Data detection system and method and nonvolatile storage medium

Abstract

The invention discloses a data detection system and method and a nonvolatile storage medium. The system comprises a data entry module, a data encryption module, a data analysis module and a data distribution module, and the data entry module is used for receiving data; the data encryption module is used for receiving the data input by the data input module, encrypting the data and storing the encrypted data into a database; the data analysis module is used for reading the encrypted data in the database and checking and decrypting the data, and the data analysis module comprises a baseline checking module and a regular checking module; and the data distribution module is used for receiving the data transmitted by the data analysis module and sending the data. According to the method and the device, the technical problems of poor security check capability, low efficiency and poor compatibility of transmitted data caused by single and centralized detection means during cross-network data transmission are solved.

Description

Technical Field

[0001] The present application relates to the field of communications, and in particular, to a data detection system, method, and non-volatile storage medium. Background Art

[0002] In recent years, the rapid development of network technologies such as artificial intelligence, big data, and 5G has accelerated the deep integration of power grids with the internet. The information exchange within the existing dedicated power system networks no longer meets the basic business needs of enterprises and users, necessitating data exchange with external networks to support business development. While typical enterprises can simply connect their internal and external networks for data exchange, for the power industry and its subsidiaries, intranets contain a vast amount of critical corporate and personal private information. This poses an extremely high risk given the complexities of current external networks. Grid business data is at risk of leakage during cross-network transmission. A leak or compromise would be devastating.

[0003] To address the above-mentioned problems, no effective solutions have been proposed so far. Summary of the Invention

[0004] The embodiments of the present application provide a data detection system, method and non-volatile storage medium to at least solve the technical problems of weak security inspection capabilities, low efficiency and poor compatibility of transmitted data caused by the single and centralized detection means when data is transmitted across the network.

[0005] According to one aspect of an embodiment of the present application, a data detection system is provided, including: a data entry module, a data encryption module, a data parsing module, and a data distribution module, wherein the data entry module is used to receive data; the data encryption module is used to receive data entered by the data entry module, encrypt the data, and store the encrypted data in a database; the data parsing module is used to read the encrypted data in the database, check and decrypt the data, wherein the data parsing module includes a baseline check module and a regular check module, the baseline check module is used to check the data according to the baseline standard, the regular check module is used to check the data according to the regular expression, and transmit the part of the data that does not pass the regular check to the baseline check module, the baseline check module updates the baseline standard according to the part of the data that does not pass the regular check, the baseline standard is used to indicate the preset security requirements that the data needs to meet, the preset security requirements include at least one of the following: port number requirements, IP address requirements and network protocol requirements, the regular expression is used to check whether the data meets the format and content rules specified by the regular expression; the data distribution module is used to receive the data transmitted by the data parsing module and send the data.

[0006] Optionally, the data entry module includes a data verification module, a data classification module and a data recording module, wherein: the data verification module is used to verify the data permissions and data format, wherein the permissions are the access rights of the user sending the data. When the data permissions are verified and the data format is verified, the data verification result is determined to be passed. When the data permissions are not verified or the data format is not verified, the data verification result is determined to be failed. The data classification module is used to classify the data, and the classification results include normal data and abnormal data. The data recording module is used to record data information, and the data information includes but is not limited to data format information, data permission information, integrity information, verification results and classification results.

[0007] Optionally, the data entry module determines whether to enter the data based on the verification result and the classification result: if the data verification result is that the data has passed the verification and the data classification result is that the data is normal, it is determined that the data is entered; if the data verification result is that the data has failed the verification and the data classification result is that the data is abnormal, it is determined that the data entry is rejected.

[0008] Optionally, the data classification module is used to classify data, including: classifying the data according to the network characteristics of the data based on the classification model, wherein the network characteristics include at least one of the following: port number information, IP address information and network protocol information; obtaining the classification results output by the classification model; and recording the classification results in the data information.

[0009] Optionally, the data parsing module also includes an integrity check module, a baseline check module and a regular check module, wherein the integrity check module is used to check data integrity, the baseline check module is used to check data according to baseline standards, and the regular check module is used to check according to regular rules.

[0010] Optionally, the baseline check includes: training a baseline model based on network feature data, wherein the network feature data includes at least one of the following: port number information, IP address information, and network protocol information; obtaining a baseline standard output by the trained model; performing a baseline check on the data based on the baseline standard, and discarding the data if the check result is that the data does not meet the baseline standard; and transmitting the data to a regular check module if the check result is that the data meets the baseline standard.

