Data security exchange system and method based on self-learning

Abstract

The present invention relates to the field of computer technology, and in particular to a data security exchange system and method based on self-learning. In the present invention, the traffic at each port is periodically monitored, and the security of the data exchange process is analyzed according to the traffic. When the traffic is large, a secondary judgment is made on whether the data exchange process is qualified based on the number of data packets received by the data receiving module, or the reason for the failure is analyzed based on the time domain variation degree of the port traffic. When the time domain variation degree of the traffic is large, it is considered that data cleaning is unqualified, resulting in a large transmission flow of data. When the time domain variation degree of the traffic is small, it is considered that the network signal in the area crossed during the data transmission process is unstable and the network switching is frequent, which leads to a large flow of data at the receiving point, thereby improving the control accuracy of the data exchange process and improving the security of the data exchange process.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a data security exchange system and method based on self-learning. Background Art

[0002] Data exchange refers to the process of sharing data resources between different information systems based on certain principles and adopting corresponding technologies. It involves transferring data from one system to another to facilitate information sharing and utilization. The existing technology uses encryption devices to encrypt and decrypt sectors of data content in mobile storage media connected to it, and sets different permissions for operating users through data terminals to ensure that unauthorized users, systems, and programs cannot call them, thereby ensuring the safe reading and writing of data. However, the control progress of the data transmission process is insufficient, the analysis accuracy is insufficient, and it is difficult to analyze whether data interception occurs during the data exchange process.

[0003] Chinese Patent Publication No.: CN109543472A discloses a data security exchange system, which solves the problem that data security cannot be truly guaranteed. The data security exchange system includes: a mobile storage medium, which is used to store data in sectors; an encryption device, which is connected to the mobile storage medium, and is used to encrypt and decrypt the data on the mobile storage medium in sectors after authenticating the user; and a data terminal, which is connected to the encryption device, and is used to write the data encrypted by the encryption device to the mobile storage medium, or read the data decrypted by the encryption device according to the user's authority. The data content in the mobile storage medium connected to it is encrypted and decrypted by the encryption device, and different permissions are set for the operating user through the data terminal to ensure that unauthorized users, systems, and programs cannot call, thereby ensuring the safe reading and writing of data.

[0004] However, the prior art still has the following problems:

[0005] There is insufficient control over the data transmission process, resulting in the risk of data leakage. Summary of the invention

[0006] To this end, the present invention provides a data security exchange system and method based on self-learning, so as to overcome the problem of insufficient control progress of the data transmission process and the risk of data leakage in the prior art.

[0007] To achieve the above object, the present invention provides a data security exchange system based on self-learning, comprising:

[0008] A data receiving module, which includes a plurality of ports for receiving exchange data transmitted by each terminal;

[0009] A data cleaning module, connected to the data receiving module, for cleaning abnormal data in the exchanged data;

[0010] A tag identification module, which is connected to the data cleaning module and is used to identify tag information attached to the cleaned data;

[0011] A self-learning database, which is used to store a number of training sets and a number of abnormal events;

[0012] A behavior construction module, which is connected to the self-learning database and is used to construct a data behavior pattern based on a training set in the self-learning database and to construct a matching criterion for the behavior pattern;

[0013] A flow monitoring module, connected to the tag identification module, for detecting the transmission flow at each of the ports;

[0014] An analysis module, which is respectively connected to the data receiving module, the data cleaning module, the label identification module, the self-learning database, the behavior construction module and the traffic monitoring module, and is used to analyze whether the security of the data exchange process is qualified based on the average traffic of a single port within a preset detection period, and to make a secondary judgment on whether the data exchange process is qualified based on the number of received data packets when the security of the data exchange process is initially determined to be unqualified, or to analyze the reason for the unqualified security of the data exchange process based on the time domain variation degree of the port traffic, and mark the type of each port;

[0015] An event construction module is connected to the self-learning database and the analysis module respectively, and is used to update the self-learning database based on the distribution of various events.

[0016] Furthermore, the analysis module is also used to generate a corresponding processing method according to the analysis result of whether the security of the data exchange process is qualified, including:

[0017] Mark the corresponding port as a primary port,

[0018] A secondary determination is made on whether the data exchange process is qualified based on the number of data packets received by the data receiving module.

[0019] Or, the cause of security failure can be analyzed based on the degree of time domain variation of the port traffic.

