Data security policy adjustment method and device and nonvolatile storage medium

Abstract

The invention discloses a data security policy adjustment method and device and a nonvolatile storage medium. The method comprises the following steps: acquiring network communication data through a distributed data acquisition mode; multiple data analysis models are adopted to analyze the network communication data to obtain an analysis result, and each data analysis model is used for determining abnormal communication data or abnormal user behaviors in network communication according to an analysis target of the target object; and when the analysis result indicates that the network communication data contains the abnormal communication data or the abnormal user behavior, adjusting a data security policy of the network communication data. According to the method and the device, the technical problem of relatively poor security due to the fact that a data security policy cannot be dynamically adjusted according to a data analysis result in related technologies is solved.

Description

Technical Field

[0001] The present application relates to the field of network communications, and in particular, to a method and device for adjusting a data security policy and a non-volatile storage medium. Background Art

[0002] With the rapid development of Internet technology, network communication has become an indispensable part of people's daily life and work. However, the massive data generated in the process of network communication faces huge challenges in security and privacy. In modern communication networks, the amount of network communication data is huge. With the continuous growth of data volume, data security issues are receiving more and more attention. Among various data security issues, abnormal network communication behavior refers to network communication behavior that has not actually occurred or should not occur. Abnormal network communication behavior is usually highly concealed and harmful, and the characteristics of abnormal network communication behavior are difficult to predict in advance, which makes the detection and identification of abnormal network communication behavior a research focus in the current field of network security.

[0003] Traditional data security strategies, such as encryption and access control, can no longer meet the data security needs of the increasingly complex network environment. Static data security strategies are usually used to detect and identify abnormal network communication behaviors, and cannot be dynamically adjusted based on data analysis results. Therefore, there is a problem of poor security.

[0004] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0005] The embodiments of the present application provide a method, device and non-volatile storage medium for adjusting a data security policy, so as to at least solve the technical problem that the data security policy in the related art cannot be dynamically adjusted according to the data analysis results, and thus has poor security.

[0006] According to one aspect of an embodiment of the present application, a method for adjusting a data security policy is provided, comprising: acquiring network communication data through a distributed data collection method; analyzing the network communication data using a plurality of data analysis models to obtain analysis results, wherein each data analysis model is used to determine abnormal communication data or abnormal user behavior in the network communication according to an analysis target of a target object; and adjusting the data security policy of the network communication data when the analysis result indicates that the network communication data contains abnormal communication data or abnormal user behavior.

[0007] In some embodiments of the present application, network communication data is obtained through a distributed data collection method, including: determining a data collection source of the network communication data; determining a data collection method based on data characteristics of the data collection source, wherein the data collection method includes at least one of the following: log collection, traffic collection, and database collection, and the data collection method is deployed in a distributed manner; and obtaining network communication data from the data collection source based on the data collection method.

[0008] In some embodiments of the present application, after acquiring network communication data through a distributed data collection method, the method also includes: acquiring predefined data cleaning rules; performing data cleaning operations on the network communication data according to the data cleaning rules to obtain cleaned first data; converting the format of the first data into a unified format to obtain second data; and desensitizing the second data.

[0009] In some embodiments of the present application, before obtaining the second data from the first data after format cleaning, the method also includes: determining whether there is data missing in the first data; if there is data missing in the first data, obtaining the missing data in the first data and completing the missing data.

[0010] In some embodiments of the present application, the second data is desensitized, including: identifying sensitive data in the second data; determining the sensitivity of the sensitive data, and sorting the sensitive data according to the sensitivity, and determining the sensitive data with a sensitivity greater than a first preset threshold as high-sensitivity data, wherein the sensitive data is determined based on data characteristics of the second data; and encrypting the high-sensitivity data using a quantum key.

[0011] In some embodiments of the present application, the method also includes: determining an analysis target of the target object; when the analysis target is communication data anomaly analysis, using a first data analysis model to perform abnormal communication data analysis on the network communication data to obtain a first analysis result; when the analysis target is abnormal user behavior analysis, using a second data analysis model to perform user behavior analysis on the network communication data to obtain a second analysis result, wherein the second data analysis model first clusters the network communication data and then performs abnormal user behavior analysis.

[0012] In some embodiments of the present application, a first data analysis model is used to analyze network communication data to obtain a first analysis result, including: obtaining a first feature and a target variable of the network communication data, wherein the first feature includes at least one of the following: flow duration, packet size, number of packets, source IP address, destination IP address, and destination port number, and the target variable is used to represent preset analysis data; using the first data analysis model to determine the Pearson correlation coefficient between each feature in the first feature and the target variable respectively; determining a feature whose Pearson correlation coefficient is greater than a second preset threshold as a first target feature; using the first data analysis model to determine the information gain corresponding to each feature in the first feature; determining a feature whose information gain is greater than a third preset threshold as a second target feature; determining the first target data in the network communication data based on the first target feature and the second target feature; determining a chi-square test statistic for the first target data, wherein the chi-square test statistic is used to represent the degree of difference between the observed frequency and the expected frequency of the first target data; and determining the first analysis result based on the chi-square test statistic.

[0013] In some embodiments of the present application, the data security policy for network communication data is adjusted, including: when the analysis results include abnormal user behavior analysis results, adjusting access control rules based on the abnormal user behavior analysis results; when the analysis results include abnormal communication data analysis results, using the abnormal data in the analysis results to train a first data analysis model.

[0014] According to another aspect of an embodiment of the present application, a device for adjusting a data security policy is also provided, including: an acquisition module for acquiring network communication data through a distributed data acquisition method; an analysis module for analyzing the network communication data using a plurality of data analysis models to obtain analysis results, wherein each data analysis model is used to determine abnormal communication data or abnormal user behavior in the network communication according to an analysis target of a target object; and an adjustment module for adjusting the data security policy of the network communication data when the analysis result indicates that the network communication data contains abnormal communication data or abnormal user behavior.

