A data security analysis method and system for teaching platform based on cloud computing

Abstract

The present invention discloses a data security analysis method and system for a teaching platform based on cloud computing, and relates to the field of data processing technology. The method comprises: obtaining at least one operation behavior sequence of each target user respectively; determining the first behavior habit parameter of the target user by using each operation behavior sequence; determining the first abnormality by using the first behavior habit parameter, the historical behavior habit parameter of the target user, and the second behavior habit parameter of the same type of user; determining the second abnormality by using the operation duration of each functional unit in each functional module of the online teaching platform, the operation sequence between each functional unit in each functional module, and the first abnormality when the first abnormality is greater than or equal to the first preset abnormality; and transmitting the normal teaching platform data to the storage space of the online teaching platform according to each second abnormality. It is helpful to improve the security of data transmission and management in the field of big data resource services and Internet data services.

Description

Technical Field

[0001] The present invention relates to the technical field of data processing, and in particular to a data security analysis method and system for a teaching platform based on cloud computing. Background Art

[0002] With the rapid development of Internet technology, online teaching platforms have gradually emerged. In the process of transmitting the teaching platform data of the online teaching platform to the storage space, it may unfortunately be mixed with abnormal teaching data generated by unauthorized login operations due to illegal theft of user accounts. This type of abnormal teaching data not only interferes with the purity of normal teaching platform data, but also affects the security of data transmission. Therefore, it is very important to eliminate abnormal teaching data before data transmission.

[0003] In existing methods, abnormal login status of users is often identified through information such as login location and login device, and data generated in the abnormal login status is determined as abnormal teaching data, thereby eliminating the abnormal teaching data.

[0004] However, the existing methods have low accuracy in identifying users' abnormal login status, which makes it impossible to accurately identify truly abnormal teaching data, resulting in low security of data transmission. Summary of the invention

[0005] The embodiments of the present invention provide a teaching platform data security analysis method and system based on cloud computing, which can improve the security of data transmission.

[0006] A first aspect of an embodiment of the present invention provides a data security analysis method for a teaching platform based on cloud computing, comprising:

[0007] Acquire at least one operation behavior sequence of each target user in a target time period, wherein the operation behavior sequence includes a plurality of teaching platform data arranged in chronological order, and the teaching platform data is used to represent the operation behavior record of the target user in the online teaching platform;

[0008] Using each operation behavior sequence, determine the first behavior habit parameter of the target user in the target time period, where the first behavior habit parameter is used to characterize the preference characteristics of the target user's operation behavior in the online teaching platform in the target time period;

[0009] Determine the first abnormality of the target user in the target time period by using the first behavior habit parameter, the historical behavior habit parameter of the target user, and the second behavior habit parameter of the similar user in the target time period, where the similar user is other users of the same user type as the target user;

[0010] When the first abnormality is greater than or equal to the first preset abnormality value, the second abnormality of the target user in the target time period is determined by using the operation duration of each functional unit in each functional module of the online teaching platform by the target user in the target time period, the operation sequence between each functional unit in each functional module, and the first abnormality;

[0011] According to the second abnormality degree of each target user within the target time period, the normal teaching platform data in each operation behavior sequence is transmitted to the storage space of the online teaching platform.

[0012] A first aspect of an embodiment of the present invention provides a teaching platform data security analysis system based on cloud computing, including:

[0013] A sequence acquisition module, used to respectively acquire at least one operation behavior sequence of each target user within a target time period, wherein the operation behavior sequence includes a plurality of teaching platform data arranged in chronological order, and the teaching platform data is used to characterize the operation behavior record of the target user in the online teaching platform;

[0014] A parameter determination module, used to determine the first behavior habit parameter of the target user in the target time period by using each operation behavior sequence, wherein the first behavior habit parameter is used to characterize the preference characteristics of the operation behavior of the target user in the online teaching platform in the target time period;

[0015] An abnormality determination module, used to determine a first abnormality of the target user in the target time period by using the first behavior habit parameter, the historical behavior habit parameter of the target user, and the second behavior habit parameter of the same type of users in the target time period, where the same type of users are other users of the same user type as the target user;

[0016] The abnormality determination module is further used to determine the second abnormality degree of the target user within the target time period by using the operation duration of each functional unit in each functional module of the online teaching platform within the target time period, the operation sequence between each functional unit in each functional module, and the first abnormality degree when the first abnormality degree is greater than or equal to the first preset abnormality value;

[0017] The data transmission module is used to transmit the normal teaching platform data in each operation behavior sequence to the storage space of the online teaching platform according to the second abnormality degree of each target user in the target time period.

[0018] In the data security analysis method of the teaching platform based on cloud computing provided by the embodiment of the present invention, first, according to the operation behavior sequence of the target user in the target time period, a first behavior habit parameter characterizing the preference characteristics of the operation behavior of the target user in the online teaching platform in the target time period is obtained. Then, according to the first behavior habit parameter, the historical behavior habit parameter of the target user and the second behavior habit parameter of the same user, a first abnormality is obtained. In the case where the first abnormality is greater than or equal to the first preset abnormal value, the operation duration of each functional unit in each functional module of the online teaching platform and the operation sequence between the functional units in each functional module of the online teaching platform in the target time period are further analyzed to obtain a second abnormality. Finally, the normal teaching platform data transmitted to the storage space of the online teaching platform is determined according to the second abnormality. In this way, the embodiment of the present invention can obtain the changes in the user's behavior characteristics by performing a preliminary analysis on the operation behavior preference characteristics of the target user, and then further performing a microscopic analysis on the changes in the operation sequence and operation duration of each functional module of the online teaching platform on the basis of the preliminary analysis. Therefore, the abnormal login status of the user can be accurately identified, and then the real abnormal teaching data can be accurately identified, which is helpful to improve the security of data transmission in the field of big data resource services and Internet data services. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solutions and advantages in the embodiments of the present invention or the prior art, the drawings required for use in the embodiments or the prior art descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0020] Figure 1 A schematic diagram of a flow chart of a first data security analysis method for a teaching platform based on cloud computing provided by an embodiment of the present invention;

[0021] Figure 2 A schematic flow chart of a second method for analyzing data security of a teaching platform based on cloud computing provided by an embodiment of the present invention;

[0022] Figure 3 A schematic flow chart of a third method for data security analysis of a teaching platform based on cloud computing provided by an embodiment of the present invention;

[0023] Figure 4 A schematic diagram of the structure of a cloud computing-based teaching platform data security analysis system provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0024] In order to further explain the technical means and effects adopted by the present invention to achieve the predetermined invention purpose, the following is a detailed description of the specific implementation method, structure, features and effects of a data security analysis method and system for a teaching platform based on cloud computing proposed by the present invention in combination with the accompanying drawings and preferred embodiments. In the following description, different "one embodiment" or "another embodiment" does not necessarily refer to the same embodiment. In addition, specific features, structures or characteristics in one or more embodiments may be combined in any suitable form.