[0020] Furthermore, the analysis module is used to perform a secondary determination on whether the data exchange process is qualified based on the number of data packets received by the data receiving module, including:

[0021] To determine the number of data packets received by the data receiving module within a preset detection period,

[0022] When the analysis module determines that the security of the data exchange process is unqualified based on the number of data packets, the analysis module analyzes the reasons for the unqualified security based on the time domain variation of the port traffic.

[0023] Alternatively, the analysis module determines that the security of the data exchange process is qualified and marks the current port as a secondary port.

[0024] Furthermore, the analysis module is also used to determine the reason for the security failure based on the variance of the traffic of the current port at each time node within the detection period, and generate a corresponding processing method according to the determined reason, including:

[0025] When it is determined that the cause is that the data cleaning process is unqualified, the current event is marked as a first-level event, or,

[0026] When it is determined that the reason is that the network switches frequently during the data transmission process, the current port is marked as a third-level port.

[0027] Furthermore, the analysis module is also used to correct the cleaning standard based on the proportion of abnormal data with a flow rate higher than a preset value when data cleaning fails, and the reduction in the cleaning standard is negatively correlated with the abnormal proportion, wherein the abnormal proportion is the ratio of the abnormal data to the total amount of data received by a single port.

[0028] Furthermore, the analysis module is used to count the marking conditions of each port, and determine the reasons why the security of the data exchange process is unqualified based on the ratio of each type of marked ports to the total number of ports, including:

[0029] The proportion of each type of port is determined based on the ratio of the number of each type of port to the total number of ports.

[0030] When it is determined that the reason for the failure of the security of the data exchange process is data missing, the current event is marked as a secondary event;

[0031] When a secondary determination is made on the cause of the unqualified security of the data exchange process based on the proportion of various types of abnormal data, or when a determination is made based on the proportion of the number of level-3 ports that the cause of the unqualified security of the data exchange process is network fluctuation caused by long-distance transmission, the network is optimized and the current event is marked as a level-3 event.

[0032] Furthermore, the analysis module modifies the similarity standard under the condition of missing data, including:

[0033] Determine the integrity of stored data,

[0034] Based on the completeness correction similarity standard,

[0035] Among them, the increase in the similarity standard is negatively correlated with the completeness.

[0036] Furthermore, the analysis module is used to make a secondary determination of the reasons why the security of the data exchange process is unqualified based on the proportion of various types of abnormal data, including:

[0037] The analysis module is used to determine that the reason why the security of the data exchange process is unqualified is that the data cleaning process is unqualified based on the proportion of abnormal traffic data, and mark the current event as a first-level event;

[0038] The analysis module is used to determine that the reason why the security of the data exchange process is unqualified is data missing based on the proportion of abnormal behavior data, and mark the current event as a secondary event.

[0039] Furthermore, the event construction module is used to count the number of various events and update the self-learning database based on the distribution of various events.

[0040] The present invention provides a data security exchange method based on self-learning. It includes:

[0041] Step S1, receiving exchange data transmitted by each terminal, performing data cleaning on the exchange data using a predetermined cleaning standard and a similarity standard, and identifying tag information attached to the cleaned data;

[0042] Step S2, detecting the transmission flow at each port, analyzing whether the security of the data exchange process is qualified based on the average flow of a single port in a preset time period, and making a secondary judgment on whether the data exchange process is qualified based on the number of received data packets when the security of the data exchange process is initially determined to be unqualified, or analyzing the reason for the unqualified security of the data exchange process based on the time domain variation degree of the port flow;

[0043] Step S3: Mark each port based on the analysis results, mark each type of event, modify the cleaning standard based on the proportion of abnormal data, analyze the reasons for the security failure of the data exchange process based on the proportion of the number of each type of ports, determine the corresponding processing method based on the analysis results, record the processing process, and integrate the processing process into events, and optimize subsequent judgments based on each event.

[0044] Compared with the prior art, the beneficial effect of the present invention lies in that, in the present invention, the traffic at each port is periodically monitored, and the security of the data exchange process is analyzed based on the traffic to determine whether it is qualified. When the traffic is large, a secondary judgment is made on whether the data exchange process is qualified based on the number of data packets received by the data receiving module, or the reason for the failure is analyzed based on the time domain variation degree of the port traffic. When the time domain variation degree of the traffic is large, data with large traffic volume caused by unqualified data cleaning is considered. When the time domain variation degree of the traffic is small, the network signal in the area crossed during the data transmission process is unstable and the network switching is frequent, which leads to a large data flow at the receiving point, thereby improving the control accuracy of the data exchange process.