[0015] According to another aspect of an embodiment of the present application, there is also provided an electronic device, comprising: a memory for storing program instructions; a processor, connected to the memory, for executing program instructions to implement the following functions: acquiring network communication data through a distributed data acquisition method; using multiple data analysis models to analyze the network communication data to obtain analysis results, wherein each data analysis model is used to determine abnormal communication data or abnormal user behavior in the network communication according to the analysis target of the target object; when the analysis result indicates that the network communication data contains abnormal communication data or abnormal user behavior, adjusting the data security policy of the network communication data.

[0016] According to another aspect of an embodiment of the present application, a non-volatile storage medium is further provided, the non-volatile storage medium including a stored computer program, wherein the device where the non-volatile storage medium is located executes the above-mentioned method for adjusting the data security policy by running the computer program.

[0017] According to another aspect of an embodiment of the present application, a computer program product is also provided, including computer instructions, which implement the above-mentioned data security policy adjustment method when executed by a processor.

[0018] In an embodiment of the present application, network communication data is acquired through a distributed data collection method; a plurality of data analysis models are used to analyze the network communication data to obtain analysis results, wherein each data analysis model is used to determine abnormal communication data or abnormal user behavior in the network communication according to the analysis target of the target object; when the analysis results indicate that the network communication data contains abnormal communication data or abnormal user behavior, the data security policy of the network communication data is adjusted. By adjusting the data security policy of the network communication data when the analysis results indicate that the network communication data contains abnormal communication data or abnormal user behavior, the purpose of dynamic adjustment according to the data analysis results is achieved, thereby solving the technical problem that the data security policy in the related technology cannot be dynamically adjusted according to the data analysis results, and thus has poor security. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0020] Figure 1 It is a hardware structure block diagram of a computer terminal for implementing a method for adjusting a data security policy provided in an embodiment of the present application;

[0021] Figure 2 It is a flowchart of a method for adjusting a data security policy provided in accordance with an embodiment of the present application;

[0022] Figure 3 is a functional schematic diagram of a computer storage medium provided according to an embodiment of the present application;

[0023] Figure 4 It is a structural diagram of a data security policy adjustment device provided according to an embodiment of the present application. DETAILED DESCRIPTION

[0024] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0025] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0026] The information collected in the embodiments of the present application is information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data comply with the relevant laws, regulations and standards of the relevant regions, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entrances for users to choose to authorize or reject automated decision-making results; if the user chooses to reject, the expert decision-making process will be entered.

[0027] The data security policy adjustment method provided in the embodiments of the present application may be executed in a mobile terminal, a computer terminal or a similar computing device. Figure 1 The hardware structure block diagram of a computer terminal for implementing a method for adjusting a data security policy is shown. Figure 1 As shown, the computer terminal 10 may include one or more (102a, 102b, ..., 102n are used to illustrate) processors (the processor may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 104 for storing data, and a transmission module 106 for communication functions connected via a wired and / or wireless network. In addition, it may also include: a display, a keyboard, a cursor control device, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the I / O interface), a network interface, and a BUS bus. Those skilled in the art can understand that Figure 1The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations shown.

[0028] It should be noted that the one or more processors and / or other data processing circuits described above may generally be referred to herein as "data processing circuits". The data processing circuits may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuit may be a single independent processing module, or may be incorporated in whole or in part into any of the other components in the computer terminal 10. As described in the embodiments of the present application, the data processing circuit acts as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0029] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the method for adjusting the data security policy in the embodiment of the present application. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory 104, that is, the method for adjusting the data security policy described above is implemented. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include a memory remotely arranged relative to the processor, and these remote memories may be connected to the computer terminal 10 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0030] The transmission module 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the computer terminal 10. In one example, the transmission module 106 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission module 106 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0031] The display may be, for example, a touch screen liquid crystal display (LCD) that enables a user to interact with a user interface of the computer terminal 10 .

[0032] It should be noted that, in some optional embodiments, the above Figure 1The computer terminal shown may include hardware elements (including circuits), software elements (including computer code stored on a computer-readable medium), or a combination of hardware elements and software elements. It should be noted that Figure 1 This is merely one example of a particular embodiment and is intended to illustrate the types of components that may be present in the computer terminal described above.

[0033] In the above-mentioned operating environment, an embodiment of the present application provides an embodiment of a method for adjusting a data security policy. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0034] The present application also provides a flowchart of a method for adjusting a data security policy. Figure 2 As shown, the method comprises the following steps:

[0035] Step S202, acquiring network communication data through a distributed data collection method.

[0036] In the technical solution provided in step S202, there are many ways to obtain network communication data through distributed data collection, such as: determining the data collection source of network communication data; determining the data collection method based on the data characteristics of the data collection source, wherein the data collection method includes at least one of the following: log collection, flow collection, database collection, and the data collection method is deployed in a distributed manner; obtaining network communication data from the data collection source according to the data collection method. Selecting the most appropriate collection method according to the characteristics of the data source can improve the quality and efficiency of data collection and reduce the occupation of network resources. It is suitable for scenarios such as network log monitoring, flow analysis, and database auditing. Obtaining network communication data from the data collection source according to the data collection method can ensure that the collected data matches the analysis target and improve the pertinence and effectiveness of data analysis.

[0037] The following is a specific embodiment:

[0038] Distributed data collection method is to deploy data collection devices (or systems) in a distributed manner to multiple servers or nodes, and collect data from one or more data collection sources (for example, websites, servers) together or separately. First, determine the data collection source for obtaining network communication data: determine the type and scope of data to be collected based on the needs of network communication data preservation. For example, network device logs, application system logs, user operation logs, network traffic data, etc. can be collected. Determine the data collection method based on the data characteristics of the data collection source: You can select a suitable data collection method based on the data characteristics of the data source (for example, collection requirements, data source type, etc.). For example, collection methods may include:

[0039] ① Log collection: Collect log data in various formats through log collectors. The log collectors can be Flume (a highly available, highly reliable, distributed system for massive log collection, aggregation and transmission provided by Cloudera), Logstash (a platform for transmission, processing, management and search of application logs and events, which can collect and transform data from multiple sources and then send the data to the target repository. It can be used to uniformly collect and manage application logs and provide a Web interface for query and statistics).

