An Information Security Management System Based on Neural Network Model

Abstract

The invention discloses an information security management system based on a neural network model, and relates to the technical field of information security management. The invention comprises: an information security management unit, an information security processing unit and a local database. The invention performs intelligent abnormal behavior analysis through the access behavior of each IP address of a web page, such as URL request and user agent character string and other data, thereby improving the security of the web page, and simultaneously uses a neural network to perform dynamic crawler analysis. When network traffic fluctuates, the set threshold is dynamically adjusted to reduce the incidence of misidentification of crawler behavior and the situation where normal users are mistakenly blocked, thereby improving the user experience, and performing IP blocking processing and user agent character string blacklist processing on each crawler IP address of a web page within a monitoring interval, thereby reducing the harm of crawler attacks.

Description

Technical Field

[0001] The present invention relates to the technical field of information security management, and in particular to an information security management system based on a neural network model. Background Art

[0002] A crawler attack is an attack that uses automated programs to access a website in order to obtain information on the website. Since crawler attacks are often used for illegal purposes, such as stealing personal information, grabbing sensitive data, or committing online fraud, it is very important to identify and defend against them. Neural networks have self-learning and adaptive capabilities and can process complex nonlinear data. Therefore, it is necessary to use neural networks to perform anti-crawler information security management.

[0003] The prior art, such as the invention patent application with announcement number: CN113987512B, discloses a method for assessing security risks of information systems, which includes: constructing a dynamic security game model; solving the optimal attack strategy based on the dynamic security game model; using the dynamic security game model to generate the optimal attack strategy of the information system, and the value output by the neural network model is the security level of the information system. This invention realizes information security game in a dynamic attack and defense environment by constructing a dynamic security game model, and uses the dynamic security game model to generate the optimal attack strategy of the information system, and uses the neural network model to generate the security level of the information system in real time, thereby realizing real-time assessment of information system security risks.

[0004] The prior art, such as the information security risk assessment system and method disclosed in the invention patent application with announcement number: CN116702156B, includes: obtaining security information to be evaluated, obtaining multi-scale security information and then fusing it to obtain a classification result for representing the risk level of the security information to be evaluated. In this way, an information security risk assessment scheme is constructed, which realizes rapid and automated assessment, reduces the risk of manual intervention and misjudgment, and thus helps users more accurately assess the risk level of the security information to be evaluated.

[0005] It can be seen from the above scheme that the current information security management system lacks certain attention to the crawler feature analysis of the user agent string and URL request of the web page. The crawler program usually uses its own unique user agent string to send requests, and the crawler attack usually tries to request some non-existent URLs, which may be randomly generated or obtained by other means. If these data are not analyzed and calculated, the security of the web page will be reduced. At the same time, there is a lack of attention to the use of neural networks for dynamic crawler analysis. The existing technology often adopts static crawler analysis. When the data anomaly coefficient of the access information of the web page is identified to exceed the preset threshold, anti-crawling is performed. In actual applications, due to the fluctuation of network traffic, the preset threshold should also need to be dynamically changed. If it is not dynamically adjusted, it is easy to misidentify the crawler behavior, resulting in normal users being mistakenly blocked, thereby reducing the user experience. Summary of the invention

[0006] The purpose of the present invention is to provide an information security management system based on a neural network model, which solves the problems existing in the background technology.

[0007] To solve the above technical problems, the present invention adopts the following technical solutions: The present invention provides an information security management system based on a neural network model, including: an information security management unit, which is used to monitor data on a web page, obtain access information of each IP address of the web page within the monitoring interval, and analyze the access threat coefficient of each IP address of the web page within the monitoring interval, so as to screen the crawler IP addresses of the web page within the monitoring interval.

[0008] The information security management unit includes: a network access information acquisition module, an information preprocessing module, and an information analysis module.

[0009] The network access information acquisition module is used to obtain the monitoring interval duration from the local database, perform data monitoring once every monitoring interval duration, obtain the total network traffic of the web page within the monitoring interval duration, the IP address of each access record, the access time point, the user agent string, the request characteristics of the URL request, and the access data at the current monitoring time point, and map the access time point, the user agent string, the request characteristics of the URL request, and the access data of each access record of each IP address of the web page within the monitoring interval duration.