[0045] Furthermore, the present invention takes into account that the number of data packets will have an impact on the data exchange rate. The more data packets there are, when the number of data packets in the network is too large, it may cause network congestion, thereby increasing the delay and packet loss rate of the data packets. Too many data packets mean more competition for network resources, which may cause data packets to queue for transmission, increasing the transmission delay. The present invention determines the security of the data exchange process according to the number of data packets. When the number of data packets is large, it determines that the reason for the large data exchange traffic is due to the excessive number of data packets, rather than due to data leakage in the data exchange process, thereby improving the control accuracy of the data transmission process.

[0046] Furthermore, the present invention first determines the flow of the port at each time node, calculates the variance of the flow value, and considers that a terminal in the network suddenly generates huge flow and exceeds a reasonable range, which may be due to flow hijacking caused by some attack attempt. Therefore, the fluctuation of the flow at each time node is determined according to the variance, and the security of the data exchange process is analyzed according to the fluctuation of the flow, and whether there is data interception. When the variance is large, it is determined that there is a security risk. Considering that the network differences across regions are large during the transmission process, multiple network switching causes large fluctuations in the flow at each time node. The port is marked according to the analysis results, and then it is analyzed whether there is a security risk according to the proportion of the number of each type of ports, thereby improving the control accuracy of the data transmission process and the analysis accuracy of the data exchange process.

[0047] Furthermore, the present invention analyzes the security of the data exchange process according to the proportion of various types of abnormal data. When the proportion of traffic abnormal data is high, considering that the data cleaning standard is low and the data cleaning processing is not in place, when the proportion of behavioral abnormal data is high, it is determined that there is data missing, and each event is marked according to the analysis results to facilitate subsequent targeted optimization. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1It is a structural block diagram of the data security exchange system based on self-learning of the present invention;

[0049] Figure 2 A flow chart for analyzing whether the security of the data exchange process is qualified;

[0050] Figure 3 A flow chart for determining whether the data exchange process is qualified for the second time;

[0051] Figure 4 A decision flow chart for analyzing the causes of security failures in the data exchange process. DETAILED DESCRIPTION

[0052] In order to make the objects and advantages of the present invention more clearly understood, the present invention is further described below in conjunction with embodiments; it should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0053] It should be pointed out that the data in this embodiment are obtained by comprehensive analysis and evaluation of the historical data of the system of the present invention in the six months before this determination and the corresponding historical determination results. It can be understood by those skilled in the art that the determination method of the system of the present invention for a single parameter mentioned above can be to select the value with the highest proportion as the preset standard parameter according to the data distribution, use weighted summation to use the obtained value as the preset standard parameter, substitute each historical data into a specific formula and use the value obtained by the formula as the preset standard parameter or other selection methods, as long as the system of the present invention can clearly define different specific situations in the single determination process through the obtained values.

[0054] The preferred embodiments of the present invention are described below with reference to the accompanying drawings. It should be understood by those skilled in the art that these embodiments are only used to explain the technical principles of the present invention and are not intended to limit the protection scope of the present invention.

[0055] It should be noted that, in the description of the present invention, terms such as "up", "down", "left", "right", "inside" and "outside" indicating directions or positional relationships are based on the directions or positional relationships shown in the drawings. This is merely for the convenience of description and does not indicate or imply that the device or element must have a specific orientation, be constructed and operated in a specific orientation. Therefore, it cannot be understood as a limitation on the present invention.

[0056] In addition, it should be noted that in the description of the present invention, unless otherwise clearly specified and limited, the terms "installed", "connected", and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal communication of two components. For those skilled in the art, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0057] See also Figure 1 As shown, it is a structural block diagram of the data security exchange system based on self-learning of the present invention.

