A network security protection method for cloud service system

Abstract

The present invention relates to the field of data processing technology, and in particular to a network security protection method for a cloud service system, comprising: obtaining current operation behavior data of a target user for a function module of a cloud service system; determining a first difference parameter between the current operation behavior data and the historical operation behavior data according to the historical operation behavior data of the target user, the current operation behavior data, and the change in operation duration for each function module in the current operation behavior data and the historical operation behavior data; when the first difference parameter is greater than a preset first threshold, calculating the similarity between the first category to which the function module operated by the i-th operation in the current operation behavior data belongs and the second category to which the function module operated by the i-1-th operation belongs, and obtaining a similarity index; when the fusion result of the first difference parameter and the similarity index is greater than a preset second threshold, determining that the target user is an abnormal user. The present invention effectively discovers abnormal users.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a network security protection method for a cloud service system. Background Art

[0002] As the amount of data recorded in hospital systems continues to grow, the storage requirements are also increasing. Given that data must be retained for a certain number of years before being deleted, more and more people prefer to store the data to be tested in cloud services.

[0003] The cloud service system has a defect that it is difficult to effectively detect whether the user's behavior status is abnormal based on the user's behavior data of operating the system. Therefore, it is difficult to find abnormal users, making the system less secure. Summary of the invention

[0004] In order to solve the technical problem that it is difficult to find abnormal users and the system security is low, the purpose of the present invention is to provide a network security protection method for a cloud service system. The technical solution adopted is as follows:

[0005] Obtain the target user's current operation behavior data on the functional modules of the cloud service system;

[0006] Determine a first difference parameter between the current operation behavior data and the historical operation behavior data according to the historical operation behavior data of the target user, the current operation behavior data, and the change in operation duration for each functional module in the current operation behavior data and the historical operation behavior data;

[0007] When the first difference parameter is greater than a preset first threshold, the similarity between the first category to which the function module corresponding to the i-th operation in the current operation behavior data belongs and the second category to which the function module corresponding to the i-1-th operation belongs is calculated to obtain a similarity index; wherein i is greater than 1 and is a positive integer;

[0008] When a fusion result of the first difference parameter and the similarity index is greater than a preset second threshold, the target user is determined to be an abnormal user.

[0009] Preferably, when the fusion result of the first difference parameter and the similarity index is greater than a preset second threshold, determining that the target user is an abnormal user includes:

[0010] multiplying the first difference parameter by the inverse of the similarity index to obtain a second abnormality parameter;

[0011] When the second abnormal parameter is greater than the preset second threshold, the target user is determined to be an abnormal user.

[0012] Preferably, the method further comprises:

[0013] When the second abnormal parameter is not greater than the preset second threshold, the target user is determined to be a normal user.

[0014] Preferably, determining a first difference parameter between the current operation behavior data and the historical operation behavior data according to the historical operation behavior data of the target user, the current operation behavior data, and the change in operation duration for each functional module in the current operation behavior data and the historical operation behavior data includes:

[0015] Determine historical behavior habit parameters according to the historical operation behavior data;

[0016] Determine current behavior habit parameters according to the current operation behavior data;

[0017] A first difference parameter between the current operation behavior data and the historical operation behavior data is determined based on the historical behavior habit parameter, the current behavior habit parameter, and the change in operation duration for each functional module in the current operation behavior data and the historical operation behavior data.

[0018] Preferably, determining the historical behavior habit parameters according to the historical operation behavior data includes:

[0019] Calculating the probability of N functional modules being operated in the historical operation behavior data respectively to obtain N execution probabilities;

[0020] The N execution probabilities are multiplied to obtain the historical behavior habit parameter of the target user, wherein N is a positive integer.

[0021] Preferably, the probability of N functional modules being operated in the historical operation behavior data is calculated respectively to obtain N execution probabilities, including:

[0022] Determining the number of operations of the jth functional module among the N functional modules and the probability of each functional module being operated as the j+1th functional module in the historical operation behavior data;

[0023] According to the j+1th functional module in the current operation behavior data, determining a corresponding target probability among the probabilities of each functional module being operated as the j+1th functional module;

[0024] The product of the number of operations of the j-th functional module and the target probability is determined as the execution probability of the j-th functional module; wherein j is a positive integer.

