Big data network security protection method and system

Abstract

The invention provides a big data network security protection method and system, and relates to the technical field of network security, and the method comprises the steps: obtaining system log information; acquiring historical system log information; determining a user traffic abnormal coefficient according to the historical user traffic use data and the user traffic use data; determining a user login abnormal coefficient according to the historical user login information and the user login information; determining a user operation abnormal coefficient according to the historical user operation information and the user operation information; determining a user behavior abnormal coefficient according to the user traffic abnormal coefficient, the user login abnormal coefficient and the user operation abnormal coefficient; and determining whether to take safety protection measures or not. According to the big data network security protection method and device, the user behavior condition can be comprehensively evaluated according to the user traffic use condition, the user login condition and the user operation condition, whether security protection measures are taken or not is judged according to the evaluation result, and the accuracy of big data network security protection is improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a big data network security protection method and system. Background Art

[0002] In the related art, CN118410504A discloses a network security system based on big data analysis, which belongs to the field of network security technology. It includes: data acquisition module, data transmission module, secure storage calculation module, data security sharing module, ciphertext calculation module, data use security module, data security destruction module, data security management module and alarm module, which are used to issue alarms when the system is unconventionally powered off and / or illegally transported. This solution combines the big data security technology framework, data security governance, security assessment and operation and maintenance management through a big data collaborative security protection system based on big data analysis and threat intelligence sharing. At the same time, it can also issue defense alarms when the host is unconventionally powered off and transported to avoid the loss of the host and internal data. On the basis of data classification and grading and full life cycle security, it solves the security problems of big data at different levels and effectively responds to security threats in the big data environment.

[0003] CN111680312A discloses an information processing method and a network security cloud server based on big data and blockchain. The method analyzes encryption interference parameters of encryption verification key information of multiple communication information channels respectively, thereby accurately measuring the degree of encryption interference of communication information channels on encryption verification key information. The target blockchain node set is screened based on the target communication information channel whose encryption interference degree meets the first set condition. The encrypted behavior information of the communication object during the communication process is stored according to the target blockchain node set, which greatly improves the resistance to encryption interference when storing the encrypted behavior information of the communication object during the communication process, improves the information encryption effect, and especially when the information encryption resources are limited, greatly improves the actual information encryption efficiency of the information encryption process.

[0004] Based on the above-mentioned related technologies, security issues at different levels of big data can be solved. However, the related technologies do not take into account the impact of abnormal user behavior on the security of big data network, that is, it is impossible to evaluate abnormal user behavior based on user traffic usage, user login status and user operation status, and determine whether to take security measures based on abnormal user behavior.

[0005] The information disclosed in the background technology section of this application is only intended to deepen the understanding of the general background technology of this application, and should not be regarded as an admission or any form of suggestion that the information constitutes the prior art already known to those skilled in the art. Summary of the invention

[0006] The present invention provides a big data network security protection method and system, which can solve the technical problem that related technologies are unable to evaluate abnormal user behavior based on user traffic usage, user login status and user operation status, and determine whether to take security measures based on abnormal user behavior.

[0007] According to a first aspect of the present invention, a big data network security protection method is provided, comprising:

[0008] In the current time period, system log information is obtained, wherein the system log information includes: user traffic usage data, user login information and user operation information;

[0009] Obtain historical system log information of a historical time period that is the same as the start time of the current time period among multiple historical dates, wherein the historical system log information includes: historical user traffic usage data, historical user login information, and historical user operation information;

[0010] Determining a user traffic anomaly coefficient based on historical user traffic usage data for multiple historical time periods and the user traffic usage data;

[0011] Determine a user login abnormality coefficient based on historical user login information of multiple historical time periods and the user login information;

[0012] Determine a user operation abnormality coefficient based on historical user operation information of multiple historical time periods and the user operation information;

[0013] Determining a user behavior abnormality coefficient according to the user traffic abnormality coefficient, the user login abnormality coefficient and the user operation abnormality coefficient;

[0014] Determine whether to take safety protection measures based on the user behavior abnormality coefficient.

[0015] According to a second aspect of the present invention, a big data network security protection system is provided, comprising:

[0016] An information collection module, used to obtain system log information in the current time period, wherein the system log information includes: user traffic usage data, user login information and user operation information;

[0017] A historical information collection module, used to obtain historical system log information of a historical time period that is the same as the start time of the current time period among multiple historical dates, wherein the historical system log information includes: historical user traffic usage data, historical user login information, and historical user operation information;

[0018] A traffic anomaly coefficient determination module, used to determine a user traffic anomaly coefficient based on historical user traffic usage data of multiple historical time periods and the user traffic usage data;

[0019] A login abnormality coefficient determination module, used to determine a user login abnormality coefficient based on historical user login information of multiple historical time periods and the user login information;

[0020] An operation abnormality coefficient determination module is used to determine a user operation abnormality coefficient based on historical user operation information of multiple historical time periods and the user operation information;

[0021] A behavior abnormality coefficient determination module, used to determine a user behavior abnormality coefficient according to the user traffic abnormality coefficient, the user login abnormality coefficient and the user operation abnormality coefficient;

[0022] The safety protection measure judgment module is used to determine whether to take safety protection measures according to the abnormal coefficient of the user behavior.