[0058] An embodiment of the present invention provides a data security exchange system based on self-learning, including:

[0059] A data receiving module, which includes a plurality of ports for receiving exchange data transmitted by each terminal;

[0060] A data cleaning module, connected to the data receiving module, for cleaning abnormal data in the exchanged data;

[0061] A tag identification module, which is connected to the data cleaning module and is used to identify tag information attached to the cleaned data;

[0062] A self-learning database, which is used to store a number of training sets and a number of abnormal events;

[0063] A behavior construction module, which is connected to the self-learning database and is used to construct a data behavior pattern based on a training set in the self-learning database and to construct a matching criterion for the behavior pattern;

[0064] A flow monitoring module, connected to the tag identification module, for detecting the transmission flow at each of the ports;

[0065] An analysis module, which is respectively connected to the data receiving module, the data cleaning module, the label identification module, the self-learning database, the behavior construction module and the traffic monitoring module, and is used to analyze whether the security of the data exchange process is qualified based on the average traffic of a single port within a preset detection period, and to make a secondary judgment on whether the data exchange process is qualified based on the number of received data packets when the security of the data exchange process is initially determined to be unqualified, or to analyze the reason for the unqualified security of the data exchange process based on the time domain variation degree of the port traffic, and mark the type of each port;

[0066] An event construction module is connected to the self-learning database and the analysis module respectively, and is used to update the self-learning database based on the distribution of various events.

[0067] In the present invention, the traffic at each port is periodically monitored, and the security of the data exchange process is analyzed based on the traffic to determine whether it is qualified. When the traffic is large, a secondary judgment is made on whether the data exchange process is qualified based on the number of data packets received by the data receiving module, or the reason for the failure is analyzed based on the time domain variation degree of the port traffic. When the time domain variation degree of the traffic is large, it is considered that data with a large traffic flow is caused by unqualified data cleaning. When the time domain variation degree of the traffic is small, it is considered that the network signal in the area crossed during the data transmission process is unstable and the network switching is frequent, which leads to a large data flow at the receiving point, thereby improving the control accuracy of the data exchange process.

[0068] See also Figure 2 As shown, it is a flow chart for analyzing whether the security of the data exchange process is qualified.

[0069] Specifically, the analysis module is used to analyze whether the security of the data exchange process is qualified based on the average flow of a single port within a preset detection period, including:

[0070] If the average flow rate is less than or equal to the first preset average flow rate, the analysis module determines that the security of the data exchange process is qualified and marks the current port as a first-level port;

[0071] If the average flow rate is greater than the first preset average flow rate and less than or equal to the second preset average flow rate, the analysis module determines whether the data exchange process is qualified based on the number of data packets received by the data receiving module;

[0072] If the average flow is greater than the second preset average flow, the analysis module determines that the security of the data exchange process is unqualified, and analyzes the reasons for the unqualified security based on the time domain variation degree of the port flow.

[0073] Specifically, in this embodiment, the average flow standard within the time period corresponding to the detection cycle under the same configuration conditions of the security environment is determined based on big data, wherein the first preset average flow is 0.85~0.95 times the average flow standard, and the second preset average flow is 1.05~1.15 times the average flow standard.

[0074] See also Figure 3 As shown, it is a flow chart for determining whether the secondary data exchange process is qualified.

[0075] Specifically, the analysis module is used to perform a secondary determination on whether the data exchange process is qualified based on the number of data packets received by the data receiving module, including:

[0076] To determine the number of data packets received by the data receiving module within a preset detection period,

[0077] If the number of the data packets is less than or equal to the preset number, the analysis module determines that the security of the data exchange process is unqualified, and analyzes the reasons for the unqualified based on the time domain variation degree of the port traffic;

[0078] If the number of the data packets is greater than the preset number, the analysis module determines that the security of the data exchange process is qualified and marks the current port as a secondary port.

[0079] Specifically, in this embodiment, the preset number is determined based on big data to determine the number standard of data packets within a predetermined time period under a safe condition, and the preset number is 0.85 to 1.2 times of the number standard.

[0080] The present invention takes into account that the number of data packets will have an impact on the data exchange rate. The more data packets there are, when there are too many data packets in the network, it may cause network congestion, thereby increasing the delay and packet loss rate of the data packets. Too many data packets mean more competition for network resources, which may cause data packets to queue up for transmission, increasing the transmission delay. The present invention determines the security of the data exchange process according to the number of data packets. When the number of data packets is large, it is determined that the reason for the large data exchange traffic is due to the excessive number of data packets, rather than due to data leakage in the data exchange process, thereby improving the control accuracy of the data transmission process.

[0081] See also Figure 4 As shown, it is a decision flow chart for analyzing the reasons why the security of the data exchange process is unqualified.

