Network-based big data analysis method and analysis system

Abstract

The invention relates to the technical field of network security, and discloses a network-based big data analysis system, which comprises an acquisition module, an arrangement module, a calculation module, an analysis module and a feedback module, and through cooperative work of the five modules, the monitoring and response capability of network security is remarkably improved. According to the system, real-time acquisition and efficient arrangement of multi-source data are realized, the accuracy and consistency of the data are ensured, meanwhile, the integrated calculation and analysis module can quickly generate a network security reference coefficient AQX and accurately evaluate the security state of a network environment, a feedback mechanism of the system ensures instant transmission of information, and the security of the network environment is ensured. According to the method, the user can quickly take countermeasures, and the comprehensive improvement not only accelerates the identification and response speed of security threats, but also enhances the initiative of network security management, and provides a safer and more reliable network environment for the user.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a network-based big data analysis method and analysis system. Background Art

[0002] In the era of rapid development of information technology, network security, as an important branch of information security, has become an issue that cannot be ignored by all kinds of organizations and individuals. With the widespread popularity of network applications, network security faces increasingly complex threats, including network attacks, data leaks and malware.

[0003] However, traditional network security monitoring methods usually rely on static thresholds and manual intervention, resulting in slow and inaccurate responses to potential threats. The limitations of existing technologies in data integration and analysis make it impossible to capture many minor changes and anomalies in a timely manner, leading to increased security risks. Summary of the invention

[0004] The present invention provides a method for solving the problem that the traditional network security monitoring method mentioned in the above background technology usually relies on static thresholds and manual intervention, resulting in slow and inaccurate response to potential threats.

[0005] The present invention provides the following technical solutions: a network-based big data analysis system, comprising a collection module, a sorting module, a calculation module, an analysis module and a feedback module;

[0006] The acquisition module is used to collect multi-source data on network security and set the basic color of the data to blue;

[0007] The sorting module is used to process the multi-source data collected by the collecting module and re-sort them into a first data set, a second data set and a third data set;

[0008] The calculation module is used to integrate and calculate the first data set, the second data set and the third data set generated by the sorting module, so as to generate a network security reference coefficient AQX;

[0009] The analysis module is used to compare the network security reference coefficient AQX generated by the calculation module with a preset first threshold value Y, thereby generating a first comparison result, and judging whether the current network environment is in a safe state according to the first comparison result;

[0010] If the first comparison result shows a non-safe state, the network security reference coefficient AQX is integrated and calculated with the first threshold value Y to generate a risk level value FLJ, and the safety level value FLJ is compared with a preset second threshold value R to generate a second comparison result. According to the second comparison result, the network environment is divided into risk categories;

[0011] The feedback module is used to feed back the results generated by the analysis module to the terminal.

[0012] Preferably, the acquisition module includes a first acquisition unit, a second acquisition unit and a third acquisition unit;

[0013] The first acquisition unit is used to collect network traffic data, the second acquisition unit is used to collect user behavior data sets, and the third acquisition unit is used to collect security event log data sets;

[0014] The network traffic data, user behavior data set and security event log data set are integrated into multi-source data.

[0015] Preferably, the finishing module includes a pre-processing unit and an integration unit;

[0016] The preprocessing unit is used to preprocess and dimensionlessly process the multi-source data collected by the collection module, and the integration unit is used to reorganize the processed multi-source data to generate a first data set, a second data set, and a third data set.

[0017] Preferably, the first data set includes the number of data packets, the total flow, the average flow rate, and the abnormal flow peak value;

[0018] The number of data packets is divided into the number of sample data packets YBS and the number of real-time data packets, where the number of real-time data packets is recorded as SJ1, SJ2, SJ3, ..., SJn according to the timestamp;

[0019] The total traffic is divided into the sample data total traffic YZL and the real-time total traffic. The real-time total traffic is recorded as ZL1, ZL2, ZL3, ..., ZLn according to the timestamp.

[0020] The average traffic rate is divided into the sample average traffic rate YLL and the real-time average traffic rate. The real-time average traffic rate is recorded as LL1, LL2, LL3, ..., LLn according to the timestamp.

[0021] The abnormal traffic peak is divided into the sample average traffic rate YYL and the real-time average traffic rate. The real-time average traffic rate is recorded as YL1, YL2, YL3, ..., YLn according to the timestamp;

[0022] The second data set includes the number of logins, session duration, and device login frequency;

[0023] The number of logins is divided into sample logins YDL and real-time logins. The real-time logins are recorded as DL1, DL2, DL3, ..., DLn according to the timestamp.