[0011] Optionally, the regular check includes: determining a regular expression based on the protocol type of the data, wherein the regular expression is used to check whether the data meets the format and content rules corresponding to the protocol; checking the data based on a preset regular expression; transmitting the data if the regular check result of the data is that the regular check passes; intercepting the data if the regular check result of the data is that the regular check fails.

[0012] According to another aspect of an embodiment of the present application, a data detection method is also provided, which is applicable to the above-mentioned data detection system, including: obtaining data entered by a data entry module, wherein the verification result of the data in the data entry module is passed verification and the classification result of the data is normal; encrypting the data and storing the encrypted data in a database.

[0013] Optionally, after storing the encrypted data in the database, the method further includes: reading the encrypted data in the database, checking and decrypting the data, wherein the check includes a baseline check and a regular check, the baseline check is used to check the data according to the baseline standard, the regular check is used to check the data according to the regular expression, and the part of the data that fails the regular check is subjected to a baseline check again, the baseline check updates the baseline standard based on the part of the data that fails the regular check, the baseline standard is used to indicate the preset security requirements that the data needs to meet, the preset security requirements include at least one of the following: port number requirements, IP address requirements and network protocol requirements, the regular expression is used to check whether the data meets the format and content rules specified by the regular expression; and sending the data that passes the baseline check and the regular check.

[0014] According to another aspect of an embodiment of the present application, a non-volatile storage medium is provided, in which a program is stored. When the program is running, a device where the non-volatile storage medium is located is controlled to execute a data detection method.

[0015] In an embodiment of the present application, a data detection system is adopted, including a data entry module, a data encryption module, a data parsing module, and a data distribution module, wherein the data entry module is used to receive data; the data encryption module is used to receive data entered by the data entry module, encrypt the data, and store the encrypted data in a database; the data parsing module is used to read the encrypted data in the database, check the data and decrypt it, wherein the data parsing module includes a baseline check module and a regular check module, the baseline check module is used to check the data according to the baseline standard, the regular check module is used to check the data according to the regular expression, and transmits part of the data that does not pass the regular check to the baseline check module, the baseline check module updates the baseline standard according to the part of the data that does not pass the regular check, and the baseline standard is used to update the baseline standard. The preset security requirements that represent data need to meet include at least one of the following: port number requirements, IP address requirements and network protocol requirements. Regular expressions are used to check whether the data meets the format and content rules specified by the regular expressions; the data distribution module is used to receive data transmitted by the data analysis module and send data. By performing comprehensive data detection based on the data entry module, data encryption module, data analysis module and data distribution module, the purpose of ensuring data compatibility and realizing refined and multi-level data security protection is achieved, thereby achieving the technical effect of enhancing the security of cross-network data transmission and improving the compatibility of data interaction, and thus solving the technical problems of weak security inspection capabilities, low efficiency and poor compatibility of transmitted data caused by the single and centralized detection means when data is transmitted across the network. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0017] Figure 1 is a structural diagram of a data detection system provided according to an embodiment of the present application;

[0018] Figure 2 This is a schematic diagram of the structure of a computer terminal (mobile device) provided according to an embodiment of the present application;

[0019] Figure 3 It is a flow chart of a data detection method provided according to an embodiment of the present application. DETAILED DESCRIPTION

[0020] In order to enable those skilled in the art to better understand the present invention, the following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of this application.

[0021] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in a sequence other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0022] In order to better understand the embodiments of the present application, the technical terms involved in the embodiments of the present application are explained as follows:

[0023] Baseline monitoring is a process that continuously monitors and records system activity during normal operation to establish a baseline or "normal behavior pattern." This baseline serves as a standard for comparing current system activity to identify any deviations from normal behavior. Baselines can include various system and network metrics, such as traffic patterns, login frequency, file access patterns, and system logs. Significant deviations from the baseline may trigger an alert, indicating a potential security threat. Baseline monitoring is a key concept in network security, primarily used to monitor and maintain the normal operation of networks or systems and to identify anomalous activity or intrusions.