[0082] Specifically, the analysis module is used to analyze the reasons why the security of the data exchange process is unqualified based on the time domain variation degree of the port traffic, including:

[0083] Used to determine the traffic of the current port at each time node within the detection cycle.

[0084] Used to calculate the variance of the flow at each time node,

[0085] If the variance is less than or equal to the preset variance, the analysis module determines that the reason why the security of the data exchange process is unqualified is that the data cleaning process is unqualified, and marks the current event as a first-level event;

[0086] If the variance is greater than the preset variance, the analysis module determines that the reason why the security of the data exchange process is unqualified is that the network switches frequently during the data transmission process, and marks the current port as a third-level port.

[0087] Specifically, in this embodiment, the preset variance is obtained by pre-measurement, obtaining data exchanged in a number of safe states, determining the flow at each time node, and solving the flow variance. The preset variance is 0.9 to 1.15 times the flow variance.

[0088] In the present invention, the flow of the port at each time node is first determined, and the variance of the flow value is calculated. Considering that a terminal in the network suddenly generates huge flow and exceeds a reasonable range, it may be due to the occurrence of flow hijacking and the like caused by a certain attack attempt. Therefore, the fluctuation of the flow at each time node is determined according to the variance, and the security of the data exchange process is analyzed according to the fluctuation of the flow, and whether there is data interception. When the variance is large, it is determined that there is a security risk. Considering that the network differences across regions are large during the transmission process, multiple network switching causes large fluctuations in the flow at each time node. The port is marked according to the analysis result, and then it is analyzed whether there is a security risk according to the proportion of the number of various types of ports, thereby improving the control precision of the data transmission process and the analysis accuracy of the data exchange process.

[0089] Specifically, the analysis module is used to modify the cleaning standard based on the proportion of abnormal data when the data cleaning fails, including:

[0090] It is used to mark data with flow rate higher than the preset value as abnormal data.

[0091] It is used to calculate the ratio of abnormal data to the total amount of data received by a single port to obtain the abnormal proportion.

[0092] The reduction in cleaning standards is negatively correlated with the abnormality ratio.

[0093] In this embodiment, optionally,

[0094] Compare the abnormality ratio with the first preset abnormality ratio and the second preset abnormality ratio,

[0095] If the abnormality ratio is less than or equal to the first preset abnormality ratio, the first cleaning standard is reduced, and the first cleaning standard is 0.12 times of the initial cleaning standard;

[0096] If the abnormality ratio is greater than the first preset abnormality ratio and less than or equal to the second preset abnormality ratio, the second cleaning standard is reduced, and the second cleaning standard is 0.08 times the initial cleaning standard;

[0097] If the abnormality ratio is greater than the second preset abnormality ratio, the third cleaning standard is reduced, and the third cleaning standard is 0.06 times of the initial cleaning standard.

[0098] Specifically, in this embodiment, the standard deviation and mean are used in the data cleaning process to identify data points far from the mean value, and the cleaning criteria are the standard deviation and mean.

[0099] Specifically, the analysis module is used to count the marking conditions of each port, and determine the reasons why the security of the data exchange process is unqualified based on the proportion of each type of marked ports, including:

[0100] Used to count the number of ports of each type.

[0101] It is used to calculate the ratio of the number of ports of each type to the total number of ports, and obtain the proportion of the number of ports of each type.

[0102] If the number of primary ports accounts for the largest proportion, the analysis module determines that the reason why the security of the data exchange process is unqualified is data missing, and marks the current event as a secondary event;

[0103] If the number of secondary ports accounts for the largest proportion, the analysis module determines the reasons why the security of the data exchange process is unqualified based on the proportion of various types of abnormal data;

[0104] If the number of level 3 ports accounts for the largest proportion, the analysis module determines that the reason why the security of the data exchange process is unqualified is that the long-distance transmission causes network fluctuations, optimizes the network, and marks the current event as a level 3 event.

[0105] Specifically, the analysis module modifies the similarity standard under the condition of missing data, including:

[0106] Determine the integrity of stored data,

[0107] Based on the completeness correction similarity standard,

[0108] Among them, the increase in the similarity standard is negatively correlated with the completeness.

