An adaptive intrusion detection system and method for big data platform

Abstract

The present invention discloses an adaptive intrusion detection system and method for a big data platform, and relates to the technical field of intrusion detection. The method discloses the following steps: Step 1: Based on a preset cycle, at each cycle node, the platform intrusion value and intrusion change value of the big data platform are obtained; Step 2: The intrusion adaptation value of the big data platform is obtained according to the platform intrusion value and the intrusion change value, and the adaptive detection level of the big data platform is generated; Step 3: Based on the adaptive detection level, the corresponding intrusion detection standard is used for the big data platform. The method of the present invention performs multi-angle in-depth intrusion detection analysis on each network device in the big data platform, ensures the detection flexibility and detection security of the intrusion detection of the big data platform, and facilitates the accurate use of reasonable intrusion detection standards for the big data platform.

Description

Technical Field

[0001] The present invention relates to the field of intrusion detection technology, and more specifically, to an adaptive intrusion detection system and method for a big data platform. Background Art

[0002] The big data platform is a data processing tool that can provide functions at all levels, including data collection, data cleaning, data storage, data analysis and mining, and data visualization. The big data platform contains a large number of network devices, which collaborate with each other to process data. In order to ensure the security of data processing, intrusion detection on the big data platform is particularly important. The current intrusion detection system can make corresponding adaptive adjustments to the intrusion detection system according to different intrusion detection results, but the current intrusion detection dimension is too one-sided and the angle is too single, which cannot fully analyze the intrusion detection, resulting in inaccurate adjustments to the intrusion detection system. Summary of the invention

[0003] In view of the deficiencies in the prior art, the object of the present invention is to provide an adaptive intrusion detection system and method for a big data platform.

[0004] To achieve the above object, the present invention provides the following technical solutions:

[0005] An adaptive intrusion detection system for a big data platform, comprising an intrusion detection module, an adaptive analysis module, and an adaptive adjustment module;

[0006] The intrusion detection module obtains the platform intrusion value and intrusion change value of the big data platform at each cycle node based on a preset cycle;

[0007] The adaptation analysis module obtains the intrusion adaptation value of the big data platform according to the platform intrusion value and the intrusion change value, and generates the adaptation detection level of the big data platform;

[0008] The adaptive adjustment module uses corresponding intrusion detection standards on the big data platform based on the adaptive detection level.

[0009] Furthermore, the platform intrusion value of the big data platform is obtained in the following manner: the platform intrusion value of the big data platform is obtained in the following manner: the intrusion detection value of each network device in the big data platform is obtained in the intrusion detection order, an intrusion detection threshold is set, when the intrusion detection value of the network device is greater than the intrusion detection threshold, the network device is marked as an intrusion abnormal device, an intrusion abnormal record of the network device is generated, the total number of intrusion abnormal devices is marked as KCB, the intrusion detection value of the intrusion abnormal device is calculated by difference with the intrusion detection threshold to obtain the detection abnormal value, all the detection abnormal values ​​are summed up to obtain the total detection abnormal value, and marked as EYH;

[0010] Perform a pairwise correlation analysis on all intrusion abnormal devices. When there is a correlation between two intrusion abnormal devices, perform a difference calculation on the intrusion detection values ​​of the two associated intrusion abnormal devices to obtain the intrusion detection difference, set the intrusion detection threshold difference, and when the intrusion detection difference is greater than or equal to the intrusion detection threshold difference, no corresponding processing is performed. When the intrusion detection difference is less than the intrusion detection threshold difference, the number of synchronous impacts is increased by one, and the number of synchronous impacts is summed to obtain the total number of synchronous impacts, which is marked as JPU. When there is no correlation between two intrusion abnormal devices, the number of independent intrusions is increased by one, and all independent intrusions are summed to obtain the total number of independent intrusions, which is marked as AGY. Using the formula The platform intrusion value PTR of the big data platform is obtained, where b1 is the total number coefficient of intrusion abnormal devices, b2 is the total value coefficient of detection abnormalities, b3 is the total number of synchronous impact coefficients, and b4 is the total number of independent intrusion coefficients.