[0025] Preferably, determining a first difference parameter between the current operation behavior data and the historical operation behavior data according to the historical behavior habit parameter, the current behavior habit parameter, and the change in operation duration for each functional module in the current operation behavior data and the historical operation behavior data includes:

[0026] Calculating the ratio of the current behavior habit parameter to the historical behavior habit parameter to obtain a habit parameter ratio;

[0027] The product of the habit parameter ratio and the change in operation duration is calculated, and the product is normalized to obtain the first difference parameter.

[0028] Preferably, calculating the similarity between the first category to which the function module corresponding to the i-th operation in the current operation behavior data belongs and the second category to which the function module corresponding to the i-1-th operation belongs to obtain a similarity index, including:

[0029] Subtract the ratio of the number of the first category and the number of the second category from 1 to obtain a difference;

[0030] The difference is normalized to obtain a similarity index.

[0031] Preferably, the method further comprises:

[0032] When the first difference parameter is not greater than the preset first threshold, it is determined that the target user is a normal user.

[0033] In one embodiment, when the fusion result of the first difference parameter and the similarity index is greater than a preset second threshold, after determining that the target user is an abnormal user, the method further includes:

[0034] Suspending the target user's account;

[0035] If the identity information of the target user is successfully verified, unblocking the target user's account;

[0036] In the event that the identity information verification of the target user fails, the target user's account will be permanently blocked.

[0037] The present invention has the following beneficial effects:

[0038] Obtain the target user's current operation behavior data for the functional modules of the cloud service system; determine the first difference parameter between the current operation behavior data and the historical operation behavior data based on the target user's historical operation behavior data, current operation behavior data, and the change in operation time for each functional module in the current operation behavior data and the historical operation behavior data; when the first difference parameter is greater than the preset first threshold, calculate the similarity between the first category to which the functional module operated by the i-th operation in the current operation behavior data belongs and the second category to which the functional module operated by the i-1-th operation belongs, and obtain a similarity index; when the fusion result of the first difference parameter and the similarity index is greater than the preset second threshold, determine that the target user is an abnormal user. In this way, the current operation behavior data is determined to be suspected of being abnormal through the first difference parameter between the current operation behavior data and the historical operation behavior data, and then combined with the similarity index of the category to which the functional module in the current operation behavior data belongs, confirm from multiple angles that the current operation behavior data is abnormal, thereby accurately discovering abnormal users and improving the security of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the technical solutions and advantages in the embodiments of the present invention or the prior art, the drawings required for use in the embodiments or the prior art descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0040] Figure 1 A method flow chart of a network security protection method for a cloud service system provided by an embodiment of the present invention;

[0041] Figure 2 A schematic diagram of step S120 in a network security protection method for a cloud service system provided by an embodiment of the present invention;

[0042] Figure 3 A schematic diagram of step S140 in a network security protection method for a cloud service system provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0043] In order to further explain the technical means and effects adopted by the present invention to achieve the predetermined invention purpose, the following is a detailed description of the network security protection method of a cloud service system proposed by the present invention, its specific implementation method, structure, characteristics and effects, in combination with the accompanying drawings and preferred embodiments. In the following description, different "one embodiment" or "another embodiment" does not necessarily refer to the same embodiment. In addition, specific features, structures or characteristics in one or more embodiments may be combined in any suitable form.

[0044] Unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs.

[0045] The following is a detailed description of a network security protection method for a cloud service system provided by the present invention in conjunction with the accompanying drawings.

[0046] See also Figure 1 , which shows a method flow chart of a network security protection method for a cloud service system provided by an embodiment of the present invention. In an exemplary embodiment, a network security protection method for a cloud service system is provided, comprising:

[0047] S110, obtaining the current operation behavior data of the target user on the functional modules of the cloud service system;

[0048] S120, determining a first difference parameter between the current operation behavior data and the historical operation behavior data according to the historical operation behavior data of the target user, the current operation behavior data, and a change in operation duration for each functional module in the current operation behavior data and the historical operation behavior data;

[0049] S130, when the first difference parameter is greater than a preset first threshold, calculating the similarity between the first category to which the function module corresponding to the i-th operation in the current operation behavior data belongs and the second category to which the function module corresponding to the i-1-th operation belongs, to obtain a similarity index; wherein i is greater than 1 and is a positive integer;

[0050] S140: When a fusion result of the first difference parameter and the similarity index is greater than a preset second threshold, determine that the target user is an abnormal user.