[0040] ② Traffic collection: Use traffic mirroring, test access point (Test Access Point, bypass TAP) and other technologies to collect network traffic data.

[0041] ③Database collection: Collect data from relational or non-relational databases through database connectors.

[0042] Then, the data collection method is deployed in a distributed manner and the distributed data collection method is determined. For example, data collection nodes can be reasonably deployed according to the network topology and data source distribution. Collection nodes can be physical servers, virtual machines, or containers. It is necessary to ensure that the collection nodes have sufficient computing, storage, and network resources to support data collection tasks.

[0043] For example, for a device log based on a private protocol, a Flume plug-in can be developed to parse and collect log data of this type. For example, the access log of the Web (World Wide Web, also known as the World Wide Web) server can be collected, and the traffic data of the internal network can be collected using traffic mirroring. For some data collection sources with special formats or protocols, a custom data collection plug-in can also be developed. The development of the data collection plug-in needs to follow the specifications of the data collection framework and be fully tested and optimized. For example, for a device log based on a private protocol, a Flume plug-in can be developed to parse and collect log data of this type. In order to ensure the security of data in the data collection stage, biometric recognition technology can also be introduced. Specifically, a biometric recognition verification request from the user is received. When the biometric recognition verification passes, the step of obtaining network communication data through a distributed data collection method is executed. For example: a fingerprint recognition sensor can be integrated, and a fingerprint recognition sensor can be integrated on a user terminal device (such as a mobile phone, a computer) to collect the user's fingerprint data; then, when the user performs network communication, fingerprint authentication is required to access network resources (i.e., data collection sources). For example, when users log in to the corporate intranet, they need to use fingerprints to unlock their phones and pass fingerprint authentication before they can access intranet applications. Iris recognition cameras can also be deployed at key network nodes (for example, server rooms, data centers) to perform iris recognition on people or users accessing these areas to ensure that only authorized personnel can enter. For example, the access control system of a data center uses iris recognition, and staff need to pass iris authentication before they can enter the server room.

[0044] The above steps can also introduce quantum communication technology to take advantage of the high security of quantum communication and provide stronger protection for the collection of network communication data. Specifically: First, it is necessary to deploy quantum key distribution (QKD) equipment. Quantum key distribution equipment, such as quantum light sources, quantum detectors, etc., are deployed at key nodes of network communication (e.g., core routers, data center exits). These devices prepare, transmit and measure quantum states through quantum channels (e.g., optical fibers) to achieve secure key distribution. For example, quantum key distribution equipment is deployed between the data center and the backup center to generate a one-to-one quantum key for encrypting the synchronous transmission of data between the two locations.

[0045] Secondly, a quantum random number generator must be integrated. A quantum random number generator can be integrated in a data acquisition terminal (e.g., server, workstation) to generate a random key seed. Compared with a traditional pseudo-random number generator, a quantum random number generator uses the uncertainty principle of quantum mechanics to generate unpredictable and repeatable random numbers, thereby improving the data security of the data acquisition process. For example, a quantum random number generator is integrated on a global wide area network (World Wide Web, referred to as Web, also known as the World Wide Web) server to generate a Hypertext Transfer Protocol Secure (HTTPS) session key to improve the security of network communication data acquisition. In an embodiment of the present application, for example, a quantum key management scheme based on the BB84 protocol is designed to generate a new quantum key every hour, with a key length of not less than 256 bits, and to store backups in three independent key management centers with a validity period of 24 hours to ensure the availability and security of the key.

[0046] After acquiring network communication data through distributed data collection, you can also obtain pre-defined data cleaning rules; perform data cleaning operations on network communication data according to the data cleaning rules to obtain cleaned first data; convert the format of the first data into a unified format to obtain second data; and perform desensitization on the second data. The use of data cleaning rules can effectively remove noise and redundant information in the collected data, improve data quality, and thus improve the accuracy and efficiency of subsequent analysis. The unification of data formats can simplify the data analysis process, improve analysis efficiency, and ensure the comparability of data from different sources. Desensitization can protect user privacy and sensitive information without affecting the accuracy of data analysis, meeting data security and compliance requirements.

[0047] The following is a specific embodiment:

[0048] According to the predefined data cleaning rules (e.g., predefined denoising methods or rules), some unnecessary and redundant data in the network communication data are filtered out, for example, mean filtering, median filtering, wavelet transform, connectivity graph method, support vector machine and other methods are used for data denoising. For Web access logs, useless data such as crawler requests and static resource requests can be filtered out to obtain the first data after cleaning. The network communication data can also be processed in a unified format to obtain the second data. For example, they are all converted into formats such as JSON and Avro (used to provide data sequence numbers and data exchange services for Hadoop, which is a data serialization system format). JSON is very suitable for data exchange in the development process or in applications that require lightweight data exchange due to its text-based and easy-to-read characteristics. And Avro is more suitable for efficient data serialization requirements due to its binary format and ability to support complex data types, such as applications in big data processing and network transmission.

[0049] The format of the first data after data cleaning can be converted into a unified format to make it a structured form suitable for storage and analysis, such as a table, a key-value pair, etc. In an embodiment of the present application, a data model (Schema) can be defined to describe the name, type, constraint, etc. of each field to achieve data formatting of the first data. For example, a Web access log can be formatted into a table containing fields such as timestamp, IP, Uniform Resource Locator (URL), status code, response time, etc.