[0011] Furthermore, the intrusion detection sequence is obtained by the following method: obtaining the intrusion sequence value of each network device, sorting all network devices in descending order according to the intrusion sequence value, and generating the intrusion detection sequence.

[0012] Furthermore, the intrusion sequence value of the network device is obtained by the following method: obtaining all intrusion anomaly records of the same network device before the current time of the system, summing up the intrusion detection values ​​of all intrusion anomaly records and taking the average value, obtaining the intrusion detection average value, and marking it as RJJ, marking the remaining network devices associated with the network device as associated devices, obtaining the intrusion detection average value of the associated devices, summing up the intrusion detection average values ​​of all associated devices and taking the average value, obtaining the average intrusion detection average value, and marking it as SPK, and using the formula The intrusion sequence value of the network device is obtained, where z1 is the intrusion detection mean coefficient and z2 is the average intrusion detection mean coefficient.

[0013] Furthermore, the intrusion detection value of the network device is obtained by: obtaining all network flow data of the network device in the current cycle, performing feature extraction on the network flow data to obtain data features of the network flow data, obtaining a data feature library of each intrusion behavior, and comparing the data features of the network flow data with the data feature library of each intrusion behavior in turn; when the data features of the network flow data match the data feature library of the intrusion behavior, marking the intrusion behavior as an abnormal behavior;

[0014] Obtain all abnormal behaviors of network devices, compare all abnormal behaviors in pairs, and when two abnormal behaviors belong to the same type of behavior, increase the number of superimposed attacks by one, and when two abnormal behaviors belong to different types of behavior, increase the number of extended attacks by one, sum up the number of superimposed attacks to get the total number of superimposed attacks, and mark it as LRT, sum up the number of extended attacks to get the total number of extended attacks, and mark it as SEP, and use the formula The intrusion detection value BMZ of the network device is obtained, where a1 is the total number of superimposed attacks coefficient, and a2 is the total number of extended attacks coefficient.

[0015] Furthermore, the intrusion anomaly record includes an intrusion detection value and an intrusion anomaly time.

[0016] Furthermore, the intrusion change value of the big data platform is obtained in the following way: obtain the n consecutive platform intrusion values ​​of the big data platform before the current time of the system, sort all the platform intrusion values ​​in the order of acquisition time, calculate the difference between the next adjacent platform intrusion value after sorting and the previous platform intrusion value to obtain the platform intrusion change value, when the platform intrusion change value is greater than 0, increase the number of intrusion risk increases by one, sum the intrusion risk increases, obtain the total number of intrusion risk increases, and mark it as ZCX, calculate the difference between the next adjacent platform intrusion value after sorting and the previous platform intrusion value and take the absolute value to obtain the intrusion risk fluctuation value, set the intrusion risk fluctuation threshold, when the intrusion risk fluctuation value is greater than or equal to the intrusion risk fluctuation threshold, increase the number of intrusion risk fluctuations by one, sum the number of intrusion risk fluctuations to obtain the total number of intrusion risk fluctuations, and mark it as SFC, and use the formula The intrusion change value BHG of the big data platform is obtained, where c1 is the total number of intrusion risk increase coefficients, and c2 is the total number of intrusion risk fluctuation coefficients.

[0017] Furthermore, the intrusion fitness value of the big data platform is obtained by the following method: using the formula The intrusion adaptation value ADS of the big data platform is obtained, where d1 is the platform intrusion value coefficient and d2 is the intrusion change value coefficient.

[0018] Furthermore, the adaptive detection level of the big data platform is obtained in the following manner: a range of each intrusion adaptive value Ti is set to correspond to an adaptive detection level, wherein the range of the intrusion adaptive value Ti includes (0, T1], (T1, T2], …, (Ti-1, Ti], and the adaptive detection levels include adaptive detection level 1, adaptive detection level 2, …, adaptive detection level i-1, and adaptive detection level i. The higher the adaptive detection level, the higher the current intrusion risk of the big data platform.