[0010] The information preprocessing module is used to analyze the network traffic anomaly coefficient of the web page and analyze each access anomaly coefficient of each IP address within the monitoring interval of the web page.

[0011] The information analysis module is used to analyze the crawler similarity coefficient of each IP address of the web page within the monitoring interval, so as to screen each crawler IP address of the web page within the monitoring interval.

[0012] The information security processing unit is used to perform IP blocking processing and user agent string blacklisting processing on each crawler IP address of the web page within the monitoring interval.

[0013] The information security processing unit includes: an IP blocking module and a user agent character string blacklisting module.

[0014] The IP ban module is used to extract the crawler similarity coefficient of each crawler IP address of the web page within the monitoring interval according to the crawler similarity coefficient of each IP address of the web page within the monitoring interval, obtain the ban time corresponding to each crawler similarity coefficient interval from the local database, and map the ban time of each crawler IP address of the web page within the monitoring interval. Each crawler IP address of the web page within the monitoring interval cannot access the web page within the ban time.

[0015] The user agent string blacklisting module is used to extract the user agent string of each access record of each crawler IP address of the web page within the monitoring interval according to the user agent string of each access record of each IP address of the web page within the monitoring interval, count the user agent strings of the web page within the monitoring interval, and not allow access to the web page through the user agent strings of the web page within the monitoring interval during the ban period.

[0016] The beneficial effects of the present invention are as follows: (1) The information security management unit of the present invention performs intelligent abnormal behavior analysis through the access behavior of each IP address of the web page, such as URL request and user agent string data, thereby improving the security of the web page, and uses a neural network to perform dynamic crawler analysis. When network traffic fluctuates, the set threshold is dynamically adjusted to reduce the incidence of misidentification of crawler behavior and the situation where normal users are mistakenly blocked, thereby improving the user experience.

[0017] (2) The information security processing unit of the present invention reduces the harm of crawler attacks by blocking the IP addresses of the crawlers and blacklisting the user agent strings within the monitoring interval of the web page. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0019] Figure 1 It is a schematic diagram of the system module of the present invention. DETAILED DESCRIPTION

[0020] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0021] Reference Figure 1 As shown, the present invention provides an information security management system based on a neural network model, including: an information security management unit, an information security processing unit and a local database.

[0022] It should be noted that the information security management unit is connected to the information security processing unit, and the local database is connected to the information security management unit and the information security processing unit.

[0023] It should also be noted that the local database is used to store the monitoring interval duration, the total network traffic of the web page at each historical current monitoring time point, the appropriate interval duration, each allowed user agent string, each abnormal request feature, the request anomaly coefficient adjustment parameter value corresponding to each access data, the screening model and calculation model of the anti-crawler neural network, the ban duration corresponding to each crawler similarity coefficient interval, and the access threat coefficient threshold.

[0024] The information security management unit is used to monitor data on the web page, obtain access information of each IP address of the web page within the monitoring interval, and analyze the access threat coefficient of each IP address of the web page within the monitoring interval, so as to screen the crawler IP addresses of the web page within the monitoring interval.

[0025] It should be noted that access information includes: the IP address of the access record, the access time, the user agent string, the request characteristics of the URL request, and the access data.

[0026] In a specific embodiment of the present invention, the information security management unit includes: a network access information acquisition module, an information preprocessing module, and an information analysis module.

[0027] The network access information acquisition module is used to obtain the monitoring interval duration from the local database, perform data monitoring once every monitoring interval duration, obtain the total network traffic of the web page within the monitoring interval duration, the IP address of each access record, the access time point, the user agent string, the request characteristics of the URL request, and the access data at the current monitoring time point, and map the access time point, the user agent string, the request characteristics of the URL request, and the access data of each access record of each IP address of the web page within the monitoring interval duration.