[0050] Desensitizing the second data, specifically, desensitizing the sensitive data, such as hashing, encryption, etc. Desensitizing is processing sensitive data to reduce the risk of data leakage while maintaining the purpose of the data and improve the security of network communication data. Sensitive data includes, for example, personal identity information, financial information, health records, and other data. For example, the following desensitizing technology can be used:

[0051] ① Hashing: The sensitive data in the second data is converted into a unique value of fixed length (i.e., hash value) through a hash function. Since the hash function is designed to be irreversible, the original data cannot be restored from the hash value, which improves data security.

[0052] ② Encryption: Use a key to convert the second data from the original (plain text) form to the encrypted (cipher text) form. After encrypting the second data, the security of data transmission during the data collection process can be ensured. Even if the data is illegally accessed, the attacker cannot read the content of the second data.

[0053] ③ Masking: Replace sensitive data in the second data with specific symbols to cover up sensitive data, for example, replace part of the digits of the social security number with asterisks (such as XXX-XX-1234). It is used to hide data in the second data that needs to be displayed but needs to be partially kept confidential, ensuring that the data is not leaked while maintaining the availability and readability of some data.

[0054] ④ Anonymization: Data with personally identifiable information in the second data can be removed to reduce the risk of direct association with individuals by replacing, deleting or generating data. The disguised data can be used for data analysis and research without leaking the original data information. In an embodiment of the present application, one or more desensitization technologies can be selected according to the type or characteristics of sensitive data in the second data to adapt to different data protection requirements and standards.

[0055] Before converting the format of the first data into a unified format and obtaining the second data, it is necessary to determine whether the first data has data missing; if the first data has data missing, obtain the missing data in the first data and perform a completion operation on the missing data. The data completion operation can improve the integrity and availability of the data and reduce the impact of missing data on the analysis results. It is suitable for scenarios such as data preprocessing and data integrity recovery.

[0056] The following is a specific embodiment:

[0057] Whether the first data has missing data can be determined by observation, descriptive statistics, visualization, etc. Taking descriptive statistics as an example, statistical indicators can be used to check the missing status of each variable in the first data, such as calculating the missing rate and missing proportion of each variable. If there is missing data, the missing data of the first data is supplemented:

[0058] For missing or incomplete data, the completion operation may include: interpolation method, external data source method and default value method. For example, the interpolation method can use the known data in the first data to estimate the missing data to complete the missing data; the external data source method can obtain the missing information from other data sources to complete the missing data in the first data; the default value method can fill the missing fields with default values ​​to complete the missing data. For example, for an access log that is missing the user's identity document (ID), the corresponding user ID can be obtained from the user database based on the Internet Protocol (IP) address, User-Agent (UA) and other information to complete the missing data of the user ID.

[0059] There are many ways to desensitize the second data, such as: identifying sensitive data in the second data; determining the sensitivity of the sensitive data, and sorting the sensitive data according to the sensitivity, and determining the sensitive data with a sensitivity greater than a first preset threshold as high-sensitivity data, wherein the sensitive data is determined based on the data characteristics of the second data; and encrypting the high-sensitivity data using a quantum key.

[0060] The following is a specific embodiment:

[0061] According to the source, type, content and other characteristics of the second data, data with a higher sensitivity level can be identified (sensitive data with a sensitivity greater than the first preset threshold is determined as high-sensitivity data, such as 90%). High-sensitivity data, such as personal privacy data, commercial confidential data, key infrastructure data, etc., can be strengthened for these high-sensitivity data. For example, through regular expressions and machine learning algorithms, sensitive content such as ID card numbers and bank card numbers contained in the data can be identified and marked as high-sensitivity levels, and the identified high-sensitivity data can be encrypted using quantum keys.

[0062] It is also possible to use a highly secure symmetric encryption algorithm (such as AES-256) and use a quantum key as the encryption key. The encrypted data can be securely stored and transmitted. For example, data marked as highly sensitive is encrypted with AES-256, and the key is derived from the quantum key generated by the QKD device. The encrypted data is stored in an independent secure storage area and remains encrypted during transmission.

[0063] In addition, in order to strengthen the protection of data by quantum keys, encryption algorithms that can resist quantum attacks can also be used, such as lattice cryptography and hash functions. For example, for sensitive data stored for a long time, lattice cryptography is used for encryption, and the key is updated regularly. For sensitive data that needs to verify integrity, a hash function that is resistant to quantum collisions (such as the third-generation Secure Hash Algorithm 3 (SHA-3)) is used to calculate the digital summary.

[0064] Step S204, using multiple data analysis models to analyze the network communication data to obtain analysis results, wherein each data analysis model is used to determine abnormal communication data or abnormal user behavior in the network communication according to the analysis target of the target object.

[0065] In the technical solution provided in step S204, the analysis target of the target object is determined; when the analysis target is communication data anomaly analysis, the first data analysis model is used to perform abnormal communication data analysis on the network communication data to obtain a first analysis result; when the analysis target is abnormal user behavior analysis, the second data analysis model is used to perform user behavior analysis on the network communication data to obtain a second analysis result, wherein the second data analysis model first clusters the network communication data and then performs abnormal user behavior analysis. By clarifying the analysis target, the pertinence and efficiency of data analysis can be improved, and resource waste can be avoided. User behavior analysis can discover internal threats and abnormal activities and improve the ability to identify internal security risks.

[0066] The following is a specific embodiment: the target and scope of data analysis can be determined according to the requirements of network communication data preservation (i.e., the analysis target of the target object), thereby determining the data analysis model. For example, the analysis target of the target object may include:

[0067] Abnormal behavior detection: Identify abnormal behavior data in network communication data, such as distributed denial of service (DDoS) attacks, port scanning, etc. ② Threat intelligence analysis: Mine network threat intelligence data in network communication data, such as malicious IP, domain name, samples, etc. Use the first data analysis model to perform abnormal communication data analysis on the network communication data to obtain the first analysis result.

