Network security intelligent monitoring method and system for bank shield key press

Abstract

The invention discloses a network security intelligent monitoring method and system for a bank shield key device, and belongs to the technical field of bank shield key devices. The method comprises the following steps: acquiring historical network flow data of the E-bank USB key in a working state; monitoring the network connection state of the bank shield key press, and obtaining the operation data of the bank shield key press; processing the historical use data of the E-bank USB key, analyzing the network data characteristics of the E-bank USB key, and generating the network use standard of the E-bank USB key; analyzing the network connection state of the bank shield key device through an intelligent network detection model, and calculating a network connection risk value of the bank shield key device; according to the network connection risk value of the bank shield key press, judging whether to carry out early warning on network security or not; and an optimization suggestion is sent to related personnel, and firewall rules are configured. By monitoring the operation behavior of the E-bank USB key in real time, abnormal behaviors can be found in time, and measures can be taken.

Description

Technical Field

[0001] The present invention relates to the technical field of bank shield keypads, and in particular to a network security intelligent monitoring method and system for bank shield keypads. Background Art

[0002] Bank Shield, also known as U Shield, is used to verify online banking transactions. Bank Shield Keypad is an online banking operation control device that includes a pressing mechanical arm. It is usually used in conjunction with the online banking U Shield to automatically press the buttons of the U Shield based on remote control instructions. Through physical buttons, users can confirm or cancel transactions after verifying transaction information, ensuring the security of online banking transactions.

[0003] In actual use, the online banking U shield needs to communicate with the bank's server. The speed of data loading depends on the local network. When conducting security monitoring of online banking use in large-scale online banking U shield hosting situations, it is necessary to focus on the security connection of the network. In the existing technology, the USB-AI robot is an intelligent device that can be connected to a computer or other device through a USB interface, and can remotely manage the online banking U shield inserted into the USB-HUB, providing users with an efficient use scenario for convenient business operations.

[0004] However, due to business needs or management requirements, many enterprises or organizations choose to centralize multiple online banking U-Shields and have them managed uniformly by dedicated personnel or professional teams. In large-scale online banking U-Shield hosting situations, data transmission between the local area network and the public network needs to pass through multiple network nodes, and the network configuration needs to be continuously monitored and maintained. If the network connection cannot be effectively managed, the data transmission speed will be too slow, the transaction response time will be delayed, and the performance pressure on network equipment and servers will be caused, affecting transaction efficiency. Summary of the invention

[0005] The purpose of the present invention is to provide a network security intelligent monitoring method and system for a bank shield key device, which can meet the use requirements of the bank shield key device in multiple network scenarios, monitor the network security of the bank shield key device and the online banking connection, and solve the problems raised in the above background technology.

[0006] In order to solve the above technical problems, the present invention provides the following technical solutions: a network security intelligent monitoring method for a bank shield keypad, the method comprising:

[0007] Step S1: number the online banking U shield inserted into the USB-HUB, and obtain the historical network traffic data of the online banking U shield when it is in working state; monitor the network connection status of the bank shield keypad, collect the connection IP of the bank shield keypad, and obtain the operation data of the bank shield keypad;

[0008] Step S2: Process the historical usage data of the online banking U shield, analyze the network data characteristics of the online banking U shield, and generate the network usage standard of the online banking U shield inserted into the USB-HUB;

[0009] Step S3: Combined with the usage behavior data of the online banking U shield, the network connection status of the bank shield key device is analyzed through the intelligent network detection model to calculate the network connection risk value of the bank shield key device;

[0010] Step S4: Determine whether to issue a warning for network security based on the network connection risk value of the Bank Shield keypad; and issue optimization suggestions to relevant personnel to configure firewall rules.