[0028] It should be noted that the request characteristics of the URL request include: obtaining resources, submitting data, deleting resources, invalidating requests, and other request characteristics.

[0029] In a specific embodiment, the total network traffic of a web page within a monitoring interval, the IP address of each access record, the access time point, the user agent string, the request characteristics of the URL request, and the access data are obtained by a specific method: the total network traffic of the web page within the monitoring interval is obtained from the background terminal of the web page, and the IP address of each access record of the web page within the monitoring interval, the access time point, the user agent string, the request characteristics of the URL request, and the access data are obtained from the web page log.

[0030] The information preprocessing module is used to analyze the network traffic anomaly coefficient of the web page and analyze each access anomaly coefficient of each IP address within the monitoring interval of the web page.

[0031] It should be noted that the access anomaly coefficients include: access time anomaly coefficient, proxy string anomaly coefficient and request anomaly coefficient.

[0032] The information analysis module is used to analyze the crawler similarity coefficient of each IP address of the web page within the monitoring interval, so as to screen each crawler IP address of the web page within the monitoring interval.

[0033] In a specific embodiment of the present invention, the network traffic anomaly coefficient of the web page is analyzed, and the specific analysis method is: obtaining the total network traffic of the web page at each historical current monitoring time point from the local database , where x represents the number of each historical current monitoring time point, , y is a positive integer greater than 2. Based on the total network traffic A of the web page during the monitoring interval, the network traffic anomaly coefficient of the web page is calculated. , where e is a natural constant and y represents the number of historical current monitoring time points.

[0034] In a specific embodiment of the present invention, the access anomaly coefficient of each IP address of the web page within the monitoring interval is analyzed, and the specific analysis method is: based on the access time point of each access record of each IP address of the web page within the monitoring interval, the access time anomaly coefficient of each IP address of the web page within the monitoring interval is analyzed.

[0035] According to the user agent string of each access record of each IP address of the web page within the monitoring interval, the agent string abnormality coefficient of each IP address of the web page within the monitoring interval is calculated.

[0036] According to the request characteristics and access data of the URL requests of each access record of each IP address of the web page within the monitoring interval, the request anomaly coefficient of each IP address of the web page within the monitoring interval is evaluated.

[0037] The access time anomaly coefficient, proxy string anomaly coefficient and request anomaly coefficient of each IP address of the web page within the monitoring interval are summarized as each access anomaly coefficient.

[0038] In a specific embodiment of the present invention, the abnormal coefficient of access time of each IP address of the web page within the monitoring interval is analyzed, and the specific analysis method is: according to the access time point of each access record of each IP address of the web page within the monitoring interval, the interval time between each access record of each IP address of the web page within the monitoring interval and the next access record is calculated. , where n represents the number of each IP address, , m is a positive integer greater than 2, i represents the number of each access record, , j is a positive integer greater than 2, and the fixed coefficient of the access frequency of each IP address of the web page within the monitoring interval is calculated , where j represents the number of access records.

[0039] Obtain the appropriate interval length B from the local database and calculate the access time anomaly coefficient of each IP address within the monitoring interval length of the web page .

[0040] In a specific embodiment of the present invention, the calculation method of the abnormal coefficient of the proxy string of each IP address of the web page within the monitoring interval is as follows: each user agent string is obtained from the local database, and the user agent string of each access record of each IP address of the web page within the monitoring interval is compared with each user agent string for similarity, so as to obtain the similarity between the user agent string of each access record of each IP address of the web page within the monitoring interval and each user agent string, and extract the maximum similarity of the user agent string of each access record of each IP address of the web page within the monitoring interval , calculate the proxy string anomaly coefficient of each IP address within the monitoring interval of the web page .

[0041] In a specific embodiment, the similarity between the user agent string of each access record of each IP address of the web page within the monitoring interval and each allowed user agent string is obtained by using the existing string similarity comparison technology to obtain the similarity between the user agent string of each access record of each IP address of the web page within the monitoring interval and each allowed user agent string.