[0024] Baseline standards: A set of rules or metrics used in baseline testing that describe the normal operating state of a system. These standards are typically based on historical data, derived from the analysis of large amounts of normal operating data, and reflect the typical behavior of the system in the absence of anomalies. Baseline standards can be static, such as fixed thresholds, or dynamic, adjusting over time, as the environment or system state changes. In cybersecurity, baseline standards can help identify potential intrusions, insider threats, system failures, or performance issues.

[0025] In related technologies, the means of cross-network data detection are single and lack integrity; data may face the risk of being intercepted, tampered with or destroyed when transmitted across networks; in addition, there are compatibility issues between different network architectures, protocols and data formats in data interaction, and at the same time, the execution code within the system's operating system is not subject to consistency verification; resource access within the operating system is not strictly controlled; although regular system upgrades can prevent known threats, the protection capability against unknown threats is weak.

[0026] Specifically, traditional cross-network data detection technology has the following problems:

[0027] 1. Low security of cross-network data transmission:

[0028] The information exchange between the original power system's dedicated networks no longer meets the basic business needs of enterprises and users, necessitating certain data exchanges with external networks to support business development. In a cross-network data transmission environment, various security measures are essentially integrated into a single module, requiring a balance of resources occupied by various functions, resulting in weak security inspection capabilities. Furthermore, security products process multiple security measures serially, making security inspections inefficient. Furthermore, limited hardware resources and a rigid internal architecture preclude the expansion of additional security measures, resulting in a lack of rigorous data review of resource access within the system, posing a risk of data leakage within the data exchange system.

[0029] 2. Low data compatibility:

[0030] Because security levels may vary between networks, data may be at risk of being intercepted, tampered with, or destroyed during cross-network transmission. Furthermore, data interaction may involve compatibility issues between different network architectures, protocols, and data formats.

[0031] In order to solve the above problems, relevant solutions are provided in the embodiments of the present application, which are described in detail below.

[0032] According to an embodiment of the present application, a system embodiment of a data detection system is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0033] The data detection system provided in the embodiment of the present application is as follows: Figure 1As shown, it includes a data entry module 10, a data encryption module 20, a data parsing module 30, and a data distribution module 40, wherein the data entry module 10 is used to receive data; the data encryption module 20 is used to receive the data entered by the data entry module 10, encrypt the data, and store the encrypted data in a database; the data parsing module 30 is used to read the encrypted data in the database, check and decrypt the data, wherein the data parsing module 30 includes a baseline check module 50 and a regular check module 60, the baseline check module 50 is used to check the data according to the baseline standard, the regular check module 60 is used to check the data according to the regular expression, and transmit the part of the data that does not pass the regular check to the baseline check module 50, the baseline check module 50 updates the baseline standard according to the part of the data that does not pass the regular check, the baseline standard is used to indicate the preset security requirements that the data needs to meet, and the preset security requirements include at least one of the following: port number requirements, IP address requirements and network protocol requirements, and the regular expression is used to check whether the data meets the format and content rules specified by the regular expression; the data distribution module 40 is used to receive the data transmitted by the data parsing module 30 and send the data.

[0034] In some optional embodiments of the present application, the data entry module obtains power grid business data from the source data source, performs format verification and security filtering (for example, data classification) on the power grid business data, generates corresponding data evaluation data (data evaluation data includes at least one of the following: data format information, data permission information, integrity information, verification results and classification results), rejects data that does not meet the requirements, and adds it to a blacklist.

[0035] Optionally, the source data source is an external network data source, and data is transmitted from the external network to the intranet. The data source includes at least one of the following:

[0036] Internet data sources: covers various data on the public network, including but not limited to websites, social media, public APIs, email servers, FTP servers, etc.

[0037] Third-party service data sources: data obtained through cooperation with third-party service providers, such as cloud storage services, online database services, data streaming services, etc.

[0038] Mobile device data sources: data collected from mobile devices connected to the Internet (such as smartphones, tablets, etc.), which may upload data through various applications or services.

[0039] IoT device data sources: Various Internet of Things (IoT) devices, such as sensors, surveillance cameras, smart meters, etc., may transmit data through wireless networks or Internet connections.

[0040] Inter-enterprise exchange data sources: data shared with other enterprises or organizations through secure data exchange protocols. This data may involve supply chain information, customer data, etc.

[0041] Public dataset data sources: datasets obtained from public data publishing agencies, such as demographic information, weather data, economic indicators, etc.