[0023] Technical effect: According to the present invention, the abnormal user behavior can be comprehensively analyzed from three aspects: abnormal user traffic usage, abnormal user login, and abnormal user operation. Further, it can be determined whether to take network security protection measures based on the abnormal user behavior, thereby improving the comprehensiveness and accuracy of big data network security protection. When determining the user traffic abnormality coefficient, the user traffic abnormality coefficient can be determined based on the user traffic usage data, the user traffic usage change rate, the benchmark user traffic usage data, and the benchmark user traffic usage change rate. During the calculation process, the user traffic usage can be comprehensively evaluated from two aspects: the abnormal user traffic usage and the abnormal user traffic usage trend, and the user traffic abnormality coefficient is determined, thereby improving the accuracy and comprehensiveness of the user traffic abnormality coefficient. When determining the user login abnormality coefficient, the user login abnormality coefficient can be determined based on the commonly used login vector, the real-time login vector, the real-time login result, and the real-time login number. During the calculation process, the abnormal user login can be evaluated from two aspects: the number of user logins and the user login status, and the user login abnormality coefficient is determined, thereby improving the accuracy and comprehensiveness of the user login abnormality coefficient. When determining the user operation abnormality coefficient, the user operation abnormality coefficient can be determined based on the number of user operations, the first operation object recognition result, the first operation type recognition result, the second operation object recognition result and the second operation type recognition result. During the calculation process, the abnormal conditions of the user operations can be comprehensively evaluated based on whether the user operation objects and user operation types belong to the commonly used range and the legal range to determine the user operation abnormality coefficient, thereby improving the accuracy and comprehensiveness of the user operation abnormality coefficient.

[0024] It should be understood that the above general description and the following detailed description are exemplary and explanatory only and do not limit the present invention. Other features and aspects of the present invention will become more apparent from the following detailed description of exemplary embodiments with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present invention. For those of ordinary skill in the art, other embodiments can be obtained based on these drawings without creative work.

[0026] Figure 1 A schematic diagram of a process flow of a big data network security protection method according to an embodiment of the present invention is exemplarily shown;

[0027] Figure 2 A block diagram of a big data network security protection system according to an embodiment of the present invention is exemplarily shown. DETAILED DESCRIPTION

[0028] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0029] The technical solution of the present invention is described in detail with specific embodiments below. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described in detail in some embodiments.

[0030] Figure 1 The following is a flow chart of a method for protecting big data network security according to an embodiment of the present invention, wherein the method comprises:

[0031] Step S101, in the current time period, obtaining system log information, wherein the system log information includes: user traffic usage data, user login information and user operation information;

[0032] Step S102, obtaining historical system log information of a historical time period that is the same as the start time of the current time period among multiple historical dates, wherein the historical system log information includes: historical user traffic usage data, historical user login information, and historical user operation information;

[0033] Step S103, determining a user traffic anomaly coefficient based on historical user traffic usage data of multiple historical time periods and the user traffic usage data;

[0034] Step S104, determining a user login abnormality coefficient based on historical user login information of multiple historical time periods and the user login information;

[0035] Step S105, determining a user operation abnormality coefficient based on historical user operation information of multiple historical time periods and the user operation information;

[0036] Step S106, determining a user behavior abnormality coefficient according to the user traffic abnormality coefficient, the user login abnormality coefficient and the user operation abnormality coefficient;

[0037] Step S107: Determine whether to take safety protection measures according to the user behavior abnormality coefficient.

[0038] According to the big data network security protection method of the embodiment of the present invention, the abnormal user behavior conditions can be comprehensively analyzed from three aspects: abnormal user traffic usage conditions, abnormal user login conditions and abnormal user operation conditions. Furthermore, it can be determined whether to take network security protection measures based on the abnormal user behavior conditions, thereby improving the comprehensiveness and accuracy of big data network security protection.

[0039] According to an embodiment of the present invention, in step S101, system log information is obtained in the current time period, wherein the system log information includes: user traffic usage data, user login information and user operation information.

[0040] For example, the user traffic usage data, user login information, and user operation information in the current time period are obtained through the event viewer.