[0024] The session duration is divided into the sample session duration YHH and the real-time session duration. The real-time session duration is recorded according to the timestamp as: HH1, HH2, HH3, ..., HHn;

[0025] The device login frequency number is divided into the sample device login frequency number YSD and the real-time device login frequency number, where the device login frequency number is recorded as SD1, SD2, SD3, ..., SDn according to the timestamp;

[0026] The third data set includes the number of incidents, incident response time, the ratio of successful to failed logins, and the number of malicious IP accesses;

[0027] The number of event occurrences is divided into the sample device login frequency number YSC and the real-time device login frequency number, where the number of real-time event occurrences is recorded as SC1, SC2, SC3, ..., SCn according to the timestamp;

[0028] The event response time is divided into the sample event response time YSX and the real-time event response time. The real-time event response time is recorded as SX1, SX2, SX3, ..., SXn according to the timestamp;

[0029] The ratio of successful and failed logins is divided into the sample device login frequency number YCS and the real-time device login frequency number, where the real-time successful and failed login ratios are recorded as CS1, CS2, CS3, ..., CSn according to the timestamp;

[0030] The number of malicious IP accesses is divided into the number of sample malicious IP accesses YEY and the number of real-time malicious IP accesses. The real-time malicious IP accesses are recorded as EY1, EY2, EY3, ..., EYn according to the timestamp.

[0031] Preferably, the calculation module includes a first calculation unit and a second calculation unit;

[0032] The first calculation unit is used to calculate the first data set, the second data set and the third data set respectively, so as to generate a first reference value S1, a second reference value S2 and an intervention correction value JXZ;

[0033] The second calculation unit is used for integrating and calculating the first reference value S1, the second reference value S2 and the intervention correction value JXZ to generate a safety reference coefficient AHC.

[0034] Preferably, the first reference value S1 and the second reference value S2 are calculated and obtained by the following formulas respectively:

[0035] S1=a1×PSJ+a2×PZL+a3×PLL+a4×PYL;

[0036] S2=a1×PSC+a2×PSX+a3×PCS+a4×PEY;

[0037]

[0038] Wherein: a1, a2, a3 and a4 are weight values, and the values ​​of a1, a2, a3 and a4 are adjusted and set by the user;

[0039] SJn, ZLn, LLn, YLn, SCn, SXn, CSn, and EYn are the number of packets, total traffic, average traffic rate, abnormal traffic peak, number of events, event response time, ratio of successful and failed logins, and number of malicious IP accesses at timestamp n, respectively;

[0040] YBS, YZL, YLL, YYL, YDL, YHH, YSD and YSC are respectively the number of sample data packets, total traffic, sample average traffic rate, sample abnormal traffic peak, number of sample event occurrences, sample event response time, sample success and failure login ratio and sample malicious IP access times.

[0041] Preferably, the intervention correction value JXZ is calculated and obtained by the following formula:

[0042] JXZ=(YDL-DL n ) 2 +(YHH-YHH n ) 2 +(YSD-SD n ) 2 ;Where: DLn, HHn and SDn are the number of logins, session duration and device login frequency at timestamp n respectively;

[0043] YDL, YHH and YSD are the number of sample logins, sample session duration and sample device login frequency respectively.

[0044] Preferably, the network security reference coefficient AQX is calculated and obtained by the following formula:

[0045] AQX=e S1 ×JXZ+ln(S2)×JXZ;

[0046] Wherein: S1 and S2 are the first reference value and the second reference value respectively, e is the exponential function, ln is the logarithmic function, and JXZ is the intervention correction value.

[0047] Preferably, the analysis module comprises a first analysis unit and a second analysis unit;

[0048] The first analysis unit is used to compare the network security reference coefficient AQX generated by the calculation module with a preset first threshold value Y, thereby generating a first comparison result, and judging whether the current construction is in a safe state according to the first comparison result;

[0049] If the first comparison result shows a non-safe state, the second analysis unit integrates and calculates the network security reference coefficient AQX and the first threshold value Y to generate a risk magnitude value FLJ, and compares the risk magnitude value FLJ with a preset second threshold value R to generate a second comparison result, and divides the network environment into risk categories according to the second comparison result;

[0050] The first comparison results are as follows;

[0051] When AQX≤Y, it means the current network environment is safe;

[0052] When AQX≤Y, it means that the current network environment is in an unsafe state;

[0053] The second comparison results are as follows;

[0054] When FLJ≤R, it means that the current network environment is in a level 1 risk state, and the data changes from basic blue to yellow;

[0055] When R<FLJ≤R×105%, the current network environment is in a secondary risk state, and the data changes from basic blue to orange;

[0056] When FLJ>R×105%, the current network environment is in the third-level risk state, and the data changes from the basic blue to red;

[0057] The risk level value FLJ is calculated by the following formula:

[0058]

[0059] Where: AQX is the network security reference coefficient, and Y is the first threshold.