[0042] In a specific embodiment of the present invention, the request anomaly coefficient of each IP address of the web page within the monitoring interval is evaluated, and its specific evaluation method is: each abnormal request feature is obtained from the local database, if the request feature of the URL request of a certain access record of a certain IP address of the web page within the monitoring interval is consistent with a certain abnormal request feature, then the access record is marked as an abnormal access record, thereby screening the abnormal access records of each IP address of the web page within the monitoring interval, and extracting the access data of each abnormal access record of each IP address of the web page within the monitoring interval.

[0043] Obtain the request anomaly coefficient adjustment parameter value corresponding to each access data from the local database, and map it to obtain the request anomaly coefficient adjustment parameter value of each abnormal access record of each IP address of the web page within the monitoring interval , where p represents the number of each abnormal access record, , q is a positive integer greater than 2, evaluating the request anomaly coefficient of each IP address within the monitoring interval of the web page .

[0044] It should be noted that the abnormal request characteristics include: invalid request, deleted resource and other request characteristics.

[0045] In a specific embodiment of the present invention, the crawler similarity coefficient of each IP address of the web page within the monitoring interval is analyzed, and its specific analysis method is: obtaining the screening model and calculation model of the anti-crawler neural network from the local database, and inputting the network traffic anomaly coefficient of the web page into the screening model of the anti-crawler neural network model, thereby obtaining the access time anomaly coefficient threshold, the proxy string anomaly coefficient threshold and the request anomaly coefficient threshold of the web page within the monitoring interval, and inputting each access anomaly coefficient of each IP address of the web page within the monitoring interval into the calculation model of the anti-crawler neural network, and outputting the crawler similarity coefficient of each IP address of the web page within the monitoring interval.

[0046] In a specific embodiment, the screening model of the anti-crawler neural network is as follows: the screening model of the anti-crawler neural network model stores the access time abnormality coefficient threshold, the proxy string abnormality coefficient threshold and the request abnormality coefficient threshold corresponding to each network traffic abnormality coefficient interval. After the network traffic abnormality coefficient of the web page is input into the screening model of the anti-crawler neural network model, the screening model of the anti-crawler neural network model will feedback the access time abnormality coefficient threshold, the proxy string abnormality coefficient threshold and the request abnormality coefficient threshold of the web page within the monitoring interval.

[0047] In a specific embodiment of the present invention, the calculation model of the anti-crawler neural network is as follows: ,in is the crawler similarity coefficient of each IP address of the web page within the monitoring interval, is the access time anomaly coefficient of each IP address within the monitoring interval of the web page. It is the proxy string anomaly coefficient of each IP address of the web page within the monitoring interval. is the request anomaly coefficient of each IP address of the web page within the monitoring interval, E is the access time anomaly coefficient threshold of the web page within the monitoring interval, F is the proxy string anomaly coefficient threshold of the web page within the monitoring interval, and G is the request anomaly coefficient threshold of the web page within the monitoring interval.

[0048] In a specific embodiment, the crawler IP addresses of the web page are filtered within the monitoring interval, and the specific screening method is: obtaining an access threat coefficient threshold from a local database, if the access threat coefficient of a certain IP address of the web page within the monitoring interval is greater than the access threat coefficient threshold, then marking the IP address as a crawler IP address, thereby filtering the crawler IP addresses of the web page within the monitoring interval.

[0049] The information security management unit of the present invention performs intelligent abnormal behavior analysis through the access behavior of each IP address of the web page, such as URL request and user agent string and other data, thereby improving the security of the web page, and uses a neural network to perform dynamic crawler analysis. When the network traffic fluctuates, the set threshold is dynamically adjusted to reduce the incidence of misidentification of crawler behavior and the situation where normal users are mistakenly blocked, thereby improving the user experience.

[0050] The information security processing unit is used to perform IP blocking processing and user agent character string blacklisting processing on each crawler IP address of the web page within the monitoring interval.

[0051] In a specific embodiment of the present invention, the information security processing unit includes: an IP blocking module and a user agent string blacklisting module.