[0068] The analysis goal is user behavior analysis: analyzing the network behavior patterns of users in the network communication data, such as access frequency, time period, preference, etc., using the second data analysis model to perform user behavior analysis on the network communication data to obtain a second analysis result.

[0069] The functions of the data analysis model correspond to the analysis objectives of the target object. Appropriate machine learning and deep learning algorithms can be selected based on the analysis objectives of the target object. For example:

[0070] ① If the data analysis goal is to detect abnormal behavior, the data analysis model is determined to be an anomaly detection algorithm. Among them, anomaly detection algorithms can be used to identify data points that deviate from normal patterns, such as isolation forest algorithms, one-class support vector machines (One-Class Support Vector Machines, One-Class SVM), etc.

[0071] ② If the data analysis goal is user behavior analysis to discover the association rules of user access behavior, then the data analysis model is determined to be an association rule algorithm. Among them, the association rule algorithm is used to determine the association relationship between data items, such as Apriori (association rule mining algorithm), Frequent Pattern-growth (FP-growth) as an association analysis algorithm, etc.

[0072] ③ If the data analysis goal is to classify network traffic, determine the data analysis model as a classification algorithm. Data can be divided into different categories based on features, such as support vector machines (SVM), decision trees, etc.

[0073] ④ If the data analysis goal is threat intelligence analysis, algorithms such as Naive Bayes and Logistic Regression can be used to analyze and predict the type and risk level of network threats. These algorithms can learn the discrimination models of different threat types based on the characteristics of threat indicators.

[0074] In practical applications, the analysis target of the target object may include a combination of multiple analyses or detections, for example, abnormal behavior detection and user behavior analysis require a combination of multiple algorithms. In the above steps, the first data analysis model is used to analyze the network communication data, and there are multiple ways to obtain the first analysis result, for example: obtaining the first feature and target variable of the network communication data, wherein the first feature includes at least one of the following: flow duration, packet size, number of packets, source IP address, destination IP address, destination port number, and the target variable is used to represent the preset analysis data; using the first data analysis model to determine the Pearson correlation coefficient between each feature in the first feature and the target variable respectively; determining the feature whose Pearson correlation coefficient is greater than the second preset threshold as the first target feature; using the first data analysis model to determine the information gain corresponding to each feature in the first feature; determining the feature whose information gain is greater than the third preset threshold as the second target feature; determining the first target data in the network communication data based on the first target feature and the second target feature; determining the chi-square test statistic of the first target data, wherein the chi-square test statistic is used to represent the degree of difference between the observed frequency and the expected frequency of the first target data; and determining the first analysis result based on the chi-square test statistic. The selection of features and target variables can ensure the effectiveness and accuracy of the analysis model and improve the accuracy of anomaly detection. Correlation analysis can identify the features most relevant to abnormal behavior and improve the interpretability and operability of the model. Through information gain screening, the feature set can be further optimized to improve the operating efficiency and prediction accuracy of the model. The determination of the first target data can improve the pertinence and accuracy of the model and reduce false positives and false negatives. The chi-square test can evaluate the correlation between the target data and abnormal behavior and improve the detection ability of the model. Through the chi-square test results, abnormal behavior in network communication can be accurately judged and the level of data security protection can be improved.

[0075] The following is a specific embodiment:

[0076] In order to improve the performance of the model, data features that are more discriminative and more closely associated with the preset data analysis target can be selected. First, the first feature is extracted from the network communication data, such as extracting statistical features such as flow duration, packet size, number of packets, source IP address, destination IP address, and destination port number from the network traffic. Such as numerical features (for example, the number of bytes, number of packets, and duration of network traffic), category features (for example, network protocol type, application layer protocol type, URL domain name, etc.), text features (for example, URL path, user agent, request parameters, etc.), time features (for example, request timestamp, response timestamp, traffic peak time, etc.), statistical features (for example, average traffic, maximum traffic, request frequency, etc. over a period of time), interactive features (for example, the number of requests for the same source IP, the number of requests for the same destination IP, etc.), and derivative features (for example, URL length, number of request parameters, response status code distribution, etc.).

[0077] Then, data features associated with the target variable are selected from the first target features. For example, correlation analysis, information gain and other methods are used to evaluate the association (or correlation, etc.) between each feature in the first feature and the target variable, thereby screening and processing data features with strong correlation (first target features).

[0078] For example, the correlation analysis may use the Pearson Correlation Coefficient, which is used to measure the linear correlation between two variables. A feature whose Pearson correlation coefficient is greater than a second preset threshold is determined as the first target feature. The formula is:

[0079]

[0080] Among them, x i and i Represent the eigenvalue and target variable of the i-th first feature, respectively. and They represent the mean of the eigenvalues ​​of the first feature and the mean of the target variable, n represents the number of the first feature, and γ represents the Pearson correlation coefficient.

[0081] Information Gain: It is used to evaluate the importance of a first feature to the preset data analysis data. It can be used in the decision tree algorithm. Its formula is:

[0082]

[0083] Among them, IG(D,A) represents information gain, D represents the data set where the first feature is located, A represents the first feature, v represents a value of the first feature A, and D vrepresents the sample subset whose value of A is v, H(D v ) represents information entropy, where the calculation formula of information entropy is:

[0084]

[0085] Among them, k represents the number of categories of the target variable, K represents the total number of categories of the target variable, and p k It represents the proportion of samples of the kth category in the data set D.