[0025] Unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs.

[0026] It should be noted that the acquisition, storage, use, and processing of data in the technical solution of the present invention are in compliance with the relevant provisions of laws and regulations.

[0027] It should be noted that in the embodiments of the present invention, certain software, components, models and other existing solutions in the industry may be mentioned, which should be regarded as exemplary. Their purpose is only to illustrate the feasibility of implementing the technical solution of the present invention, but it does not mean that the applicant has or will necessarily use the solution.

[0028] In existing methods, the abnormal login status of users is often identified through information such as the login location and login device, and the data generated in the abnormal login status is determined as abnormal teaching data, so that the abnormal teaching data is eliminated. However, the existing methods have low accuracy in identifying the abnormal login status of users, which makes it impossible to accurately identify the real abnormal teaching data, resulting in low security of data transmission.

[0029] The object of the present invention is to provide a data security analysis method and system for a teaching platform based on cloud computing. In the data security analysis method for a teaching platform based on cloud computing provided in an embodiment of the present invention, first, according to the operation behavior sequence of the target user in the target time period, a first behavior habit parameter characterizing the preference characteristics of the operation behavior of the target user in the online teaching platform in the target time period is obtained. Then, according to the first behavior habit parameter, the historical behavior habit parameter of the target user and the second behavior habit parameter of the same user, a first abnormality is obtained. In the case where the first abnormality is greater than or equal to the first preset abnormality value, the operation duration of each functional unit in each functional module of the online teaching platform by the target user in the target time period and the operation sequence between the functional units in each functional module are further analyzed to obtain a second abnormality. Finally, the normal teaching platform data transmitted to the storage space of the online teaching platform is determined according to the second abnormality. In this way, the embodiment of the present invention can obtain the change of the user behavior characteristics by performing a preliminary analysis on the operation behavior preference characteristics of the target user, and then further performing a microscopic analysis on the changes in the operation sequence and operation duration of each functional module of the online teaching platform on the basis of the preliminary analysis. This can accurately identify the user's abnormal login status and then accurately identify the real abnormal teaching data, which helps to improve the security of data transmission in the field of big data resource services and Internet data services.

[0030] The following describes a specific embodiment of a data security analysis method and system for a teaching platform based on cloud computing provided by an embodiment of the present invention.

[0031] Figure 1 A flow chart of a data security analysis method for a teaching platform based on cloud computing is provided. The data security analysis method for a teaching platform based on cloud computing can be applied to a server. The data security analysis method for a teaching platform based on cloud computing can include the following S101 to S105.

[0032] S101, respectively obtaining at least one operation behavior sequence of each target user within a target time period, wherein the operation behavior sequence includes a plurality of teaching platform data arranged in chronological order, and the teaching platform data is used to characterize the operation behavior record of the target user in the online teaching platform.

[0033] In this embodiment, the operation behavior sequence is used to characterize a series of operation behaviors performed by the target user after logging into the online teaching platform once. Among them, there is at least one operation behavior sequence in the target time period, and the number of operation behavior sequences corresponds to the number of online teaching platforms logged in by the user. Specifically, the target user has only one login behavior in the target time period, that is, there is only one operation behavior sequence in the target time period; the target user has multiple login behaviors in the target time period, that is, there are multiple corresponding operation behavior sequences in the target time period.

[0034] As an example, the server first sets a target time period, such as one day or one week. Then, for each target user (specifically, students, teachers, and parents), all teaching platform data for the online teaching platform within the time period is extracted from the database of the online teaching platform.

[0035] Then, the teaching platform data corresponding to each target user is sorted according to the order of login and timestamp, and one or more operation behavior sequences are generated for each target user. Each operation behavior sequence is a teaching platform data set arranged in chronological order.

[0036] S102, using each operation behavior sequence, determining a first behavior habit parameter of the target user within a target time period, where the first behavior habit parameter is used to characterize a preference feature of the target user's operation behavior in the online teaching platform within the target time period.

[0037] In this embodiment, the first behavior habit parameter is used to characterize the preference characteristics of the target user's operation behavior in the online teaching platform within the target time period. For example, the preference characteristics may include the most frequently visited function modules, the average learning time, and the active time period.

[0038] As an example, the server uses data analysis tools (such as Python's Pandas library) to calculate the statistics corresponding to the target user's operation behavior sequence, which may include frequency, average, and median, etc., so as to quantify the target user's behavioral preference characteristics and obtain the target user's first behavioral habit parameters in the target time period.

[0039] S103, determining a first abnormality degree of the target user within the target time period by using the first behavior habit parameter, the historical behavior habit parameter of the target user, and the second behavior habit parameter of similar users within the target time period, where the similar users are other users of the same user type as the target user.

[0040] In this embodiment, the historical behavior habit parameters are used to characterize the preference characteristics of the target user's operating behavior in the online teaching platform within a historical time period.

[0041] The same type of users are other users who belong to the same user type as the target user. For example, if the user type of the target user is a student in the first grade, class 1, then all users in the first grade, class 1 except the target user are determined as the same type of users.

[0042] The second behavior habit parameter is used to characterize the preference characteristics of the operating behaviors of similar users in the online teaching platform within the target time period.