[0060] This application also includes a network-based big data analysis method, the specific steps are as follows;

[0061] S1. Collect network security related data through multiple data sources and set the basic color of the data to blue to facilitate subsequent processing and identification;

[0062] S2, cleaning and standardizing the collected multi-source data, eliminating noise and redundant information, and reorganizing the processed data into three data sets;

[0063] S3, integrating and calculating the three sorted data sets to generate a network security reference coefficient AQX;

[0064] S4, compare the calculated safety reference coefficient AQX with the preset first threshold value Y to generate a first comparison result, and judge whether the current network environment is safe according to the comparison result. If it is not safe, further calculate the risk level value FLJ and compare it with the second threshold value R to generate a second comparison result, so as to facilitate risk classification;

[0065] S5. Feedback the security status and risk level results generated by the analysis module to the terminal to ensure that relevant personnel can obtain information in a timely manner and take corresponding measures.

[0066] The present invention has the following beneficial effects:

[0067] 1. This system significantly improves the monitoring and response capabilities of network security through the collaborative work of five modules. Compared with traditional technologies, this system realizes the real-time collection and efficient organization of multi-source data to ensure the accuracy and consistency of data. At the same time, the integrated calculation and analysis modules can quickly generate the network security reference coefficient AQX and accurately evaluate the security status of the network environment. The feedback mechanism of the system ensures the instant transmission of information, allowing users to take countermeasures quickly. This comprehensive improvement not only speeds up the identification and response of security threats, but also enhances the initiative of network security management, providing users with a safer and more reliable network environment.

[0068] 2. By integrating reference values ​​to generate a safety reference coefficient AHC, the assessment process is made more comprehensive and intuitive. The system also uses exponential and logarithmic functions to further enhance the calculation depth of the safety reference coefficient AQX, making it more sensitive to small changes, so that potential risks can be discovered in a timely manner. This improvement makes network security assessment more dynamic and accurate. Compared with traditional methods, it can respond and adjust protection strategies more quickly, effectively improve the overall network security protection capabilities, and ensure the security of user data and systems. BRIEF DESCRIPTION OF THE DRAWINGS

[0069] Figure 1 It is a system flow chart of the present invention.

[0070] Figure 2 It is a diagram of the method steps of the present invention.

[0071] In the figure: 1. acquisition module; 11. first acquisition unit; 12. second acquisition unit; 13. third acquisition unit; 2. sorting module; 21. preprocessing unit; 22. integration unit; 3. calculation module; 31. first calculation unit; 32. second calculation unit; 4. analysis module; 41. first analysis unit; 42. second analysis unit; 5. feedback module. DETAILED DESCRIPTION

[0072] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0073] Example 1

[0074] See also Figure 1 , a network-based big data analysis system, comprising a collection module 1, a sorting module 2, a calculation module 3, an analysis module 4 and a feedback module 5;

[0075] The acquisition module 1 is used to collect multi-source data on network security and set the basic color of the data to blue;

[0076] The sorting module 2 is used to process the multi-source data collected by the collecting module 1 and re-sort them into a first data set, a second data set and a third data set;

[0077] The calculation module 3 is used to integrate and calculate the first data set, the second data set and the third data set generated by the sorting module 2, so as to generate a network security reference coefficient AQX;

[0078] The analysis module 4 is used to compare the network security reference coefficient AQX generated by the calculation module 3 with a preset first threshold value Y, thereby generating a first comparison result, and judging whether the current network environment is in a safe state according to the first comparison result;

[0079] If the first comparison result shows a non-safe state, the network security reference coefficient AQX is integrated and calculated with the first threshold value Y to generate a risk level value FLJ, and the safety level value FLJ is compared with a preset second threshold value R to generate a second comparison result. According to the second comparison result, the network environment is divided into risk categories;

[0080] The feedback module 5 is used to feed back the results generated by the analysis module 4 to the terminal.

[0081] In this embodiment: the acquisition module 1 is responsible for acquiring information related to network security from multi-source data. These data include network traffic, user behavior logs, and security event records, which can monitor network activities in real time. By setting the basic color of the collected data to blue, it is easy to identify and classify different types of data, thereby improving the efficiency of data processing. The effective data collection of this module provides a reliable basis for subsequent analysis and decision-making.