[0086] Assume that there is a binary classification problem, the target variable is whether it is malicious network traffic (abnormal behavior detection), and the first feature includes: flow duration, packet size, number of packets, source IP address, destination IP address, destination port number, etc. First, calculate the Pearson correlation coefficient between each feature and the target variable, and select the feature with a larger absolute value of the correlation coefficient, such as flow duration, packet size, destination port number, etc. Then, calculate the information gain of each feature, and determine the feature with an information gain greater than the third preset threshold as the second target feature, such as destination port number, source IP address, etc. Finally, comprehensively consider the correlation and information gain, and select a subset containing the most discriminative features as the first target data, for example, the first target data can be {flow duration, packet size, destination port number, source IP address}. The above example considers correlation and information gain at the same time. In other embodiments, only correlation (for example, the weight of the second target feature is set to 0) or only information gain (for example, the weight of the first target feature is set to 0) can be considered.

[0087] Then determine the Chi-Square Test Statistic of the first target data. The Chi-Square statistic is calculated using the following formula:

[0088]

[0089] Among them, x 2 represents the chi-square test statistic of the first target data, which indicates the degree of difference between the observed frequency and the expected frequency of the first target data. r and c represent the number of rows and columns in the contingency table, respectively. ij represents the observed frequency (actual frequency) of the i-th row and j-th column, that is, the actual observed frequency of the i-th row and j-th column, E ij It represents the expected frequency of the i-th row and j-th column, which is calculated based on the row marginal and column marginal. It represents the frequency expected to be observed in the i-th row and j-th column if there is no association between the feature and the target variable.

[0090] According to the chi-square statistic and degrees of freedom, query the chi-square distribution table to obtain the chi-square test statistic x 2The value of is used to determine the first analysis result based on the chi-square test statistic. If it is less than the significance level (for example, 0.05), it is considered that the data has a significant correlation with malicious traffic and is a discriminating feature.

[0091] Before data processing, data features can be normalized, standardized, discretized, and other transformations to make them suitable for the input of machine learning models. Among them, normalization is suitable for situations where the range of feature values ​​varies greatly and the data features need to be scaled to a fixed interval (for example, [0, 1]). Normalization can convert features of different dimensions to the same scale for easy comparison and calculation. Taking Min-Max Normalization as an example, it is a linear normalization method that scales the data to a fixed range. The formula is, for example:

[0092]

[0093] Among them, x represents the eigenvalue of the original data, max(x) and min(x) represent the maximum and minimum values ​​of the feature respectively, and x ′ represents the normalized eigenvalue.

[0094] Standardization is suitable for situations where the eigenvalue distribution is approximately Gaussian and the eigenvalue needs to be converted to a standard normal distribution with a mean of 0 and a variance of 1. Standardization can eliminate the dimensionality of features and make different features have the same scale and distribution. For example, Z-score Standardization is a method of converting data to a standard normal distribution, so that the mean of the data is 0 and the standard deviation is 1. The formula is:

[0095]

[0096] Among them, x represents the eigenvalue of the original data, μ and σ represent the mean and standard deviation of the feature respectively, and x ′ represents the standardized feature value.

[0097] Discretization: Applicable to continuous features, and when continuous values ​​need to be converted into discrete categories or intervals. Discretization can simplify the representation of features, reduce the impact of noise and outliers, and improve the generalization ability of the model. Taking equal width discretization as an example, it can divide the value range of the feature into m equal width intervals, each of which corresponds to a discrete value. The width of the interval is:

[0098]

[0099] Among them, max(x) and min(x) represent the maximum and minimum values ​​of the feature respectively, and m represents the number of discretized intervals.

[0100] A first data analysis model (a type of data analysis model) is used to perform abnormal communication data analysis on network communication data to obtain a first analysis result; when the analysis target is abnormal user behavior analysis, a second data analysis model (a type of data analysis model) is used to perform user behavior analysis on network communication data to obtain a second analysis result, wherein the second data analysis model first clusters the network communication data and then performs abnormal user behavior analysis, and the data analysis model extracts data features from the network communication data, and then classifies and predicts the data features to obtain the data analysis result. The data analysis result is, for example, a behavior model that identifies whether the user's behavior is abnormal, and / or identifies malicious IPs, domain names, etc. in the network communication data.

[0101] The output of the data analysis model can also be compared with the trusted data on the blockchain, and the trusted data on the blockchain can be used to supplement the output of the data analysis model to finally obtain the analysis results. Specifically, the data on the blockchain is indexed and organized to improve the efficiency of data retrieval and analysis. Database technology can be used to synchronize blockchain data to a relational database or a non-relational database, and to establish an index. For example, the network device configuration data on the blockchain is synchronized to a document database (also a non-relational database), and indexes are established according to dimensions such as device type, manufacturer, and time. The security event data on the blockchain is synchronized to an elastic search engine, and indexes are established according to dimensions such as event type, hazard level, and asset type. Furthermore, in the process of performing data analysis to obtain data analysis results, the blockchain data is integrated with the output of the data analysis model to improve the comprehensiveness and accuracy of the analysis. Blockchain data can be used as a trusted reference to verify and supplement the output of the data analysis model. For example, in threat intelligence analysis, security event data on the blockchain is compared with the output results of threat intelligence analysis to identify more threat indicators and attack patterns. In abnormal behavior detection, the device configuration change history on the blockchain is associated with real-time network traffic data to help discover suspicious operational behaviors.

[0102] Step S206: When the analysis result indicates that the network communication data contains abnormal communication data or abnormal user behavior, the data security policy of the network communication data is adjusted.

[0103] In the technical solution provided in step S206, the data security policy of network communication data can be adjusted in a variety of ways, for example: when the analysis results include abnormal user behavior analysis results, the access control rules are adjusted according to the abnormal user behavior analysis results; when the analysis results include abnormal communication data analysis results, the first data analysis model is trained using the abnormal data in the analysis results. By adjusting the access control rules, internal threats can be responded to in a timely manner, the response speed and protection efficiency of the system can be improved, and the detection capability and adaptability of the model can be improved by continuous training and optimization of the model, so as to better respond to network threats.