[0011] Furthermore, the step S1 specifically includes the following steps:

[0012] Step S101: numbering the online banking U shields according to the order in which the online banking U shields are inserted into the USB-HUB, obtaining the historical network traffic data of the online banking U shields with different numbers when in working state, cleaning the historical network traffic data of the online banking U shields when in working state according to the log records, and integrating and generating the network traffic data range of the online banking U shields when in normal working state;

[0013] The network traffic data range is recorded as [L min , L max ], where L min Indicates the minimum network traffic of the online banking U shield when there is no abnormal working state, L max It indicates the maximum value of network traffic when the online banking U shield is in normal working state;

[0014] Step S102: Monitor the network connection status of the bank shield key device, collect the connection IP of the bank shield key device corresponding to the online banking U shield, and record the connection IP of the bank shield key device corresponding to the online banking U shield numbered i as D_IP i ;

[0015] Step S103: In the historical operation log of the bank shield keypad, the operation behavior characteristics of each bank shield keypad are identified. The operation behavior characteristics represent the average time from the bank shield keypad initiating a command from the device to which the corresponding IP address belongs to the bank shield keypad completing the key operation. The operation behavior characteristics of the bank shield keypad corresponding to the online banking U shield numbered i are recorded as TQ i , and generate an operational behavior feature set, denoted as TQ = {TQ i |i∈[1,n]}, where n represents the maximum number of online banking U-Shield.

[0016] Furthermore, the step S2 specifically includes:

[0017] Step S201: Record the network data characteristics of the online banking U shield according to the historical usage data of the online banking U shield, and record the network data characteristics of any operation of the online banking U shield i as i_t k (IP k , L k ), where t k Indicates the starting time point corresponding to the kth use of the online banking U shield i, IP k , L k They represent the operation IP and network traffic generated by the k-th use of the online banking U shield i; k∈[1,m], m represents the total number of network data features of the online banking U shield i;

[0018] Step S202: Calculate the current network quality index of the online banking USB shield i in the USB-HUB in combination with the network data characteristics of each numbered online banking USB shield. The specific calculation formula is as follows:

[0019]

[0020] Among them, IP m+1 Indicates the operation IP corresponding to the m+1th use of online banking U shield i; if m+1 (i) represents the conditional discriminant function, if the network traffic generated by the k-th use of the online banking U shield i does not belong to the network traffic data range [L min , L max ], then if m+1 (i) = 0; if the network traffic generated by the k-th use of the online banking U shield i belongs to the network traffic data range [L min , L max ],but L m+1 Indicates the network traffic generated by the m+1th use of Online Banking U Shield i;

[0021] Step S203: Generate network usage standards for each online banking U-Shield inserted into the USB-HUB based on the network quality index of the online banking U-Shield; set that when the network quality index of any online banking U-Shield is less than or equal to 1, it is determined that the online banking U-Shield does not meet the network usage standards, and the online banking U-Shield that does not meet the network usage standards is reported, and the online banking business operation is suspended; when the network quality index of the online banking U-Shield is greater than 1, it is determined that the online banking U-Shield meets the network usage standards and the online banking business operation continues.

[0022] Furthermore, the step S3 is specifically as follows:

[0023] Retrieve the connection IP of the bank shield keypad corresponding to each online banking U shield, analyze the network connection status of the bank shield keypad through the intelligent network detection model, and calculate the network connection risk value of the bank shield keypad corresponding to the online banking U shield i according to the following formula:

[0024]

[0025] Where WZ(i) represents the network connection risk value of the bank shield keypad corresponding to the online banking U shield i, μ represents the integral variable; 6 represents the confidence level of the bank shield keypad corresponding to the online banking U shield i; i_t k +TQ i represents the network connection characteristic variable of the bank shield key press corresponding to the online banking U shield i, and the network connection characteristic variable satisfies the cumulative distribution function; A represents the maximum network connection risk value of the bank shield key press under the confidence level 6; d μ represents the integral differential element;

[0026] Specifically, A = -inf{x∈R:P(it k +TQ i ≤x)≥1-δ}, where, P(i_t k +TQ i ≤x) represents the variable i_t k +TQ i The probability of being less than or equal to a certain value x, inf represents the infimum function, taking the minimum value; R represents the set of real numbers;

[0027] Furthermore, the step S4 specifically includes:

[0028] Step S401: Based on the result of determining whether the online banking U-Shield complies with the network usage standards in step S2, optimization suggestions are issued to relevant personnel to manage online banking transactions;

[0029] Step S402: According to the network connection risk value of the bank shield button in step S3, when the network connection risk value of any bank shield button is greater than the preset security threshold, it is determined that the bank shield button has a network security risk, and the bank shield button corresponding to the online banking U shield has a network security risk, an early warning is issued to relevant personnel, the number of the online banking U shield with network security risk is reported, and the firewall rules are configured.