[0082] The sorting module 2 processes and integrates the collected multi-source data to generate the first, second and third data sets. The sorting module 2 ensures the accuracy and consistency of the data through cleaning, standardization and classification. This process not only improves the availability of the data, but also lays a good foundation for subsequent calculations and analysis, enabling the system to further process the data efficiently.

[0083] The calculation module 3 uses the data set generated by the sorting module 2 to perform integrated calculations to generate a network security reference coefficient AQX. Through this coefficient, the system can quantify the network security status and facilitate a comprehensive risk assessment. The efficient computing power of the calculation module 3 ensures timely analysis of real-time data and improves the system's speed and accuracy in identifying potential threats.

[0084] The analysis module 4 compares the network security reference coefficient AQX generated by the calculation module 3 with the preset first threshold value Y to determine the security status of the current network environment. If a security risk is found, the module further calculates the risk magnitude value FLJ and compares it with the second threshold value R to achieve a fine division of the risk. This analysis process enables the system to respond quickly to security threats, provide decision makers with real-time and accurate security assessments, and help efficient protection.

[0085] Feedback module 5 is responsible for timely feeding back the results generated by analysis module 4 to the terminal, ensuring that relevant personnel can quickly obtain the latest information on network security status. Through timely feedback, users can quickly take countermeasures to enhance the initiative and responsiveness of network security protection. The effective communication function of this module ensures the transparency of information and the real-time nature of decision-making, and improves the overall security management level.

[0086] This system significantly improves the monitoring and response capabilities of network security through the collaborative work of five modules. Compared with traditional technologies, this system realizes the real-time collection and efficient organization of multi-source data, ensuring the accuracy and consistency of data. At the same time, it can quickly generate the network security reference coefficient AQX and accurately evaluate the security status of the network environment. The feedback mechanism of the system ensures the instant transmission of information, allowing users to take countermeasures quickly. This comprehensive improvement not only speeds up the identification and response of security threats, but also enhances the initiative of network security management, providing users with a safer and more reliable network environment.

[0087] Example 2

[0088] See also Figure 1 , the acquisition module 1 includes a first acquisition unit 11, a second acquisition unit 12 and a third acquisition unit 13;

[0089] The first collection unit 11 is used to collect network traffic data, the second collection unit 12 is used to collect user behavior data sets, and the third collection unit 13 is used to collect security event log data sets;

[0090] Network traffic data, user behavior datasets, and security event log datasets are integrated into multi-source data.

[0091] In this embodiment: the acquisition module 1 significantly improves the comprehensiveness and accuracy of network security monitoring by integrating network traffic data, user behavior data sets, and security event log data sets into multi-source data. The first acquisition unit 11 focuses on capturing network traffic in real time, providing an instant view of traffic dynamics; the second acquisition unit 12 deeply analyzes user behavior to help identify abnormal activities; the third acquisition unit 13 records security event logs and provides important background information on security events. This multi-source data integration method not only reduces dependence on a single data source and enhances the ability to identify potential threats, but also provides a richer foundation for subsequent data collation and analysis. Compared with traditional technologies, the system can identify complex security threats more quickly, thereby improving the effectiveness and response speed of overall network security protection and ensuring the security of user data and systems.

[0092] Example 3

[0093] See also Figure 1 , the sorting module 2 includes a pre-processing unit 21 and an integration unit 22;

[0094] The preprocessing unit 21 is used to preprocess and dimensionlessly process the multi-source data collected by the collection module 1 , and the integration unit 22 is used to reorganize the processed multi-source data to generate a first data set, a second data set, and a third data set.

[0095] The first data set includes the number of packets, total traffic, average traffic rate, and abnormal traffic peak;

[0096] The number of data packets is divided into the number of sample data packets YBS and the number of real-time data packets, where the number of real-time data packets is recorded as SJ1, SJ2, SJ3, ..., SJn according to the timestamp;

[0097] The total traffic is divided into the sample data total traffic YZL and the real-time total traffic. The real-time total traffic is recorded as ZL1, ZL2, ZL3, ..., ZLn according to the timestamp.

[0098] The average traffic rate is divided into the sample average traffic rate YLL and the real-time average traffic rate. The real-time average traffic rate is recorded as LL1, LL2, LL3, ..., LLn according to the timestamp.

[0099] The abnormal traffic peak is divided into the sample average traffic rate YYL and the real-time average traffic rate. The real-time average traffic rate is recorded as YL1, YL2, YL3, ..., YLn according to the timestamp;

[0100] The second data set includes the number of logins, session duration, and device login frequency;

[0101] The number of logins is divided into sample logins YDL and real-time logins. The real-time logins are recorded as DL1, DL2, DL3, ..., DLn according to the timestamp.