[0104] The following is a specific embodiment:

[0105] The points to be optimized of the data security policy of network communication data can be determined based on the data analysis results, and then the determined points to be optimized can be adjusted. For example, the points to be optimized include but are not limited to:

[0106] Access control rules: When the data analysis results include user behavior analysis results, the access control non-abnormal list and abnormal list can be optimized based on the user behavior analysis results.

[0107] The optimization of the access control non-abnormal list and abnormal list can be targeted at specific users or user groups. For example, if a data analysis model determines that a user's behavior is abnormal, such as frequent failed login attempts, sensitive data access, etc., then you can consider adding the user to the abnormal list and restricting their access rights. If the data analysis model determines that a certain type of user (such as remote access users) has a higher overall behavioral risk, you can apply stricter access control rules to this type of user.

[0108] Specifically, the steps for optimizing access control rules are as follows:

[0109] The first step is to identify user behavior through data analysis models, obtain user behavior analysis results, and identify high-risk users or user groups. The second step is to evaluate whether the existing access control rules are sufficient to restrict these high-risk users or user groups, and obtain evaluation results. The third step is to adjust the non-abnormal list and / or abnormal list based on the evaluation results, and / or add or delete specific users or IP addresses. The fourth step is to modify the access control policy to implement stricter permission control for high-risk users, such as requiring multi-factor authentication, restricting sensitive operations, etc.

[0110] In the case where the data analysis results include abnormal behavior detection, the threshold of abnormal detection can be dynamically adjusted according to the statistical characteristics of abnormal behavior. The optimization of the abnormal detection threshold can be based on the overall statistical characteristics of abnormal behavior, for example, by analyzing the frequency and distribution characteristics of abnormal behavior over a period of time, so as to determine whether the existing threshold setting is reasonable or effective.

[0111] Specifically, the anomaly detection threshold optimization step includes, for example, the following:

[0112] The first step is to obtain the output results of the data analysis model (e.g., anomaly detection model) within a period of time to obtain abnormal behavior detection data, including but not limited to the type, severity, and occurrence time of abnormal behavior. The second step is to perform statistical analysis on the acquired abnormal behavior detection data, such as calculating the occurrence frequency of different types of anomalies, the distribution of anomalies in different time periods, etc., so as to obtain statistical analysis results. The third step is to evaluate the effectiveness of the existing anomaly detection threshold based on the statistical analysis results. For example, if a certain type of abnormal behavior is found to occur frequently but not detected, the detection threshold of this type of anomaly is lowered. For example, the anomaly detection threshold of the anomaly detection model is adjusted from 0.8 to 0.75 to improve the detection rate of medium-risk anomalies. In addition to optimizing the anomaly detection threshold, the anomaly detection weight can also be optimized to make it more suitable for the actual abnormal behavior distribution. Under the adjusted anomaly detection threshold setting, the data analysis model (e.g., anomaly detection model) can be rerun, and the optimized detection effect can be further evaluated, the anomaly detection results can be continuously monitored, and the threshold setting can be dynamically adjusted according to the actual situation.

[0113] Through the above steps, it is possible to efficiently obtain massive amounts of network communication data through distributed data collection, so as to fully perceive the security situation of network communication data, improve data processing efficiency, and have good scalability and fault tolerance. By using the trained data analysis model to introduce machine learning algorithms, it is possible to intelligently analyze massive amounts of data, timely discover security risks in network communication data, optimize data security strategies based on the data analysis results of the data analysis model, realize adaptive adjustment of network communication data preservation, and improve the intelligence of network communication data preservation. Solve the security and privacy challenges faced by massive network communication data and improve data security in cyberspace.

[0114] The present application also provides a functional schematic diagram of a computer storage medium, such as Figure 3 As shown, a computer program is stored in the computer-readable storage medium 300, and when the computer program is executed by the processor, each step of the above-mentioned data security policy adjustment method is implemented. For example, when the computer program is executed by the processor, the following steps are implemented:

[0115] Acquire network communication data through distributed data collection; use multiple data analysis models to analyze the network communication data to obtain analysis results, wherein each data analysis model is used to determine abnormal communication data or abnormal user behavior in the network communication according to the analysis target of the target object; when the analysis result indicates that the network communication data contains abnormal communication data or abnormal user behavior, adjust the data security policy of the network communication data.

[0116] In some embodiments, the storage medium is further configured to store program code 301 for performing the following steps:

[0117] Acquire network communication data through distributed data collection; use multiple data analysis models to analyze the network communication data to obtain analysis results, wherein each data analysis model is used to determine abnormal communication data or abnormal user behavior in the network communication according to the analysis target of the target object; when the analysis result indicates that the network communication data contains abnormal communication data or abnormal user behavior, adjust the data security policy of the network communication data.

[0118] The present application also provides a schematic diagram of a data security policy adjustment device. Figure 4 As shown, including:

[0119] The acquisition module 402 is used to acquire network communication data through a distributed data acquisition method.

[0120] The analysis module 404 is used to analyze the network communication data using multiple data analysis models to obtain analysis results, wherein each data analysis model is used to determine abnormal communication data or abnormal user behavior in the network communication according to the analysis target of the target object.

[0121] The adjustment module 406 is used to adjust the data security policy of the network communication data when the analysis result indicates that the network communication data contains abnormal communication data or abnormal user behavior.

[0122] The embodiment of the present application further provides an electronic device, which includes a memory and a processor, wherein the memory is used to store program instructions; the processor is connected to the memory and is used to execute the program instructions to implement the following functions:

[0123] Acquire network communication data through distributed data collection; use multiple data analysis models to analyze the network communication data to obtain analysis results, wherein each data analysis model is used to determine abnormal communication data or abnormal user behavior in the network communication according to the analysis target of the target object; when the analysis result indicates that the network communication data contains abnormal communication data or abnormal user behavior, adjust the data security policy of the network communication data.