[0019] Furthermore, an adaptive intrusion detection method for a big data platform includes the following steps:

[0020] Step 1: Based on the preset cycle, at each cycle node, the platform intrusion value and intrusion change value of the big data platform are obtained;

[0021] Step 2: Obtain the intrusion adaptation value of the big data platform according to the platform intrusion value and the intrusion change value, and generate the adaptation detection level of the big data platform;

[0022] Step 3: Apply corresponding intrusion detection standards to the big data platform based on the adaptive detection level.

[0023] Compared with the prior art, the present invention has the following beneficial effects:

[0024] 1. The method of the present invention performs multi-angle in-depth intrusion detection analysis on each network device in the big data platform, ensuring the detection flexibility and detection security of the big data platform intrusion detection, and facilitating the accurate use of reasonable intrusion detection standards for the big data platform;

[0025] 2. Set up an intrusion detection module to perform multi-dimensional judgments on network devices and intrusion behaviors in the big data platform through periodic detection methods, ensure the accuracy of subsequent adaptation level rating of the big data platform, and use deep intrusion detection as the standard to dynamically customize the intrusion detection sequence of each network device. Set up an adaptation analysis module and an adaptation adjustment module to perform high-precision adaptation level rating of the big data platform, ensuring that the system can flexibly respond to the ever-changing threat environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 It is a flowchart of an adaptive intrusion detection method for a big data platform;

[0027] Figure 2 A flowchart for generating adaptive detection levels for a big data platform. DETAILED DESCRIPTION Example 1

[0028] Reference Figure 1 , an adaptive intrusion detection method for a big data platform, comprising the following steps:

[0029] Step 1: Based on the preset cycle, at each cycle node, the platform intrusion value and intrusion change value of the big data platform are obtained;

[0030] Step 2: Obtain the intrusion adaptability value of the big data platform according to the platform intrusion value and the intrusion change value, and generate the adaptation detection level of the big data platform;

[0031] Step 3: Apply corresponding intrusion detection standards to the big data platform based on the adaptive detection level.

[0032] The method of the present invention performs multi-angle in-depth intrusion detection analysis on each network device in the big data platform, ensuring the detection flexibility and detection security of the big data platform intrusion detection, and facilitating the accurate use of reasonable intrusion detection standards for the big data platform. Example 2

[0033] Reference Figure 2 ,An adaptive intrusion detection system for a big data platform includes an intrusion detection module, an adaptive analysis module, and an adaptive adjustment module.

[0034] Intrusion detection module: Based on the preset cycle, at each cycle node, the platform intrusion value and intrusion change value of the big data platform are obtained.

[0035] The intrusion change value of the big data platform is obtained in the following way: obtain the n consecutive platform intrusion values ​​of the big data platform before the current time of the system, sort all the platform intrusion values ​​in the order of acquisition time, calculate the difference between the next adjacent platform intrusion value after sorting and the previous platform intrusion value, and obtain the platform intrusion change value. When the platform intrusion change value is greater than 0, the number of times the intrusion risk increases is increased once. When the platform intrusion change value is less than or equal to 0, no corresponding processing is performed. The intrusion risk increase is summed up to obtain the total number of times the intrusion risk increases, and marked as ZCX. The difference between the next adjacent platform intrusion value after sorting and the previous platform intrusion value is calculated and the absolute value is taken to obtain the intrusion risk fluctuation value. The intrusion risk fluctuation threshold is set. The intrusion risk fluctuation threshold is the system setting threshold and can be modified according to actual needs. When the intrusion risk fluctuation value is greater than or equal to the intrusion risk fluctuation threshold, the number of intrusion risk fluctuations is increased once. The number of intrusion risk fluctuations is summed up to obtain the total number of intrusion risk fluctuations, and marked as SFC. The formula is used The intrusion change value BHG of the big data platform is obtained, where c1 is the total number of intrusion risk increase coefficient, c2 is the total number of intrusion risk fluctuation coefficient, the value of c1 is 0.95, and the value of c2 is 0.77.

