SDN-based network security dynamic protection and multi-factor authentication management and control platform

Abstract

The invention discloses a network security dynamic protection and multi-factor authentication management and control platform based on an SDN, and relates to the technical field of industrial control network security. Through cooperative work of a user behavior data acquisition module and a behavior feature analysis module, the operation behavior of a user can be monitored in real time, and the security of the user is improved. Such as clipboard operation, network request, flow downloading, USB equipment connection and the like. According to the multi-dimensional monitoring mode, the dimensionless processing technology is combined, standardization processing is conducted on user behavior data, a shearing behavior index YcJ and an abnormal operation index Ycc are generated and evaluated, and when abnormity exists in evaluation, the system immediately sends out an early warning instruction and triggers a corresponding authentication process. Through calculation and analysis of the behavior characteristic index Btxs, whether the operation of the current user accords with a normal behavior mode is dynamically evaluated, and whether higher-level multi-factor authentication is needed is further judged. The abnormal behavior can be effectively identified, and the risk of false alarm can be reduced.

Description

Technical Field

[0001] The present invention relates to the field of industrial control network security technology, and specifically to a network security dynamic protection and multi-factor authentication management and control platform based on SDN. Background Art

[0002] As global energy demand continues to grow, hydropower, as a clean and renewable energy source, has occupied an important position in the global power generation structure. Modern hydropower plants have widely used automated control systems, such as SCADA (supervisory control and data acquisition system), DCS (distributed control system) and PLC (programmable logic controller), etc., which have improved the operating efficiency of hydropower plants through real-time data acquisition and control optimization. However, with the deep integration of industrial control networks and the Internet, the network security issues of hydropower plants have become increasingly prominent.

[0003] The control network of industrial hydropower plants involves key infrastructure such as generator sets, substations, and reservoir water level control. Once the network is attacked or data is tampered with, it may cause equipment failure, power outages, and even have a serious impact on the stability of the regional power system. In recent years, industrial control systems (ICS) have gradually become the focus of cyber attacks, and malware has triggered widespread security warnings by invading PLC and SCADA systems. Such incidents show that traditional network security protection methods are no longer able to cope with the multiple threats faced by modern industrial hydropower plants.

[0004] Traditional network security authentication solutions mainly rely on static passwords, fingerprints or two-factor authentication, etc., and often lack real-time monitoring and dynamic analysis of user behavior characteristics, such as frequent clipboard operations or abnormally high download traffic. Internal attackers or malicious programs may invade by forging user behavior or tampering with system operations, and traditional systems are difficult to effectively protect. Summary of the invention

[0005] In view of the deficiencies in the prior art, the present invention provides an SDN-based network security dynamic protection and multi-factor authentication management and control platform to solve the problems mentioned in the background technology.

[0006] To achieve the above objectives, the present invention is implemented through the following technical solutions: a network security dynamic protection and multi-factor authentication management and control platform based on SDN, including a user behavior data collection module, a behavior feature analysis module, a first multi-factor dynamic authentication module and a second multi-factor dynamic authentication module;

[0007] The user behavior data collection module is used to monitor and record the user's operation behavior data during the user's daily operation, and establish a user behavior feature database;

[0008] The behavior feature analysis module is used to extract the clipboard operation features, network request features, download traffic features and USB device connection status features from the user behavior feature database collected in the user behavior data collection module, and to standardize the collected data according to the dimensionless processing technology to calculate and generate the clipping behavior index YcJ and the abnormal operation index Ycc; when the clipping behavior index YcJ exceeds the first abnormal threshold value X1, a first warning instruction is issued; when the abnormal operation index Ycc exceeds the second abnormal threshold value X2, a second warning instruction is issued;

[0009] The user operation behavior characteristics are extracted from the user behavior characteristic database and analyzed to obtain: typing input behavior coefficient TIC, mouse movement trajectory coefficient MTC and screen use behavior coefficient SUC, and the behavior characteristic index Btxs is obtained by correlation;

[0010] The first multi-factor dynamic authentication module is used to trigger the first authentication process after receiving the first warning instruction; and trigger the second authentication process after receiving the second warning instruction;

[0011] The second multi-factor dynamic authentication module is used to analyze and evaluate the behavior characteristic index Btxs calculated by the behavior characteristic analysis module and the standard behavior threshold M to determine whether the corresponding authentication process needs to be triggered.

[0012] Preferably, the user behavior data collection module includes a networking unit and an identification unit;

[0013] The networking unit is used to interconnect the generators, control systems, PLCs and DCS devices within the hydropower plant using the SDN software-defined network architecture. The network path is dynamically configured through a centrally controlled network manager to ensure that the behavior data of user operations can be transmitted to the platform in real time for processing and analysis.

[0014] The recognition unit is used to identify the start and end time of the user's operating system, record the user's login and logout operations, collect time stamps for all operation processes, and collect user operation behavior data in real time during the user's daily operations, including typing speed, typing rhythm and input data of different characters. At the same time, the user's mouse movement trajectory, click frequency and pause time are monitored in real time, and a user behavior feature database is established.

[0015] Preferably, the user behavior feature database includes typing input behavior data, mouse movement trajectory data and screen usage behavior data:

[0016] The steps for collecting user operation behavior data include:

[0017] S11, identifying the time when the user successfully logs into the operating system, and obtaining a first time T1; identifying the time when the user logs out of the operating system, and obtaining a second time T2; if the first time T1 exceeds a preset operation time threshold TX, a dynamic personalized question is triggered, and a first cognitive authentication is performed;

[0018] S12, and collect and obtain the user's network request frequency wlqP, network delay response value Wlycz and download traffic peak value Lfz in the operating system:

[0019] The network request frequency wlqP includes the frequency of accessing different servers or external resources;

[0020] The network delay response value Wlycz is used to record the response time after the user's network request;

[0021] Upload and download traffic peak value Lfz: monitors the changes in the user's upload and download traffic during the operation period;

[0022] Collect the user's clipboard operation mode, including the frequency of copying and pasting, and collect the clipboard content;

[0023] S13, identifying the connection frequency of USB devices after the user logs in USBpl: recording the frequency of the user connecting the USB device during the operation;

[0024] S14. Collect and obtain the typing input behavior data after the user completes the login command. The typing input behavior data includes:

[0025] Average typing speed: the average number of characters typed per unit time Pjzf;

[0026] Typing rhythm: the time interval difference between different characters Jgcy;

[0027] Alphabet character input frequency zmpl: frequency statistics of user inputted alphabetic characters, identifying the frequency distribution of commonly used alphabetic characters;

[0028] Symbol character input frequency Fhpl: frequency statistics of symbol characters input by users, identifying the frequency distribution of commonly used symbols;

[0029] Digital character input frequency Szpl: frequency statistics of digital characters input by users, identifying the frequency distribution of commonly used numbers;

[0030] Average pause time The average time users pause during input operations;

[0031] Maximum pause time Tdt max : The longest pause time during user input;

[0032] Pause frequency Tdpl: The number of pauses per unit time, which helps identify the user's thinking or operation interval pattern.