[0042] Each data source has its own specific format, transmission protocol, and security requirements. Therefore, these factors must be fully considered when entering data to ensure its legitimacy and security. Data formatting must be checked and classified to prevent unauthorized access, data leakage, malware transmission, and other security issues. In cross-network data exchange scenarios, particularly in the power industry, the type and security of the data source are crucial to the robust operation of the entire system.

[0043] In some embodiments of the present application, the data entry module 10 includes a data verification module 60, a data classification module 70 and a data recording module 80, wherein: the data verification module 60 is used to verify the data permissions and data format, wherein the permissions are the access permissions of the user sending the data. When the data permissions pass the verification and the data format passes the verification, the data verification result is determined to be passed. When the data permissions fail the verification or the data format fails the verification, the data verification result is determined to be failed. The data classification module 70 is used to classify the data, and the classification results include normal data and abnormal data. The data recording module 80 is used to record data information, and the data information includes but is not limited to data format information, data permission information, integrity information, verification results and classification results.

[0044] In some optional embodiments of the present application, during the data entry process, the device is connected to the security gateway of the intranet in the extranet environment. The security gateway will require the user to authenticate, which usually includes a username and password, or a more secure two-factor authentication, such as a password plus a mobile phone verification code, or the use of a smart card, biometrics, etc. Once the authentication is successful, the data verification module 60 will perform permission checks and format verification on the submitted data to ensure that the data meets the acceptance standards of the internal network. The permission check will check whether the user has permission to access specific resources in the internal network or submit specific types of data. This may involve role-based access control (RBAC), in which the user's permissions are set according to their role in the intranet (such as engineer, administrator, visitor, etc.). The data classification module 70 will classify the submitted data. If the data comes from an untrusted external source, the gateway will apply more stringent data screening and filtering rules to further reduce risks. This may include checking whether the source IP address of the data is in the permitted whitelist and performing deep packet inspection (DPI) on the data to identify potential attack patterns. All data transmission and access requests from the external network to the internal network will be recorded in the log by the data recording module 80 for subsequent auditing and tracking. This helps monitor network activities and promptly detect and respond to potential security incidents.

[0045] In some embodiments of the present application, the data entry module 10 determines whether to enter the data based on the verification result and the classification result: when the verification result of the data is passed and the classification result of the data is normal, it is determined to enter the data; when the verification result of the data is failed and the classification result of the data is abnormal, it is determined to refuse to enter the data.

[0046] In some optional embodiments of the present application, a data packet enters from an external network, and its source IP address is 192.168.1.100 and the destination port number is 8080. The data verification module 60 performs format and permission verification based on the characteristic attribute information of the data packet, including whether the data content conforms to the standard format specified by the protocol. The data classification module 70 classifies the data packet based on the characteristic attribute information of the data packet, which includes the source port number, destination port number, source IP address, and destination IP address. If the data verification result is that the verification fails or the data classification result is that the data is abnormal, it is determined that the data entry is rejected and the data packet is prevented from entering the subsequent network process to ensure that the abnormal data does not affect the security of the power grid business data. The data recording module 80 records the source IP address 192.168.1.100 and related abnormal behavior information in the log. All data packets from this IP address will automatically be subject to stricter inspection in the data entry module 10, or even directly rejected, to reduce the risk of repeated attacks.

[0047] In some embodiments of the present application, the data classification module 70 is used to classify data, including: classifying the data according to the network characteristics of the data based on the classification model, wherein the network characteristics include at least one of the following: port number information, IP address information, and network protocol information; obtaining the classification results output by the classification model; and recording the classification results in the data information.

[0048] In some optional embodiments of the present application, the classification model uses an adaptive genetic algorithm to optimize the penalty parameters and kernel function parameters of the support vector machine (SVM) classifier during training to improve the generalization ability of the classification. By calculating the characteristic attribute information that describes the changes in network traffic characteristics, such as source port number, destination port number, source IP address and destination IP address, etc., these characteristic attributes are normalized to reduce the interference of abnormal sample data on classification performance. The trained classification model identifies changes in the information entropy of traffic characteristic attributes and realizes the detection of abnormal network traffic. By introducing the SMOTE algorithm to over-sample minority class samples and combining the ENN algorithm to eliminate noise data, the problem of data imbalance is solved.