[0052] The IP ban module is used to extract the crawler similarity coefficient of each crawler IP address of the web page within the monitoring interval according to the crawler similarity coefficient of each IP address of the web page within the monitoring interval, obtain the ban time corresponding to each crawler similarity coefficient interval from the local database, and map the ban time of each crawler IP address of the web page within the monitoring interval. Each crawler IP address of the web page within the monitoring interval cannot access the web page within the ban time.

[0053] The user agent string blacklisting module is used to extract the user agent string of each access record of each crawler IP address of the web page within the monitoring interval according to the user agent string of each access record of each IP address of the web page within the monitoring interval, count the user agent strings of the web page within the monitoring interval, and not allow access to the web page through the user agent strings of the web page within the monitoring interval during the ban period.

[0054] The information security processing unit of the present invention reduces the harm of crawler attacks by performing IP blocking processing and user agent character string blacklisting processing on each crawler IP address within the monitoring interval of the web page.

[0055] The above contents are merely examples and explanations of the concept of the present invention. Those skilled in the art may make various modifications or additions to the specific embodiments described or replace them in a similar manner. As long as they do not deviate from the concept of the invention or exceed the scope defined by the present invention, they shall all fall within the protection scope of the present invention.

Claims

1. An information security management system based on a neural network model, characterized in that: include: The information security management unit is used to monitor the data of the web page, obtain the access information of each IP address of the web page within the monitoring interval, and analyze the access threat coefficient of each IP address of the web page within the monitoring interval, so as to screen the crawler IP addresses of the web page within the monitoring interval; The information security management unit includes: a network access information acquisition module, an information preprocessing module, and an information analysis module; The network access information acquisition module is used to obtain the monitoring interval from the local database, perform data monitoring once every monitoring interval, obtain the total network traffic of the web page within the monitoring interval, the IP address of each access record, the access time point, the user agent string, the request characteristics of the URL request, and the access data at the current monitoring time point, and map the access time point, the user agent string, the request characteristics of the URL request, and the access data of each access record of each IP address of the web page within the monitoring interval; The information preprocessing module is used to analyze the network traffic anomaly coefficient of the web page and analyze the access anomaly coefficient of each IP address of the web page within the monitoring interval; The information analysis module is used to analyze the crawler similarity coefficient of each IP address of the web page within the monitoring interval, so as to screen each crawler IP address of the web page within the monitoring interval; The specific analysis method of analyzing the access anomaly coefficients of each IP address of the web page within the monitoring interval is as follows: According to the access time points of each access record of each IP address within the monitoring interval of the web page, the access time anomaly coefficient of each IP address within the monitoring interval of the web page is analyzed; Calculate the abnormal coefficient of the proxy string of each IP address of the web page within the monitoring interval according to the user proxy string of each access record of each IP address of the web page within the monitoring interval; According to the request characteristics and access data of the URL requests of each access record of each IP address of the web page within the monitoring interval, the request anomaly coefficient of each IP address of the web page within the monitoring interval is evaluated; The access time anomaly coefficient, proxy string anomaly coefficient and request anomaly coefficient of each IP address of the web page within the monitoring interval are summarized as each access anomaly coefficient; The specific analysis method of analyzing the abnormal coefficient of access time of each IP address of the web page within the monitoring interval is as follows: According to the access time points of each access record of each IP address within the monitoring interval of the web page, calculate the interval between each access record of each IP address within the monitoring interval and the next access record , where n represents the number of each IP address, , m is a positive integer greater than 2, i represents the number of each access record, , j is a positive integer greater than 2, and the fixed coefficient of the access frequency of each IP address of the web page within the monitoring interval is calculated , where j represents the number of access records; Obtain the appropriate interval length B from the local database and calculate the access time anomaly coefficient of each IP address within the monitoring interval length of the web page ; The specific calculation method of calculating the proxy string anomaly coefficient of each IP address of the web page within the monitoring interval is as follows: Obtain each allowed user agent string from the local database, and compare the user agent string of each access record of each IP address of the web page within the monitoring interval with each allowed user agent string, so as to obtain the similarity between the user agent string of each access record of each IP address of the web page within the monitoring interval and each allowed user agent string, and extract the maximum similarity of the user agent string of each access record of each IP address of the web page within the monitoring interval , calculate the proxy string anomaly coefficient of each IP address within the monitoring interval of the web page ; The information security processing unit is used to perform IP blocking processing and user agent string blacklisting processing on each crawler IP address of the web page within the monitoring interval.