[0033] Preferably, the step of collecting user operation behavior data also includes:

[0034] S15. Collect and obtain the mouse movement trajectory data after the user completes the login command. The mouse movement trajectory data includes:

[0035] Number of straight line movement paths zxlj: records the number of straight line movement paths that the mouse moves on the screen;

[0036] Number of curve movement paths qxlj: records the number of curve movement paths that the mouse moves on the screen;

[0037] Mouse left button click frequency sbzjP: the number of mouse left button clicks per unit time;

[0038] Mouse right button click frequency sbyjP: the number of mouse right button clicks per unit time;

[0039] Mouse pause time sbddt: the time the mouse pauses at a specific position on the operation interface.

[0040] Preferably, the step of collecting user operation behavior data also includes:

[0041] S16. Collect and obtain screen usage behavior data after the user completes the login command. The screen usage behavior data includes:

[0042] Window switching frequency kcqh: the frequency at which the user switches application windows during operation;

[0043] Screen focus switching time jdqh: the speed at which users switch application windows;

[0044] Full screen and reduced operation frequency qspl: monitors whether the user frequently switches the application window to full screen or reduced.

[0045] Preferably, the behavior feature analysis module includes a model building unit, an abnormality analysis unit and an abnormality assessment unit;

[0046] The model building unit is used to use the convolutional neural network to build an initial convolutional neural network model, and train and test the initial convolutional neural network model with the user behavior feature database, and use the trained initial convolutional neural network model as the user behavior prediction model, and use the intermediate layer output of the user behavior prediction model as a feature vector to identify feature information, and train, test and verify the user behavior prediction model through the acquired feature information;

[0047] The anomaly analysis unit is used to extract the clipboard operation characteristics, network request characteristics, download traffic characteristics, and USB device connection status characteristics from the user behavior feature database. After dimensionless processing, the clipboard behavior index YcJ and the abnormal operation index Ycc are calculated through the following formula:

[0048]

[0049] In the formula, C l is the length of the copied characters monitored, and L max represents the maximum character length preset for the clipboard; P f is the number of paste operations per minute, and P max represents the preset normal paste frequency reference value; f(C t ) represents the feature function of the clipboard content, with different weightings set for different content types. The specific settings are as follows:

[0050] For recognized text content: f(C t ) = 1; for recognized web link address URL type: f(C t ) = 2; for recognized code snippet type: f(C t ) = 3; for recognized command type: f(C t ) = 4; The meaning of the formula is that the square processing of the copied character length C l amplifies the influence of the abnormal character length on YcJ; if the copied content is too long, the possibility of abnormality is greater; α, β, and γ are all weight values;

[0051] a1, a2, a3, and a4 respectively represent the weight values of the network request frequency wlqP, network delay response value Wlycz, download traffic peak value Lfz, and USB device connection frequency USBpl, and 0 < a1 < 1, 0 < a2 < 1, 0 < a3 < 1, 0 < a4 < 1. Their specific values are adjusted and set by the user, and a1 + a2 + a3 + a4 = 1;

[0052] The anomaly evaluation unit is used to preset the first anomaly threshold X1 and the second anomaly threshold X2, and compare and evaluate the clipboard behavior index YcJ with the first anomaly threshold X1 to determine whether there is an anomaly risk in the user's clipboard and obtain the first evaluation result, including:

[0053] When the clipboard behavior index YcJ > the first anomaly threshold X1, it indicates that there is an anomaly risk in the user's current clipboard operation, and a first warning instruction is generated;

[0054] When the clipboard behavior index YcJ ≤ the first anomaly threshold X1, it indicates that there is no anomaly risk in the user's current clipboard operation, and continuous monitoring is carried out;

[0055] ​Comparing and evaluating the abnormal operation index Ycc with the second abnormal threshold value X2 to obtain a second evaluation result includes:

[0056] When the abnormal operation index Ycc> the second abnormal threshold X2, it indicates that the user's current operation has a risk of data leakage, and a second warning instruction is generated;

[0057] When the abnormal operation index Ycc ≤ the second abnormal threshold X2, it indicates that there is no risk of data leakage in the user's current operation, and monitoring is continued.

[0058] Preferably, the first multi-factor dynamic authentication module is used to trigger a first authentication process after receiving the first warning instruction, including:

[0059] S21. Lock the user's current operation and present a dynamically generated image or pattern, requiring the user to identify specific content in the image within a limited time. If the verification fails, the user is temporarily restricted from continuing the copy / paste operation of the clipboard, and two-factor authentication is forcibly enabled, requiring the user to pass biometric identification. If the biometric identification is successful, the user can be released to the user's current operation page; biometric identification uses a camera to capture the user's gestures or movements, and cooperates with image recognition technology for authentication;

[0060] After receiving the second warning instruction, the second authentication process is triggered, including:

[0061] S22. A pop-up window prompts the user that there is abnormal behavior in the current data leakage, locks the user's current operation, and triggers a time-limited task sequence operation authentication: complete the multi-step operation authentication within 30 seconds, open a folder, run an application or enter a setting menu. The task sequence is randomly generated and different each time. If the verification fails, the dynamic verification of the bound device is triggered, requiring the user to verify through another bound device, and sending a dynamic verification request code to the user's mobile phone, requiring the user to confirm the identity through the mobile phone within the specified time.

[0062] Preferably, the behavior feature analysis module further includes a behavior analysis subunit and an associated unit; the behavior analysis subunit is used to calculate and analyze the user behavior feature data set, and obtain the typing input behavior coefficient TIC, the mouse movement trajectory coefficient MTC and the screen use behavior coefficient SUC by the following formula;

[0063]

[0064] In the formula, a5, a6, a7, a8, a9, a 10 、a 11 、a 12 、a 13 and a 14 All are weight values;

[0065] The associated unit is used to process the typing input behavior coefficient TIC, the mouse movement trajectory coefficient MTC and the screen usage behavior coefficient SUC dimensionlessly, and then generate the behavior characteristic index Btxs through the following associated formula:

[0066] Btxs=δ1×TIC+δ2×MTC+δ3×SUC;

[0067] In the formula, δ1, δ2 and δ3 are weight values.

[0068] Preferably, the second multi-factor dynamic authentication module is used to set a standard behavior threshold M, and compare the user's behavior characteristic index Btxs with the standard behavior threshold M to determine whether the user's typing input behavior, mouse movement behavior, and screen use behavior are abnormal, and obtain a third evaluation result, including:

[0069] When the behavior characteristic index Btxs> the standard behavior threshold M, it means that the user's typing input behavior, mouse movement behavior, and screen use behavior are abnormal; triggering the third authentication process, including:

[0070] Using the vibration function of the device, a specific vibration pattern is sent to the user, requiring the user to feedback the vibration rhythm through gestures or other means; since the vibration pattern is generated differently each time, it is difficult to replicate through conventional methods;

[0071] When the standard behavior threshold M×50% ≤ behavior characteristic index Btxs ≤ standard behavior threshold M, it means that the user's typing input behavior, mouse movement behavior, and screen use behavior are judged to be normal, and continuous monitoring is performed:

[0072] When the behavior characteristic index Btxs is less than the standard behavior threshold M×50%, it indicates that the user's typing input behavior, mouse movement behavior, and screen use behavior are judged to have timeout anomalies; the fourth authentication process is triggered, including:

[0073] A pop-up window prompts the user that the operation has timed out and requires the user to enter a one-time dynamic password (OTP), which is sent via SMS, email, or an identity verification application on a mobile device and must be verified within 30 seconds. If the verification fails, the current user operation interface is locked.