[0049] In some embodiments of the present application, the data analysis module 30 also includes an integrity check module 70, a baseline check module 50 and a regular check module 60, etc., wherein the integrity check module is used to check data integrity, the baseline check module 50 is used to check data according to the baseline standard, and the regular check module 60 is used to check according to regular rules.

[0050] The optional integrity check module 70 is a key component for ensuring that data has not been tampered with or corrupted during transmission and storage. Although data is encrypted and stored in the data encryption module 20, encryption alone does not guarantee data integrity. When the data parsing module 30 reads encrypted power grid service data files from disk, it uses the integrity check module 70 to verify data integrity. This verification process is typically based on a checksum or hash algorithm, such as SHA-256 or MD5, which generates a unique digest or "fingerprint" for the data file. This digest is also calculated and recorded by the system when the data file is initially written to disk. When the data needs to be distributed, the integrity check module recalculates the data file's digest and compares it with the originally recorded digest. If the two match, the data has not been tampered with during storage and maintains its integrity. If they do not match, the data may have been maliciously modified or an error occurred during storage. In this case, the data will be rejected and the system may trigger an alarm to notify the administrator for further investigation.

[0051] Furthermore, for real-time data transmission, the integrity check module can employ more dynamic mechanisms, such as using a sequence number or timestamp combined with a hash value, to ensure the integrity and timeliness of each data transmission. During data transmission, the receiving end checks the hash value, as well as the sequence number or timestamp, of each data packet to verify that the packets were received in order and that the content has not been tampered with. This approach not only prevents data integrity violations during transmission but also ensures the consistency and correctness of data interactions, thereby improving the reliability and security of the entire defense system. By regularly evaluating and updating these data integrity check algorithms, new threats and changes can be addressed, ensuring the security and integrity of power grid business data during cross-network interactions.

[0052] In some embodiments of the present application, the baseline check includes: training a baseline model based on network feature data, wherein the network feature data includes at least one of the following: port number information, IP address information, and network protocol information; obtaining a baseline standard output by the trained model; performing a baseline check on the data based on the baseline standard, and discarding the data if the check result is that the data does not meet the baseline standard; and transmitting the data to the regularization check module 60 if the check result is that the data meets the baseline standard.

[0053] Optionally, during the baseline model training process, data collection and preprocessing are performed first. A large amount of normal network traffic data, as well as known abnormal traffic data, is collected from historical power system service data. This data is then cleaned and standardized to ensure data quality and consistency. This data may originate from normal grid operations, such as power dispatch, equipment monitoring, and user data transmission. By extracting features and identifying patterns from this data, machine learning algorithms such as support vector machines (SVMs), random forests, or neural networks are used to train a baseline model that accurately reflects the normal behavior of the power grid.

[0054] During model training, algorithm parameters must be continuously optimized to ensure model accuracy and generalization. For example, a genetic algorithm is used to adjust the penalty and kernel parameters of the Support Vector Machine (SVM) to improve the model's adaptability and anti-interference capabilities. Furthermore, the SMOTE algorithm is introduced to address sample imbalance, ensuring that the model can accurately judge even anomalous minority samples. After model training is complete, a set of baseline standards is output that quantitatively describe the activity characteristics and behavioral patterns of the power grid during normal operation.

[0055] Obtain the baseline standard output by the trained baseline model. By comparing the current data with the baseline standard, identify any abnormal data that deviates from the normal pattern. For example, if a sudden and abnormal increase in traffic to a specific port number is detected, or a certain IP address frequently attempts unauthorized access, these may be regarded as abnormal signals, triggering the alarm system, and alerting network administrators to possible security threats. In addition, for the transmission of power business data, the baseline standard can set specific packet formats, transmission time patterns, and data flow size thresholds. When data transmission behavior does not meet these standards, the anomaly detection mechanism will also be triggered.

[0056] The application of baseline standards is not limited to detecting external intrusions or abnormal traffic; it can also be used to identify potential risks within the internal network, such as equipment failures, configuration errors, or improper operation by internal employees. By dynamically adjusting baseline standards based on seasonal changes, peak business periods, or network upgrades, the real-time status of the power network can be more accurately reflected, improving the precision and flexibility of security detection. Furthermore, baseline standards can work in conjunction with security mechanisms such as firewall rules, intrusion detection systems (IDS), and intrusion prevention systems (IPS), forming a multi-layered defense system that effectively enhances the security protection capabilities of the power network.

