Computer information security protection system and method based on big data

Abstract

The invention discloses a computer information security protection system based on big data, and the system comprises a data collection module which is used for collecting network logs, system logs, application program logs and other information from a plurality of data sources; the preprocessing module is used for carrying out preprocessing operations such as cleaning and formatting on the collected data so as to improve the data quality and availability; the big data analysis engine is used for analyzing the preprocessed data by adopting a machine learning and / or deep learning technology and identifying potential security threats; the threat assessment and response module assesses the detected security event according to the big data analysis result and automatically triggers corresponding defense measures; and the user interface provides a visual and easy-to-use operation interface, so that an administrator can conveniently check the system state, manage rule configuration and query historical records. Various security threats can be effectively monitored and defended, the whole process is highly automatic, and meanwhile efficient operation of the system is guaranteed.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and specifically to a computer information security protection system and method based on big data. Background Art

[0002] With the rapid development of information technology, the internet has become an indispensable infrastructure for modern society, but this has also brought with it increasingly severe cybersecurity challenges. Currently, cybersecurity threats come in various forms, including virus attacks, malware intrusions, and data leaks, posing significant challenges to personal privacy and corporate information security. Traditional security measures such as firewalls and antivirus software, while able to protect against known threats to a certain extent, are insufficient when faced with new attack patterns. These traditional methods rely primarily on predefined rules and signature databases, lacking the ability to effectively detect unknown or evolving attacks. Furthermore, they typically only provide passive defenses and are unable to dynamically adjust protection strategies based on actual conditions, resulting in slow response times and limited defensive effectiveness. As cyberattack methods continue to evolve, there is an urgent need for intelligent security systems that can proactively identify and defend against emerging threats. Summary of the Invention

[0003] 1. Technical Problems Solved

[0004] The technical problems to be solved by the present invention are the various problems mentioned in the above background technology, and a computer information security protection system and method based on big data are provided.

[0005] 2. Technical Solution

[0006] To solve the above technical problems, the present invention provides a technical solution: a computer information security protection system based on big data, comprising: a data acquisition module for collecting network logs, system logs, application logs and other information from multiple data sources; a preprocessing module for performing preprocessing operations such as cleaning and formatting on the collected data to improve data quality and availability; a big data analysis engine, which uses machine learning and / or deep learning technology to analyze the preprocessed data and identify potential security threats; a threat assessment and response module, which evaluates the detected security incidents based on the big data analysis results and automatically triggers corresponding defense measures; a user interface, which provides an intuitive and easy-to-use operation interface, allowing administrators to easily view system status, management rule configuration and query historical records.

[0007] As an improvement, the data acquisition module can support multiple data formats and protocols to ensure that required information can be obtained from different data sources.

[0008] As an improvement, the preprocessing module includes data denoising, missing value filling and outlier detection functions to ensure the validity and accuracy of the data.

[0009] As an improvement, the big data analysis engine can automatically identify new attack patterns through training models, thereby improving the ability to detect unknown threats.

[0010] As an improvement, the threat assessment and response module can automatically select appropriate defense strategies based on the severity of security incidents, including isolating infected devices and blocking suspicious connections. The user interface supports graphical display of system operation status and provides detailed log query capabilities, making it easier for administrators to track and analyze security incidents.

[0011] As an improvement, the user interface supports graphical display of system operation status and provides detailed log query function to facilitate administrators to track and analyze security events.

[0012] As an improvement, a method for using a computer information security protection system based on big data includes the following steps:

[0013] Step 1: Collect necessary log information from multiple data sources through the data collection module;

[0014] Step 2: Use the pre-processing module to clean and format the collected data to ensure data quality;

[0015] Step 3: Use the big data analysis engine to conduct in-depth analysis of the pre-processed data to identify potential security threats;

[0016] Step 4: The threat assessment and response module assesses the risk level of the security incident based on the analysis results and takes appropriate defensive measures;

[0017] Step 5: Provide system status display, rule management, log query and other functions through the user interface to facilitate administrator operation and management.