[0030] A network security intelligent monitoring system for bank shield keypad, comprising: a network connection monitoring module, a network data processing module, a network analysis module and an intelligent management module;

[0031] The network connection monitoring module is used to monitor the network connection status of the online banking U shield and the bank shield keypad, and collect relevant data of the network connection;

[0032] The network data processing module is used to process the monitoring data output by the network connection monitoring module, analyze the network data characteristics of the online banking USB shield, and generate the network usage standard of the online banking USB shield inserted into the USB-HUB;

[0033] The network analysis module is used to analyze the network connection status of the bank shield key device by combining the usage behavior data of the online banking U shield through the intelligent network detection model, and calculate the network connection risk value of the bank shield key device;

[0034] The intelligent management module is used to warn of the network connection risks of the online banking U shield and the bank shield keypad according to the analysis results output by the network analysis module, and to manage online banking transactions.

[0035] Further, the network connection monitoring module includes an online banking U shield monitoring unit and a bank shield keypad monitoring unit;

[0036] The online banking U shield monitoring unit is used to number the online banking U shields inserted into the USB-HUB, obtain the historical network traffic data of each numbered online banking U shield when in working state, clean the historical network traffic data of the online banking U shield when in working state according to the log records, and integrate and generate the network traffic data range of the online banking U shield when there is no abnormal working state;

[0037] The bank shield keypad monitoring unit is used to monitor the network connection status of the bank shield keypad, collect the connection IP of the bank shield keypad corresponding to the online banking U shield, and record the connection IP of the bank shield keypad corresponding to the online banking U shield numbered i as D_IP i .

[0038] Further, the network data processing module includes a feature extraction unit, a network quality analysis unit and a network usage standard determination unit;

[0039] The feature extraction unit is used to record the network data features of the online banking U shield according to the historical usage data of the online banking U shield, and record the network data features of any operation of the online banking U shield i as i_t k (IP k , L k ), where t k Indicates the starting time point corresponding to the kth use of the online banking U shield i, IP k , L k They represent the operation IP and network traffic generated by the k-th use of the online banking U shield i; k∈[1,m], m represents the total number of network data features of the online banking U shield i;

[0040] The network quality analysis unit is used to calculate the current network quality index of the online banking USB shield i in the USB-HUB by combining the network data characteristics of each numbered online banking USB shield;

[0041] The network usage standard determination unit generates a network usage standard for each online banking U shield inserted into the USB-HUB based on the network quality index of the online banking U shield; it is set that when the network quality index of any online banking U shield is less than or equal to 1, the online banking U shield is determined to not meet the network usage standard, the online banking U shield that does not meet the network usage standard is reported, and the online banking business operation is suspended; when the network quality index of the online banking U shield is greater than 1, the online banking U shield is determined to meet the network usage standard, and the online banking business operation is continued.

[0042] Furthermore, the intelligent management module includes a risk warning unit and a rule configuration unit;

[0043] The risk warning unit is used to warn of the network connection risk of the online banking U shield and the bank shield key device according to the analysis results output by the network data processing module and the network analysis module;

[0044] The rule configuration unit is used to configure the firewall rules according to the warning information.

[0045] Compared with the prior art, the beneficial effects achieved by the present invention are:

[0046] The present invention monitors the network connection status of the online banking U shield and the bank shield key device through a network connection monitoring module, collects relevant data of the network connection, performs real-time monitoring and rapid response to online banking services, can promptly discover abnormal behaviors and take measures, and reduces the impact of network security incidents.