[0057] In some embodiments of the present application, the regular check includes: determining a regular expression based on the protocol type of the data, wherein the regular expression is used to check whether the data meets the format and content rules corresponding to the protocol; checking the data based on a preset regular expression; transmitting the data if the regular check result of the data is that the regular check passes; intercepting the data if the regular check result of the data is that the regular check fails.

[0058] According to an embodiment of the present application, a method embodiment of a data detection method is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0059] The method embodiments provided in the embodiments of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Figure 2 FIG1 shows a hardware structure block diagram of a computer terminal (or mobile device) for implementing a data detection method. Figure 2As shown, the computer terminal 20 (or mobile device 20) may include one or more (shown as 202a, 202b, ..., 202n in the figure) processors 202 (the processor 202 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 204 for storing data, and a transmission device 206 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the BUS bus), a network interface, a power supply and / or a camera. It will be understood by those skilled in the art that Figure 2 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 2 More or fewer components than shown, or with Figure 2 Different configurations shown.

[0060] It should be noted that the one or more processors 202 and / or other data processing circuits described above may generally be referred to herein as "data processing circuitry." The data processing circuitry may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuitry may be a single, independent processing module, or may be incorporated in whole or in part into any of the other components of the computer terminal 20 (or mobile device). As described in the embodiments of the present application, the data processing circuitry serves as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0061] The memory 204 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the data detection method in the embodiment of the present application. The processor 202 executes various functional applications and data processing by running the software programs and modules stored in the memory 204, that is, implementing the above-mentioned data detection method. The memory 204 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 204 may further include a memory remotely located relative to the processor 202, and these remote memories may be connected to the computer terminal 20 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0062] Transmission device 206 is configured to receive or transmit data via a network. A specific example of the aforementioned network may include a wireless network provided by the communications provider of computer terminal 20. In one embodiment, transmission device 206 includes a network interface controller (NIC), which can be connected to other network devices via a base station to enable communication with the Internet. In another embodiment, transmission device 206 may be a radio frequency (RF) module configured to communicate with the Internet wirelessly.

[0063] The display may be, for example, a touch screen liquid crystal display (LCD) that enables a user to interact with a user interface of the computer terminal 20 (or mobile device).

[0064] In the above operating environment, the embodiment of the present application provides a data detection method, which is applicable to the above data detection system. Figure 3 As shown, the method includes the following steps:

[0065] Step S302, obtaining data entered by the data entry module, wherein the data is verified as passed by the data entry module and the data classification result is normal;

[0066] Optionally, after the data has been initially processed by the data entry module, the verification results indicate that the data meets security standards and has passed data quality checks, and is classified as normal data. This means that the data not only meets the preset rules in terms of format and content, but also passes the classification detection of the classification model at the security level, ensuring that the data does not carry known vulnerabilities or potential risks before entering the subsequent processing flow. The normal classification results of the data are based on data cleaning, preprocessing, and importance assessment of the big data processing layer, ensuring that subsequent baseline check modules and regular data check modules can receive high-quality and secure data, providing a solid foundation for the efficient operation of the entire system and data security.

[0067] Step S304: encrypt the data and store the encrypted data in a database.

[0068] Optionally, the data encryption module first performs software-level encryption processing on the power grid business data file, and then writes the encrypted data file into the disk data directory.

[0069] In some embodiments of the present application, after storing the encrypted data in the database, the method further includes: reading the encrypted data in the database, checking and decrypting the data, wherein the check includes a baseline check and a regular check, the baseline check is used to check the data according to the baseline standard, the regular check is used to check the data according to the regular expression, and the part of the data that fails the regular check is subjected to a baseline check again, the baseline check updates the baseline standard based on the part of the data that fails the regular check, the baseline standard is used to indicate the preset security requirements that the data needs to meet, the preset security requirements include at least one of the following: port number requirements, IP address requirements and network protocol requirements, the regular expression is used to check whether the data meets the format and content rules specified by the regular expression; and sending the data that passes the baseline check and the regular check.

[0070] Optionally, the parsing module retrieves the power grid business data file from the database directory and performs a secondary cross-network data packet check on the power grid business data file. Under this process, the data is checked by the integrity check module, the regularization check module and the baseline check module.