[0041] According to one embodiment of the present invention, in step S102, historical system log information of a historical time period that is the same as the start time of the current time period is obtained from multiple historical dates, wherein the historical system log information includes: historical user traffic usage data, historical user login information, and historical user operation information.

[0042] For example, determine the date within a week before the date of the current time period as the historical date. For example, the start time of the current time period is 8 am and the end time is 12 noon. Use the event viewer to filter the historical user traffic usage data, historical user login information, and historical user operation information from 8 am to 12 noon in the previous week.

[0043] According to an embodiment of the present invention, in step S103, the user traffic anomaly coefficient is determined based on historical user traffic usage data of multiple historical time periods and the user traffic usage data.

[0044] According to one embodiment of the present invention, step S103 includes:

[0045] Fitting the user traffic usage data and the moments in the current time period to obtain a user traffic usage data function in the current time period;

[0046] Determining a user traffic usage data derivative function according to the user traffic usage data function;

[0047] Determining the user traffic usage change rate at multiple moments in the current time period according to the user traffic usage data derivative function;

[0048] Determining benchmark user traffic usage data based on the historical user traffic usage data of the multiple historical time periods;

[0049] Fitting the benchmark user traffic usage data and the moments in the time period to obtain a benchmark user traffic usage data function in the time period;

[0050] Determining a benchmark user traffic usage data derivative function according to the benchmark user traffic usage data function;

[0051] Determining the benchmark user traffic usage change rate at multiple moments in a time period according to the benchmark user traffic usage data derivative function;

[0052] A user traffic anomaly coefficient is determined according to the user traffic usage data, the user traffic usage change rate, the benchmark user traffic usage data and the benchmark user traffic usage change rate.

[0053] For example, the user traffic usage data and the moments in the current time period are fitted to obtain a user traffic usage data function for describing the changes of the user traffic usage data in the current time period over time; the user traffic usage data function is derived to obtain a derived function of the user traffic usage data; multiple moments in the current time period are substituted into the derived function of the user traffic usage data to determine the user traffic usage change rate at multiple moments in the current time period; the benchmark user traffic usage data is determined based on the historical user traffic usage data of the historical time period in multiple historical dates, for example, the benchmark user traffic usage data at 8 a.m. is determined by summing and averaging the historical user traffic usage data at 8 a.m. in the previous week. The method comprises the steps of: fitting the benchmark user traffic usage data and the moments in the time period to obtain a benchmark user traffic usage data function for describing the change of the benchmark user traffic usage data in the time period over time; deriving the benchmark user traffic usage data function to obtain a derivative function of the benchmark user traffic usage data; substituting multiple moments in the time period into the derivative function of the benchmark user traffic usage data to determine the change rate of the benchmark user traffic usage at multiple moments in the time period; evaluating the abnormal user traffic usage according to the user traffic usage data, the change rate of the user traffic usage, the benchmark user traffic usage data and the change rate of the benchmark user traffic usage to determine the abnormal user traffic coefficient.

[0054] According to an embodiment of the present invention, determining a user traffic anomaly coefficient according to the user traffic usage data, the user traffic usage change rate, the benchmark user traffic usage data and the benchmark user traffic usage change rate includes: determining the user traffic anomaly coefficient Acut for the current time period according to formula (1): p ,

[0055]

[0056] Among them, α1 and α2 are preset weights, if is the conditional function, and t k is the kth moment of the time period, T h (t k ) is the benchmark user traffic usage data at the kth moment of the time period, T p (t k ) is the user traffic usage data at the kth moment in the current time period, Td T is the preset flow difference threshold, T' h (t k ) is the change rate of the base user traffic usage at the kth moment of the time period, T' p (t k ) is the user traffic usage change rate at the kth moment in the current time period, K is the number of moments in the time period, k≤K, and k and K are both positive integers.

[0057] According to one embodiment of the present invention, T p (t k )-T h (t k ) represents the difference between the user traffic usage data at the kth moment in the time period and the benchmark user traffic usage data, Indicates the difference between the total amount of user traffic usage data and the total amount of benchmark user traffic usage data during the time period; It is the relative difference between the difference between the total amount of user traffic usage data and the benchmark user traffic usage data in a time period and the preset traffic difference threshold. The larger the ratio, the more the total amount of user traffic usage data in the current time period is relative to the benchmark user traffic usage data. When the user uses an abnormally large amount of traffic, there may be malware, viruses or network attacks (such as distributed denial of service attacks). The greater the possibility of security risks, the more abnormal the user traffic usage.