2. According to claim 1, an information security management system based on a neural network model is characterized in that: The specific analysis method of analyzing the abnormal coefficient of network traffic of a web page is as follows: Get the total network traffic of the web page at each historical current monitoring time point from the local database , where x represents the number of each historical current monitoring time point, , y is a positive integer greater than 2. Based on the total network traffic A of the web page during the monitoring interval, the network traffic anomaly coefficient of the web page is calculated. , where e is a natural constant and y represents the number of historical current monitoring time points.

3. The information security management system based on the neural network model according to claim 1 is characterized in that: The specific evaluation method of evaluating the request anomaly coefficient of each IP address of the web page within the monitoring interval is as follows: Acquire each abnormal request feature from the local database. If the request feature of the URL request of a certain access record of a certain IP address of the web page within the monitoring interval is consistent with a certain abnormal request feature, then mark the access record as an abnormal access record, thereby filtering each abnormal access record of each IP address of the web page within the monitoring interval, and extracting the access data of each abnormal access record of each IP address of the web page within the monitoring interval; Obtain the request anomaly coefficient adjustment parameter value corresponding to each access data from the local database, and map it to obtain the request anomaly coefficient adjustment parameter value of each abnormal access record of each IP address of the web page within the monitoring interval , where p represents the number of each abnormal access record, , q is a positive integer greater than 2, evaluating the request anomaly coefficient of each IP address within the monitoring interval of the web page .

4. The information security management system based on the neural network model according to claim 1 is characterized in that: The crawler similarity coefficient of each IP address of the web page analyzed within the monitoring interval is specifically analyzed as follows: The screening model and calculation model of the anti-crawler neural network are obtained from the local database, and the network traffic anomaly coefficient of the web page is input into the screening model of the anti-crawler neural network model to obtain the access time anomaly coefficient threshold, the proxy string anomaly coefficient threshold and the request anomaly coefficient threshold of the web page within the monitoring interval, and each access anomaly coefficient of each IP address of the web page within the monitoring interval is input into the calculation model of the anti-crawler neural network to output the crawler similarity coefficient of each IP address of the web page within the monitoring interval.

5. The information security management system based on the neural network model according to claim 4 is characterized in that: The calculation model of the anti-crawler neural network is as follows: ,in is the crawler similarity coefficient of each IP address of the web page within the monitoring interval, is the access time anomaly coefficient of each IP address within the monitoring interval of the web page. It is the proxy string anomaly coefficient of each IP address of the web page within the monitoring interval. is the request anomaly coefficient of each IP address of the web page within the monitoring interval, E is the access time anomaly coefficient threshold of the web page within the monitoring interval, F is the proxy string anomaly coefficient threshold of the web page within the monitoring interval, and G is the request anomaly coefficient threshold of the web page within the monitoring interval.

6. The information security management system based on the neural network model according to claim 1 is characterized in that: The information security processing unit includes: an IP blocking module and a user agent string blacklisting module; The IP blocking module is used to extract the crawler similarity coefficient of each crawler IP address of the web page within the monitoring interval according to the crawler similarity coefficient of each IP address of the web page within the monitoring interval, obtain the blocking duration corresponding to each crawler similarity coefficient interval from the local database, and map the blocking duration of each crawler IP address of the web page within the monitoring interval. Each crawler IP address of the web page within the monitoring interval cannot access the web page within the blocking duration; The user agent string blacklisting module is used to extract the user agent string of each access record of each crawler IP address of the web page within the monitoring interval according to the user agent string of each access record of each IP address of the web page within the monitoring interval, count the user agent strings of the web page within the monitoring interval, and not allow access to the web page through the user agent strings of the web page within the monitoring interval during the ban period.

Images