[0051] In step S110, illustratively, the target user can be any user who has logged into the cloud service system, or a specified user who has logged into the cloud service system, which is not limited here. The current operation behavior data includes at least one operation behavior on a functional module, and the current operation behavior data can be stored in the form of a behavior log.

[0052] Specifically, after logging in normally, the target user will operate the functional modules in the cloud service system according to his / her identity and position. The system records and processes the target user's operation behavior data to obtain the current operation behavior data.

[0053] In this embodiment, when the cloud service system numbers and sorts different functional modules in advance, it strictly follows the order in which they are created, that is, the first created functional module is numbered 1, and the subsequent functional modules are numbered 2, 3, etc. At the same time, the system also uses the same method to number different functions under each functional module.

[0054] After the user completes the registration process, he / she can log in to the system using the login function. The system will record all the target user's operations in detail and generate corresponding behavior logs so that the target user's behavior habits can be analyzed in depth later. These behavior logs will be retained for a long time to ensure that historical behavior logs can be reviewed at any time. In addition, the system will also conduct in-depth mining and analysis of this part of the data to extract the user's operation behavior records. For example, in the historical login, the user performed x operations on function module a, and the average duration of each operation was t seconds.

[0055] In step S120, illustratively, each time the target user logs into the system and operates the system content, new operation behavior data will be generated. At the same time, the system will record this part of data in the target user's behavior log in real time to form a new operation record. Subsequently, the system compares and analyzes the newly generated operation log with the historical behavior operation data, that is, by comparing the target user's current behavior habits with historical behavior habits, it determines whether the user behavior is abnormal.

[0056] Preferably, if Figure 2 As shown, step S120 includes: S1210, determining historical behavior habit parameters based on the historical operation behavior data; S1220, determining current behavior habit parameters based on the current operation behavior data; S1230, determining the first difference parameter between the current operation behavior data and the historical operation behavior data based on the historical behavior habit parameters, the current behavior habit parameters, and the change in operation time for each functional module in the current operation behavior data and the historical operation behavior data.

[0057] For example, taking the cloud service as a medical system, after logging into the medical system, users will pay attention to and focus on different information due to their different user identities. For example, after logging into the system, the attending physician will mainly query the patient information and surgery arrangements of the patients he / she is attending, while the pharmacist will pay more attention to the inventory information and drug management of the hospital's drugs. Therefore, the behavior habit parameters should be generated based on the operation behavior data.

[0058] Furthermore, the current behavior habit parameters and the historical behavior habit parameters are determined in the same manner. Taking the historical behavior habit parameters as an example, determining the historical behavior habit parameters according to the historical operation behavior data includes: calculating the probability of N function modules being operated in the historical operation behavior data respectively to obtain N execution probabilities; multiplying the N execution probabilities to obtain the historical behavior habit parameters of the target user; wherein N is a positive integer.

[0059] Exemplarily, the number of operations of the jth functional module and the probability of each functional module being operated as the j+1th functional module are determined in the historical operation behavior data; according to the j+1th functional module in the current operation behavior data, the corresponding target probability is determined in the probability of each functional module being operated as the j+1th functional module; the product of the number of operations of the jth functional module and the target probability is determined as the execution probability of the jth functional module; wherein j is a positive integer. In this way, the possibility of the operation of the jth functional module is obtained.

[0060] After the N function modules in the historical operation behavior data are calculated according to the above-mentioned execution probability calculation method, N execution probabilities are obtained, and the N execution probabilities are multiplied to obtain the historical behavior habit parameters of the target user.

[0061] In this embodiment, the calculation formula of the historical behavior habit parameter is as follows:

[0062]

[0063] Among them, G is the historical behavior habit parameter of the target user, a is the number of the system function module, N is the number of the target user's historical operations on the function module, and n a is the number of operations of the target user on the functional module a, which is used as the parameter of the target user's operation habits. a,s is the probability of operating each module in sequence in the historical operation behavior data, n a ×P a,s It is the product of the number of operations on function module a and the sequence probability in the target user's historical behavior operation data, which is used to indicate the possibility of the target user operating the function module. By multiplying the operation probabilities of all functional modules in the historical operation behavior data, the historical behavior habit parameters of the target user are obtained.