[0043] The first abnormality degree is used to characterize the degree of deviation between the target user's operation behavior and the normal operation behavior.

[0044] As an example, the server uses a machine learning algorithm (such as cluster analysis or anomaly detection algorithm) to evaluate the abnormality of the target user's behavior based on the target user's first behavior habit parameters, the target user's historical behavior habit parameters, and the second behavior habit parameters of similar users, thereby obtaining the first abnormality degree of the target user within the target time period.

[0045] S104, when the first abnormality is greater than or equal to the first preset abnormality value, the second abnormality of the target user within the target time period is determined by using the operation time of each functional unit in each functional module of the online teaching platform by the target user within the target time period, the operation sequence between each functional unit in each functional module, and the first abnormality.

[0046] In this embodiment, when the first abnormality exceeds the set first preset abnormality value, it indicates that the target user's operation behavior in the target time period deviates greatly from the normal operation behavior, that is, the target user may have abnormal behavior at this time.

[0047] For example, the first preset abnormal value can be set to 0.6. When the first abnormality exceeds 0.6, the login is considered to be suspected of abnormal status, which may indicate that the logged-in user is not the user himself or there is a risk of illegal login; on the contrary, if the first abnormality does not exceed 0.6, the login is determined to be a normal login by the user himself, and the user status is considered normal.

[0048] When the first abnormality exceeds 0.6, the server further analyzes the target user's operation details in the specific functional modules, which may include operation duration, operation sequence, etc., to determine the second abnormality. The functional modules may include a video playback module, a homework submission module, and a forum interaction module.

[0049] Specifically, the server uses time series analysis and process mining technology to identify abnormal operation patterns, such as frequent interruptions to learning, abnormally long stays on non-learning pages, etc., and calculates the second abnormality degree based on this.

[0050] Among them, time series analysis is the theory and method of establishing mathematical models based on time series data through curve fitting and parameter estimation; process mining, also known as workflow mining, is a technology that mines knowledge from existing event logs to discover, monitor and improve actual processes.

[0051] The weights may be allocated according to the number of learning interruptions and the number of abnormally long stays on non-learning pages, so that the second abnormality degree is obtained by adding the two weights.

[0052] S105, according to the second abnormality degree of each target user in the target time period, the normal teaching platform data in each operation behavior sequence is transmitted to the storage space of the online teaching platform.

[0053] In this embodiment, a preset threshold is set, and for a target user whose second abnormality does not reach the preset threshold, it can be determined that the target user does not have abnormal behavior. For example, the preset threshold can be 0.3, and when the second abnormality is less than or equal to 0.3, it is determined that the target user does not have abnormal behavior.

[0054] At this time, the data of each teaching platform in its operation behavior sequence is transmitted to the storage space of the online teaching platform for subsequent analysis, evaluation or reporting.

[0055] Specifically, through data cleaning and filtering, the operation behavior sequences of target users with abnormal behaviors are removed, and only the operation behavior sequences of target users without abnormal behaviors are retained, and stored in a designated location through an application programming interface (API) or database operation.

[0056] In the data security analysis method of the teaching platform based on cloud computing provided in the present embodiment, first, according to the operation behavior sequence of the target user in the target time period, a first behavior habit parameter characterizing the preference characteristics of the operation behavior of the target user in the online teaching platform in the target time period is obtained. Then, according to the first behavior habit parameter, the historical behavior habit parameter of the target user and the second behavior habit parameter of the same type of user, a first abnormality is obtained. In the case where the first abnormality is greater than or equal to the first preset abnormal value, the operation duration of each functional unit in each functional module of the online teaching platform and the operation sequence between the functional units in each functional module of the target user in the target time period are further analyzed to obtain a second abnormality. Finally, the normal teaching platform data transmitted to the storage space of the online teaching platform is determined according to the second abnormality. In this way, the embodiment of the present invention can obtain the changes in the user's behavior characteristics by performing a preliminary analysis on the operation behavior preference characteristics of the target user, and then further performing a microscopic analysis on the changes in the operation sequence and operation duration of each functional module of the online teaching platform on the basis of the preliminary analysis. Thus, the abnormal login status of the user can be accurately identified, and then the real abnormal teaching data can be accurately identified, which is helpful to improve the security of data transmission in the field of big data resource services and Internet data services.

[0057] As an optional embodiment, Figure 2 As shown, S101 may specifically include the following S201 to S203:

[0058] S201, numbering each functional module in the online teaching platform and each functional unit in each functional module to obtain a corresponding functional number identification;

[0059] S202, in response to the target user's operation behavior in the online teaching platform, obtaining teaching platform data corresponding to the operation behavior, the teaching platform data including a function number identifier, an operation start time, and an operation end time corresponding to the operation behavior;

[0060] S203, generating an operation behavior sequence for each teaching platform data in chronological order according to the operation start time and operation end time corresponding to each teaching platform data.

[0061] In this embodiment, an online teaching platform may include multiple functional modules, and a functional module may include multiple functional units. As an example, the online teaching platform may include a video playback module, a homework submission module, and a forum interaction module, and the video playback module may include functional units such as "play", "pause", and "fast forward".

[0062] As an example, the server first numbers all the functional modules in the online teaching platform one by one, and each functional module gets a unique module number. Then, each functional unit in each functional module is also numbered, and each functional unit gets a unique unit number. These numbers together constitute the corresponding function number identification. At the same time, these function number identifications are stored in the form of a database or configuration file. In the database or configuration file, each functional module and functional unit has a corresponding unique function number identification, which is convenient for subsequent data processing and query.

[0063] Then, when the target user performs operations in the online teaching platform (such as clicking a function button, browsing a page, etc.), the system captures these operations in real time and obtains the teaching platform data corresponding to these operations. Specifically, JavaScript or other front-end technologies can be used to capture the user's operation behavior, and these data can be sent to the back-end server in real time through communication technologies such as AJAX or WebSocket. After receiving the data, the back-end server stores it in the database for subsequent analysis and processing.

[0064] Finally, after obtaining the data of each teaching platform, the system sorts them according to the operation start time and operation end time corresponding to these data. The sorted data generates an operation behavior sequence in chronological order, which reflects a series of operation behaviors of the target user in the online teaching platform.