[0071] The integrity check module reads the encrypted file from the disk, checks the integrity of the data file, refuses to process incomplete data files, and performs decryption processing to obtain the original data. Finally, the decrypted power grid business data is distributed to the next-level baseline check module. The baseline check module checks the power grid business data according to the baseline standard. The power grid business data that passes the baseline check is transmitted to the regular check module for regular check to ensure that the data conforms to the transmission format required by the corresponding protocol and ensures compatibility. The data that passes the regular check is transmitted to the external network through the data distribution module. The data that fails the regular data check is returned to the baseline check module for input into the baseline model to statistically update the algorithm model. The regular check module uses predefined regular expressions to identify and intercept possible malicious data, and performs static checks on the entered data to ensure that the data conforms to the preset format and content rules; by detecting duplicate, inconsistent or non-business logic data, malicious data insertion or deception is prevented.

[0072] Modularizing data during data detection allows each inspection module to run independently. For example, after the data is entered into the module, the module that passes the data entry inspection can start the detection mechanism, and can also perform encrypted data transmission. The two can run independently, or by introducing a data inspection process, it can be determined whether a cross-network data hidden danger identification mechanism is needed.

[0073] Through the above steps, it is possible to effectively detect and defend against various security threats faced by power networks when interacting with external networks, ensure the security, integrity and compliance of data transmission, and improve the efficiency and accuracy of security checks. Specifically, the data detection system verifies and records the source data permissions through the data entry module, classifies and identifies network anomalies, improves the defense capabilities against malicious traffic, and ensures data consistency and security; the baseline check module dynamically adjusts the baseline standard in real time based on the baseline model, provides a dynamic reference for data packet evaluation, enhances the accuracy of security checks, accurately identifies data anomalies, and strengthens the depth and breadth of data review; the regular data check module ensures the compliance of data format and content, promotes standardization work between different networks, ensures the compatibility and differentiation of data between different networks, and improves the compatibility and standardization of cross-network data interaction. The parallel design and progressive verification process of each module not only improves the efficiency and flexibility of security checks, but also ensures the protection of sensitive information and the security of data during transmission through means such as data classification, encrypted storage, and integrity checks. The data classification, storage, access control, and audit mechanisms established during the detection process provide special management and protection for sensitive information. Later, by simulating different data leakage scenarios, it is possible to analyze the strategies and methods that attackers may adopt. For the transmission of sensitive information, encryption technology is used to encrypt and decrypt data, ensuring the security of data during storage. This effectively solves the problems of single security means, low efficiency, and lack of compatibility in existing technologies. Through parallel modular design, each module can run independently, which improves the flexibility and efficiency of security checks.

[0074] The embodiment of the present application provides a non-volatile storage medium, wherein a program is stored in the non-volatile storage medium, wherein when the program is running, the device where the non-volatile storage medium is located is controlled to perform the following data detection method, which is applicable to the above-mentioned data detection system: obtaining data entered by the data entry module 10, wherein the verification result of the data in the data entry module 10 is passed verification and the classification result of the data is normal; encrypting the data, and storing the encrypted data in a database. After storing the encrypted data in the database, the method further includes: reading the encrypted data in the database, checking and decrypting the data, wherein the check includes a baseline check and a regular check, the baseline check is used to check the data according to the baseline standard, the regular check is used to check the data according to the regular expression, and the partial data that does not pass the regular check is subjected to the baseline check again, the baseline check updates the baseline standard based on the partial data that does not pass the regular check, the baseline standard is used to indicate the preset security requirements that the data needs to meet, the preset security requirements include at least one of the following: port number requirements, IP address requirements and network protocol requirements, the regular expression is used to check whether the data meets the format and content rules specified by the regular expression; and sending the data that passes the baseline check and the regular check.

[0075] The serial numbers of the above embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0076] In the above embodiments of the present application, the description of each embodiment has its own focus. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0077] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only exemplary. For example, the division of the units can be a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0078] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0079] In addition, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0080] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the relevant technology or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for enabling a computer device (which can be a personal computer, a server or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk.