[0047] The monitoring data output by the network connection monitoring module is processed through the network data processing module, the network data characteristics of the online banking U shield are analyzed, and the network usage standard of the online banking U shield inserted into the USB-HUB is generated; it can deeply analyze the network behavior and usage mode of the online banking U shield, and can more effectively identify and prevent potential network security threats.

[0048] Through the network analysis module, combined with the usage behavior data of the online banking U shield, the network connection status of the bank shield keypad is analyzed through the intelligent network detection model, and the network connection risk value of the bank shield keypad is calculated; based on the network connection of the bank shield keypad, the network behavior is judged, which can improve the efficiency of security monitoring;

[0049] Based on the analysis results output by the network analysis module, the intelligent management module can issue early warnings on the network connection risks of the online banking U-Shield and Bank Shield keypad, and manage online banking transactions; it can help security managers respond to potential security incidents in a timely manner and take corresponding measures. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings:

[0051] Figure 1 It is a structural schematic diagram of a network security intelligent monitoring method for a bank shield key device of the present invention;

[0052] Figure 2 The present invention is a structural schematic diagram of a network security intelligent monitoring system for a bank shield keypad. DETAILED DESCRIPTION

[0053] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0054] See also Figure 1 , in the first embodiment: a network security intelligent monitoring system for a bank shield keypad is provided, comprising: a network connection monitoring module, a network data processing module, a network analysis module and an intelligent management module;

[0055] The network connection monitoring module is used to monitor the network connection status of the online banking U shield and the bank shield keypad, and collect relevant data of the network connection; it includes an online banking U shield monitoring unit and a bank shield keypad monitoring unit;

[0056] The online banking U shield monitoring unit is used to number the online banking U shields inserted into the USB-HUB, obtain the historical network traffic data of each numbered online banking U shield when in working state, clean the historical network traffic data of the online banking U shield when in working state according to the log records, and integrate and generate the network traffic data range of the online banking U shield when there is no abnormal working state;

[0057] The bank shield keypad monitoring unit is used to monitor the network connection status of the bank shield keypad, collect the connection IP of the bank shield keypad corresponding to the online banking U shield, and record the connection IP of the bank shield keypad corresponding to the online banking U shield numbered i as D_IP i .

[0058] The network data processing module is used to process the monitoring data output by the network connection monitoring module, analyze the network data characteristics of the online banking USB shield, and generate the network usage standard of the online banking USB shield inserted into the USB-HUB; it includes a feature extraction unit, a network quality analysis unit and a network usage standard determination unit;

[0059] The feature extraction unit is used to record the network data features of the online banking U shield according to the historical usage data of the online banking U shield, and record the network data features of any operation of the online banking U shield i as i_t k (IP k , L k ), where t k Indicates the starting time point corresponding to the kth use of the online banking U shield i, IP k , L k They represent the operation IP and network traffic generated by the k-th use of the online banking U shield i; k∈[1,m], m represents the total number of network data features of the online banking U shield i;

[0060] The network quality analysis unit is used to calculate the current network quality index of the online banking USB shield i in the USB-HUB by combining the network data characteristics of each numbered online banking USB shield;

[0061] The network usage standard determination unit generates a network usage standard for each online banking U shield inserted into the USB-HUB based on the network quality index of the online banking U shield; it is set that when the network quality index of any online banking U shield is less than or equal to 1, the online banking U shield is determined to not meet the network usage standard, the online banking U shield that does not meet the network usage standard is reported, and the online banking business operation is suspended; when the network quality index of the online banking U shield is greater than 1, the online banking U shield is determined to meet the network usage standard, and the online banking business operation is continued.

[0062] The network analysis module is used to analyze the network connection status of the bank shield key device by combining the usage behavior data of the online banking U shield through the intelligent network detection model, and calculate the network connection risk value of the bank shield key device;

[0063] The intelligent management module is used to warn of the network connection risk of the online banking U shield and the bank shield keypad according to the analysis results output by the network analysis module, and manage online banking transactions, including a risk warning unit and a rule configuration unit;

[0064] The risk warning unit is used to warn of the network connection risk of the online banking U shield and the bank shield key device according to the analysis results output by the network data processing module and the network analysis module;

[0065] The rule configuration unit is used to configure the firewall rules according to the warning information.