[0074] The present invention provides a SDN-based network security dynamic protection and multi-factor authentication management and control platform. It has the following beneficial effects:

[0075] (1) The SDN-based network security dynamic protection and multi-factor authentication management and control platform, the present invention realizes real-time monitoring and dynamic analysis of user operation behavior through user behavior data collection module and behavior feature analysis module. The system can not only capture routine operation data (such as clipboard operation, network request, download traffic, etc.), but also extract the characteristic coefficients of typing input, mouse movement trajectory and screen usage behavior to generate a behavior feature index Btxs. This comprehensive multi-dimensional behavior analysis mechanism effectively improves the ability to identify potential risks. Through the preset abnormal threshold, the system can accurately determine whether the user has abnormal behavior or data leakage risk. This is more accurate than the traditional static rule security detection method, avoids false positives or false negatives, and enhances the security of the system.

[0076] (2) The SDN-based network security dynamic protection and multi-factor authentication management and control platform has designed the first and second multi-factor dynamic authentication modules, which trigger the corresponding authentication process according to the early warning instructions. When the system detects abnormal operation of the user, it not only takes conventional protection measures such as locking operation, but also dynamically generates different authentication tasks, such as gesture recognition, vibration feedback, two-factor authentication and one-time dynamic password (OTP) authentication. The authentication tasks are highly flexible and random, and it is difficult for users to circumvent security checks through simple preset modes. This multi-factor authentication mechanism greatly enhances the protection against illegal operations through seamless integration with behavior monitoring, especially providing more efficient control means in the security management and leakage protection of key data.

[0077] (3) The SDN-based network security dynamic protection and multi-factor authentication management and control platform is based on the SDN (software defined network) architecture, so that network security protection is not limited to traditional static rule control, but through the dynamic control capability of SDN, flexible network protection strategy adjustment is achieved. The user behavior feature index Btxs is combined with network traffic, USB device connection and other features, and can dynamically adjust the network protection strategy according to the real-time monitored behavior data, so as to more effectively respond to potential network threats and security risks. The programmable characteristics of SDN enable the system to adapt to changing security needs, reduce human intervention, and improve the system's automated protection capabilities.

[0078] (4) The SDN-based network security dynamic protection and multi-factor authentication management and control platform uses dimensionless processing technology to standardize user behavior data. Behavioral feature data of different dimensions (such as clipboard operation characteristics, network request frequency, USB connection frequency, etc.) can be uniformly converted into standardized indexes (such as YcJ, Ycc, Btxs). This processing method not only makes data analysis more concise and rapid, but also facilitates the system to perform cross-module data comparison and comprehensive evaluation. Traditional network protection systems often have low processing efficiency due to the complexity of different data types. The present invention improves analysis efficiency through data standardization, enabling the system to more quickly and accurately evaluate user behavior and provide real-time security response. BRIEF DESCRIPTION OF THE DRAWINGS

[0079] Figure 1 This is a flowchart diagram of the network security dynamic protection and multi-factor authentication management and control platform based on SDN of the present invention. DETAILED DESCRIPTION

[0080] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0081] Example 1

[0082] See also Figure 1 , the present invention provides a network security dynamic protection and multi-factor authentication management and control platform based on SDN, the network security dynamic protection and multi-factor authentication management and control platform based on SDN includes a user behavior data collection module, a behavior feature analysis module, a first multi-factor dynamic authentication module and a second multi-factor dynamic authentication module;

[0083] The user behavior data collection module is used to monitor and record the user's operation behavior data during the user's daily operation, and establish a user behavior feature database;

[0084] The behavior feature analysis module is used to extract the clipboard operation features, network request features, download traffic features and USB device connection status features from the user behavior feature database collected in the user behavior data collection module, and to standardize the collected data according to the dimensionless processing technology to calculate and generate the clipping behavior index YcJ and the abnormal operation index Ycc; when the clipping behavior index YcJ exceeds the first abnormal threshold value X1, a first warning instruction is issued; when the abnormal operation index Ycc exceeds the second abnormal threshold value X2, a second warning instruction is issued;

[0085] The user operation behavior characteristics are extracted from the user behavior characteristic database and analyzed to obtain: typing input behavior coefficient TIC, mouse movement trajectory coefficient MTC and screen use behavior coefficient SUC, and the behavior characteristic index Btxs is obtained by correlation;

[0086] The first multi-factor dynamic authentication module is used to trigger the first authentication process after receiving the first warning instruction; and trigger the second authentication process after receiving the second warning instruction;

[0087] The second multi-factor dynamic authentication module is used to analyze and evaluate the behavior characteristic index Btxs calculated by the behavior characteristic analysis module and the standard behavior threshold M to determine whether the corresponding authentication process needs to be triggered.

[0088] In this embodiment, the present invention can monitor and record the user's operation behavior, such as clipboard operation, network request, download traffic, USB device connection, etc., in real time during the user's daily operation process through the user behavior data collection module. This monitoring method not only covers the user identity in the static authentication method, but also can discover potential abnormal operation behaviors through behavior analysis technology. The behavior feature analysis module extracts the clipboard operation features, network request features, download traffic features, etc. of the user operation data, and applies dimensionless processing technology to standardize the data to generate the clipping behavior index YcJ and the abnormal operation index Ycc. When the first abnormal threshold X1 or the second abnormal threshold X2 is exceeded, the system will immediately issue a warning instruction. This dynamic analysis capability makes up for the defect that the traditional static authentication method cannot capture the user's operation behavior, and effectively improves the detection accuracy of abnormal operations.

[0089] The first multi-factor dynamic authentication module and the second multi-factor dynamic authentication module of the present invention provide a flexible and dynamic authentication mechanism. According to the real-time changes of the user's behavior characteristic index Btxs, when the system receives the first early warning instruction or the second early warning instruction, different levels of authentication processes can be triggered immediately. By comparing the behavior characteristic index with the standard behavior threshold M, the present invention can dynamically evaluate whether the current user's operation conforms to the normal behavior pattern, and further determine whether a higher level of multi-factor authentication is required. This authentication mechanism not only enhances the security of the system, but also improves the system's response speed to potential threats.