[0058] According to one embodiment of the present invention, in formula (1), the conditional function if{T' h (t k )T' p (t k )>0,0,1} includes the following two cases, when T' h (t k )T' p (t k )>0, the user traffic usage change rate at the i-th moment has the same sign as the benchmark user traffic usage change rate, indicating that the user traffic usage change trend at the i-th moment of the current time period is the same as the benchmark user traffic usage change trend at the i-th moment of the time period, and the user traffic usage change trend at the i-th moment of the time period is normal. The value of the conditional function is 0. h (t k )T' p (t k )>0, the sign of the user traffic usage change rate at the i-th moment is different from that of the benchmark user traffic usage change rate, indicating that the user traffic usage change trend at the i-th moment of the current time period is different from the benchmark user traffic usage change trend at the i-th moment of the time period, and the user traffic usage change trend at the i-th moment of the time period may be abnormal, and the value of the conditional function is 1; The sum and average of the number of moments in the time period indicates the abnormality of the overall user traffic usage change trend in the current time period. The larger the ratio, the more abnormal the overall user traffic usage change trend in the current time period.

[0059] According to one embodiment of the present invention, It means evaluating the abnormal user traffic usage based on the user traffic usage amount and the changing trend of user traffic usage to determine the user traffic abnormality coefficient.

[0060] In this way, the user traffic anomaly coefficient can be determined based on the user traffic usage data, the user traffic usage change rate, the benchmark user traffic usage data and the benchmark user traffic usage change rate. During the calculation process, the user traffic usage status can be comprehensively evaluated from two aspects: the abnormal status of user traffic usage and the abnormal status of user traffic usage change trend, and the user traffic anomaly coefficient can be determined, thereby improving the accuracy and comprehensiveness of the user traffic anomaly coefficient.

[0061] According to an embodiment of the present invention, in step S104, the user login abnormality coefficient is determined based on historical user login information of multiple historical time periods and the user login information.

[0062] According to one embodiment of the present invention, step S104 includes:

[0063] Determine the commonly used network protocols, commonly used login times, commonly used login IP addresses and normal login times based on the historical user login information of the multiple historical time periods;

[0064] Determine a common login vector according to the common network protocol, the common login time and the common login IP address;

[0065] Determine the real-time network protocol, real-time login result, real-time login time, real-time login IP address and real-time login times according to the user login information;

[0066] Determine a real-time login vector according to the real-time network protocol, the real-time login time and the real-time login IP address;

[0067] A user login abnormality coefficient is determined according to the common login vector, the real-time login vector, the real-time login result, the real-time login times and the normal login times.

[0068] For example, user login information of multiple historical time periods is obtained from the system log, the number of times each network protocol is used is counted, and the network protocol with the most usage is determined as the commonly used network protocol; the number of logins in each time period is counted, and the time period with the most logins is determined as the commonly used login time; the number of occurrences of each login IP address is counted, and the IP address with the most occurrences is determined as the commonly used login IP address; the number of logins in multiple historical periods is summed and averaged to determine the normal number of logins; the commonly used login vector is determined based on the commonly used network protocols, commonly used login times and commonly used login IP addresses obtained and counted from the system log; the real-time network protocol, real-time login result, real-time login time, real-time login IP address and real-time login number of user logins in the current time period are obtained from the system log; the real-time login vector is determined based on the real-time network protocol, real-time login time and real-time login IP address; the user login abnormality is evaluated based on the commonly used login vector, real-time login vector, real-time login result and real-time login number, and the user login abnormality coefficient is determined.

[0069] According to an embodiment of the present invention, determining a user login abnormality coefficient according to the common login vector, the real-time login vector, the real-time login result, the real-time login times and the normal login times includes: determining the user login abnormality coefficient Acul for the current time period according to formula (2): p ,

[0070]

[0071] Among them, if is the conditional function, Lt i is the real-time login time of the i-th login in the current time period, Lip i Np is the real-time login IP address of the i-th login in the current time period, i is the real-time network protocol for the i-th login in the current time period, is the real-time login vector of the i-th login in the current time period, for The transposed vector of , ULt is the common login time, ULip is the common login IP address, Np is the common network protocol, is the commonly used landing vector, Lr i is the real-time login result of the i-th login in the current time period, β is the preset weight, β>1, Ln p is the real-time login times in the current time period, Ln T is the number of normal logins, i≤Ln p , i and Ln p All are positive integers.

[0072] According to one embodiment of the present invention, in formula (2), the conditional function The value of includes the following two cases: p <Ln T When the condition of Ln is met, the real-time login times in the current time period are less than the normal login times, indicating that the user login times are within the normal range, and the value of the condition function is 1. p <Ln T When the condition is met, the real-time login times in the current time period are greater than or equal to the normal login times, indicating that the user login times are abnormal. The value of the condition function is It is the relative difference between the number of real-time logins and the number of normal logins in the current time period. The larger the ratio is, the more real-time logins there are in the current time period relative to the normal logins, which means the account may have been stolen or there are other security risks, and the user's login status is more abnormal.