[0066] See also Figure 2 In the second embodiment, a network security intelligent monitoring method for a bank shield keypad is provided, comprising:

[0067] Step S1: number the online banking U shield inserted into the USB-HUB, and obtain the historical network traffic data of the online banking U shield when it is in working state; monitor the network connection status of the bank shield keypad, collect the connection IP of the bank shield keypad, and obtain the operation data of the bank shield keypad;

[0068] Step S101: numbering the online banking U shields according to the order in which the online banking U shields are inserted into the USB-HUB, obtaining the historical network traffic data of the online banking U shields with different numbers when in working state, cleaning the historical network traffic data of the online banking U shields when in working state according to the log records, and integrating and generating the network traffic data range of the online banking U shields when in normal working state;

[0069] The network traffic data range is recorded as [L min , L max ], where L min Indicates the minimum network traffic of the online banking U shield when there is no abnormal working state, L max It indicates the maximum value of network traffic when the online banking U shield is in normal working state;

[0070] Step S102: Monitor the network connection status of the bank shield key device, collect the connection IP of the bank shield key device corresponding to the online banking U shield, and record the connection IP of the bank shield key device corresponding to the online banking U shield numbered i as D_IP i ;

[0071] It should be noted that in network communication, IP addresses are used to identify devices that send and receive data. For the Bank Shield keypad, the connection IP refers to the IP address of the system or host device connected to it; the keypad itself is not directly connected to the network, but the remote control instructions it receives need to be transmitted through the network. When the keypad is connected to the system, the connection IP of the Bank Shield keypad is the network IP address of the system; when the keypad is connected to a host device through USB or other interfaces, the connection IP of the Bank Shield keypad is the network IP address of the host device;

[0072] Step S103: In the historical operation log of the bank shield keypad, the operation behavior characteristics of each bank shield keypad are identified. The operation behavior characteristics represent the average time from the bank shield keypad initiating a command from the device to which the corresponding IP address belongs to the bank shield keypad completing the key operation. The operation behavior characteristics of the bank shield keypad corresponding to the online banking U shield numbered i are recorded as TQ i , and generate an operational behavior feature set, denoted as TQ = {TQ i |i∈[1,n]}, where n represents the maximum number of online banking U-Shield;

[0073] In the scenario of large-scale online banking USB-Shield hosting, when using the Bank Shield keypad to remotely manage the online banking USB-Shield inserted into the USB-HUB, the keypad is usually connected to the system used to remotely manage and control USB devices. At this time, the communication between the keypad and the system is carried out through the local area network.

[0074] Step S2: Process the historical usage data of the online banking U shield, analyze the network data characteristics of the online banking U shield, and generate the network usage standard of the online banking U shield inserted into the USB-HUB;

[0075] Step S201: Record the network data characteristics of the online banking U shield according to the historical usage data of the online banking U shield, and record the network data characteristics of any operation of the online banking U shield i as i_t k (IP k , L k ), where t k Indicates the starting time point corresponding to the kth use of the online banking U shield i, IP k , L k They represent the operation IP and network traffic generated by the k-th use of the online banking U shield i; k∈[1,m], m represents the total number of network data features of the online banking U shield i;

[0076] Step S202: Calculate the current network quality index of the online banking USB shield i in the USB-HUB in combination with the network data characteristics of each numbered online banking USB shield. The specific calculation formula is as follows:

[0077]

[0078] Among them, IP m+1 Indicates the operation IP corresponding to the m+1th use of online banking U shield i; if m+1 (i) represents the conditional discriminant function, if the network traffic generated by the k-th use of the online banking U shield i does not belong to the network traffic data range [L min , L max ], then if m+1 (i) = 0; if the network traffic generated by the k-th use of the online banking U shield i belongs to the network traffic data range [L min , L max ],but L m+1 Indicates the network traffic generated by the m+1th use of Online Banking U Shield i;

[0079] Step S203: Generate network usage standards for each online banking U-Shield inserted into the USB-HUB based on the network quality index of the online banking U-Shield; set that when the network quality index of any online banking U-Shield is less than or equal to 1, it is determined that the online banking U-Shield does not meet the network usage standards, and the online banking U-Shield that does not meet the network usage standards is reported, and the online banking business operation is suspended; when the network quality index of the online banking U-Shield is greater than 1, it is determined that the online banking U-Shield meets the network usage standards and the online banking business operation continues.