[0090] By extracting the user's typing input behavior coefficient TIC, mouse movement trajectory coefficient MTC, screen use behavior coefficient SUC and other behavior characteristics, and calculating and generating a comprehensive behavior characteristic index Btxs, the present invention can comprehensively evaluate the user's overall operation behavior. Through the calculation and analysis of the behavior characteristic index Btxs, the present invention can not only effectively identify abnormal behavior, but also reduce the risk of false alarms. Traditional authentication systems often trigger redundant security processes due to a single abnormal operation, while the present invention can more accurately identify real threats through multi-factor authentication and behavior index evaluation, thereby reducing misoperation and unnecessary authentication processes for normal users. Compared with the traditional single authentication method, this multi-dimensional evaluation mechanism based on behavioral characteristics significantly improves the detection capability of malicious operations or abnormal behaviors, especially in the face of complex attacks such as advanced persistent threats APT, it can effectively respond. When abnormal behavior is detected, the SDN control layer can instantly adjust the network path, isolate suspicious users or prevent the spread of malicious traffic, thereby minimizing the impact of security incidents on normal business operations. This dynamic network protection mechanism based on SDN not only ensures the real-time and flexibility of the network, but also improves the security protection level of the entire network.

[0091] Example 2

[0092] This embodiment is explained in Example 1, please refer to Figure 1 ,Specifically, the user behavior data collection module includes a networking unit and an ,identification unit;

[0093] The networking unit is used to interconnect the generators, control systems, PLCs and DCS devices within the hydropower plant using the SDN software-defined network architecture. The network path is dynamically configured through the centrally controlled network manager to ensure that all user operation behavior data can be efficiently and real-time transmitted to the platform for processing and analysis within the power plant. SDN's centralized control and dynamic configuration of network paths make network data transmission more flexible and efficient, thereby improving the stability and security of the network, ensuring that behavior data is not lost, and improving the ability to respond quickly to potential threats.

[0094] The recognition unit is used to identify the start and end time of the user's operating system, record the user's login and logout operations, collect time stamps for all operation processes, and collect user operation behavior data in real time during the user's daily operations, including typing speed, typing rhythm and input data of different characters. At the same time, the user's mouse movement trajectory, click frequency and pause time are monitored in real time, and a user behavior feature database is established.

[0095] In this embodiment, the present invention can continuously update the user behavior feature database during the user's operation. By monitoring the user's typing speed, mouse click frequency and other behavioral features, the system can establish a dynamic user behavior model. Compared with the traditional static authentication method, this dynamic analysis based on the user's operation behavior features can more accurately identify the user's identity, effectively prevent the risk of forgery or abnormal operation, and further enhance the system's security protection capabilities.

[0096] Example 3

[0097] This embodiment is explained in Example 1, please refer to Figure 1 Specifically, the user behavior feature database includes typing input behavior data, mouse movement trajectory data, and screen usage behavior data:

[0098] The steps for collecting user operation behavior data include:

[0099] S11, identify the time when the user successfully logs into the operating system, and obtain the first time T1; identify the time when the user logs out of the operating system, and obtain the second time T2; if the first time T1 exceeds the preset operation time threshold TX, a dynamic personalized question is triggered to perform the first cognitive authentication; the system asks personalized questions based on the user's historical operation behavior, such as "What was the last file name you visited last time?" or "What are the three applications you visited recently?" These questions can only be answered through the user's actual operation habits and are not easy to guess; these questions can only be answered by the user, and it is difficult to guess by external attackers or malicious programs, thereby improving security. The system log automatically records the user's login and logout operations, and generates personalized questions based on the behavioral characteristics in the historical operation database.

[0100] S12, and collect and obtain the user's network request frequency wlqP, network delay response value Wlycz and download traffic peak Lfz in the operating system: the network monitoring software tracks the network requests, response time and data traffic changes between the operating system and external servers or resources in real time, and collects and records relevant data. It can effectively identify abnormal behaviors of user network operations. For example, frequent network requests, abnormal delays or sudden increases in traffic may indicate potential network attacks or malware activities, and the system can provide early warnings.

[0101] The network request frequency wlqP includes the frequency of accessing different servers or external resources;

[0102] The network delay response value Wlycz is used to record the response time after the user's network request;

[0103] Upload and download traffic peak value Lfz: monitors the changes in the user's upload and download traffic during the operation period;

[0104] Collect the user's clipboard operation mode, including the frequency of copying and pasting, and collect the clipboard content;

[0105] S13, identifying the connection frequency USBpl of USB devices after the user logs in: recording the frequency of the user connecting the USB device during the operation; the operating system and the hardware interaction interface monitor and record the time and frequency of the user inserting the USB device in real time. By recording the frequency USBpl of USB devices connected after the user logs in, the system can monitor and prevent abnormal device connection behaviors, such as the connection of unauthorized USB devices or abnormal operations of frequent connections, which can help detect potential security threats, such as data theft or malware transmission through USB.

[0106] S14. Collect and obtain the typing input behavior data after the user completes the login command. The typing input behavior data includes:

[0107] Average typing speed: the average number of typed characters per unit time Pjzf; the system can establish typing speed characteristics to help identify the user's typical operation mode and prevent machine simulation or abnormal user operation.

[0108] Typing rhythm: the time interval difference between different characters Jgcy; monitoring the time interval difference between different characters can further refine the user's operation characteristics and prevent abnormal typing behavior.

[0109] Alphabet character input frequency zmpl: frequency statistics of user inputted alphabetic characters, identifying the frequency distribution of commonly used alphabetic characters;

[0110] Symbol character input frequency Fhpl: frequency statistics of symbol characters input by users, identifying the frequency distribution of commonly used symbols;

[0111] Digital character input frequency Szpl: frequency statistics of digital characters input by users, identifying the frequency distribution of commonly used numbers;

[0112] By counting the frequency of user input of letters, symbols, and numbers, we can build a unique input habit profile of the user and identify abnormal input behavior.

[0113] Average pause time The average time that users pause during input operations; helps analyze users' thinking patterns or operation intervals during input and identify abnormalities in operation rhythm.

[0114] Maximum pause time Tdt max : The longest pause time during user input; the number of pauses per unit time can reflect the continuity and fluency of user operations, and help detect abnormal operations or robot simulation behaviors.

[0115] Pause frequency Tdpl: The number of pauses per unit time, which helps identify the user's thinking or operation interval pattern.

[0116] Capture the user's typing speed, character spacing, and input type in real time through keyboard logging, and obtain the input log analysis

[0117] S15. Collect and obtain the mouse movement trajectory data after the user completes the login command. The mouse movement trajectory data includes:

[0118] Number of straight line movement paths zxlj: records the number of straight line movement paths that the mouse moves on the screen;

[0119] Number of curved movement paths qxlj: Records the number of curved movement paths of the mouse on the screen; by recording the movement paths of the mouse on the screen, the user's operation habits can be distinguished. Abnormal mouse movement paths may indicate the operation of automated tools or malware.

[0120] Mouse left button click frequency sbzjP: the number of mouse left button clicks per unit time;

[0121] Mouse right-click frequency sbyjP: the number of right-clicks per unit time. By monitoring the click frequency, the system can identify the user's typical click behavior. Abnormally frequent or irregular clicks may indicate malicious operations.

[0122] Mouse pause time sbddt: The time the mouse pauses at a specific location on the operation interface. The pause time at a specific location can reflect the user's interaction depth with the application or operation interface. Abnormal pause time can indicate abnormal operation or attack. Mouse event monitoring captures the mouse's movement trajectory, click frequency, and pause time, combined with system log analysis.