[0102] The session duration is divided into the sample session duration YHH and the real-time session duration. The real-time session duration is recorded according to the timestamp as: HH1, HH2, HH3, ..., HHn;

[0103] The device login frequency number is divided into the sample device login frequency number YSD and the real-time device login frequency number, where the device login frequency number is recorded as SD1, SD2, SD3, ..., SDn according to the timestamp;

[0104] The third data set includes the number of incidents, incident response time, the ratio of successful to failed logins, and the number of malicious IP accesses;

[0105] The number of event occurrences is divided into the sample device login frequency number YSC and the real-time device login frequency number, where the number of real-time event occurrences is recorded as SC1, SC2, SC3, ..., SCn according to the timestamp;

[0106] The event response time is divided into the sample event response time YSX and the real-time event response time. The real-time event response time is recorded as SX1, SX2, SX3, ..., SXn according to the timestamp;

[0107] The ratio of successful and failed logins is divided into the sample device login frequency number YCS and the real-time device login frequency number, where the real-time successful and failed login ratios are recorded as CS1, CS2, CS3, ..., CSn according to the timestamp;

[0108] The number of malicious IP accesses is divided into the number of sample malicious IP accesses YEY and the number of real-time malicious IP accesses. The real-time malicious IP accesses are recorded as EY1, EY2, EY3, ..., EYn according to the timestamp.

[0109] In this embodiment: the preprocessing unit 21 cleans and standardizes the collected raw data, eliminates noise and inconsistency, and ensures the accuracy of the data during analysis. Dimensionless processing allows data of different units and magnitudes to be effectively compared, reducing the complexity of data analysis. The integration unit 22 reorganizes the processed data into the first, second and third data sets to ensure the clarity and consistency of the data structure. This systematic data organization method not only improves the efficiency of subsequent calculations and analysis, but also enhances the ability to comprehensively evaluate the network security status. Compared with traditional methods, this module can provide high-quality data support more quickly, making network security monitoring and response more accurate and effectively responding to changing security threats.

[0110] The structural design of the first, second and third data sets significantly improves the accuracy of network security monitoring and analysis by subdividing different types of parameters. The first data set contains the number of packets, total traffic, average traffic rate and abnormal traffic peak. The comparison of real-time and sample data enables the system to capture changes in network traffic in a timely manner and quickly identify potential abnormal activities. The second data set helps to deeply analyze user behavior and device security by integrating the number of logins, session duration and device login frequency, thereby improving the ability to identify abnormal logins and potential attacks. The third data set covers the number of events, event response time, successful and failed login ratios, and the number of malicious IP visits, providing an important basis for real-time monitoring and response to network security events.

[0111] Example 4

[0112] See also Figure 1 , the calculation module 3 includes a first calculation unit 31 and a second calculation unit 32;

[0113] The first calculation unit 31 is used to calculate the first data set, the second data set and the third data set respectively, so as to generate a first reference value S1, a second reference value S2 and an intervention correction value JXZ;

[0114] The second calculation unit 32 is used for integrating and calculating the first reference value S1 , the second reference value S2 and the intervention correction value JXZ to generate a safety reference factor AHC.

[0115] The first reference value S1 and the second reference value S2 are calculated and obtained by the following formulas respectively;

[0116] S1=a1×PSJ+a2×PZL+a3×PLL+a4×PYL;

[0117] S2=a1×PSC+a2×PSX+a3×PCS+a4×PEY;

[0118]

[0119] Wherein: a1, a2, a3 and a4 are weight values, and the values ​​of a1, a2, a3 and a4 are adjusted and set by the user;

[0120] SJn, ZLn, LLn, YLn, SCn, SXn, CSn, and EYn are the number of packets, total traffic, average traffic rate, abnormal traffic peak, number of events, event response time, ratio of successful and failed logins, and number of malicious IP accesses at timestamp n, respectively;

[0121] YBS, YZL, YLL, YYL, YDL, YHH, YSD and YSC are respectively the number of sample data packets, total traffic, sample average traffic rate, sample abnormal traffic peak, number of sample event occurrences, sample event response time, sample success and failure login ratio and sample malicious IP access times.

[0122] The intervention correction value JXZ is calculated by the following formula:

[0123] JXZ=(YDL-DL n ) 2 +(YHH-YHH n ) 2 +(YSD-SD n ) 2 ;

[0124] Where: DLn, HHn and SDn are the number of logins, session duration and device login frequency at timestamp n respectively;

[0125] YDL, YHH and YSD are the number of sample logins, sample session duration and sample device login frequency respectively.