[0080] Step S3: Combined with the usage behavior data of the online banking U shield, the network connection status of the bank shield key device is analyzed through the intelligent network detection model to calculate the network connection risk value of the bank shield key device;

[0081] Retrieve the connection IP of the bank shield keypad corresponding to each online banking U shield, analyze the network connection status of the bank shield keypad through the intelligent network detection model, and calculate the network connection risk value of the bank shield keypad corresponding to the online banking U shield i according to the following formula:

[0082]

[0083] Wherein, WZ(i) represents the network connection risk value of the bank shield keypad corresponding to the online banking U shield i, μ represents the integral variable; 6 represents the confidence level of the bank shield keypad corresponding to the online banking U shield i, illustratively, δ=0.05; i_t k +TQ i represents the network connection characteristic variable of the bank shield key press corresponding to the online banking U shield i, and the network connection characteristic variable satisfies the cumulative distribution function; A represents the maximum network connection risk value of the bank shield key press under the confidence level 6; d μ represents the integral differential element;

[0084] Specifically, A = -inf{x∈R:P(it k +TQ i ≤x)≥1-δ}, where, P(i_t k +TQ i ≤x) represents the variable i_t k +TQ i The probability of being less than or equal to a certain value x, inf represents the infimum function, taking the minimum value; R represents the set of real numbers;

[0085] Step S4: Determine whether to issue a warning for network security based on the network connection risk value of the Bank Shield keypad; and issue optimization suggestions to relevant personnel to configure firewall rules;

[0086] Step S401: Based on the result of determining whether the online banking U-Shield meets the network usage standards in step S2, optimization suggestions are issued to relevant personnel to manage online banking transactions; the optimization suggestions may be to set up routers or switches, adjust bandwidth restrictions on the use of the online banking U-Shield, and ensure network performance when handling online banking services.

[0087] Step S402: According to the network connection risk value of the bank shield button in step S3, when the network connection risk value of any bank shield button is greater than the preset security threshold, it is determined that the bank shield button has a network security risk, and the bank shield button corresponding to the online banking U shield has a network security risk, an early warning is issued to relevant personnel, the number of the online banking U shield with network security risk is reported, and the firewall rules are configured.

[0088] In one embodiment, when When the bank shield keypad is determined to have network security risks, D_IP i′ Indicates the current connection IP of the bank shield keypad corresponding to the online banking U shield numbered i;

[0089] In one embodiment, configuring firewall rules includes:

[0090] Define time scheduling rules and specify the time period during which public IP access is allowed;

[0091] Create a rule to allow traffic from a specified public IP address to pass through during a set time period; allow traffic from a specified LAN IP address to pass through at all times; and deny traffic from all IP addresses that do not meet the above two conditions;

[0092] Save the configuration, apply the new rule set on the firewall, and configure NAT rules based on the firewall rules.

[0093] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

[0094] Finally, it should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art can still modify the technical solutions described in the aforementioned embodiments or replace some of the technical features therein by equivalents. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A network security intelligent monitoring method for a bank shield keypad, characterized in that: The method comprises: Step S1: number the online banking U shield inserted into the USB-HUB, and obtain the historical network traffic data of the online banking U shield when it is in working state; monitor the network connection status of the bank shield keypad, collect the connection IP of the bank shield keypad, and obtain the operation data of the bank shield keypad; Step S2: Process the historical usage data of the online banking U shield, analyze the network data characteristics of the online banking U shield, and generate the network usage standard of the online banking U shield inserted into the USB-HUB; Step S3: Combined with the usage behavior data of the online banking U shield, the network connection status of the bank shield key device is analyzed through the intelligent network detection model to calculate the network connection risk value of the bank shield key device; Step S4: Determine whether to issue a warning for network security based on the network connection risk value of the Bank Shield keypad; and issue optimization suggestions to relevant personnel to configure firewall rules.