[0064] It should be noted that in the historical operation behavior data, since there are multiple historical operations, the order of each operation may be different. a,sThe probability of the user operating the most likely module after operating module a is taken. For example, if the historical operation behavior data is abc, bac, cab, then after the user operates module a, the probability of operating module b is two-thirds. If the user then operates module b, then P a,s The value is two-thirds. When the user stops operating, the calculation stops to ensure that the p value cannot be 0.

[0065] Furthermore, the user's current operation not only affects the accumulation of historical data, but may also have a direct impact on the operation data of some modules, such as the number of times and duration. This impact is then reflected in the changes in the behavior log data, resulting in differences in the user's behavior parameters. During long-term use, the user's behavior parameters will usually stabilize within a relatively fixed numerical range, with a small fluctuation range and gradually tend to stabilize. However, when the behavior habits of this operation change significantly from the historical operation habits, the user's operation behavior parameters may deviate significantly.

[0066] Therefore, in order to detect whether the user's behavior is abnormal, the system will compare the operation data after the current login (such as operation sequence, duration, etc.) with the historical data in detail and calculate the difference parameters between the two. Based on these difference parameters, the system can evaluate and determine whether the user is likely to be abnormal.

[0067] Preferably, step S1230 includes: calculating the ratio of the current behavior habit parameter to the historical behavior habit parameter to obtain a habit parameter ratio; calculating the product of the habit parameter ratio and the change in operation duration, and normalizing the product to obtain the first difference parameter.

[0068] For example, when checking the patient's information, there is no big difference in the time of daily checking, but when the viewing / operation time is too long, there may be an abnormality. Therefore, the change in operation time is multiplied by the ratio of the current behavior habit parameter to the historical behavior habit parameter, so that the difference between the current operation behavior data and the historical operation behavior data can be more accurately represented, that is, the first difference parameter is more accurate. The normalization process is used to control the result between 0-1, making the calculation process simpler, thereby saving the system's computing power.

[0069] Specifically, the calculation formula of the first difference parameter is as follows:

[0070]

[0071] Among them, F is the first difference parameter, m and o are used to represent the current operation and the historical operation respectively, and distinguish them. m is the current behavior habit parameter, G o is the historical behavior habit parameter, is the habit parameter ratio, which indicates the difference between the current operation behavior data and the historical operation behavior data. is the absolute value of the difference between the current operation behavior data and the historical operation behavior data and 1. The larger the value, the greater the difference between the current operation behavior data and the historical operation behavior data, and vice versa. i is the order of system operation modules after this login, Δa i is the difference between the duration and sequence of the system operation modules after this login and the historical operation sequence, i refers to the sequence number of the system function operation after login, M is the total number of function modules in the current operation behavior data, ΔS i is the change in operation duration for each functional module in the current operation behavior data and the historical operation behavior data; | | is the absolute value symbol. Use norm() to normalize the obtained calculation results to facilitate subsequent calculations.

[0072] In step S130, illustratively, the larger the F (i.e., the first difference parameter) value is, the greater the difference between the previous operation behavior data and the historical operation behavior data is, and vice versa. The preset first threshold value can be a value set according to actual experience. In this embodiment, the preset first threshold value is 0.4. Then, when the first difference parameter is greater than 0.4, it means that there is an abnormality in the current operation behavior data of the target user, and the target user is a suspected abnormal user.

[0073] However, when using this system, users may encounter situations where they need to query and index other information. For example, when the attending physician diagnoses a patient, he or she will query the information of patients with the same or similar conditions in the hospital based on the patient's condition to view the treatment and rehabilitation of these patients as reference cases, so as to develop better treatment methods and processes for the patient. However, when the information of a single patient is not sufficient to provide effective reference, the physician may choose to query information on multiple similar patients. In this process, the system may mistakenly analyze this behavior as an abnormal state. Therefore, we further analyze the current operation behavior data of suspected abnormal users to prevent the system from making misjudgments.