[0126] The network security reference coefficient AQX is calculated by the following formula:

[0127] AQX=e S1 ×JXZ+ln(S2)×JXZ;

[0128] Wherein: S1 and S2 are the first reference value and the second reference value respectively, e is the exponential function, ln is the logarithmic function, and JXZ is the intervention correction value.

[0129] In this embodiment, the design of the calculation module 3 significantly improves the accuracy and flexibility of network security assessment by introducing the first calculation unit 31 and the second calculation unit 32.

[0130] The first calculation unit 31 calculates the first data set, the second data set and the third data set respectively to generate the first reference value S1, the second reference value S2 and the intervention correction value JXZ, ensuring that the analysis process comprehensively considers the real-time and sample data. This multi-level calculation method can not only reflect the current network status, but also adjust the weight value to adapt the system to different environments and needs, thereby enhancing personalized security management capabilities.

[0131] The second calculation unit 32 generates a safety reference coefficient AHC by integrating these reference values, making the evaluation process more comprehensive and intuitive. The system also uses exponential and logarithmic functions to further enhance the calculation depth of the safety reference coefficient AQX, making it more sensitive to small changes, so that potential risks can be discovered in a timely manner. This improvement makes network security assessment more dynamic and accurate. Compared with traditional methods, it can respond and adjust protection strategies more quickly, effectively improve the overall network security protection capabilities, and ensure the security of user data and systems.

[0132] Example 5

[0133] See also Figure 1 , the analysis module 4 includes a first analysis unit 41 and a second analysis unit 42;

[0134] The first analysis unit 41 is used to compare the network security reference coefficient AQX generated by the calculation module 3 with a preset first threshold value Y, thereby generating a first comparison result, and judging whether the current construction is in a safe state according to the first comparison result;

[0135] If the first comparison result shows a non-safe state, the second analysis unit 42 integrates and calculates the network security reference coefficient AQX and the first threshold value Y to generate a risk level value FLJ, and compares the risk level value FLJ with a preset second threshold value R to generate a second comparison result, and divides the network environment into risk categories according to the second comparison result;

[0136] The first comparison results are as follows;

[0137] When AQX≤Y, it means the current network environment is safe;

[0138] When ΔQX≤Y, it means that the current network environment is in an unsafe state;

[0139] The second comparison results are as follows;

[0140] When FLJ≤R, it means that the current network environment is in a level 1 risk state, and the data changes from basic blue to yellow;

[0141] When R<FLJ≤R×105%, the current network environment is in a secondary risk state, and the data changes from basic blue to orange;

[0142] When FLJ>R×105%, the current network environment is in the third-level risk state, and the data changes from the basic blue to red;

[0143] The risk level value FLJ is calculated by the following formula:

[0144]

[0145] Where: AQX is the network security reference coefficient, and Y is the first threshold.

[0146] In this embodiment: the analysis module 4 significantly enhances the real-time monitoring and risk assessment capabilities of the construction safety status by introducing the first analysis unit 41 and the second analysis unit 42. The first analysis unit 41 compares the network security reference coefficient AQX generated by the calculation module 3 with the preset first threshold value Y to quickly determine whether the current construction is in a safe state. This instant feedback mechanism can effectively shorten the time of safety assessment and improve the response speed to potential risks.

[0147] When the first comparison result shows an unsafe state, the second analysis unit 42 further integrates AQX and the first threshold value Y to calculate the risk magnitude value FLJ, and compares it with the preset second threshold value R. This hierarchical analysis method not only provides a clear risk classification, but also intuitively reflects the safety level of the construction site through color coding blue, yellow, orange, and red. Compared with the traditional single threshold judgment, this improvement improves the adaptability to complex construction environments and makes risk assessment more detailed and flexible, thereby providing more reliable safety protection for the construction site, ensuring that protective measures are taken in a timely manner, and reducing the possibility of safety accidents.

[0148] This application also includes a network-based big data analysis method, see Figure 2 , the specific steps are as follows;

[0149] S1. Collect network security related data through multiple data sources and set the basic color of the data to blue to facilitate subsequent processing and identification;

[0150] S2, cleaning and standardizing the collected multi-source data, eliminating noise and redundant information, and reorganizing the processed data into three data sets;

[0151] S3, integrating and calculating the three sorted data sets to generate a network security reference coefficient AQX;

[0152] S4, compare the calculated safety reference coefficient AQX with the preset first threshold value Y to generate a first comparison result, and judge whether the current network environment is safe according to the comparison result. If it is not safe, further calculate the risk level value FLJ and compare it with the second threshold value R to generate a second comparison result, so as to facilitate risk classification;

[0153] S5. Feedback the security status and risk level results generated by the analysis module 4 to the terminal to ensure that relevant personnel can obtain information in a timely manner and take corresponding measures.