2. A network security intelligent monitoring method for a bank shield key device according to claim 1, characterized in that: The step S1 specifically includes the following steps: Step S101: numbering the online banking U shields according to the order in which the online banking U shields are inserted into the USB-HUB, obtaining the historical network traffic data of the online banking U shields with different numbers when in working state, cleaning the historical network traffic data of the online banking U shields when in working state according to the log records, and integrating and generating the network traffic data range of the online banking U shields when in normal working state; The network traffic data range is recorded as [L min , L max ], where L min Indicates the minimum network traffic of the online banking U shield when there is no abnormal working state, L max It indicates the maximum value of network traffic when the online banking U shield is in normal working state; Step S102: Monitor the network connection status of the bank shield key device, collect the connection IP of the bank shield key device corresponding to the online banking U shield, and record the connection IP of the bank shield key device corresponding to the online banking U shield numbered i as D_IP i ; Step S103: In the historical operation log of the bank shield keypad, the operation behavior characteristics of each bank shield keypad are identified. The operation behavior characteristics represent the average time from the bank shield keypad initiating a command from the device to which the corresponding IP address belongs to the bank shield keypad completing the key operation. The operation behavior characteristics of the bank shield keypad corresponding to the online banking U shield numbered i are recorded as TQ i , and generate an operational behavior feature set, denoted as TQ = {TQ i |i∈[1,n]}, where n represents the maximum number of online banking U-Shield.

3. A network security intelligent monitoring method for a bank shield key device according to claim 1, characterized in that: The step S2 specifically includes: Step S201: Record the network data characteristics of the online banking U shield according to the historical usage data of the online banking U shield, and record the network data characteristics of any operation of the online banking U shield i as i_t k (IP k , L k ), where t k Indicates the starting time point corresponding to the kth use of the online banking U shield i, IP k , L k They represent the operation IP and network traffic generated by the k-th use of the online banking U shield i; k∈[1,m], m represents the total number of network data features of the online banking U shield i; Step S202: Calculate the current network quality index of the online banking USB shield i in the USB-HUB in combination with the network data characteristics of each numbered online banking USB shield. The specific calculation formula is as follows: Among them, IP m+1 Indicates the operation IP corresponding to the m+1th use of online banking U shield i; if m+1 (i) represents the conditional discriminant function, if the network traffic generated by the k-th use of the online banking U shield i does not belong to the network traffic data range [L min , L max ], then if m+1 (i) = 0; if the network traffic generated by the k-th use of the online banking U shield i belongs to the network traffic data range [L min , L max ],but L m+1 Indicates the network traffic generated by the m+1th use of Online Banking U Shield i; Step S203: Generate network usage standards for each online banking U-Shield inserted into the USB-HUB based on the network quality index of the online banking U-Shield; set that when the network quality index of any online banking U-Shield is less than or equal to 1, it is determined that the online banking U-Shield does not meet the network usage standards; when the network quality index of the online banking U-Shield is greater than 1, it is determined that the online banking U-Shield meets the network usage standards.

4. A network security intelligent monitoring method for a bank shield key device according to claim 1, characterized in that: The step S3 is specifically as follows: Retrieve the connection IP of the bank shield keypad corresponding to each online banking U shield, analyze the network connection status of the bank shield keypad through the intelligent network detection model, and calculate the network connection risk value of the bank shield keypad corresponding to the online banking U shield i according to the following formula: Among them, WZ(i) represents the network connection risk value of the bank shield keypad corresponding to the online banking U shield i, μ represents the integral variable; δ represents the confidence level of the bank shield keypad corresponding to the online banking U shield i; i_t k +TQ i represents the network connection characteristic variable of the bank shield key device corresponding to the online banking U shield i; A represents the maximum network connection risk value of the bank shield key device under the confidence level δ; dμ represents the integral differential element.