[0074] Specifically, the correlation between each functional module is analyzed to determine whether the current operation behavior data is indeed abnormal. For example, when an orthopedic physician performs a case examination on a patient, he or she will mainly query the relevant information of the orthopedic patient, rather than randomly querying the patient information of other departments, to ensure that the diagnosis and treatment plan for the patient are both effective and reliable. Therefore, if the functional modules are different, or a functional module is not outdated, the similarity between the functional modules can be determined by analyzing the category to which the functional modules belong (i.e., its upper-level module). For example, Chinese medicine (I) and Chinese medicine (II) have different numbers, but they belong to the general category of Chinese medicine, so the similarity between these parts is high when comparing information.

[0075] For another example, each functional module group has its own functions, such as the user information module contains add, delete, modify and query, etc., which are recorded in a numerical structure, such as the user information module is numbered 1, the delete function below it is numbered 2, and the modify function is 3. The number of the user's deletion operation on the information is (1-2), and the parent number of 2 is 1, that is, the deletion function belongs to the user information module category. The number of the user's modification operation on the information is (1-3), and the parent number of 3 is 1, that is, the modification function belongs to the user information module category. Although the deletion function and the modification function are different, the direct similarity of the two functions can be determined by comparing their parent modules (i.e., comparing 1 with 1).

[0076] Preferably, the similarity between the first category to which the functional module corresponding to the i-th operation in the current operation behavior data belongs and the second category to which the functional module corresponding to the i-1-th operation belongs is calculated to obtain a similarity index, including: subtracting the ratio of the number of the first category and the number of the second category from 1 to obtain a difference; and normalizing the difference to obtain a similarity index.

[0077] Specifically, the similarity index calculation formula is as follows:

[0078]

[0079] Among them, Z i is the similarity index, i is the sequence number of the current operation behavior data, m i is the upper level module number (i.e. the number of the first category) of the function module a during the i-th operation, m' i The module number of the upper level module (i.e. the number of the second category) of the function module that the user has completed after logging in. It is the ratio of the number of the first category to the number of the second category, and is used to indicate the difference between the functional modules. The closer the value is to 1, the higher the similarity between the functional modules, and vice versa.

[0080] Will Perform a minus 1 operation to make The value changes with 0 as the base, and then the derivative of the Softsign() function is used to make the Z value between (0,1], and The closer the value is to 0, the larger the Z value is, and the higher the similarity of the target user's current operation behavior data is. Conversely, the smaller the Z value is. It should be noted that the Z value is not 0.

[0081] In step S140, illustratively, when an abnormal user attempts to illegally obtain user data, he may operate in the order of users or functions, and this operation mode is similar to the behavior of some doctors when they query information. Therefore, if the user in the abnormal state is distinguished only by the similarity index between the user operation function modules, it may lead to inaccurate identification, so that the abnormal user is mistakenly identified as a normal user. Therefore, it is necessary to fuse the first difference parameter and the similarity index, and use the fusion result as an important basis for distinguishing normal users from abnormal users, so as to achieve accurate distinction between users in the two states.

[0082] Preferably, if Figure 3 As shown, step S140 includes: S1410, multiplying the first difference parameter by the inverse of the similarity index to obtain a second abnormal parameter; S1420, when the second abnormal parameter is greater than the preset second threshold, determining that the target user is an abnormal user.

[0083] Specifically, for the first difference parameter F and the similarity index Z i , the larger the F value, the greater the possibility of user abnormality, and Z i The larger the value, the less likely the user is abnormal. To analyze the user status more accurately, we use the similarity index Z i Take the reciprocal (denoted as ) method, so far, F and Both parameters are positively correlated with the possibility of abnormal user status. Based on the correlation between these two positively correlated parameters, it is possible to more effectively confirm whether the user is abnormal.

[0084] Then, the calculation formula of the second abnormal parameter is as follows:

[0085]

[0086] Among them, Y represents the second abnormal parameter, F is the first difference parameter, Z i is the similarity index, The reciprocal of i is the sequence number of the target user's operation behavior after logging in this time. The Sigmoid() function is used to normalize the calculation result so that the Y value range is between [0,1] to reduce the computing power occupied by the system.

[0087] It is used to indicate the abnormality of the target user's current login. The higher the value, the greater the possibility of abnormality, and vice versa. The preset second threshold is set based on actual experience. In this embodiment, the preset second threshold is 0.5.