[0065] Through this embodiment, the functional modules and functional units of the online teaching platform are numbered, and the user's operation behavior data is captured and recorded in real time, and finally an operation behavior sequence reflecting the time sequence of the user's operation behavior is generated. In this way, the obtained operation behavior sequence provides an important basis for the calculation of the first abnormality and the second abnormality of the subsequent target user, thereby helping to improve the security of data transmission.

[0066] As an optional embodiment, the teaching platform data also includes an Internet protocol address corresponding to the operation behavior;

[0067] Before S102, the cloud computing-based teaching platform data security analysis method may further include:

[0068] Compare each Internet Protocol address in the operation behavior sequence with a historical Internet Protocol address corresponding to the target user to obtain an address comparison result;

[0069] S102 may specifically include:

[0070] When the address comparison result indicates that there is an Internet Protocol address in the operation behavior sequence that is inconsistent with the historical Internet Protocol address, the first behavior habit parameter of the target user in the target time period is determined using each operation behavior sequence.

[0071] In this embodiment, the historical Internet protocol address is used to represent the Internet protocol address that the target user has used in the history.

[0072] Before S102, a pre-processing step of comparing the Internet Protocol address may be included. The purpose of this step is to verify whether the Internet Protocol address recorded in the operation behavior sequence is consistent with the historical Internet Protocol address of the target user, so as to determine whether to trigger the calculation step of the first behavior habit parameter.

[0073] For example, when the Internet Protocol address recorded in the operation behavior sequence does not exist in the historical Internet Protocol address corresponding to the target user, it is considered that an Internet Protocol address that has never been used before is used at this time, and the calculation step of the first behavior habit parameter is triggered at this time.

[0074] As an example, the server first extracts the historical Internet Protocol address records of the target user from the database of the online teaching platform. These records usually include all historical Internet Protocol addresses used by the user in the past period of time.

[0075] Then, each Internet Protocol address recorded in the operation behavior sequence is compared with the historical Internet Protocol address of the target user. Specifically, this comparison process can be implemented by writing a special comparison algorithm or using an existing address matching tool.

[0076] After the comparison is completed, the address comparison result is output. If there is an Internet Protocol address in the operation behavior sequence that is inconsistent with the historical Internet Protocol address, the calculation step of the first behavior habit parameter is triggered; if there is no Internet Protocol address in the operation behavior sequence that is inconsistent with the historical Internet Protocol address, the calculation step of the first behavior habit parameter is not triggered.

[0077] Through this embodiment, before calculating the first behavior habit parameter, it is also verified whether the Internet Protocol address recorded in the operation behavior sequence is consistent with the historical Internet Protocol address of the target user, so as to serve as a condition for determining whether to trigger the first behavior habit parameter. In this way, the first behavior habit parameter is calculated only when the trigger condition is met, which can improve the efficiency of data transmission.

[0078] As an optional embodiment, S102 may specifically include:

[0079] According to the user type of the target user, a target function module corresponding to the user type is obtained;

[0080] The teaching platform data in each operation behavior sequence is statistically analyzed to obtain the target user's first operation probability on the target function module and the corresponding unit operation probability of each target function unit in the target function module in each operation sequence. The first operation probability is used to characterize the probability that the target user will execute the target function module in the first operation. The unit operation probability is used to characterize the probability that the target function unit is executed in the corresponding operation sequence;

[0081] The first behavior habit parameters of the target user in the target time period are determined by using the first operation probability and the operation probability of each unit.

[0082] In this embodiment, the target function module is the key module that the target user focuses on, and the target function module is associated with the user type of the target user. For example, if the user type of the target user is a student in the first grade of class one, then the corresponding target function module is the test module.

[0083] As an example, the first behavior habit parameter may be specifically determined by the following formula 1:

[0084]

[0085] In the formula, P is used to characterize the first behavior habit parameter of the target user in the target time period, P a It is used to characterize the first operation probability of the target user executing module a in the first operation behavior, and a is used to characterize the target function module corresponding to the target user. Used to indicate that the user has completed the execution of target functional unit a in module a. t-1After the operation, the target functional unit a is executed t The probability of the operation. t is used to represent the sequence number of the target functional unit executed in the target functional module, and T is used to represent the maximum number of operations on the target functional module in each operation behavior sequence.

[0086] in, It is used to represent the product of the cumulative value of the probability of the user operating the target functional unit in each operation sequence. That is, the cumulative value of the corresponding probability of each target functional unit in the second operation sequence is multiplied by the cumulative value of the corresponding probability of each target functional unit in the third operation sequence, until it is multiplied by the cumulative value of the corresponding probability of each target functional unit in the last operation sequence. Since each user has certain behavioral habits in their operations, the corresponding first behavioral habit parameter can be obtained by statistically analyzing the teaching platform data in each operation behavior sequence.

[0087] Among them, the first operation probability and the unit operation probability can be determined by statistically analyzing the teaching platform data in each operation behavior sequence. For example, the operation behavior sequences include {A, B, D, F, E, C}, {A, F, B, D, E, C}, and {B, D, E, C, A, F}. It can be seen from statistics that the unit operation probability corresponding to A in the first operation sequence is two-thirds.

[0088] Through this embodiment, by statistically analyzing the target user's operation behavior sequences, the first behavior habit parameters of the target user in the target time period can be accurately determined, thereby facilitating the subsequent accurate identification of abnormal teaching data based on the first behavior habit parameters, and helping to improve the security of data transmission.

[0089] As an optional embodiment, before S103, the cloud computing-based teaching platform data security analysis method may further include:

[0090] Compare the first behavior habit parameter with each historical behavior habit parameter to obtain a first parameter comparison result;

[0091] When the first parameter comparison result indicates that there is a first parameter difference greater than or equal to a first preset difference, the first behavior habit parameter is compared with each second behavior habit parameter to obtain a second parameter comparison result, and the first parameter difference is used to characterize the difference between the first behavior habit parameter and the historical behavior habit parameter;

[0092] When the second parameter comparison result indicates that the second parameter difference is greater than or equal to the second preset difference, it is determined that the target user is a suspected abnormal user, and the second parameter difference is used to characterize the difference between the first behavior habit parameter and the second behavior habit parameter;

[0093] S103 may specifically include:

[0094] When it is determined that the target user is a suspected abnormal user, the first abnormality degree of the target user in the target time period is determined by using the first behavior habit parameter, the historical behavior habit parameter of the target user, and the second behavior habit parameter of similar users in the target time period.