[0036] The intrusion fitness value of the big data platform is obtained by the following method: using the formula The intrusion adaptation value ADS of the big data platform is obtained, where d1 is the platform intrusion value coefficient, d2 is the intrusion change value coefficient, the value of d1 is 0.75, and the value of d2 is 0.68.

[0037] The platform intrusion value of the big data platform is obtained in the following way: the intrusion detection value of each network device in the big data platform is obtained in the order of intrusion detection, and the intrusion detection threshold is set. The intrusion detection threshold is the system setting threshold and can be modified according to actual needs. When the intrusion detection value of the network device is greater than the intrusion detection threshold, the network device is marked as an intrusion abnormal device, and an intrusion abnormal record of the network device is generated. The intrusion abnormal record includes the intrusion detection value and the intrusion abnormal time (the corresponding time of generating the intrusion abnormal record). When the intrusion detection value of the network device is less than or equal to the intrusion detection threshold, no corresponding processing is performed, and the total number of intrusion abnormal devices is marked as KCB. The difference between the intrusion detection value of the intrusion abnormal device and the intrusion detection threshold is calculated to obtain the detection abnormal value, and all the detection abnormal values ​​are summed to obtain the total detection abnormal value, which is marked as EYH.

[0038] Perform pairwise correlation analysis on all intrusion abnormal devices. When there is a correlation between two intrusion abnormal devices, perform difference calculation on the intrusion detection values ​​of the two associated intrusion abnormal devices to obtain the intrusion detection difference, set the intrusion detection threshold difference, and set the intrusion detection threshold difference. The intrusion detection threshold difference is the system setting threshold, which can be modified according to actual needs. When the intrusion detection difference is greater than or equal to the intrusion detection threshold difference, no corresponding processing is performed. When the intrusion detection difference is less than the intrusion detection threshold difference, the number of synchronous impacts is increased once, and the number of synchronous impacts is summed to obtain the total number of synchronous impacts, which is marked as JPU. When there is no correlation between the two intrusion abnormal devices, the number of independent intrusions is increased once, and all independent intrusions are summed to obtain the total number of independent intrusions, which is marked as AGY. Using the formula The platform intrusion value PTR of the big data platform is obtained, where b1 is the coefficient of the total number of intrusion abnormal devices, b2 is the coefficient of the total value of detection abnormalities, b3 is the coefficient of the total number of synchronous impacts, and b4 is the coefficient of the total number of independent intrusions. The value of b1 is 0.39, the value of b2 is 0.22, the value of b3 is 0.52, and the value of b4 is 0.41.

[0039] The network devices in the big data platform represent the relationships between each other in the form of a knowledge graph. If there is a business relationship between two network devices, then the two network devices will be associated in the knowledge graph.

[0040] The intrusion detection value of the network device is obtained in the following way: obtain all network traffic data of the network device in the current cycle, perform feature extraction on the network traffic data, obtain data features of the network traffic data, obtain the data feature library of each intrusion behavior (in the system) (there are various intrusion behaviors, such as address scanning intrusion behavior, port scanning intrusion behavior, Troy attack behavior, worm attack behavior), and compare the data features of the network traffic data with the data feature library of each intrusion behavior in turn. When the data features of the network traffic data match the data feature library of the intrusion behavior, the intrusion behavior is marked as abnormal behavior. When the data features of the network traffic data do not match the data feature library of the intrusion behavior, no corresponding processing is performed.