[0123] S16. Collect and obtain screen usage behavior data after the user completes the login command. The screen usage behavior data includes:

[0124] Window switching frequency kcqh: The frequency with which users switch application windows during operation; frequent window switching may indicate that users have a multitasking habit, but unusually frequent switching may also be a manifestation of some kind of automated operation or abnormal behavior.

[0125] Screen focus switching timejdqh: the speed at which users switch application windows; the speed at which users switch between applications can reflect the smoothness of their operation. Too fast or too slow switching speed may mean abnormal operation.

[0126] Full screen and reduced operation frequency qspl: Monitors whether users frequently switch application windows to full screen or reduced. Monitoring whether users frequently switch application windows to full screen or reduced can identify potential manipulation behaviors, especially the characteristics of users operating multiple applications. The built-in window manager of the operating system captures user window switching, full screen reduction operations and other behavior data and stores them in the system log.

[0127] In this embodiment, each step can effectively establish a user behavior prediction model through accurate data collection, help identify abnormal operations, and thus improve the security and protection capabilities of the entire network environment. The data source relies on the built-in monitoring module of the operating system, network interaction logs, keyboard and mouse recording systems, etc., to ensure the real-time and accuracy of the data.

[0128] Example 4

[0129] This embodiment is explained in Example 1, please refer to Figure 1 ,Specifically, the behavior feature analysis module includes a model building unit, an omaly analysis unit and anomaly evaluation unit;

[0130] The model building unit is used to use the convolutional neural network to build an initial convolutional neural network model, and train and test the initial convolutional neural network model with the user behavior feature database, and use the trained initial convolutional neural network model as the user behavior prediction model, and use the intermediate layer output of the user behavior prediction model as a feature vector to identify feature information, and train, test and verify the user behavior prediction model through the acquired feature information;

[0131] The abnormal analysis unit is used to extract the clipboard operation features, network request features, download traffic features, and USB device connection characteristics of the user behavior feature database. After dimensionless processing, the clipping behavior index YcJ and abnormal operation index Ycc are calculated by the following formula:

[0132]

[0133] In the formula, C l Monitor the length of the copied characters, L max Indicates the maximum character length of the clipboard preset; P f Indicates the number of pastes per minute, P max Indicates the preset normal pasting frequency reference value; f(C t ) represents the characteristic function of the clipboard content, and different weights are set for different content types. The specific settings are:

[0134] Identify text content: f(C t )=1; Identify the URL type of the web page link address: f(Ct ) = 2; Identify the code snippet type: f(C t ) = 3; Identify the command type: f(C t ) = 4; Content type function f(C t ) provides additional recognition ability for the content. Higher-risk content types such as code snippets or commands will increase the sensitivity of anomaly detection; the meaning of the formula is: the length of the copied characters C l Square processing Amplifies the influence of the abnormal character length on YcJ; if the copied content is overly long, the possibility of anomaly is greater; α, β, and γ are all weight values; and 0 < α < 1, 0 < β < 1, 0 < γ < 1, and their specific values are adjusted by the user, α + β + γ = 1;

[0135] a1, a2, a3, and a4 respectively represent the weight values of the network request frequency wlqP, the network latency response value Wlycz, the download traffic peak Lfz, and the USB device connection frequency USBpl, and 0 < a1 < 1, 0 < a2 < 1, 0 < a3 < 1, 0 < a4 < 1, and their specific values are adjusted by the user, a1 + a2 + a3 + a4 = 1;

[0136] The anomaly evaluation unit is used to preset the first anomaly threshold X1 and the second anomaly threshold X2, compare and evaluate the clipboard behavior index YcJ with the first anomaly threshold X1 to determine whether there is an anomaly risk in the user's clipboard, and obtain the first evaluation result, including:

[0137] When the clipboard behavior index YcJ > the first anomaly threshold X1, it indicates that there is an anomaly risk in the user's current clipboard operation, and a first warning instruction is generated;

[0138] When the clipboard behavior index YcJ ≤ the first anomaly threshold X1, it indicates that there is no anomaly risk in the user's current clipboard operation, and continuous monitoring is carried out;

[0139] Compare and evaluate the abnormal operation index Ycc with the second anomaly threshold X2 to obtain the second evaluation result, including:

[0140] When the abnormal operation index Ycc > the second anomaly threshold X2, it indicates that there is a data leakage risk in the user's current operation, and a second warning instruction is generated;

[0141] When the abnormal operation index Ycc ≤ the second anomaly threshold X2, it indicates that there is no data leakage risk in the user's current operation, and continuous monitoring is carried out.

[0142] In this embodiment, by using the convolutional neural network CNN to build the initial model, and using the user behavior feature database to train and test it, the system can effectively identify the user's operation behavior pattern. The feature vector output by the intermediate layer further optimizes the prediction model, so that the model can predict the user's operation habits based on the real-time behavior characteristics, and achieve accurate behavior feature prediction. This provides an efficient basis for subsequent abnormal analysis and improves the understanding and response capabilities of user behavior.

[0143] The system uses an abnormal analysis unit to perform multi-dimensional dimensionless processing on features such as the clipboard, network requests, download traffic, and USB connections, and calculates the clipping behavior index YcJ and the abnormal operation index Ycc. These two indices quickly identify potential abnormal behaviors or security threats by monitoring abnormal behaviors in user operations, such as copying a large number of characters, abnormally frequent paste operations, abnormal download traffic, or high-frequency USB device connections. This analysis mechanism effectively improves the system's sensitivity to abnormal behaviors.

[0144] The clipboard operation feature monitors the length of copied characters, the frequency of pasting, the type of clipboard content, and other information, and performs comprehensive calculations based on the set weight values ​​to amplify the impact of abnormal operations. For example, the copy operation of very long text will be weighted and amplified, and different weights will be set for text, URLs, code snippets, commands, and other types through the content type recognition function. When there is high-risk content such as code snippets or commands, the sensitivity of abnormal detection is improved. This function ensures the timely detection of potential malicious data copying or data leakage.

[0145] The system allows users to adjust the weight values ​​of different operation behavior characteristics according to actual needs, including the weights of network request frequency, network latency, download traffic peak and USB connection frequency. Users can set appropriate weight values ​​according to different security requirements, so that the system can flexibly adapt to the security requirements in different environments, thereby performing more personalized anomaly detection and ensuring the security and adaptability of the system.

[0146] The abnormal assessment unit performs a dual risk assessment by setting two abnormal thresholds X1 and X2. When the cutting behavior index YcJ exceeds the first abnormal threshold X1, the system will generate a first warning instruction, prompting that there is an abnormal risk in the cutting board operation and reminding the user to pay attention. If the abnormal operation index Ycc exceeds the second abnormal threshold X2, it will prompt a higher level of risk, such as data leakage risk, and the system will generate a second warning instruction. This multi-level warning mechanism provides timely and targeted responses to risks at different levels. Even if the abnormal operation index Ycc or the cutting behavior index YcJ is lower than the set threshold, the system will not stop monitoring, but will continue to analyze the user's operation behavior. This continuous monitoring can ensure that the potential and gradually accumulated risks in user operations are captured in a timely manner, and by automatically generating warning instructions, remind users or administrators to intervene or take measures on abnormal operations.