[0088] There are obvious differences between normal users and abnormal users in their choices when operating each functional module. Normal users are more inclined to choose to obtain data related to themselves, while abnormal users mainly focus on obtaining a large amount of user information. When Y is greater than 0.5, it means that the target user obtains a large amount of user information and the login status is abnormal, then the target user is an abnormal user.

[0089] In the technical solution of the present application, the current operation behavior data of the target user for the functional modules of the cloud service system is obtained; the first difference parameter between the current operation behavior data and the historical operation behavior data is determined according to the historical operation behavior data, the current operation behavior data, and the change in the operation time of each functional module in the current operation behavior data and the historical operation behavior data of the target user; when the first difference parameter is greater than the preset first threshold, the similarity between the first category to which the functional module operated by the i-th operation in the current operation behavior data belongs and the second category to which the functional module operated by the i-1-th operation belongs is calculated to obtain a similarity index; when the fusion result of the first difference parameter and the similarity index is greater than the preset second threshold, the target user is determined to be an abnormal user. In this way, the current operation behavior data is determined to be suspected to be abnormal through the first difference parameter between the current operation behavior data and the historical operation behavior data, and then combined with the similarity index of the category to which the functional module in the current operation behavior data belongs, it is confirmed from multiple angles that the current operation behavior data is abnormal, thereby accurately discovering abnormal users and improving the security of the system.

[0090] In one embodiment, the method further comprises:

[0091] When the second abnormal parameter is not greater than the preset second threshold, the target user is determined to be a normal user.

[0092] Specifically, after obtaining the second abnormal parameter, the second abnormal parameter is compared with the preset second threshold value (i.e., 0.5). If the second abnormal parameter is not greater than the preset second threshold value, it means that the target user is more inclined to choose to obtain data related to himself, and the login status is normal. Therefore, the target user is a normal user, and the check on the target user is ended.

[0093] In one embodiment, the method further comprises:

[0094] When the first difference parameter is not greater than the preset first threshold, it is determined that the target user is a normal user.

[0095] Specifically, after determining the first difference parameter between the current operation behavior data and the historical operation behavior data based on the target user's historical operation behavior data, current operation behavior data, and changes in the operation time of each functional module in the current operation behavior data and the historical operation behavior data, the first difference parameter is compared with a preset first threshold (i.e., 0.4). If the first difference parameter is not greater than the preset first threshold, it means that there is no abnormality in the current operation behavior data, and the target user is a normal user, then there is no need to calculate the similarity index and the second abnormality parameter.

[0096] In one embodiment, when the fusion result of the first difference parameter and the similarity index is greater than a preset second threshold, after determining that the target user is an abnormal user, the method further includes:

[0097] Suspending the target user's account;

[0098] If the identity information of the target user is successfully verified, unblocking the target user's account;

[0099] In the event that the identity information verification of the target user fails, the target user's account will be permanently blocked.

[0100] Specifically, after determining that the target user is an abnormal user, the degree of the abnormal state is analyzed in detail, and emergency suspension measures (i.e. suspension processing) are implemented on the target user's account. Abnormal data is then reported to system administrators in a timely manner through various effective channels such as emails and message pop-ups. At the same time, the identity information of the abnormal user is verified. If the identity is confirmed to be normal, the system or administrator will restore the account and immediately lift the suspension status of the account; conversely, if the identity is abnormal or there is a security risk, the account will be permanently suspended and its related data will be deleted, while strengthening security protection measures for the remaining information. In this way, even if the account of the abnormal user is processed, the security of the cloud service system is guaranteed.

[0101] At the same time, we will conduct in-depth analysis of the abnormal status after login, identify the cause of the abnormality, and record it in detail in the log to facilitate subsequent tracking and prevention of such incidents from happening again.

[0102] In other embodiments, a device is also provided, including a memory and a processor. The memory is used to store executable program code, and the processor is used to call and run the executable program code from the memory, so that the device executes the network security protection method of the cloud service system described above. The device can be a chip, a component or a module, and the chip may include a connected processor and a memory; wherein the memory is used to store instructions, and when the processor calls and executes the instructions, the chip can execute the network security protection method of the cloud service system provided in the above embodiment.