[0081] The above is only a preferred embodiment of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A data detection system, characterized in that: It includes data entry module, data encryption module, data analysis module and data distribution module, among which: The data entry module is used to receive data; The data encryption module is used to receive the data entered by the data entry module, encrypt the data, and store the encrypted data in a database; The data parsing module is used to read the encrypted data in the database, check and decrypt the data, wherein the data parsing module includes a baseline check module and a regular check module, the baseline check module is used to check the data according to the baseline standard, the regular check module is used to check the data according to the regular expression, and transmit the part of the data that does not pass the regular check to the baseline check module, the baseline check module updates the baseline standard according to the part of the data that does not pass the regular check, the baseline standard is used to indicate the preset security requirements that the data needs to meet, the preset security requirements include at least one of the following: port number requirements, IP address requirements and network protocol requirements, the regular expression is used to check whether the data meets the format and content rules specified by the regular expression; The data distribution module is used to receive the data transmitted by the data analysis module and send the data.

2. The data detection system according to claim 1, characterized in that: The data entry module includes a data verification module, a data classification module and a data recording module, wherein: The data verification module is used to verify the authority and data format of the data, wherein the authority is the access authority of the user who sent the data, and when the authority of the data passes the verification and the data format passes the verification, the verification result of the data is determined to be passed, and when the authority of the data fails the verification or the data format fails the verification, the verification result of the data is determined to be failed; The data classification module is used to classify the data, and the classification results of the classification include normal data and abnormal data; The data recording module is used to record data information, and the data information includes but is not limited to data format information, data authority information, integrity information, verification results and classification results.

3. The data detection system according to claim 2, characterized in that: The data entry module determines whether to enter the data according to the verification result and the classification result: When the verification result of the data is that the verification is passed and the classification result of the data is that the data is normal, determining to enter the data; When the verification result of the data is failure to pass the verification and the classification result of the data is data abnormality, it is determined that the data is refused to be entered.

4. The data detection system according to claim 2, characterized in that: The data classification module is used to classify the data, including: Classifying the data according to the classification model according to the network characteristics of the data, wherein the network characteristics include at least one of the following: port number information, IP address information, and network protocol information; Obtaining a classification result output by the classification model; The classification result is recorded in the data information.

5. The data detection system according to claim 1, characterized in that: The data analysis module also includes an integrity check module, a baseline check module and a regular check module, wherein the integrity check module is used to check data integrity, the baseline check module is used to check data according to a baseline standard, and the regular check module checks according to regular rules.

6. The data detection system according to claim 5, characterized in that: The baseline examination includes: Training a baseline model based on network feature data, wherein the network feature data includes at least one of the following: port number information, IP address information, and network protocol information; Get a baseline of the trained model outputs; A baseline check is performed on the data according to the baseline standard. If the check result is that the data does not meet the baseline standard, the data is discarded. If the check result is that the data meets the baseline standard, the data is transmitted to a regular check module.

7. The data detection system according to claim 5, characterized in that: The regularity check includes: Determining a regular expression according to a protocol type of the data, wherein the regular expression is used to check whether the data satisfies format and content rules corresponding to the protocol; Checking the data according to a preset regular expression; If the regularity check result of the data is that the regularity check passes, transmitting the data; If the regularity check result of the data is that the regularity check fails, the data is intercepted.

8. A data detection method, characterized in that: The data detection system according to any one of claims 1 to 7 comprises: Acquire data entered by a data entry module, wherein a verification result of the data in the data entry module is that the data has passed the verification and a classification result of the data is that the data is normal; The data is encrypted and stored in a database.

9. The data detection method according to claim 8, characterized in that: After storing the encrypted data in the database, the method further comprises: Read the encrypted data in the database, check and decrypt the data, wherein the check includes a baseline check and a regular check, the baseline check is used to check the data according to a baseline standard, the regular check is used to check the data according to a regular expression, and the baseline check is performed again on part of the data that does not pass the regular check, the baseline check updates the baseline standard according to the part of the data that does not pass the regular check, the baseline standard is used to indicate the preset security requirements that the data needs to meet, the preset security requirements include at least one of the following: port number requirements, IP address requirements and network protocol requirements, the regular expression is used to check whether the data meets the format and content rules specified by the regular expression; The data that passes the baseline check and the regularization check is sent.

10. A non-volatile storage medium, characterized in that: The non-volatile storage medium stores a program, wherein when the program is running, the device where the non-volatile storage medium is located is controlled to execute the data detection method described in any one of claims 8 to 9.

Images