[0147] Example 5

[0148] This embodiment is explained in Example 1, please refer to Figure 1 Specifically, the first multi-factor dynamic authentication module is used to trigger a first authentication process after receiving the first warning instruction, including:

[0149] S21. Lock the user's current operation and present a dynamically generated image or pattern, requiring the user to identify specific content in the image within a limited time. If the verification fails, the user is temporarily restricted from continuing the copy / paste operation of the clipboard, and two-factor authentication is forcibly enabled, requiring the user to pass biometric identification. If the biometric identification is successful, the user can be released to the user's current operation page; biometric identification uses a camera to capture the user's gestures or movements, and cooperates with image recognition technology for authentication;

[0150] After receiving the second warning instruction, the second authentication process is triggered, including:

[0151] S22. A pop-up window prompts the user that there is abnormal behavior in the current data leakage, locks the user's current operation, and triggers a time-limited task sequence operation authentication: complete the multi-step operation authentication within 30 seconds, open a folder, run an application or enter a setting menu. The task sequence is randomly generated and different each time. If the verification fails, the dynamic verification of the bound device is triggered, requiring the user to verify through another bound device, and sending a dynamic verification request code to the user's mobile phone, requiring the user to confirm the identity through the mobile phone within the specified time.

[0152] In this embodiment, the multi-factor dynamic authentication module can quickly trigger the authentication process when receiving an abnormal warning. Through the first authentication process, when the user performs sensitive operations such as copy / paste on the clipboard, the system will dynamically generate an image or pattern and require the user to identify it, which increases the difficulty of the operation, thereby reducing the possibility of malicious users obtaining sensitive data through simple operations. This dynamic authentication mechanism improves the system's ability to respond immediately to potential data leaks or abnormal behaviors. When the user cannot pass the image or pattern verification, the system will force the use of two-factor authentication and combine biometrics such as gestures or movements for identity authentication. By capturing the user's real-time gestures through the camera and combining it with image recognition technology, the system can ensure the security and reliability of the verification process. This biometric-based verification method is more difficult to forge, greatly increasing the system's security protection layer.

[0153] When the system receives the second warning instruction, it triggers the second authentication process, requiring the user to complete a randomly generated multi-step operation within 30 seconds. Each time the operation steps are randomly generated, the user needs to complete a series of tasks, such as opening a specific folder, running an application, or entering the settings menu. The randomness of the time limit and the task increases the complexity of authentication, ensuring that only legitimate users who are familiar with system operations can pass the verification, further reducing the risk of data leakage. When the user fails to pass the multi-step operation authentication, the system will trigger the dynamic verification of the bound device and confirm the identity through another bound device. This dynamic verification mechanism of the bound device ensures that even if the device is stolen or the account is attacked, the user still needs to confirm it again through his or her mobile device. Sending a dynamic verification request code to the user's mobile phone and requiring identity confirmation within the specified time, this double verification greatly improves the security and protection of the system. Although the system adopts a strict authentication process, it ensures that legitimate users can quickly resume normal operations after passing the verification through biometrics and bound device verification. Multi-factor verification, time-limited task operation, and two-factor identity authentication in the authentication process minimize the impact on user experience while ensuring security, and achieve a balance between security and operational convenience.

[0154] Example 6

[0155] This embodiment is explained in Example 1, please refer to Figure 1 Specifically, the behavior feature analysis module also includes a behavior analysis subunit and associated units; the behavior analysis subunit is used to calculate and analyze the user behavior feature data set, and obtain the typing input behavior coefficient TIC, the mouse movement trajectory coefficient MTC and the screen use behavior coefficient SUC through the following formula;

[0156]

[0157] In the formula, a5, a6, a7, a8, a9, a 10 、a 11 、a 12 、a 13 and a 14 are all weight values; and 0 <a5<1,0<a6<1,0<a7<1,0<a8<1,0<a9<1,0<a 10 <1,0 11 <1,0 12 <1,0 13 <1,0 14 <1, the specific value is adjusted by the user, a5+a6+a7+a8=1; a9+a 10 +a 11 =1; a 12 +a 13 +a 14 =1;

[0158] The correlation unit is used to process the typing input behavior coefficient TIC, the mouse movement trajectory coefficient MTC and the screen usage behavior coefficient SUC dimensionlessly, and generate the behavior characteristic index Btxs through the following correlation formula:

[0159] Btxs=δ1×TIC+δ2×MTC+δ3×SUC;

[0160] Wherein, δ1, δ2 and δ3 are all weight values; and 0<δ1<1, 0<δ2<1, 0<δ3<1, and their specific values ​​are adjusted and set by the user, δ1+δ2+δ3=1;

[0161] In this embodiment, the behavior feature analysis module analyzes the behavior data of multiple dimensions such as the typing input behavior coefficient TIC, the mouse movement trajectory coefficient MTC, and the screen use behavior coefficient SUC, and generates a comprehensive behavior feature index Btxs through a related formula. This multi-dimensional data comprehensive analysis can more accurately describe the user's operating habits, thereby improving the ability to detect abnormal behaviors. Through dimensionless processing, the unit differences between different behavior features are eliminated, so that various types of data can be directly compared and analyzed, and the effectiveness of the abnormal detection model is improved. Through the multi-dimensional data analysis of the typing input behavior coefficient TIC, the mouse movement trajectory coefficient MTC, and the screen use behavior coefficient SUC, the system can comprehensively analyze the user's operating habits and avoid false alarms caused by single behavior anomalies. The calculation of the behavior feature index Btxs reduces the impact of the fluctuation of a single behavior on the overall security judgment while allocating weights to multiple behavior dimensions, and improves the accuracy of the system judgment. At the same time, the system can capture the intersection of abnormal behaviors in multiple dimensions in a timely manner, reducing the risk of missed reports.

[0162] Example 7​​​​

[0163] This embodiment is explained in Example 1, please refer to Figure 1 Specifically, the second multi-factor dynamic authentication module is used to set a standard behavior threshold M, and compare the user's behavior characteristic index Btxs with the standard behavior threshold M to determine whether the user's typing input behavior, mouse movement behavior, and screen use behavior are abnormal, and obtain a third evaluation result, including:

[0164] When the behavior characteristic index Btxs> the standard behavior threshold M, it means that the user's typing input behavior, mouse movement behavior, and screen use behavior are abnormal; triggering the third authentication process, including:

[0165] Using the vibration function of the device, a specific vibration pattern is sent to the user, requiring the user to feedback the vibration rhythm through gestures or other means; since the vibration pattern is generated differently each time, it is difficult to replicate through conventional methods;

[0166] When the standard behavior threshold M×50% ≤ behavior characteristic index Btxs ≤ standard behavior threshold M, it means that the user's typing input behavior, mouse movement behavior, and screen use behavior are judged to be normal, and continuous monitoring is performed:

[0167] When the behavior characteristic index Btxs is less than the standard behavior threshold M×50%, it indicates that the user's typing input behavior, mouse movement behavior, and screen use behavior are judged to have timeout anomalies; the fourth authentication process is triggered, including:

[0168] A pop-up window prompts the user that the operation has timed out, requiring the user to enter a one-time dynamic password (OTP), which is sent via SMS, email, or an identity verification application on a mobile device and must be verified within 30 seconds. If the verification fails, the current user operation interface is locked.