[0095] In this embodiment, the server first compares the first behavior habit parameter of the target user (i.e., the behavior habit parameter in the current time period) with each historical behavior habit parameter (i.e., the behavior habit parameter of the target user in the past time period) to obtain multiple first parameter difference values. Among them, the first parameter difference value is used to represent the difference between the first behavior habit parameter and the historical behavior habit parameter. The larger the difference value, the more significant the behavior change.

[0096] In the case where the first parameter difference is greater than or equal to the first preset difference, it is considered that the behavior of the target user has changed significantly and needs further analysis. For example, the first preset difference can be 0.1. At this time, the first behavior habit parameter is compared with each second behavior habit parameter to obtain multiple second parameter differences. Among them, the second parameter difference is used to characterize the difference between the first behavior habit parameter and the second behavior habit parameter. The larger the difference, the greater the behavioral difference between the target user and similar users.

[0097] If the second parameter difference is greater than or equal to the second preset difference, the target user is determined to be a suspected abnormal user. The second preset difference may be the same as the first preset difference, or may be different from the first preset difference. For example, if the second preset difference is the same as the first preset difference, the second preset difference is also 0.1. If the second preset difference is different from the first preset difference, the second preset difference may be preset to 0.15.

[0098] Suspected abnormal users may have data leakage risks or malicious attack behaviors, etc. If the target user is a suspected abnormal user, the first abnormality degree of the target user in the target time period is calculated.

[0099] Through this embodiment, the behavior habit parameter comparison and abnormal user identification mechanism are introduced, which effectively improves the reliability and security of data security analysis of the cloud computing-based teaching platform. At the same time, when it is determined that the target user is a suspected abnormal user, the first abnormality degree of the target user in the target time period is calculated, which can improve the efficiency of data transmission.

[0100] As an optional embodiment, Figure 3 As shown, S103 may specifically include the following S301 to S303:

[0101] S301, calculating the difference between the first behavior habit parameter and each second behavior habit parameter and then averaging them to obtain the group deviation degree of the target user, where the group deviation degree is used to characterize the overall difference degree between the target user and each similar user;

[0102] S302, dividing the first behavior habit parameter by each historical behavior habit parameter to obtain each historical deviation degree of the target user, where the historical deviation degree is used to represent the difference between the current operation behavior habit of the target user and the historical operation behavior habit;

[0103] S303: Determine the first abnormality degree of the target user in the target time period by using the historical deviation degrees and the group deviation degree.

[0104] In this embodiment, the server first collects the first behavior habit parameters of the target user (i.e., the behavior habit parameters in the current time period) and the second behavior habit parameters of the same type of users (i.e., the behavior habit parameters of the same type of users in the same time period). Then, the difference between the first behavior habit parameters and each second behavior habit parameter is calculated, and the average of these differences is calculated to obtain the group deviation degree of the target user.

[0105] Then, the first behavior habit parameter and the historical behavior habit parameter (ie, the behavior habit parameter in the past time period) of the target user are collected. Then, the first behavior habit parameter is divided by each historical behavior habit parameter to obtain each historical deviation degree of the target user.

[0106] Finally, the group deviation and historical deviation are used to comprehensively evaluate the abnormality of the target user in the target time period. Specifically, the first abnormality of the target user can be calculated using an appropriate algorithm or model (such as weighted average, machine learning model, etc.) based on the group deviation and each historical deviation.

[0107] Through this embodiment, the group deviation degree and historical deviation degree of the target user are accurately calculated. Then, according to the group deviation degree and historical deviation degree of the target user, the first abnormality degree is determined. This helps the online teaching platform to timely discover and handle abnormal user behavior and improve data security.

[0108] As an optional embodiment, S303 may specifically include:

[0109] Accumulate each historical deviation to obtain a historical deviation cumulative value;

[0110] Multiply the accumulated historical deviation by the group deviation to obtain the initial abnormality of the target user in the target time period;

[0111] The initial abnormality is normalized to obtain the first abnormality of the target user in the target time period.

[0112] In this embodiment, the initial abnormality can be specifically determined by the following formula 2:

[0113]

[0114] In the formula, Y is used to represent the initial abnormality of the target user in the target time period, P0 is used to represent the first behavioral habit parameter of the target user in the target time period, and P i It is used to characterize the historical behavior habit parameters of the target user in the i-th historical time period, I is used to characterize the total number of historical behavior habit parameters, avg(ΔP all ) is used to characterize the group deviation degree of the target users.

[0115] in, Used to characterize the historical deviation of the target user. It is used to characterize the cumulative value of the historical deviation of the target user. The larger the cumulative value of the historical deviation of the target user, the greater the difference between the current operating behavior habits of the target user and the historical operating behavior habits, that is, the greater the initial abnormality. The larger the group deviation of the target user, the greater the overall difference between the target user and other similar users, that is, the greater the initial abnormality. The larger the initial abnormality, the greater the risk that the target user is not the login user himself or has logged in illegally.

[0116] After obtaining the initial abnormality degree of the target user in the target time period, the initial abnormality degree is normalized to obtain the first abnormality degree of the target user in the target time period.

[0117] Through this embodiment, the first abnormality of the target user is accurately determined based on the group deviation and historical deviation of the target user. This can accurately assess the risk of the target user logging in as a different user or logging in illegally, which helps the online teaching platform to promptly discover and handle abnormal user behavior and improve data security.