[0154] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

[0155] The above are only preferred embodiments of the present invention. It should be pointed out that, for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the technical principles of the present invention. These improvements and modifications should also be regarded as within the scope of protection of the present invention.

Claims

1. A network-based big data analysis system, characterized by: It comprises a collection module (1), a sorting module (2), a calculation module (3), an analysis module (4) and a feedback module (5); The acquisition module (1) is used to collect multi-source data on network security and set the basic color of the data to blue; The sorting module (2) is used to process the multi-source data collected by the collecting module (1) and re-sort the data into a first data set, a second data set and a third data set; The calculation module (3) is used to integrate and calculate the first data set, the second data set and the third data set generated by the sorting module (2), so as to generate a network security reference coefficient AQX; The analysis module (4) is used to compare the network security reference coefficient AQX generated by the calculation module (3) with a preset first threshold value Y, thereby generating a first comparison result, and judging whether the current network environment is in a safe state according to the first comparison result; If the first comparison result shows a non-safe state, the network security reference coefficient AQX is integrated and calculated with the first threshold value Y to generate a risk level value FLJ, and the safety level value FLJ is compared with a preset second threshold value R to generate a second comparison result. According to the second comparison result, the network environment is divided into risk categories; The feedback module (5) is used to feed back the result generated by the analysis module (4) to the terminal.

2. A network-based big data analysis system according to claim 1, characterized in that: The acquisition module (1) comprises a first acquisition unit (11), a second acquisition unit (12) and a third acquisition unit (13); The first acquisition unit (11) is used to collect network traffic data, the second acquisition unit (12) is used to collect user behavior data sets, and the third acquisition unit (13) is used to collect security event log data sets; The network traffic data, user behavior data set and security event log data set are integrated into multi-source data.

3. A network-based big data analysis system according to claim 2, characterized in that: The finishing module (2) comprises a pre-processing unit (21) and an integration unit (22); The preprocessing unit (21) is used to preprocess and dimensionlessly process the multi-source data collected by the collection module (1), and the integration unit (22) is used to reorganize the processed multi-source data, thereby generating a first data set, a second data set, and a third data set.

4. A network-based big data analysis system according to claim 3, characterized in that: The first data set includes the number of packets, total traffic, average traffic rate, and abnormal traffic peak; The number of data packets is divided into the number of sample data packets YBS and the number of real-time data packets, where the number of real-time data packets is recorded as SJ1, SJ2, SJ3, ..., SJn according to the timestamp; The total traffic is divided into the sample data total traffic YZL and the real-time total traffic. The real-time total traffic is recorded as ZL1, ZL2, ZL3, ..., ZLn according to the timestamp. The average traffic rate is divided into the sample average traffic rate YLL and the real-time average traffic rate. The real-time average traffic rate is recorded as LL1, LL2, LL3, ..., LLn according to the timestamp. The abnormal traffic peak is divided into the sample average traffic rate YYL and the real-time average traffic rate. The real-time average traffic rate is recorded as YL1, YL2, YL3, ..., YLn according to the timestamp; The second data set includes the number of logins, session duration, and device login frequency; The number of logins is divided into sample logins YDL and real-time logins. The real-time logins are recorded as DL1, DL2, DL3, ..., DLn according to the timestamp. The session duration is divided into the sample session duration YHH and the real-time session duration. The real-time session duration is recorded according to the timestamp as: HH1, HH2, HH3, ..., HHn; The device login frequency number is divided into the sample device login frequency number YSD and the real-time device login frequency number, where the device login frequency number is recorded as SD1, SD2, SD3, ..., SDn according to the timestamp; The third data set includes the number of incidents, incident response time, the ratio of successful to failed logins, and the number of malicious IP accesses; The number of event occurrences is divided into the sample device login frequency number YSC and the real-time device login frequency number, where the number of real-time event occurrences is recorded as SC1, SC2, SC3, ..., SCn according to the timestamp; The event response time is divided into the sample event response time YSX and the real-time event response time. The real-time event response time is recorded as SX1, SX2, SX3, ..., SXn according to the timestamp; The ratio of successful and failed logins is divided into the sample device login frequency number YCS and the real-time device login frequency number, where the real-time successful and failed login ratios are recorded as CS1, CS2, CS3, ..., CSn according to the timestamp; The malicious IP access times are divided into sample malicious IP access times YEY and real-time malicious IP access times, where the real-time malicious IP access times are recorded as EY1, EY2, EY3, ..., EYn according to the timestamp.