[0073] According to one embodiment of the present invention, is the cosine similarity between the real-time login vector of the i-th login in the current time period and the common login vector. The smaller the similarity, the greater the difference between the real-time login time, real-time login IP address and real-time network protocol of the i-th login in the current time period and the common login time, common login IP address and common login network protocol. The real-time login time, real-time login IP address and real-time network protocol may be abnormal. When the login time is abnormal, it means that there may be malicious users trying to log in to the account during the time period when the user does not log in frequently, and there is a greater possibility of network security risk. When the login IP address is abnormal, it means that there may be malicious users who forge IP addresses or use proxy servers to carry out network attacks, and there is a greater possibility of network security risk. When the login network protocol is abnormal, it means that there may be malicious users who may use protocol vulnerabilities to carry out network attacks (such as man-in-the-middle attacks and injection attacks), and there is a greater possibility of network security risk. Lr i is the real-time login result of the i-th login in the current time period. When the real-time login result is failure, it means that the login operation may not be performed by the user himself, which may pose a greater security risk; The abnormal login status of the user at the i-th login is determined based on the real-time login time, real-time login IP address, abnormal status of the real-time network protocol and real-time login result of the i-th login. The larger the value, the more abnormal the user's real-time login status is; The ratio is calculated by summing and averaging the number of login times in the current time period, indicating abnormal login status of the user in the current time period. The larger the ratio, the more abnormal the login status of the user in the current time period.

[0074] According to one embodiment of the present invention, It indicates that the user login abnormality coefficient is determined according to the abnormal conditions of the number of user logins and the abnormal conditions of the user login status.

[0075] In this way, the user login anomaly coefficient can be determined based on the commonly used login vectors, real-time login vectors, real-time login results and real-time login times. During the calculation process, the abnormal conditions of user logins can be evaluated from two aspects: the number of user logins and the user login status, and the user login anomaly coefficient can be determined, thereby improving the accuracy and comprehensiveness of the user login anomaly coefficient.

[0076] According to an embodiment of the present invention, in step S105, the user operation abnormality coefficient is determined based on historical user operation information of multiple historical time periods and the user operation information.

[0077] According to one embodiment of the present invention, step S105 includes:

[0078] Determine the number of user operations, the user operation object, and the user operation type according to the user operation information;

[0079] Determining common operation objects and common operation types according to the historical user operation information;

[0080] Determining a first operation object recognition result according to the user operation object and the common operation object;

[0081] Determining a first operation type recognition result according to the user operation type and the common operation type;

[0082] Obtaining the user's operation authority, and determining the legal operation object and legal operation type based on the operation authority;

[0083] Determining a second operation object recognition result according to the user operation object and the legal operation object;

[0084] Determining a second operation type identification result according to the user operation type and the legal operation type;

[0085] A user operation abnormality coefficient is determined according to the number of user operations, the first operation object recognition result, the first operation type recognition result, the second operation object recognition result, and the second operation type recognition result.

[0086] For example, obtaining the user's operation information from the system log, traversing the operation information, determining the number of user operations, extracting the operation object information of each record (such as the operated files, directories, and system configuration items), determining the user operation object, extracting the operation type information of each record (such as file access, file editing, and system configuration change), and determining the user operation type; obtaining the user's historical operation information from the system log, and determining the commonly used operation objects and commonly used operation types based on the relatively large number of operation objects and operation types in the historical operation information; comparing the user operation object with the commonly used operation objects, checking whether the user operation object belongs to the commonly used operation object, and determining the first operation object recognition result; comparing the user operation type with the commonly used operation type, checking whether the user operation type belongs to the commonly used operation type , determine the first operation type identification result; obtain the user's operation authority information from the system, determine the objects and types that the user is allowed to operate within the scope of authority according to the user's operation authority information, and determine the legal operation objects and legal operation types; compare the user's operation object with the legal operation object, check whether the user's operation object belongs to the legal operation object, and determine the second operation object identification result; compare the user's operation type with the legal operation type, check whether the user's operation type belongs to the legal operation type, and determine the second operation type identification result; based on the number of user operations, the first operation object identification result, the first operation type identification result, the second operation object identification result and the second operation type identification result, comprehensively evaluate the abnormal situation of the user's operation behavior and determine the user operation abnormality coefficient.