5. A network security intelligent monitoring method for a bank shield key device according to claim 1, characterized in that: The step S4 specifically includes: Step S401: Based on the result of determining whether the online banking U-Shield complies with the network usage standards in step S2, optimization suggestions are issued to relevant personnel to manage online banking transactions; Step S402: According to the network connection risk value of the bank shield button in step S3, when the network connection risk value of any bank shield button is greater than the preset security threshold, it is determined that the bank shield button has a network security risk, and the bank shield button corresponding to the online banking U shield has a network security risk, an early warning is issued to relevant personnel, the number of the online banking U shield with network security risk is reported, and the firewall rules are configured.

6. A network security intelligent monitoring system for a bank shield keypad, executing a network security intelligent monitoring method for a bank shield keypad as described in any one of claims 1 to 5, characterized in that: include: Network connection monitoring module, network data processing module, network analysis module and intelligent management module; The network connection monitoring module is used to monitor the network connection status of the online banking U shield and the bank shield keypad, and collect relevant data of the network connection; The network data processing module is used to process the monitoring data output by the network connection monitoring module, analyze the network data characteristics of the online banking USB shield, and generate the network usage standard of the online banking USB shield inserted into the USB-HUB; The network analysis module is used to analyze the network connection status of the bank shield key device by combining the usage behavior data of the online banking U shield through the intelligent network detection model, and calculate the network connection risk value of the bank shield key device; The intelligent management module is used to warn of the network connection risks of the online banking U shield and the bank shield keypad according to the analysis results output by the network analysis module, and to manage online banking transactions.

7. The network security intelligent monitoring system for bank shield keypad according to claim 6 is characterized by: The network connection monitoring module includes an online banking U shield monitoring unit and a bank shield keypad monitoring unit; The online banking U shield monitoring unit is used to number the online banking U shields inserted into the USB-HUB, obtain the historical network traffic data of each numbered online banking U shield when in working state, clean the historical network traffic data of the online banking U shield when in working state according to the log records, and integrate and generate the network traffic data range of the online banking U shield when there is no abnormal working state; The bank shield keypad monitoring unit is used to monitor the network connection status of the bank shield keypad, collect the connection IP of the bank shield keypad corresponding to the online banking U shield, and record the connection IP of the bank shield keypad corresponding to the online banking U shield numbered i as D_IP i .

8. The network security intelligent monitoring system for bank shield keypad according to claim 6 is characterized by: The network data processing module includes a feature extraction unit, a network quality analysis unit and a network usage standard determination unit; The feature extraction unit is used to record the network data features of the online banking U shield according to the historical usage data of the online banking U shield, and record the network data features of any operation of the online banking U shield i as i_t k (IP k , L k ), where t k Indicates the starting time point corresponding to the kth use of the online banking U shield i, IP k , L k They represent the operation IP and network traffic generated by the k-th use of the online banking U shield i; k∈[1,m], m represents the total number of network data features of the online banking U shield i; The network quality analysis unit is used to calculate the current network quality index of the online banking USB shield i in the USB-HUB by combining the network data characteristics of each numbered online banking USB shield; The network usage standard determination unit generates a network usage standard for each online banking U shield inserted into the USB-HUB based on the network quality index of the online banking U shield; it is set that when the network quality index of any online banking U shield is less than or equal to 1, it is determined that the online banking U shield does not meet the network usage standard; when the network quality index of the online banking U shield is greater than 1, it is determined that the online banking U shield meets the network usage standard.

9. The network security intelligent monitoring system for bank shield keypad according to claim 6 is characterized by: The intelligent management module includes a risk warning unit and a rule configuration unit; The risk warning unit is used to warn of the network connection risk of the online banking U shield and the bank shield key device according to the analysis results output by the network data processing module and the network analysis module; The rule configuration unit is used to configure the firewall rules according to the warning information.

Images