[0118] As an optional embodiment, S104 may specifically include:

[0119] When the first abnormality degree is greater than or equal to the first preset abnormality value, the operation sequence between the functional units in the functional module is compared with the corresponding standard operation sequence to obtain an operation coefficient sequence, wherein the operation coefficient sequence includes operation coefficients corresponding to the operation sequence between each two adjacent functional units;

[0120] Determine the third abnormality degree of the corresponding functional module by using the operation coefficient sequence and the operation duration of each functional unit in the corresponding functional module;

[0121] The second abnormality degree of the target user in the target time period is determined by using the third abnormality degree and the first abnormality degree of each functional module.

[0122] In this embodiment, the standard operation sequence is an operation sequence that is summarized based on the operation sequences of each historical time period and serves as a benchmark.

[0123] The operation coefficient sequence includes the operation coefficients corresponding to the operation sequence between each two adjacent functional units. The operation coefficient is used to characterize whether the operation sequence between the two adjacent functional units is consistent with the standard operation sequence. For example, when the operation sequence between the two adjacent functional units is consistent with the standard operation sequence, the operation coefficient is set to 1; when the operation sequence between the two adjacent functional units is inconsistent with the standard operation sequence, the operation coefficient is set to 0.

[0124] As an example, the server first calculates the fourth abnormality degree using the third abnormality degree of each functional module and the initial abnormality degree corresponding to the first abnormality degree before normalization, and then normalizes the fourth abnormality degree to obtain the second abnormality degree.

[0125] The fourth abnormality degree of the target user in the target time period can be specifically determined by the following formula 3:

[0126]

[0127] In the formula, F is used to represent the fourth abnormality of the target user in the target time period, and Y is used to represent the initial abnormality of the target user in the target time period. t+1 -m t |The operation coefficient used to characterize the operation sequence between the functional unit of the t-th operation and the functional unit of the t+1-th operation. If the operation sequence is consistent with the standard operation sequence, the operation coefficient is set to 1; if the operation sequence is inconsistent with the standard operation sequence, the operation coefficient is set to 0. s t The operation time of the functional unit used to characterize the tth operation, s t+1 It is used to represent the operation time of the functional unit for the t+1th operation. n is used to represent the total number of operations on the functional module, and Q is used to represent the total number of functional modules operated.

[0128] in, It is used to characterize the third abnormality degree corresponding to a functional module. The accumulated value of the third abnormality degree corresponding to each functional module is used to characterize the function. The larger the third abnormality degree, the more the operation is not performed in accordance with the standard operation sequence, and the larger the fourth abnormality degree; the larger the initial abnormality degree, the greater the risk that the target user is not the user himself or has logged in illegally, and the larger the fourth abnormality degree.

[0129] Through this embodiment, the operation sequence and operation duration of each functional module of the online teaching platform are analyzed at a micro level, and the changes in user behavior characteristics can be obtained. Therefore, the risk of the target user logging in as a different user or logging in illegally can be accurately assessed, which helps the online teaching platform to promptly discover and handle abnormal user behavior and improve data security.

[0130] As an optional embodiment, S105 may specifically include:

[0131] Determine the teaching platform data in the operation behavior sequence of each target user whose second abnormality degree is less than the second preset abnormality value as the first normal teaching platform data;

[0132] Performing data security detection on the teaching platform data in the operation behavior sequence of each target user whose second abnormality degree is greater than or equal to the second preset abnormality value to obtain a security detection result;

[0133] When the security detection result indicates that there is no data that affects the security of the system in the teaching platform data, the teaching platform data is marked and packaged to obtain the second normal teaching platform data;

[0134] The first normal teaching platform data and the second normal teaching platform data are transferred to the storage space of the online teaching platform.

[0135] In this embodiment, the second preset abnormal value is a preset threshold value used to distinguish normal data from potential risk data. For example, the second preset abnormal value can be set to 0.3.

[0136] As an example, the server classifies the teaching platform data of each target user whose second abnormality is less than the second preset abnormality value as the first normal teaching platform data, and classifies the teaching platform data of each target user whose second abnormality is greater than or equal to the second preset abnormality value as the data to be detected.

[0137] Then, the data to be tested is subjected to in-depth security testing, which may include: checking whether there is malicious code or virus in the data, analyzing whether the data contains sensitive information leakage, and verifying the integrity and authenticity of the data. Based on the test results, a security test report is generated, which clearly indicates whether there is data in the teaching platform data that affects the security of the system.

[0138] Then, when the security test results indicate that there is no data in the teaching platform data that affects the security of the system, the data is marked and packaged to meet the storage and transmission requirements of the online teaching platform. Among them, the marking and packaging can specifically include: adding a unique identifier or label to the data and encrypting or compressing the data. The data after the marking and packaging processing is finally classified as the second normal teaching platform data.

[0139] Finally, the first normal teaching platform data and the second normal teaching platform data are transmitted to the storage space of the online teaching platform for use in subsequent teaching activities.

[0140] Through this embodiment, after determining the second abnormality of the target user in the target time period, further data security detection is performed on each teaching platform data whose second abnormality does not meet the preset conditions to obtain a security detection result. Finally, according to the security detection result, it is determined whether the data should be discarded. In this way, normal teaching platform data is avoided from being discarded, and the integrity of data transmission is ensured as much as possible.

[0141] According to the teaching platform data security analysis method based on cloud computing, the present invention also provides a specific embodiment of a teaching platform data security analysis system based on cloud computing.

[0142] Figure 4 A structural schematic diagram of a cloud computing-based teaching platform data security analysis system provided in an embodiment of the present application is shown. The cloud computing-based teaching platform data security analysis system 400 may include a sequence acquisition module 410, a parameter determination module 420, an abnormality determination module 430 and a data transmission module 440.