[0103] In other embodiments, a computer program product is also provided. When the computer program product is run on a computer, the computer executes the above-mentioned related steps to implement a network security protection method for a cloud service system provided in the above-mentioned embodiment.

[0104] In other embodiments, a computer-readable storage medium is also provided, in which a computer program code is stored. When the computer program code runs on a computer, the computer executes the above-mentioned related method steps to implement a network security protection method for a cloud service system provided in the above-mentioned embodiment.

[0105] Among them, the provided systems, devices, computer program products, and computer-readable storage media are all used to execute the corresponding methods provided above. Therefore, the beneficial effects that can be achieved can refer to the beneficial effects in the corresponding methods provided above and will not be repeated here.

[0106] It should be noted that the sequence of the above embodiments of the present invention is only for description and does not represent the advantages and disadvantages of the embodiments. The processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0107] The various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referenced to each other, and each embodiment focuses on the differences from other embodiments.

Claims

1. A network security protection method for a cloud service system, characterized in that: The method comprises: Obtain the target user's current operation behavior data on the functional modules of the cloud service system; Determine historical behavior habit parameters according to historical operation behavior data; determine current behavior habit parameters according to the current operation behavior data; determine a first difference parameter between the current operation behavior data and the historical operation behavior data according to the historical behavior habit parameters, the current behavior habit parameters, and the change in operation duration for each functional module in the current operation behavior data and the historical operation behavior data; The first difference parameter is obtained by: calculating the ratio of the current behavior habit parameter to the historical behavior habit parameter to obtain a habit parameter ratio; calculating the product of the habit parameter ratio and the change in operation duration, and normalizing the product to obtain the first difference parameter; When the first difference parameter is greater than a preset first threshold, the similarity between the first category to which the function module corresponding to the i-th operation in the current operation behavior data belongs and the second category to which the function module corresponding to the i-1-th operation belongs is calculated to obtain a similarity index; wherein i is greater than 1 and is a positive integer; The similarity index is obtained by: subtracting the ratio of the number of the first category and the number of the second category from 1 to obtain a difference; normalizing the difference to obtain a similarity index; When a fusion result of the first difference parameter and the similarity index is greater than a preset second threshold, the target user is determined to be an abnormal user.

2. A network security protection method for a cloud service system according to claim 1, characterized in that: When a fusion result of the first difference parameter and the similarity index is greater than a preset second threshold, determining that the target user is an abnormal user includes: multiplying the first difference parameter by the inverse of the similarity index to obtain a second abnormality parameter; When the second abnormal parameter is greater than the preset second threshold, the target user is determined to be an abnormal user.

3. A network security protection method for a cloud service system according to claim 2, characterized in that: The method further comprises: When the second abnormal parameter is not greater than the preset second threshold, the target user is determined to be a normal user.

4. A network security protection method for a cloud service system according to claim 1, characterized in that: Determining historical behavior habit parameters according to the historical operation behavior data includes: Calculating the probability of N functional modules being operated in the historical operation behavior data respectively to obtain N execution probabilities; The N execution probabilities are multiplied to obtain the historical behavior habit parameter of the target user, wherein N is a positive integer.

5. A network security protection method for a cloud service system according to claim 4, characterized in that: The probability of N functional modules being operated in the historical operation behavior data is calculated respectively to obtain N execution probabilities, including: Determining the number of operations of the jth functional module among the N functional modules and the probability of each functional module being operated as the j+1th functional module in the historical operation behavior data; According to the j+1th functional module in the current operation behavior data, determining a corresponding target probability among the probabilities of each functional module being operated as the j+1th functional module; The product of the number of operations of the j-th functional module and the target probability is determined as the execution probability of the j-th functional module; wherein j is a positive integer.

6. A network security protection method for a cloud service system according to any one of claims 1 to 5, characterized in that: The method further comprises: When the first difference parameter is not greater than the preset first threshold, it is determined that the target user is a normal user.

7. A network security protection method for a cloud service system according to claim 6, characterized in that: When the fusion result of the first difference parameter and the similarity index is greater than a preset second threshold, after determining that the target user is an abnormal user, the method further includes: Suspending the target user's account; If the identity information of the target user is successfully verified, unblocking the target user's account; In the event that the identity information verification of the target user fails, the target user's account will be permanently blocked.

Images