the corresponding preset login location security level, and the preliminary network security status is judged according to the answer results of the first login questionnaire;

[0121] Access permission module: If the user successfully passes all questions in the first login questionnaire, the preliminary network security status is determined to be temporarily normal, and the user is allowed to access the computer network;

[0122] Access anomaly module: when a user accesses a computer, the action status data of the user accessing the computer is obtained, and the access anomaly coefficient is obtained according to the action status data; the action status data includes the file access anomaly coefficient, the access time anomaly coefficient and the access network signal unqualified coefficient;

[0123] Response status module: compare the access anomaly coefficient with the preset access anomaly coefficient threshold. If the access anomaly coefficient is not less than the preset access anomaly coefficient threshold, obtain the questionnaire response status data of the user when responding to the first login questionnaire to obtain the response status coefficient of the first login questionnaire; the questionnaire response status data includes the response time coefficient and the response operation number coefficient;

[0124] Final judgment module: obtain the login questionnaire coefficient according to the response status coefficient and access anomaly coefficient of the first login questionnaire, generate the second login questionnaire according to the questionnaire information corresponding to the login questionnaire coefficient, and judge the final network security anomaly status of the computer according to the user's response status coefficient to the second login questionnaire.

[0125] A computer network security anomaly detection system provided by an embodiment of the present invention can determine whether the computer network security is normal according to the actual situation when logging in to the computer network remotely through the above method, thereby reducing misjudgment of the computer network security status, and detecting the security of the computer network without affecting the normal use of the user.

[0126] The above is a detailed description of an embodiment of the present invention, but the content is only a preferred embodiment of the present invention and cannot be considered to limit the scope of implementation of the present invention. All equivalent changes and improvements made within the scope of the present invention should still fall within the scope of the patent coverage of the present invention.

Claims

1. A computer network security anomaly detection method, characterized in that: The following steps are involved: When the computer detects that a remote login has been made, the login location is obtained, and a first login questionnaire is issued according to the corresponding preset login location security level, and a preliminary network security status is determined according to the answer results of the first login questionnaire; If the user successfully passes all questions in the first login questionnaire, the preliminary network security status is determined to be temporarily normal, and the user is allowed to access the computer network; When a user accesses a computer, the action state data of the user accessing the computer is obtained, and an access abnormality coefficient is obtained according to the action state data; the action state data includes a file access abnormality coefficient, an access time abnormality coefficient and an access network signal unqualified coefficient; The access anomaly coefficient is compared with a preset access anomaly coefficient threshold. If the access anomaly coefficient is not less than the preset access anomaly coefficient threshold, the questionnaire response status data of the user when answering the first login questionnaire is obtained to obtain the response status coefficient of the first login questionnaire; the questionnaire response status data includes a response time coefficient and a response operation number coefficient; A login questionnaire coefficient is obtained according to the response status coefficient and the access abnormality coefficient of the first login questionnaire, and a second login questionnaire is generated according to the questionnaire information corresponding to the login questionnaire coefficient, and the computer network security abnormality state is determined according to the user's response status coefficient to the second login questionnaire.

2. A computer network security anomaly detection method according to claim 1, characterized in that: The file access anomaly coefficients include: The total number of files accessed by the user during computer access is obtained, and the total number of operation types for each access file is obtained. The access risk coefficient of each access file is obtained according to the preset risk value corresponding to each operation type. The calculation formula is: Where PL is the access risk factor of each access file, RG i is the preset risk value corresponding to the i-th operation type, n is the total number of operation types corresponding to each access file, and n is a positive integer; The file access anomaly coefficient is obtained based on the access risk coefficient of each access file and the corresponding preset file importance weight value. The calculation formula is: Where Gsx is the file access anomaly coefficient, PL k is the access risk coefficient of the kth file, RG k is the preset file importance weight value corresponding to k files, t is the total number of files accessed, and t is a positive integer.

3. A computer network security anomaly detection method according to claim 2, characterized in that: The access time anomaly coefficients include: Obtaining the access time period of each access file during the user's access to the computer, and comparing the access time range of each access file with a preset normal access time range. If the access time range is within the preset normal access time range, the access time range of the corresponding file is recorded as the normal access time period; If it is not within the preset normal access time range, the access time range of the corresponding file is recorded as an abnormal access time period; the access time period abnormal coefficient is calculated, and the calculation formula is: PU = PF / PW, where PU is the access time period abnormal coefficient, PF is the total number of abnormal access time periods, and PW is the access time period of all access files; Obtain the access time length of each access file, and extract the average access time length of each access file from the historical data, and divide the access time length of each access file by the historical average access time length to obtain the access time length deviation coefficient of the corresponding access file, and add the access time length deviation coefficients of all access files to obtain the access time length deviation coefficient PH, The access time length deviation coefficient Bza is calculated according to the access time period anomaly coefficient and the access time length deviation coefficient, and the calculation formula is Bza=a1×PU+a2×PH; wherein a1 and a2 are the preset weight coefficients of the access time period anomaly coefficient and the access time length deviation coefficient, respectively, and a1 and a2 are both greater than 0.