[0087] According to an embodiment of the present invention, determining the user operation abnormality coefficient according to the number of user operations, the first operation object recognition result, the first operation type recognition result, the second operation object recognition result and the second operation type recognition result includes: determining the user operation abnormality coefficient Acuo for the current time period according to formula (3): p ,

[0088]

[0089] Among them, β1 and β2 are preset weights, Oc 1,j is the first operation object recognition result of the j-th operation in the current time period, Ot 1,j is the first operation type identification result of the j-th operation in the current time period, Oc 2,j is the second operation object recognition result of the j-th operation in the current time period, Ot 2,jis the second operation type identification result of the j-th operation in the current time period, m is the number of user operations in the current time period, j≤m, and both j and m are positive integers.

[0090] According to one embodiment of the present invention, Oc 1,j +Ot 1,j It is the sum of the first operation object recognition result and the first operation type recognition result of the j-th operation in the current time period. When the value is 0, it means that the operation object and operation type of the j-th operation are both in the common range, and the possibility of security risks is low. When the value is 1, it means that the operation object or operation type of the j-th operation is not in the common range, and the j-th operation may have security risks. When the value is 2, the operation object and operation type of the j-th operation are not in the common range, and the possibility of security risks in the j-th operation is high. 2,j +Ot 2,j It is the sum of the second operation object identification result and the second operation type identification result of the j-th operation in the current time period. When the value is 0, it means that the operation object and operation type of the j-th operation are both within the legal range, and the possibility of security risks is low. When the value is 1, it means that the operation object or operation type of the j-th operation is not within the legal range, and the j-th operation may have security risks. When the value is 2, it means that the operation object and operation type of the j-th operation are not within the legal range, and the j-th operation may have security risks.

[0091] According to one embodiment of the present invention, It means that the user operation abnormality coefficient is determined based on whether the user operation object and type belong to the common range and the legal range. The larger the user operation abnormality coefficient is, the more abnormal the user operation condition is, and the greater the possibility of network security risks.

[0092] In this way, the user operation abnormality coefficient can be determined based on the number of user operations, the first operation object recognition result, the first operation type recognition result, the second operation object recognition result and the second operation type recognition result. During the calculation process, the abnormal conditions of the user operations can be comprehensively evaluated based on whether the user operation object and the user operation type belong to the commonly used range and the legal range, and the user operation abnormality coefficient can be determined, thereby improving the accuracy and comprehensiveness of the user operation abnormality coefficient.

[0093] According to one embodiment of the present invention, in step S106, the user behavior abnormality coefficient is determined based on the user traffic abnormality coefficient, the user login abnormality coefficient and the user operation abnormality coefficient.

[0094] For example, the user traffic anomaly coefficient, user login anomaly coefficient and user operation anomaly coefficient are weighted and summed to determine the user behavior anomaly coefficient. The larger the user behavior anomaly coefficient, the more abnormal the user behavior is, and the greater the possibility that the big data network security will be threatened.

[0095] According to an embodiment of the present invention, in step S107, it is determined whether to take security protection measures based on the user behavior abnormality coefficient.

[0096] According to one embodiment of the present invention, step S107 includes:

[0097] If the user behavior abnormality coefficient is greater than or equal to a set threshold, it is determined to take security protection measures.

[0098] For example, if the user behavior anomaly coefficient is greater than the set anomaly coefficient threshold, it means that the user behavior is abnormal and may have an impact on the security of the big data network. The system will immediately trigger the response mechanism and take security measures to deal with the abnormal behavior, such as suspending the use of the user account, resetting the user password, blocking suspicious IP addresses, and immediately notifying the security team to conduct a detailed investigation and continuously monitor the user. If the user behavior anomaly coefficient is less than or equal to the set anomaly coefficient threshold, it means that the user behavior is normal. The system will monitor the user behavior for a long time and continuously detect whether there are any abnormalities in the user behavior to prevent the network from being threatened by security threats.

[0099] According to the big data network security protection method of the embodiment of the present invention, the abnormal user behavior can be comprehensively analyzed from three aspects: abnormal user traffic usage, abnormal user login, and abnormal user operation. Further, it can be determined whether to take network security protection measures according to the abnormal user behavior, thereby improving the comprehensiveness and accuracy of big data network security protection. When determining the user traffic abnormality coefficient, the user traffic abnormality coefficient can be determined according to the user traffic usage data, the user traffic usage change rate, the benchmark user traffic usage data, and the benchmark user traffic usage change rate. In the calculation process, the user traffic usage can be comprehensively evaluated from two aspects: the abnormal user traffic usage and the abnormal user traffic usage trend, and the user traffic abnormality coefficient is determined, thereby improving the accuracy and comprehensiveness of the user traffic abnormality coefficient. When determining the user login abnormality coefficient, the user login abnormality coefficient can be determined according to the commonly used login vector, the real-time login vector, the real-time login result, and the real-time login number. In the calculation process, the abnormal user login can be evaluated from two aspects: the number of user logins and the user login status, and the user login abnormality coefficient is determined, thereby improving the accuracy and comprehensiveness of the user login abnormality coefficient. When determining the user operation abnormality coefficient, the user operation abnormality coefficient can be determined based on the number of user operations, the first operation object recognition result, the first operation type recognition result, the second operation object recognition result and the second operation type recognition result. During the calculation process, the abnormal conditions of the user operations can be comprehensively evaluated based on whether the user operation objects and user operation types belong to the commonly used range and the legal range to determine the user operation abnormality coefficient, thereby improving the accuracy and comprehensiveness of the user operation abnormality coefficient.