[0143] The sequence acquisition module 410 is used to respectively acquire at least one operation behavior sequence of each target user within a target time period, wherein the operation behavior sequence includes a plurality of teaching platform data arranged in chronological order, and the teaching platform data is used to represent the operation behavior record of the target user in the online teaching platform;

[0144] The parameter determination module 420 is used to determine the first behavior habit parameter of the target user in the target time period by using each operation behavior sequence, and the first behavior habit parameter is used to characterize the preference characteristics of the operation behavior of the target user in the online teaching platform in the target time period;

[0145] The abnormality determination module 430 is used to determine the first abnormality of the target user in the target time period by using the first behavior habit parameter, the historical behavior habit parameter of the target user, and the second behavior habit parameter of the similar user in the target time period, where the similar user is other users of the same user type as the target user;

[0146] The abnormality determination module 430 is further configured to determine a second abnormality degree of the target user within the target time period by using the operation duration of each functional unit in each functional module of the online teaching platform within the target time period, the operation sequence between each functional unit in each functional module, and the first abnormality degree when the first abnormality degree is greater than or equal to the first preset abnormality value;

[0147] The data transmission module 440 is used to transmit the normal teaching platform data in each operation behavior sequence to the storage space of the online teaching platform according to the second abnormality degree of each target user in the target time period.

[0148] In the cloud computing-based teaching platform data security analysis system provided by the embodiment of the present invention, first, according to the target user's operation behavior sequence in the target time period, a first behavior habit parameter characterizing the preference characteristics of the target user's operation behavior in the online teaching platform in the target time period is obtained. Then, according to the first behavior habit parameter, the target user's historical behavior habit parameter and the second behavior habit parameter of the same user, a first abnormality is obtained. In the case where the first abnormality is greater than or equal to the first preset abnormal value, the target user's operation duration of each functional unit in each functional module of the online teaching platform in the target time period and the operation sequence between the functional units in each functional module are further analyzed to obtain a second abnormality. Finally, the normal teaching platform data transmitted to the storage space of the online teaching platform is determined according to the second abnormality. In this way, the embodiment of the present invention can obtain the changes in the user's behavior characteristics by performing a preliminary analysis on the target user's operation behavior preference characteristics, and then further performing a microscopic analysis on the changes in the operation sequence and operation duration of each functional module of the online teaching platform on the basis of the preliminary analysis. Therefore, the abnormal login status of the user can be accurately identified, and then the real abnormal teaching data can be accurately identified, which is helpful to improve the security of data transmission in the field of big data resource services and Internet data services.

[0149] It should be clear that the present invention is not limited to the specific configurations and processes described above and shown in the figures. For the sake of simplicity, a detailed description of known methods is omitted here. In the above embodiments, several specific steps are described and shown as examples. It should also be noted that the exemplary embodiments mentioned in the present invention describe some methods or systems based on a series of steps or devices. However, the present invention is not limited to the order of the above steps, that is, the steps can be performed in the order mentioned in the embodiment, or they can be different from the order in the embodiment, or several steps can be performed simultaneously.

[0150] The above is only a specific implementation of the present invention. Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working process of the system, module and unit described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here. It should be understood that the protection scope of the present invention is not limited to this. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed by the present invention, and these modifications or replacements should be covered within the protection scope of the present invention.

Claims

1. A data security analysis method for a teaching platform based on cloud computing, characterized in that: The method comprises: Acquire at least one operation behavior sequence of each target user in a target time period, wherein the operation behavior sequence includes a plurality of teaching platform data arranged in chronological order, and the teaching platform data is used to represent the operation behavior record of the target user in the online teaching platform; Using each of the operation behavior sequences, determining a first behavior habit parameter of the target user within a target time period, wherein the first behavior habit parameter is used to characterize a preference feature of the operation behavior of the target user in the online teaching platform within the target time period; Determine a first abnormality degree of the target user in the target time period by using the first behavior habit parameter, the historical behavior habit parameter of the target user, and the second behavior habit parameter of a similar user in the target time period, wherein the similar user is other users of the same user type as the target user; In the case where the first abnormality is greater than or equal to the first preset abnormality value, the second abnormality of the target user in the target time period is determined by using the operation duration of the target user on each functional unit in each functional module of the online teaching platform in the target time period, the operation sequence between each functional unit in each functional module, and the first abnormality; According to the second abnormality degree of each target user within the target time period, the normal teaching platform data in each operation behavior sequence is transmitted to the storage space of the online teaching platform; The determining of a first abnormality degree of the target user in the target time period by using the first behavior habit parameter, the historical behavior habit parameter of the target user, and the second behavior habit parameter of a similar user in the target time period includes: The difference between the first behavior habit parameter and each of the second behavior habit parameters is calculated and then averaged to obtain the group deviation degree of the target user, where the group deviation degree is used to characterize the overall difference between the target user and each of the similar users; Dividing the first behavior habit parameter by each of the historical behavior habit parameters respectively to obtain each historical deviation degree of the target user, wherein the historical deviation degree is used to characterize the degree of difference between the current operation behavior habit of the target user and the historical operation behavior habit; The first abnormality degree of the target user in the target time period is determined by using the historical deviation degrees and the group deviation degree.

2. The data security analysis method for a teaching platform based on cloud computing according to claim 1 is characterized in that: The step of respectively obtaining at least one operation behavior sequence of each target user within a target time period includes: Numbering each functional module in the online teaching platform and each functional unit in each functional module to obtain a corresponding functional number identification; In response to the operation behavior of the target user in the online teaching platform, acquiring the teaching platform data corresponding to the operation behavior, the teaching platform data including the function number identifier, operation start time and operation end time corresponding to the operation behavior; According to the operation start time and the operation end time corresponding to each teaching platform data, each teaching platform data is converted into an operation behavior sequence in chronological order.

3. The data security analysis method for a teaching platform based on cloud computing according to claim 2 is characterized in that: The teaching platform data also includes the Internet protocol address corresponding to the operation behavior; Before determining the first behavior habit parameter of the target user within the target time period by using each of the operation behavior sequences, the method further includes: Compare each of the Internet Protocol addresses in the operation behavior sequence with a historical Internet Protocol address corresponding to the target user to obtain an address comparison result; The determining the first behavior habit parameter of the target user within the target time period by using each of the operation behavior sequences includes: When the address comparison result indicates that there is an Internet Protocol address in the operation behavior sequence that is inconsistent with the historical Internet Protocol address, the first behavior habit parameter of the target user in the target time period is determined by using each of the operation behavior sequences.