[0041] Obtain all abnormal behaviors of network devices, compare all abnormal behaviors in pairs, and when two abnormal behaviors belong to the same type of behavior, increase the number of superimposed attacks by one, and when two abnormal behaviors belong to different types of behavior, increase the number of extended attacks by one, sum up the number of superimposed attacks to get the total number of superimposed attacks, and mark it as LRT, sum up the number of extended attacks to get the total number of extended attacks, and mark it as SEP, and use the formula The intrusion detection value BMZ of the network device is obtained, where a1 is the total number of superimposed attacks coefficient, a2 is the total number of extended attacks coefficient, the value of a1 is 0.85, and the value of a2 is 0.62.

[0042] Each intrusion behavior corresponds to a data feature library, such as an address scanning intrusion behavior corresponds to a data feature library, and a port scanning intrusion behavior corresponds to a data feature library. Each data feature library contains a data feature set corresponding to the intrusion behavior.

[0043] The types of intrusion behaviors include, but are not limited to, information collection type intrusion behaviors, access type intrusion behaviors, and virus type intrusion behaviors. For example, address scanning intrusion behaviors and port scanning intrusion behaviors are both information collection type intrusion behaviors, while Trojan attack behaviors and worm attack behaviors are both virus type intrusion behaviors.

[0044] The intrusion detection sequence is obtained in the following manner: the intrusion sequence value of each network device is obtained, all network devices are sorted in descending order according to the intrusion sequence value, and an intrusion detection sequence is generated.

[0045] The intrusion sequence value of the network device is obtained in the following way: all intrusion anomaly records of the same network device before the current time of the system, the intrusion detection values ​​of all intrusion anomaly records are summed up and averaged to obtain the intrusion detection mean, which is marked as RJJ, the remaining network devices associated with the network device are marked as associated devices, the intrusion detection mean of the associated devices is obtained, the intrusion detection mean of all associated devices is summed up and averaged to obtain the average intrusion detection mean, which is marked as SPK, and the formula is used. The intrusion sequence value of the network device is obtained, where z1 is the intrusion detection mean coefficient, z2 is the average intrusion detection mean coefficient, the value of z1 is 0.42, and the value of z2 is 0.38.

[0046] An intrusion detection module is set up to perform multi-dimensional judgments on network devices and intrusion behaviors in the big data platform through periodic detection methods, to ensure the accuracy of subsequent adaptation level rating of the big data platform, and to dynamically customize the intrusion detection order of each network device based on deep intrusion detection.

[0047] Adaptation analysis module: obtains the intrusion adaptation value of the big data platform based on the platform intrusion value and the intrusion change value, and generates the adaptation detection level of the big data platform.

[0048] The adaptive detection level is obtained in the following way: set the range of each intrusion fitness value Ti to correspond to an adaptive detection level, where the range of intrusion fitness value Ti includes (0, T1], (T1, T2], …, (Ti-1, Ti], and the adaptive detection level includes adaptive detection level 1, adaptive detection level 2, …, adaptive detection level i-1, adaptive detection level i. When Ti∈(0, T1], the adaptive detection level of the big data platform is 1. The higher the adaptive detection level, the higher the current intrusion risk of the big data platform. Different adaptive detection levels correspond to different intrusion detection standards (different intrusion detection standards such as different intrusion detection configuration optimization standards and different defense system optimization standards).

[0049] Adaptive adjustment module: Use corresponding intrusion detection standards for the big data platform based on the adaptive detection level.

[0050] The adaptive intrusion detection system of the big data platform of the present invention is widely used in various network environments and business scenarios, including but not limited to enterprise networks, cloud computing environments, industrial control systems (ICS), Internet of Things (IoT) networks, etc.

[0051] By setting up the adaptation analysis module and the adaptation adjustment module, high-precision adaptability rating of the big data platform can be performed to ensure that the system can flexibly respond to the ever-changing threat environment.

[0052] The above formulas are all dimensionless and numerical calculations. The formula is a formula for the most recent real situation obtained by collecting a large amount of data and performing software simulation. The preset parameters in the formula are set by technicians in this field according to actual conditions.