[0100] Figure 2 A block diagram of a big data network security protection system according to an embodiment of the present invention is exemplarily shown, and the system includes:

[0101] An information collection module, used to obtain system log information in the current time period, wherein the system log information includes: user traffic usage data, user login information and user operation information;

[0102] A historical information collection module, used to obtain historical system log information of a historical time period that is the same as the start time of the current time period among multiple historical dates, wherein the historical system log information includes: historical user traffic usage data, historical user login information, and historical user operation information;

[0103] A traffic anomaly coefficient determination module, used to determine a user traffic anomaly coefficient based on historical user traffic usage data of multiple historical time periods and the user traffic usage data;

[0104] A login abnormality coefficient determination module, used to determine a user login abnormality coefficient based on historical user login information of multiple historical time periods and the user login information;

[0105] An operation abnormality coefficient determination module is used to determine a user operation abnormality coefficient based on historical user operation information of multiple historical time periods and the user operation information;

[0106] A behavior abnormality coefficient determination module, used to determine a user behavior abnormality coefficient according to the user traffic abnormality coefficient, the user login abnormality coefficient and the user operation abnormality coefficient;

[0107] The safety protection measure judgment module is used to determine whether to take safety protection measures according to the abnormal coefficient of the user behavior.

[0108] The present invention may be a method, an apparatus, a system and / or a computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for executing various aspects of the present invention.

[0109] It should be understood by those skilled in the art that the embodiments of the present invention described above and shown in the accompanying drawings are only examples and do not limit the present invention. The purpose of the present invention has been fully and effectively achieved. The functional and structural principles of the present invention have been demonstrated and explained in the embodiments, and the embodiments of the present invention may be deformed or modified in any way without departing from the principles.

Claims

1. A big data network security protection method, characterized in that: include: In the current time period, system log information is obtained, wherein the system log information includes: user traffic usage data, user login information and user operation information; Obtain historical system log information of a historical time period that is the same as the start time of the current time period among multiple historical dates, wherein the historical system log information includes: historical user traffic usage data, historical user login information, and historical user operation information; Determining a user traffic anomaly coefficient based on historical user traffic usage data for multiple historical time periods and the user traffic usage data; Determine a user login abnormality coefficient based on historical user login information of multiple historical time periods and the user login information; Determine a user operation abnormality coefficient based on historical user operation information of multiple historical time periods and the user operation information; Determining a user behavior abnormality coefficient according to the user traffic abnormality coefficient, the user login abnormality coefficient and the user operation abnormality coefficient; Determine whether to take safety protection measures based on the user behavior abnormality coefficient.

2. The big data network security protection method according to claim 1 is characterized in that: Determining a user traffic anomaly coefficient according to historical user traffic usage data of multiple historical time periods and the user traffic usage data includes: Fitting the user traffic usage data and the moments in the current time period to obtain a user traffic usage data function in the current time period; Determining a user traffic usage data derivative function according to the user traffic usage data function; Determining the user traffic usage change rate at multiple moments in the current time period according to the user traffic usage data derivative function; Determining benchmark user traffic usage data based on the historical user traffic usage data of the multiple historical time periods; Fitting the benchmark user traffic usage data and the moments in the time period to obtain a benchmark user traffic usage data function in the time period; Determining a benchmark user traffic usage data derivative function according to the benchmark user traffic usage data function; Determining the benchmark user traffic usage change rate at multiple moments in a time period according to the benchmark user traffic usage data derivative function; A user traffic anomaly coefficient is determined according to the user traffic usage data, the user traffic usage change rate, the benchmark user traffic usage data and the benchmark user traffic usage change rate.

3. The big data network security protection method according to claim 2 is characterized in that: Determining a user traffic anomaly coefficient according to the user traffic usage data, the user traffic usage change rate, the benchmark user traffic usage data, and the benchmark user traffic usage change rate includes: According to the formula Determine the user traffic abnormality coefficient Acut for the current time period p , where α1 and α2 are preset weights, if is a conditional function, t k is the kth moment of the time period, T h (t k ) is the benchmark user traffic usage data at the kth moment of the time period, T p (t k ) is the user traffic usage data at the kth moment in the current time period, Td T is the preset flow difference threshold, T' h (t k ) is the change rate of the base user traffic usage at the kth moment of the time period, T' p (t k ) is the user traffic usage change rate at the kth moment in the current time period, K is the number of moments in the time period, k≤K, and k and K are both positive integers.