5. A network-based big data analysis system according to claim 4, characterized in that: The calculation module (3) comprises a first calculation unit (31) and a second calculation unit (32); The first calculation unit (31) is used to calculate the first data set, the second data set and the third data set respectively, so as to generate a first reference value S1, a second reference value S2 and an intervention correction value JXZ; The second calculation unit (32) is used for integrating and calculating the first reference value S1, the second reference value S2 and the intervention correction value JXZ, so as to generate a safety reference coefficient AHC.

6. A network-based big data analysis system according to claim 5, characterized in that: The first reference value S1 and the second reference value S2 are calculated and obtained by the following formulas respectively; S1=a1×PSJ+a2×PZL+a3×PLL+a4×PYL; S2=a1×PSC+a2×PSX+a3×PCS+a4×PEY; Wherein: a1, a2, a3 and a4 are weight values, and the values ​​of a1, a2, a3 and a4 are adjusted and set by the user; SJn, ZLn, LLn, YLn, SCn, SXn, CSn, and EYn are respectively the number of data packets, total traffic, average traffic rate, abnormal traffic peak, number of event occurrences, event response time, success and failure login ratio, and number of malicious IP accesses at the nth timestamp; YBS, YZL, YLL, YYL, YDL, YHH, YSD, and YSC are respectively the number of sample data packets, total traffic, sample average traffic rate, sample abnormal traffic peak, number of sample event occurrences, sample event response time, sample success and failure login ratio, and number of sample malicious IP accesses.

7. A network-based big data analysis system according to claim 6, characterized in that: The intervention correction value JXZ is obtained by calculating through the following formula; JXZ=(YDL-DL n , 2 +(YHH-YHH n , 2 +(YSD-SD n , 2 , In the formula: DLn, HHn, and SDn are respectively the number of logins, session duration, and device login frequency at the nth timestamp; YDL, YHH, and YSD are respectively the sample number of logins, sample session duration, and sample device login frequency.

8. A network-based big data analysis system according to claim 7, characterized in that: The network security reference coefficient AQX is obtained by calculating through the following formula; AQX=e S1 ×JXZ+ln(S2)×JXZ; In the formula: S1 and S2 are respectively the first reference value and the second reference value, e is the exponential function, ln is the logarithmic function, and JXZ is the intervention correction value.

9. A network-based big data analysis system according to claim 8, characterized in that: The analysis module (4) includes a first analysis unit (41) and a second analysis unit (42); The first analysis unit (41) is used to compare the network security reference coefficient AQX generated by the calculation module (3) with a preset first threshold Y, so as to generate a first comparison result, and judge whether the current construction is in a safe state according to the first comparison result; If the first comparison result shows a non-safe state, the second analysis unit (42) integrates and calculates the network security reference coefficient AQX with the first threshold Y, so as to generate a risk level value FLJ, and compares the risk level value FLJ with a preset second threshold R, so as to generate a second comparison result, and perform risk division on the network environment according to the second comparison result; The first comparison result is as follows; When AQX ≤ Y, it represents that the current network environment is in a safe state; When AQx ≤ Y, it represents that the current network environment is in a non-safe state; The second comparison result is as follows; When FLJ ≤ R, it represents that the current network environment is in a first-level risk state, and the data changes from the basic blue to yellow; When R < FLJ ≤ R × 105%, it represents that the current network environment is in a second-level risk state, and the data changes from the basic blue to orange; When FLJ > R × 105%, it represents that the current network environment is in a third-level risk state, and the data changes from the basic blue to red; The risk level value FLJ is obtained by calculating through the following formula; In the formula: AQX is the network security reference coefficient, and Y is the first threshold.

10. A network-based big data analysis method, characterized in that: The method is executed by the system according to any one of claims 1 to 9 above, and the specific steps are as follows: S1. Collect network security-related data through multiple data sources, and set the basic color of the data to blue for convenient subsequent processing and identification; S2. Clean and standardize the collected multi-source data, eliminate noise and redundant information, and reorganize the processed data into three data sets; S3, integrating and calculating the three sorted data sets to generate a network security reference coefficient AQX; S4, compare the calculated safety reference coefficient AQX with the preset first threshold value Y to generate a first comparison result, and judge whether the current network environment is safe according to the comparison result. If it is not safe, further calculate the risk level value FLJ and compare it with the second threshold value R to generate a second comparison result, so as to facilitate risk classification; S5. Feedback the security status and risk level results generated by the analysis module (4) to the terminal to ensure that relevant personnel can obtain information in a timely manner and take corresponding measures.

Images