[0053] The above embodiments can be implemented in whole or in part by software, hardware, firmware or any other combination. When implemented by software, the above embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website site, computer, server or data center to another website site, computer, server or data center by wired or wireless (e.g., infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that contains one or more available media sets. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium. The semiconductor medium can be a solid-state hard disk.

[0054] It should be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0055] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0056] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0057] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0058] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage media include: various media that can store program codes, such as USB flash drives, mobile hard disks, read-only memories (ROM), random access memories (RAM), magnetic disks or optical disks.

[0059] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. An adaptive intrusion detection system for a big data platform, characterized in that: It includes intrusion detection module, adaptation analysis module and adaptation adjustment module; The intrusion detection module obtains the platform intrusion value and intrusion change value of the big data platform at each cycle node based on a preset cycle; Obtain the intrusion detection value of each network device in the big data platform in the order of intrusion detection, set the intrusion detection threshold, and when the intrusion detection value of the network device is greater than the intrusion detection threshold, mark the network device as an intrusion abnormal device, generate an intrusion abnormal record of the network device, obtain the total number of intrusion abnormal devices KCB and the total detection abnormality value EYH, perform pairwise correlation analysis on all intrusion abnormal devices, and then obtain the total number of synchronous impacts JPU and the total number of independent intrusions AGY, and use the formula The platform intrusion value PTR of the big data platform is obtained, where b1 is the total number coefficient of intrusion abnormal devices, b2 is the total value coefficient of detection abnormalities, b3 is the total number of synchronous impact coefficients, and b4 is the total number of independent intrusion coefficients; Obtain the n consecutive platform intrusion values ​​of the big data platform before the current time of the system, sort all platform intrusion values ​​in the order of acquisition time, calculate the difference between the next adjacent platform intrusion value after sorting and the previous platform intrusion value, and obtain the platform intrusion variable value, and then obtain the total number of intrusion risk increases ZCX and the total number of intrusion risk fluctuations SFC, and use the formula The intrusion change value BHG of the big data platform is obtained, where c1 is the total number of intrusion risk increase coefficients, and c2 is the total number of intrusion risk fluctuation coefficients; The adaptation analysis module obtains the intrusion adaptation value of the big data platform according to the platform intrusion value and the intrusion change value, and generates the adaptation detection level of the big data platform; The adaptive adjustment module uses corresponding intrusion detection standards on the big data platform based on the adaptive detection level.

2. The adaptive intrusion detection system for a big data platform according to claim 1, characterized in that: The total value of detection anomaly EYH is obtained as follows: the intrusion detection value of the intrusion abnormal device is calculated by difference with the intrusion detection threshold to obtain the detection anomaly value, and all the detection anomaly values ​​are summed to obtain the total value of detection anomaly, which is marked as EYH; The total number of synchronous impacts JPU and the total number of independent intrusions AGY are obtained as follows: when there is a correlation between two intrusion abnormal devices, the intrusion detection values ​​of the two associated intrusion abnormal devices are differenced to obtain the intrusion detection difference, and the intrusion detection threshold difference is set. When the intrusion detection difference is greater than or equal to the intrusion detection threshold difference, no corresponding processing is performed. When the intrusion detection difference is less than the intrusion detection threshold difference, the number of synchronous impacts is increased by one, the number of synchronous impacts is summed up to obtain the total number of synchronous impacts, and marked as JPU. When there is no correlation between the two intrusion abnormal devices, the number of independent intrusions is increased by one, all independent intrusions are summed up to obtain the total number of independent intrusions, and marked as AGY.

3. The adaptive intrusion detection system for a big data platform according to claim 2, characterized in that: The intrusion detection sequence is obtained in the following manner: the intrusion sequence value of each network device is obtained, all network devices are sorted in descending order according to the intrusion sequence value, and an intrusion detection sequence is generated.