[0109] In this embodiment, optionally,

[0110] The completeness is compared with the first preset completeness and the second preset completeness,

[0111] If the completeness is less than or equal to the first preset completeness, then a first similarity standard is added, and the first similarity standard is 0.25 times the initial similarity standard;

[0112] If the completeness is greater than the first preset completeness and less than or equal to the second preset completeness, then a second similarity standard is added, and the second similarity standard is 0.2 times the initial similarity standard;

[0113] If the completeness is greater than the second preset completeness, a third similarity standard is added, and the third similarity standard is 0.1 times the initial similarity standard.

[0114] Specifically, in this embodiment, the standard for abnormal data is determined based on big data, and whether a single data is abnormal data is determined based on a similarity standard between the single data and the standard for the abnormal data.

[0115] Specifically, the analysis module is used to make a secondary determination of the reasons why the security of the data exchange process is unqualified based on the proportion of various types of abnormal data, including:

[0116] If the proportion of abnormal traffic data is greater than or equal to the preset proportion, the analysis module determines that the reason why the security of the data exchange process is unqualified is that the data cleaning process is unqualified, and marks the current event as a level one event;

[0117] If the proportion of abnormal behavior data is greater than or equal to the preset proportion, the analysis module determines that the reason for the failure of the security of the data exchange process is data missing, and marks the current event as a secondary event.

[0118] Specifically, in this embodiment, the preset ratio is selected in the interval [0.35~0.4].

[0119] In the present invention, the security of the data exchange process is analyzed according to the proportion of various types of abnormal data. When the proportion of traffic abnormal data is high, considering that the data cleaning standard is low and the data cleaning processing is not in place, when the proportion of behavioral abnormal data is high, it is determined that there is data missing, and each event is marked according to the analysis results to facilitate subsequent targeted optimization.

[0120] Specifically, the event construction module is used to count the number of various events and update the self-learning database based on the distribution of various events.

[0121] The embodiment of the present invention provides a data security exchange method based on self-learning, including:

[0122] Step S1, receiving exchange data transmitted by each terminal, performing data cleaning on the exchange data using a predetermined cleaning standard and a similarity standard, and identifying tag information attached to the cleaned data;

[0123] Step S2, detecting the transmission flow at each port, analyzing whether the security of the data exchange process is qualified based on the average flow of a single port in a preset time period, and making a secondary judgment on whether the data exchange process is qualified based on the number of received data packets when the security of the data exchange process is initially determined to be unqualified, or analyzing the reason for the unqualified security of the data exchange process based on the time domain variation degree of the port flow;

[0124] Step S3: Mark each port based on the analysis results, mark each type of event, modify the cleaning standard based on the proportion of abnormal data, analyze the reasons for the security failure of the data exchange process based on the proportion of the number of each type of ports, determine the corresponding processing method based on the analysis results, record the processing process, and integrate the processing process into events, and optimize subsequent judgments based on each event.

[0125] So far, the technical solutions of the present invention have been described in conjunction with the preferred embodiments shown in the accompanying drawings. However, it is easy for those skilled in the art to understand that the protection scope of the present invention is obviously not limited to these specific embodiments. Without departing from the principle of the present invention, those skilled in the art can make equivalent changes or substitutions to the relevant technical features, and the technical solutions after these changes or substitutions will fall within the protection scope of the present invention.