4. The data security analysis method for a teaching platform based on cloud computing according to claim 1 is characterized in that: The determining the first behavior habit parameter of the target user within the target time period by using each of the operation behavior sequences includes: According to the user type of the target user, obtaining a target function module corresponding to the user type; The teaching platform data in each of the operation behavior sequences are statistically analyzed to obtain the first operation probability of the target user on the target function module and the unit operation probability corresponding to each target function unit in the target function module in each operation sequence, wherein the first operation probability is used to characterize the probability that the target user executes the target function module in the first operation; the unit operation probability is used to characterize the probability that the target function unit is executed in the corresponding operation sequence; The first behavior habit parameter of the target user within the target time period is determined by using the first operation probability and each of the unit operation probabilities.

5. The data security analysis method for a teaching platform based on cloud computing according to claim 1 is characterized in that: Before determining the first abnormality of the target user in the target time period by using the first behavior habit parameter, the historical behavior habit parameter of the target user, and the second behavior habit parameter of the same type of user in the target time period, the method further includes: Compare the first behavior habit parameter with each of the historical behavior habit parameters to obtain a first parameter comparison result; When the first parameter comparison result indicates that there is a first parameter difference greater than or equal to a first preset difference, the first behavior habit parameter is compared with each of the second behavior habit parameters to obtain a second parameter comparison result, wherein the first parameter difference is used to characterize the difference between the first behavior habit parameter and the historical behavior habit parameter; When the second parameter comparison result indicates that the second parameter difference is greater than or equal to a second preset difference, it is determined that the target user is a suspected abnormal user, and the second parameter difference is used to characterize the difference between the first behavior habit parameter and the second behavior habit parameter; The determining of a first abnormality degree of the target user in the target time period by using the first behavior habit parameter, the historical behavior habit parameter of the target user, and the second behavior habit parameter of a similar user in the target time period includes: When it is determined that the target user is a suspected abnormal user, the first abnormality degree of the target user in the target time period is determined by using the first behavioral habit parameter, the historical behavioral habit parameter of the target user and the second behavioral habit parameter of similar users in the target time period.

6. The data security analysis method for a teaching platform based on cloud computing according to claim 1 is characterized in that: The determining the first abnormality degree of the target user in the target time period by using the historical deviation degrees and the group deviation degree includes: Accumulating the historical deviations to obtain a historical deviation accumulation value; Multiplying the accumulated value of the historical deviation by the group deviation to obtain the initial abnormality of the target user in the target time period; The initial abnormality degree is normalized to obtain a first abnormality degree of the target user within a target time period.

7. The data security analysis method for a teaching platform based on cloud computing according to claim 1 is characterized in that: In the case where the first abnormality is greater than or equal to a first preset abnormality value, determining a second abnormality of the target user within the target time period by using the operation duration of each functional unit in each functional module of the online teaching platform within the target time period, the operation sequence between each functional unit in each functional module, and the first abnormality, including: When the first abnormality degree is greater than or equal to a first preset abnormality value, the operation sequence between the functional units in the functional module is compared with the corresponding standard operation sequence to obtain an operation coefficient sequence, wherein the operation coefficient sequence includes operation coefficients corresponding to the operation sequence between each two adjacent functional units; Determine a third abnormality degree of the corresponding functional module by using the operation coefficient sequence and the operation duration of each functional unit in the corresponding functional module; The second abnormality degree of the target user in the target time period is determined by using the third abnormality degree of each of the functional modules and the first abnormality degree.

8. The data security analysis method for a teaching platform based on cloud computing according to claim 1 is characterized in that: The transmitting the normal teaching platform data in each operation behavior sequence to the storage space of the online teaching platform according to the second abnormality degree of each target user in the target time period includes: Determine the teaching platform data in the operation behavior sequence of each of the target users whose second abnormality degree is less than a second preset abnormality value as first normal teaching platform data; Performing data security detection on the teaching platform data in the operation behavior sequence of each of the target users whose second abnormality degree is greater than or equal to a second preset abnormality value, to obtain a security detection result; When the security detection result indicates that there is no data affecting system security in the teaching platform data, marking and packaging the teaching platform data to obtain second normal teaching platform data; The first normal teaching platform data and the second normal teaching platform data are transferred to the storage space of the online teaching platform.

9. A teaching platform data security analysis system based on cloud computing, characterized in that: The system comprises: A sequence acquisition module, used to respectively acquire at least one operation behavior sequence of each target user within a target time period, wherein the operation behavior sequence includes a plurality of teaching platform data arranged in chronological order, and the teaching platform data is used to represent the operation behavior record of the target user in the online teaching platform; A parameter determination module, used to determine a first behavior habit parameter of the target user within a target time period by using each of the operation behavior sequences, wherein the first behavior habit parameter is used to characterize a preference feature of the operation behavior of the target user in the online teaching platform within the target time period; The abnormality determination module is used to determine the first abnormality of the target user in the target time period by using the first behavior habit parameter, the historical behavior habit parameter of the target user, and the second behavior habit parameter of the same type of user in the target time period, wherein the same type of user is other users belonging to the same user type as the target user; wherein determining the first abnormality of the target user in the target time period includes: The difference between the first behavior habit parameter and each of the second behavior habit parameters is calculated and then averaged to obtain the group deviation degree of the target user, and the group deviation degree is used to characterize the overall difference between the target user and each of the similar users; the first behavior habit parameter is divided by each of the historical behavior habit parameters to obtain each of the historical deviation degrees of the target user, and the historical deviation degree is used to characterize the difference between the current operation behavior habit of the target user and the historical operation behavior habit; the first abnormality degree of the target user in the target time period is determined by using each of the historical deviation degrees and the group deviation degree; The abnormality determination module is further configured to determine a second abnormality degree of the target user within the target time period by using the operation duration of each functional unit in each functional module of the online teaching platform within the target time period, the operation sequence between each functional unit in each functional module, and the first abnormality degree when the first abnormality degree is greater than or equal to a first preset abnormality value; A data transmission module is used to transmit the normal teaching platform data in each operation behavior sequence to the storage space of the online teaching platform according to the second abnormality degree of each target user within the target time period.

Images