[0124] An embodiment of the present application also provides a non-volatile storage medium, which includes a stored computer program, wherein the device where the non-volatile storage medium is located executes the following data security policy adjustment method by running the computer program: acquiring network communication data through a distributed data acquisition method; using multiple data analysis models to analyze the network communication data to obtain analysis results, wherein each data analysis model is used to determine abnormal communication data or abnormal user behavior in the network communication according to the analysis target of the target object; when the analysis result indicates that the network communication data contains abnormal communication data or abnormal user behavior, adjusting the data security policy of the network communication data.

[0125] An embodiment of the present application also provides a computer program product, including computer instructions, which, when executed by a processor, implement the steps of the method for adjusting the data security policy in each embodiment of the present application.

[0126] The embodiments of the present application also provide a computer program, which, when executed by a processor, implements the steps of the method for adjusting the data security policy in each embodiment of the present application.

[0127] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0128] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0129] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0130] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0131] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0132] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, in essence, or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk and other media that can store program codes.

[0133] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A method for adjusting a data security policy, characterized in that: include: Acquire network communication data through distributed data collection; Analyzing the network communication data using a plurality of data analysis models to obtain analysis results, wherein each data analysis model is used to determine abnormal communication data or abnormal user behavior in the network communication according to an analysis target of a target object; When the analysis result indicates that the network communication data contains abnormal communication data or abnormal user behavior, the data security policy of the network communication data is adjusted.

2. The method according to claim 1, characterized in that Obtain network communication data through distributed data collection, including: Determining a data acquisition source of the network communication data; Determine a data collection method according to the data characteristics of the data collection source, wherein the data collection method includes at least one of the following: log collection, flow collection, and database collection, and the data collection method is deployed in a distributed manner; The network communication data is acquired from the data acquisition source according to the data acquisition method.

3. The method according to claim 1, characterized in that After acquiring the network communication data by means of distributed data collection, the method further includes: Get predefined data cleaning rules; Performing a data cleaning operation on the network communication data according to the data cleaning rule to obtain cleaned first data; Converting the format of the first data into a unified format to obtain second data; The second data is desensitized.

4. The method according to claim 3, characterized in that Before converting the format of the first data into a unified format to obtain the second data, the method further includes: Determine whether the first data has data missing; In the case that there is missing data in the first data, the missing data in the first data is obtained, and a completion operation is performed on the missing data.

5. The method according to claim 3, characterized in that: Performing desensitization processing on the second data includes: identifying sensitive data in the second data; Determining the sensitivity of the sensitive data, and sorting the sensitive data according to the sensitivity, and determining the sensitive data with a sensitivity greater than a first preset threshold as high-sensitivity data, wherein the sensitive data is determined according to the data characteristics of the second data; The highly sensitive data is encrypted using a quantum key.

6. The method according to claim 1, characterized in that The method further comprises: Determine the analysis objectives of the target object; When the analysis target is communication data anomaly analysis, using a first data analysis model to perform abnormal communication data analysis on the network communication data to obtain a first analysis result; When the analysis target is abnormal user behavior analysis, a second data analysis model is used to perform user behavior analysis on the network communication data to obtain a second analysis result, wherein the second data analysis model first clusters the network communication data and then performs abnormal user behavior analysis.

7. The method according to claim 1, characterized in that The network communication data is analyzed using a first data analysis model to obtain a first analysis result, including: Obtaining a first feature and a target variable of the network communication data, wherein the first feature includes at least one of the following: flow duration, packet size, number of packets, source IP address, destination IP address, and destination port number, and the target variable is used to represent preset analysis data; Determine the Pearson correlation coefficient between each of the first features and the target variable using the first data analysis model; Determine the feature whose Pearson correlation coefficient is greater than a second preset threshold as a first target feature; Determine the information gain corresponding to each feature of the first features using the first data analysis model; Determine the feature whose information gain is greater than a third preset threshold as a second target feature; Determining first target data in the network communication data according to the first target feature and the second target feature; Determining a chi-square test statistic of the first target data, wherein the chi-square test statistic is used to indicate the degree of difference between the observed frequency and the expected frequency of the first target data; The first analysis result is determined according to the chi-square test statistic.

8. The method according to claim 6, characterized in that Adjusting the data security policy of the network communication data includes: In the case where the analysis result includes an abnormal user behavior analysis result, adjusting the access control rule according to the abnormal user behavior analysis result; In a case where the analysis result includes an abnormal communication data analysis result, the first data analysis model is trained using the abnormal data in the analysis result.

9. A data security policy adjustment device, characterized in that: include: An acquisition module, used for acquiring network communication data through a distributed data acquisition method; An analysis module, used to analyze the network communication data using multiple data analysis models to obtain analysis results, wherein each data analysis model is used to determine abnormal communication data or abnormal user behavior in the network communication according to the analysis target of the target object; The adjustment module is used to adjust the data security policy of the network communication data when the analysis result indicates that the network communication data contains abnormal communication data or abnormal user behavior.

10. An electronic device, characterized in that: include: A memory for storing program instructions; A processor, connected to the memory, for executing program instructions to implement the following functions: acquiring network communication data by distributed data acquisition; analyzing the network communication data by using a plurality of data analysis models to obtain analysis results, wherein each data analysis model is used to determine abnormal communication data or abnormal user behavior in network communication according to an analysis target of a target object; When the analysis result indicates that the network communication data contains abnormal communication data or abnormal user behavior, the data security policy of the network communication data is adjusted.

11. A non-volatile storage medium, characterized in that: The non-volatile storage medium includes a stored computer program, wherein the device where the non-volatile storage medium is located executes the method for adjusting the data security policy described in any one of claims 1 to 8 by running the computer program.

12. A computer program product comprising computer instructions, characterized in that: When the computer instructions are executed by a processor, the method for adjusting the data security policy described in any one of claims 1 to 8 is implemented.

Images