[0169] In this embodiment, the second multi-factor dynamic authentication module introduces a comparative analysis based on the behavior feature index Btxs and the standard behavior threshold M, which can accurately determine whether the user's operation behavior is normal or not. When the behavior is abnormal, the third and fourth authentication processes of the specific multi-factor authentication process are triggered to ensure the authenticity of the user's identity. Through verification by means of vibration feedback and dynamic passwords, the authentication process is difficult to be copied or counterfeited by malicious attackers, which greatly improves the security protection capability of the system. The system automatically adjusts the strength of the authentication according to the fluctuation of the user's behavior feature index Btxs. When Btxs is close to the standard behavior threshold M, the system considers that the operation behavior is normal and no additional authentication is required; and when the index is significantly above or below the threshold, the system will trigger a more stringent authentication process. This dynamic adjustment can not only reduce the false alarm rate, but also reduce interference with the user's normal operation, improve user experience and ensure security. The system sends a randomly generated vibration pattern to the user through the vibration function of the device, requiring the user to feedback the vibration rhythm through gestures. Since the vibration pattern generated each time is different and difficult to copy by conventional means, the security of the authentication process is significantly improved. Compared with traditional static password or graphic verification, vibration pattern verification not only increases the dynamic nature of authentication, but also further reduces the risk of being simulated or cracked by attackers.

[0170] Through the design of the multi-factor dynamic authentication module, the system can respond promptly to abnormal user operation behaviors, not only preventing malicious operations by illegal users, but also effectively avoiding the risk of data leakage caused by internal user operation errors or accidents. In particular, through the detailed comparative analysis of the standard behavior threshold M and the behavior characteristic index Btxs, the system can more comprehensively grasp the characteristics of user operation behaviors and strengthen real-time monitoring of data security.

[0171] The threshold is set to facilitate comparison. The size of the threshold depends on the amount of sample data and the number of bases set by technicians in this field for each group of sample data; as long as it does not affect the proportional relationship between the parameter and the quantized value.

[0172] The above formulas are obtained by collecting a large amount of data for software simulation and selecting a formula that is close to the actual value. The coefficients in the formula are set by technical personnel in this field according to actual conditions. The above is only a preferred specific implementation manner of the present invention, but the protection scope of the present invention is not limited to this. Any technical personnel familiar with the technical field within the technical scope disclosed by the present invention, according to the technical solution and the inventive concept of the present invention, make equivalent replacement or change, which should be covered within the protection scope of the present invention.

Claims

1. SDN-based network security dynamic protection and multi-factor authentication management and control platform, characterized by: It includes a user behavior data collection module, a behavior feature analysis module, a first multi-factor dynamic authentication module and a second multi-factor dynamic authentication module; The user behavior data collection module is used to monitor and record the user's operation behavior data during the user's daily operation, and establish a user behavior feature database; The behavior feature analysis module is used to extract the clipboard operation features, network request features, download traffic features and USB device connection status features from the user behavior feature database collected in the user behavior data collection module, and to perform standardization processing on the collected data according to the dimensionless processing technology to calculate and generate the clipping behavior index YcJ and the abnormal operation index Ycc; when the clipping behavior index YcJ exceeds the first abnormal threshold value X1, a first warning instruction is issued; when the abnormal operation index Ycc exceeds the second abnormal threshold value X2, a second warning instruction is issued; The user operation behavior characteristics are extracted from the user behavior characteristic database and analyzed to obtain: typing input behavior coefficient TIC, mouse movement trajectory coefficient MTC and screen use behavior coefficient SUC, and the behavior characteristic index Btxs is obtained by correlation; The first multi-factor dynamic authentication module is used to trigger a first authentication process after receiving a first warning instruction; After receiving the second warning instruction, triggering the second authentication process; The second multi-factor dynamic authentication module is used to analyze and evaluate the behavior characteristic index Btxs calculated by the behavior characteristic analysis module and the standard behavior threshold M to determine whether the corresponding authentication process needs to be triggered.

2. The SDN-based network security dynamic protection and multi-factor authentication management and control platform according to claim 1 is characterized in that: The user behavior data collection module includes a networking unit and an identification unit; The networking unit is used to interconnect the generators, control systems, PLCs and DCS devices inside the hydropower plant using the SDN software-defined network architecture, dynamically configure the network path through a centrally controlled network manager, and ensure that the behavior data of user operations can be transmitted to the platform in real time for processing and analysis; The identification unit is used to identify the start and end time of the user's operating system, record the user's login and logout operations, collect time stamps of all operation processes, and collect user operation behavior data in real time during the user's daily operations, including typing speed, typing rhythm and input data of different characters. At the same time, the user's mouse movement trajectory, click frequency and pause time are monitored in real time, and a user behavior feature database is established.

3. The SDN-based network security dynamic protection and multi-factor authentication management and control platform according to claim 1 is characterized in that: The user behavior feature database includes typing input behavior data, mouse movement trajectory data and screen usage behavior data: The steps for collecting user operation behavior data include: S11, identifying the time when the user successfully logs into the operating system, and obtaining a first time T1; identifying the time when the user logs out of the operating system, and obtaining a second time T2; if the first time T1 exceeds a preset operation time threshold TX, a dynamic personalized question is triggered, and a first cognitive authentication is performed; S12, and collect and obtain the user's network request frequency wlqP, network delay response value Wlycz and download traffic peak value Lfz in the operating system: The network request frequency wlqP includes the frequency of accessing different servers or external resources; The network delay response value Wlycz is used to record the response time after the user's network request; Upload and download traffic peak value Lfz: monitors the changes in the user's upload and download traffic during the operation period; Collect the user's clipboard operation mode, including the frequency of copying and pasting, and collect the clipboard content; S13, identifying the connection frequency of USB devices after the user logs in USBpl: recording the frequency of the user connecting the USB device during the operation; S14, collecting and obtaining the typing input behavior data after the user completes the login command, the typing input behavior data includes: Average typing speed: the average number of characters typed per unit time Pjzf; Typing rhythm: the time interval difference between different characters Jgcy; Alphabet character input frequency zmpl: frequency statistics of user inputted alphabetic characters, identifying the frequency distribution of commonly used alphabetic characters; Symbol character input frequency Fhpl: frequency statistics of symbol characters input by users, identifying the frequency distribution of commonly used symbols; Digital character input frequency Szpl: frequency statistics of digital characters input by users, identifying the frequency distribution of commonly used numbers; Average pause time The average time users pause during input operations; Maximum pause time Tdt max : The longest pause time during user input; Pause frequency Tdpl: The number of pauses per unit time, which helps identify the user's thinking or operation interval pattern.