[0126] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A data security exchange system based on self-learning, characterized in that: include: A data receiving module, which includes a plurality of ports for receiving exchange data transmitted by each terminal; A data cleaning module, connected to the data receiving module, for cleaning abnormal data in the exchanged data; A tag identification module, which is connected to the data cleaning module and is used to identify tag information attached to the cleaned data; A self-learning database, which is used to store a number of training sets and a number of abnormal events; A behavior construction module, which is connected to the self-learning database and is used to construct a data behavior pattern based on a training set in the self-learning database and to construct a matching criterion for the behavior pattern; A flow monitoring module, connected to the tag identification module, for detecting the transmission flow at each of the ports; An analysis module, which is respectively connected to the data receiving module, the data cleaning module, the label identification module, the self-learning database, the behavior construction module and the traffic monitoring module, and is used to analyze whether the security of the data exchange process is qualified based on the average traffic of a single port within a preset detection period, and to make a secondary judgment on whether the data exchange process is qualified based on the number of received data packets when the security of the data exchange process is initially determined to be unqualified, or to analyze the reason for the unqualified security of the data exchange process based on the time domain variation degree of the port traffic, and mark the type of each port; An event construction module, which is connected to the self-learning database and the analysis module respectively, and is used to update the self-learning database based on the distribution of various events; The analysis module is also used to determine the reason for the security failure based on the variance of the traffic of the current port at each time node within the detection period, and generate a corresponding processing method according to the determined reason, including: When it is determined that the cause is that the data cleaning process is unqualified, the current event is marked as a first-level event, or, When it is determined that the reason is frequent network switching during data transmission, marking the current port as a third-level port; The analysis module is also used to correct the cleaning standard based on the proportion of abnormal data with a flow rate higher than a preset value when the data cleaning fails, and the reduction of the cleaning standard is negatively correlated with the abnormal proportion, wherein the abnormal proportion is the ratio of the abnormal data to the total amount of data received by a single port; The analysis module is used to count the marking conditions of each port, and determine the reasons why the security of the data exchange process is unqualified based on the ratio of each type of marked ports to the total number of ports, including: The proportion of each type of port is determined based on the ratio of the number of each type of port to the total number of ports. When it is determined that the reason for the failure of the security of the data exchange process is data missing, the current event is marked as a secondary event; When a secondary determination is made on the cause of the unqualified security of the data exchange process based on the proportion of various types of abnormal data, or when a determination is made based on the proportion of the number of level-3 ports that the cause of the unqualified security of the data exchange process is network fluctuation caused by long-distance transmission, the network is optimized and the current event is marked as a level-3 event.

2. The data security exchange system based on self-learning according to claim 1 is characterized in that: The analysis module is also used to generate a corresponding processing method according to the analysis result of whether the security of the data exchange process is qualified, including: Mark the corresponding port as a primary port, A secondary determination is made on whether the data exchange process is qualified based on the number of data packets received by the data receiving module. Or, the cause of security failure can be analyzed based on the degree of time domain variation of the port traffic.

3. The data security exchange system based on self-learning according to claim 2 is characterized in that: The analysis module is used to perform a secondary determination on whether the data exchange process is qualified based on the number of data packets received by the data receiving module, including: To determine the number of data packets received by the data receiving module within a preset detection period, When the analysis module determines that the security of the data exchange process is unqualified based on the number of data packets, the analysis module analyzes the reasons for the unqualified security based on the time domain variation of the port traffic. Alternatively, the analysis module determines that the security of the data exchange process is qualified and marks the current port as a secondary port.

4. The data security exchange system based on self-learning according to claim 1 is characterized in that: The analysis module corrects the similarity standard under the condition of missing data, including: Determine the integrity of stored data, Based on the completeness correction similarity standard, Among them, the increase in the similarity standard is negatively correlated with the completeness.

5. The data security exchange system based on self-learning according to claim 1 is characterized in that: The analysis module is used to make a secondary determination of the reasons why the security of the data exchange process is unqualified based on the proportion of various types of abnormal data, including: The analysis module is used to determine that the reason why the security of the data exchange process is unqualified is that the data cleaning process is unqualified based on the proportion of abnormal traffic data, and mark the current event as a first-level event; The analysis module is used to determine that the reason why the security of the data exchange process is unqualified is data missing based on the proportion of abnormal behavior data, and mark the current event as a secondary event.

6. The data security exchange system based on self-learning according to claim 5, characterized in that: The event construction module is used to count the number of various events and update the self-learning database based on the distribution of various events.

7. A data security exchange method based on self-learning running on the system according to any one of claims 1 to 6, characterized in that: Step S1, receiving exchange data transmitted by each terminal, performing data cleaning on the exchange data using a predetermined cleaning standard and a similarity standard, and identifying tag information attached to the cleaned data; Step S2, detecting the transmission flow at each port, analyzing whether the security of the data exchange process is qualified based on the average flow of a single port in a preset time period, and making a secondary judgment on whether the data exchange process is qualified based on the number of received data packets when the security of the data exchange process is initially determined to be unqualified, or analyzing the reason for the unqualified security of the data exchange process based on the time domain variation degree of the port flow; Step S3: Mark each port based on the analysis results, mark each type of event, modify the cleaning standard based on the proportion of abnormal data, analyze the reasons for the security failure of the data exchange process based on the proportion of the number of each type of ports, determine the corresponding processing method based on the analysis results, record the processing process, and integrate the processing process into events, and optimize subsequent judgments based on each event.

Images