4. The adaptive intrusion detection system for a big data platform according to claim 3, characterized in that: The intrusion sequence value of the network device is obtained by the following method: obtain all intrusion anomaly records of the same network device before the current time of the system, sum up and average the intrusion detection values ​​of all intrusion anomaly records, obtain the intrusion detection mean, and mark it as RJJ, mark the remaining network devices associated with the network device as associated devices, obtain the intrusion detection mean of the associated devices, sum up and average the intrusion detection means of all associated devices, obtain the average intrusion detection mean, and mark it as SPK, and use the formula The intrusion sequence value of the network device is obtained, where z1 is the intrusion detection mean coefficient and z2 is the average intrusion detection mean coefficient.

5. The adaptive intrusion detection system for a big data platform according to claim 2, characterized in that: The intrusion detection value of the network device is obtained in the following manner: obtaining all network flow data of the network device in the current cycle, performing feature extraction on the network flow data to obtain data features of the network flow data, obtaining a data feature library of each intrusion behavior, and comparing the data features of the network flow data with the data feature library of each intrusion behavior in turn; when the data features of the network flow data match the data feature library of the intrusion behavior, marking the intrusion behavior as an abnormal behavior; Obtain all abnormal behaviors of network devices, compare all abnormal behaviors in pairs, and when two abnormal behaviors belong to the same type of behavior, increase the number of superimposed attacks by one, and when two abnormal behaviors belong to different types of behavior, increase the number of extended attacks by one, sum up the number of superimposed attacks to get the total number of superimposed attacks, and mark it as LRT, sum up the number of extended attacks to get the total number of extended attacks, and mark it as SEP, and use the formula The intrusion detection value BMZ of the network device is obtained, where a1 is the total number of superimposed attacks coefficient, and a2 is the total number of extended attacks coefficient.

6. The adaptive intrusion detection system for a big data platform according to claim 2, characterized in that: The intrusion anomaly record includes the intrusion detection value and the intrusion anomaly time.

7. The adaptive intrusion detection system for a big data platform according to claim 1, characterized in that: The total number of times the intrusion risk increases ZCX and the total number of times the intrusion risk fluctuates SFC are obtained as follows: when the platform intrusion variable value is greater than 0, the number of times the intrusion risk increases is increased by one, and the intrusion risk increases are summed to obtain the total number of times the intrusion risk increases, which is marked as ZCX. The difference between the adjacent next platform intrusion value and the previous platform intrusion value after sorting is calculated and the absolute value is taken to obtain the intrusion risk fluctuation value. An intrusion risk fluctuation threshold is set. When the intrusion risk fluctuation value is greater than or equal to the intrusion risk fluctuation threshold, the number of intrusion risk fluctuations is increased by one, and the number of intrusion risk fluctuations is summed to obtain the total number of intrusion risk fluctuations, which is marked as SFC.

8. The adaptive intrusion detection system for a big data platform according to claim 1, characterized in that: The intrusion fitness value of the big data platform is obtained by the following method: using the formula The intrusion adaptation value ADS of the big data platform is obtained, where d1 is the platform intrusion value coefficient and d2 is the intrusion change value coefficient.

9. The adaptive intrusion detection system for a big data platform according to claim 1, characterized in that: The adaptive detection level of the big data platform is obtained in the following way: set the range of each intrusion adaptation value Ti to correspond to an adaptive detection level, where the range of the intrusion adaptation value Ti includes (0, T1], (T1, T2], …, (Ti-1, Ti], and the adaptive detection level includes adaptive detection level 1, adaptive detection level 2, …, adaptive detection level i-1, adaptive detection level i. The higher the adaptive detection level, the higher the current intrusion risk of the big data platform.

10. An adaptive intrusion detection method for a big data platform, applied to an adaptive intrusion detection system for a big data platform according to claim 1, characterized in that: The steps include: Step 1: Based on the preset cycle, at each cycle node, the platform intrusion value and intrusion change value of the big data platform are obtained; Step 2: Obtain the intrusion adaptability value of the big data platform according to the platform intrusion value and the intrusion change value, and generate the adaptation detection level of the big data platform; Step 3: Apply corresponding intrusion detection standards to the big data platform based on the adaptive detection level.

Images