4. The SDN-based network security dynamic protection and multi-factor authentication management and control platform according to claim 1 is characterized in that: The steps of collecting user operation behavior data also include: S15. Collect and obtain the mouse movement trajectory data after the user completes the login command. The mouse movement trajectory data includes: Number of straight line movement paths zxlj: records the number of straight line movement paths that the mouse moves on the screen; Number of curve movement paths qxlj: records the number of curve movement paths that the mouse moves on the screen; Mouse left button click frequency sbzjP: the number of mouse left button clicks per unit time; Mouse right button click frequency sbyjP: the number of mouse right button clicks per unit time; Mouse pause time sbddt: the time the mouse pauses at a specific position on the operation interface.

5. The SDN-based network security dynamic protection and multi-factor authentication management and control platform according to claim 1 is characterized in that: The steps of collecting user operation behavior data also include: S16. Collect and obtain screen usage behavior data after the user completes the login command. The screen usage behavior data includes: Window switching frequency kcqh: the frequency at which the user switches application windows during operation; Screen focus switching time jdqh: the speed at which users switch application windows; Full screen and reduced operation frequency qspl: monitors whether the user frequently switches the application window to full screen or reduced.

6. The SDN-based network security dynamic protection and multi-factor authentication management and control platform according to claim 1 is characterized in that: The behavior feature analysis module includes a model building unit, an abnormality analysis unit and an abnormality assessment unit; The model building unit is used to use a convolutional neural network to construct an initial convolutional neural network model, and train and test the initial convolutional neural network model with a user behavior feature database, and use the trained initial convolutional neural network model as a user behavior prediction model, and use the intermediate layer output of the user behavior prediction model as a feature vector to identify feature information, and train, test and verify the user behavior prediction model through the acquired feature information; The abnormal analysis unit is used to extract the clipboard operation features, network request features, download traffic features and USB device connection status features of the user behavior feature database, and after dimensionless processing, the clipping behavior index YcJ and the abnormal operation index Ycc are calculated by the following formula: In the formula, C l Monitor the length of the copied characters, L max Indicates the maximum character length of the clipboard preset; P f Indicates the number of pastes per minute, P max Indicates the preset normal pasting frequency reference value; f(C t ) represents the characteristic function of the clipboard content, and different weights are set for different content types. The specific settings are: Identify text content: f(C t )=1; Identify the URL type of the web link address: f(C t )=2; Identify the code snippet type: f(C t )=3; Identify command type: f(C t )=4; α, β and γ are all weight values; a1, a2, a3 and a4 represent the weight values ​​of network request frequency wlqP, network delay response value Wlycz, download traffic peak value Lfz and USB device connection frequency USBpl respectively; The abnormality assessment unit is used to preset a first abnormality threshold value X1 and a second abnormality threshold value X2, compare and evaluate the cutting behavior index YcJ with the first abnormality threshold value X1 to determine whether there is an abnormal risk in the user's cutting board, and obtain a first assessment result, including: When the cutting behavior index YcJ> the first abnormal threshold value X1, it indicates that the user's current cutting board operation has an abnormal risk, and a first warning instruction is generated; When the shearing behavior index YcJ ≤ the first abnormal threshold X1, it means that the user's current shear board operation does not have abnormal risks and continues to monitor; Comparing and evaluating the abnormal operation index Ycc with the second abnormal threshold value X2 to obtain a second evaluation result includes: When the abnormal operation index Ycc> the second abnormal threshold X2, it indicates that the user's current operation has a risk of data leakage, and a second warning instruction is generated; When the abnormal operation index Ycc ≤ the second abnormal threshold X2, it indicates that there is no risk of data leakage in the user's current operation, and monitoring is continued.

7. The SDN-based network security dynamic protection and multi-factor authentication management and control platform according to claim 6 is characterized in that: The first multi-factor dynamic authentication module is used to trigger a first authentication process after receiving a first warning instruction, including: S21. Lock the user's current operation and present a dynamically generated image or pattern, requiring the user to identify specific content in the image within a limited time. If the verification fails, the user is temporarily restricted from continuing the copy / paste operation of the clipboard, and two-factor authentication is forcibly enabled, requiring the user to pass biometric identification. If the biometric identification is successful, the user can be released to the user's current operation page; biometric identification uses a camera to capture the user's gestures or movements, and cooperates with image recognition technology for authentication; After receiving the second warning instruction, the second authentication process is triggered, including: S22. A pop-up window prompts the user that there is abnormal behavior in the current data leakage, locks the user's current operation, and triggers a time-limited task sequence operation authentication: complete the multi-step operation authentication within 30 seconds, open a folder, run an application or enter a setting menu. The task sequence is randomly generated and different each time. If the verification fails, the dynamic verification of the bound device is triggered, requiring the user to verify through another bound device, and sending a dynamic verification request code to the user's mobile phone, requiring the user to confirm the identity through the mobile phone within the specified time.

8. The SDN-based network security dynamic protection and multi-factor authentication management and control platform according to claim 7 is characterized in that: The behavior feature analysis module also includes a behavior analysis subunit and an associated unit; the behavior analysis subunit is used to calculate and analyze the user behavior feature data set, and obtain the typing input behavior coefficient TIC, the mouse movement trajectory coefficient MTC and the screen use behavior coefficient SUC through the following formula; In the formula, a5, a6, a7, a8, a9, a 10 、a 11 、a 12 、a 13 and a 14 All are weight values; The correlation unit is used to generate a behavior characteristic index Btxs through the following correlation formula after dimensionless processing of the typing input behavior coefficient TIC, the mouse movement trajectory coefficient MTC and the screen usage behavior coefficient SUC: Btxs=δ1×TIC+δ2×MTC+δ3×SUC; In the formula, δ1, δ2 and δ3 are weight values.

9. The SDN-based network security dynamic protection and multi-factor authentication management and control platform according to claim 8 is characterized in that: The second multi-factor dynamic authentication module is used to set a standard behavior threshold M, and compare the user's behavior characteristic index Btxs with the standard behavior threshold M to determine whether the user's typing input behavior, mouse movement behavior, and screen use behavior are abnormal, and obtain a third evaluation result, including: When the behavior characteristic index Btxs> the standard behavior threshold M, it means that the user's typing input behavior, mouse movement behavior, and screen use behavior are abnormal; triggering the third authentication process, including: Using the vibration function of the device, a specific vibration pattern is sent to the user, requiring the user to feedback the vibration rhythm through gestures or other means; since the vibration pattern is generated differently each time, it is difficult to replicate through conventional methods; When the standard behavior threshold M×50% ≤ behavior characteristic index Btxs ≤ standard behavior threshold M, it means that the user's typing input behavior, mouse movement behavior, and screen use behavior are judged to be normal, and continuous monitoring is performed: When the behavior characteristic index Btxs is less than the standard behavior threshold M×50%, it indicates that the user's typing input behavior, mouse movement behavior, and screen use behavior are judged to have timeout anomalies; the fourth authentication process is triggered, including: A pop-up window prompts the user that the operation has timed out, requiring the user to enter a one-time dynamic password (OTP), which is sent via SMS, email, or an identity verification application on a mobile device and must be verified within 30 seconds. If the verification fails, the current user operation interface is locked.

Images