4. The big data network security protection method according to claim 1 is characterized in that: Determining a user login abnormality coefficient according to historical user login information of multiple historical time periods and the user login information includes: Determine the commonly used network protocols, commonly used login times, commonly used login IP addresses and normal login times based on the historical user login information of the multiple historical time periods; Determine a common login vector according to the common network protocol, the common login time and the common login IP address; Determine the real-time network protocol, real-time login result, real-time login time, real-time login IP address and real-time login times according to the user login information; Determine a real-time login vector according to the real-time network protocol, the real-time login time and the real-time login IP address; A user login abnormality coefficient is determined according to the common login vector, the real-time login vector, the real-time login result, the real-time login times and the normal login times.

5. The big data network security protection method according to claim 4 is characterized in that: Determining a user login abnormality coefficient according to the common login vector, the real-time login vector, the real-time login result, the real-time login times and the normal login times includes: According to the formula Determine the user login abnormality coefficient Acul for the current time period p , where if is the conditional function, Lt i is the real-time login time of the i-th login in the current time period, Lip i Np is the real-time login IP address of the i-th login in the current time period, i is the real-time network protocol for the i-th login in the current time period, is the real-time login vector of the i-th login in the current time period, for The transposed vector of , ULt is the common login time, ULip is the common login IP address, Np is the common network protocol, is the commonly used landing vector, Lr i is the real-time login result of the i-th login in the current time period, β is the preset weight, β>1, Ln p is the real-time login times in the current time period, Ln T is the number of normal logins, i≤Ln p , i and Ln p All are positive integers.

6. The big data network security protection method according to claim 1 is characterized in that: Determining a user operation abnormality coefficient according to historical user operation information of multiple historical time periods and the user operation information includes: Determine the number of user operations, the user operation object, and the user operation type based on the user operation information; Determining common operation objects and common operation types according to the historical user operation information; Determining a first operation object recognition result according to the user operation object and the common operation object; Determining a first operation type recognition result according to the user operation type and the common operation type; Obtaining the user's operation authority, and determining the legal operation object and legal operation type based on the operation authority; Determining a second operation object recognition result according to the user operation object and the legal operation object; Determining a second operation type identification result according to the user operation type and the legal operation type; A user operation abnormality coefficient is determined according to the number of user operations, the first operation object recognition result, the first operation type recognition result, the second operation object recognition result, and the second operation type recognition result.

7. The big data network security protection method according to claim 6 is characterized in that: Determining a user operation abnormality coefficient according to the number of user operations, the first operation object recognition result, the first operation type recognition result, the second operation object recognition result, and the second operation type recognition result includes: According to the formula Determine the user operation abnormality coefficient Acuo for the current time period p , where β1 and β2 are preset weights, Oc 1，j is the first operation object recognition result of the j-th operation in the current time period, Ot 1，j is the first operation type identification result of the j-th operation in the current time period, Oc 2，j is the second operation object recognition result of the j-th operation in the current time period, Ot 2，j is the second operation type identification result of the j-th operation in the current time period, m is the number of user operations in the current time period, j≤m, and both j and m are positive integers.

8. The big data network security protection method according to claim 1 is characterized in that: Determine whether to take security protection measures based on the user behavior abnormality coefficient, including: If the user behavior abnormality coefficient is greater than or equal to a set threshold, it is determined to take security protection measures.

9. A big data network security protection system, characterized in that: include: An information collection module, used to obtain system log information in the current time period, wherein the system log information includes: user traffic usage data, user login information and user operation information; A historical information collection module, used to obtain historical system log information of a historical time period that is the same as the start time of the current time period among multiple historical dates, wherein the historical system log information includes: historical user traffic usage data, historical user login information and historical user operation information; A traffic anomaly coefficient determination module, used to determine a user traffic anomaly coefficient based on historical user traffic usage data of multiple historical time periods and the user traffic usage data; A login abnormality coefficient determination module, used to determine a user login abnormality coefficient based on historical user login information of multiple historical time periods and the user login information; An operation abnormality coefficient determination module is used to determine a user operation abnormality coefficient based on historical user operation information of multiple historical time periods and the user operation information; A module for determining an abnormal behavior coefficient, used to determine an abnormal user behavior coefficient according to the abnormal user flow coefficient, the abnormal user login coefficient and the abnormal user operation coefficient; The safety protection measure judgment module is used to determine whether to take safety protection measures according to the abnormal coefficient of the user behavior.

Images