4. A computer network security anomaly detection method according to claim 3, characterized in that: The access network signal unqualified coefficient includes: Get the signal strength value at each moment when the user accesses the computer, and mark the signal strength value as RN x , x represents the sequence number of the signal strength value, x∈[1,c], c is the total number of signal strength values, and c is a positive integer; Compare the signal strength value at each moment with the preset minimum normal signal strength threshold, and record the signal strength value less than the preset minimum normal signal strength threshold as an unqualified signal strength value and mark it as HB y , y represents the order number of the unqualified signal strength value, y∈[0,u], u is the total number of unqualified signal strength values, and u is an integer; Calculate the access network signal unqualified coefficient Kbv, the calculation formula is: Kbv = u / c, where QS is the preset normal signal strength; The access anomaly coefficients obtained based on the action status data include: The access anomaly coefficient is obtained according to the file access anomaly coefficient, access time anomaly coefficient and access network signal unqualified coefficient. The calculation formula is: Wherein, Bfs is the access anomaly coefficient, Gsx, Bza and Kbv are the file access anomaly coefficient, access time anomaly coefficient and access network signal unqualified coefficient respectively, b1, b2 and b3 are the preset proportional coefficients of the file access anomaly coefficient, access time anomaly coefficient and access network signal unqualified coefficient respectively, and b1, b2 and b3 are all greater than 0.

5. A computer network security anomaly detection method according to claim 1, characterized in that: The response time factors include: In the process of users answering the first login questionnaire, the time spent by the users to complete each question in the first login questionnaire is obtained, and the time spent coefficient is obtained by combining the preset weight value corresponding to each question. The calculation formula is: In the formula, DF is the time consumption coefficient, ED is m The time spent on the mth question, WD m is the preset weight value corresponding to the mth question, e is the total number of questions in the first login questionnaire, and e is a positive integer; The response time coefficient is obtained according to the time consumption coefficient and the preset time consumption coefficient threshold, and the calculation formula is: Dwq=DF / DC, where Dwq is the response time coefficient and DC is the preset time consumption coefficient threshold.

6. A computer network security anomaly detection method according to claim 1, characterized in that: The reply operation number coefficient includes: In the process of users answering the first login questionnaire, the number of user's answer operations for each question is obtained, and the corresponding preset weight value and the maximum preset operation number are combined to obtain the answer operation number coefficient. The calculation formula is: Where GHd is the response operation frequency coefficient, WD m is the preset weight value corresponding to the mth question, e is the total number of questions in the first login questionnaire, and e is a positive integer; YH m is the number of answer operations corresponding to the mth question, YB m is the maximum preset number of operations corresponding to the mth question.

7. A computer network security anomaly detection method according to claim 1, characterized in that: The response status coefficients include: The reply status coefficient is obtained according to the reply time coefficient and the reply operation number coefficient. The calculation formula is: Wherein, Edf is the reply state coefficient, Dwq and GHd are the reply time coefficient and the reply operation number coefficient respectively, c1 and c2 are the preset proportional coefficients of the reply time coefficient and the reply operation number coefficient respectively, and c1 and c2 are both greater than 0.

8. A computer network security anomaly detection method according to claim 1, characterized in that: The login questionnaire coefficient obtained according to the response status coefficient and the access abnormality coefficient of the first login questionnaire includes: TYH=f1×Bfs+f2×Edf, where TYH is the login questionnaire coefficient, Bfs and Edf are the access abnormality coefficient and the response status coefficient respectively, f1 and f2 are the preset proportional coefficients of the access abnormality coefficient and the response status coefficient respectively, and f1 and f2 are both greater than 0.

9. A computer network security anomaly detection method according to claim 1, characterized in that: The final abnormal network security status of the computer is determined based on the user's response status coefficient to the second login questionnaire, including: Comparing the answer status coefficient of the second login questionnaire with a preset threshold, when the answer status coefficient of the second login questionnaire is not less than the preset threshold, the current computer final network security status is judged to be an abnormal state; When the response status coefficient of the second login questionnaire is not less than a preset threshold, the current computer final network security status is judged to be a normal state.

10. A computer network security anomaly detection system, characterized in that: The system comprises: Preliminary judgment module: when the computer detects that a remote login has been made, the login location is obtained, and a first login questionnaire is issued according to the corresponding preset login location security level, and the preliminary network security status is judged according to the answer results of the first login questionnaire; Access permission module: If the user successfully passes all questions in the first login questionnaire, the preliminary network security status is determined to be temporarily normal, and the user is allowed to access the computer network; Access anomaly module: when a user accesses a computer, obtains the action state data of the user accessing the computer, and obtains the access anomaly coefficient according to the action state data; the action state data includes the file access anomaly coefficient, the access time anomaly coefficient and the access network signal unqualified coefficient; Response status module: compare the access anomaly coefficient with the preset access anomaly coefficient threshold. If the access anomaly coefficient is not less than the preset access anomaly coefficient threshold, obtain the questionnaire response status data of the user when responding to the first login questionnaire to obtain the response status coefficient of the first login questionnaire; the questionnaire response status data includes the response time coefficient and the response operation number coefficient; Final judgment module: obtain the login questionnaire coefficient according to the response status coefficient and access anomaly coefficient of the first login questionnaire, generate the second login questionnaire according to the questionnaire information corresponding to the login questionnaire coefficient, and judge the final network security anomaly status of the computer according to the user's response status coefficient to the second login questionnaire.

Images