[0018] 3. Beneficial Effects

[0019] The advantages of the present invention compared with the prior art are:

[0020] The present invention provides a computer information security protection system based on big data and a method for using the same, which realizes intelligent identification and defense of security threats in a computer network environment by integrating multiple modules such as data acquisition, preprocessing, big data analysis, threat assessment and response, and user interface. The system can support multiple data formats and protocols to ensure the acquisition of high-quality information from different data sources; it uses advanced machine learning and deep learning technologies to automatically identify new attack patterns, significantly improving the ability to detect unknown threats; and it can automatically select and execute appropriate defense strategies based on the severity of the security incident, such as isolating infected devices, blocking suspicious connections, etc., thereby enhancing the system's response speed and defense effectiveness. In addition, the user-friendly graphical interface not only provides an intuitive display of the system's operating status, but also supports detailed log query functions, which greatly simplifies the administrator's operating procedures and improves management efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 This is a structural diagram of a computer information security protection system based on big data in the present invention.

[0022] Figure 2 This is a flow chart of a method for using a computer information security protection system based on big data according to the present invention. DETAILED DESCRIPTION

[0023] The technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments; based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0024] Example 1

[0025] like Figure 1 As shown, a computer information security protection system based on big data is characterized in that it includes: a data acquisition module for collecting network logs, system logs, application logs and other information from multiple data sources; a preprocessing module for performing preprocessing operations such as cleaning and formatting on the collected data to improve data quality and availability; a big data analysis engine, which uses machine learning and / or deep learning technology to analyze the preprocessed data and identify potential security threats; a threat assessment and response module, which evaluates the detected security incidents based on the big data analysis results and automatically triggers corresponding defense measures; a user interface, which provides an intuitive and easy-to-use operation interface, allowing administrators to easily view system status, management rule configuration and query history records.

[0026] like Figure 1As shown, the data acquisition module can support multiple data formats and protocols to ensure that the required information can be obtained from different data sources. The preprocessing module includes data denoising, missing value filling and outlier detection functions to ensure the validity and accuracy of the data. The big data analysis engine can automatically identify new attack patterns through training models to improve the detection capability of unknown threats. The threat assessment and response module can automatically select appropriate defense strategies according to the severity of the security incident, including isolating infected devices and blocking suspicious connections. The user interface supports graphical display of system operation status and provides detailed log query functions to facilitate administrators to track and analyze security incidents.

[0027] Example 1

[0028] like Figure 2 As shown, a method for using a computer information security protection system based on big data includes the following steps:

[0029] Step 1: Collect necessary log information from multiple data sources through the data collection module;

[0030] Step 2: Use the pre-processing module to clean and format the collected data to ensure data quality;

[0031] Step 3: Use the big data analysis engine to conduct in-depth analysis of the pre-processed data to identify potential security threats;

[0032] Step 4: The threat assessment and response module assesses the risk level of the security incident based on the analysis results and takes appropriate defensive measures;

[0033] Step 5: Provide system status display, rule management, log query and other functions through the user interface to facilitate administrator operation and management.

[0034] During implementation, the system comprises five main modules: a data acquisition module, a preprocessing module, a big data analysis engine, a threat assessment and response module, and a user interface. First, the data acquisition module collects information from multiple data sources (such as network logs, system logs, and application logs), supporting various data formats and protocols to ensure that the required log data can be obtained from different sources. Next, the preprocessing module cleans, formats, removes noise, fills in missing values, and detects outliers on the collected data to improve data quality and usability.

[0035] The Big Data Analytics Engine then uses advanced machine learning and / or deep learning technologies to conduct in-depth analysis of the preprocessed data and identify potential security threats. This engine automatically identifies new attack patterns through trained models, significantly improving its ability to detect unknown threats. When the Big Data Analytics Engine detects a potential security incident, the Threat Assessment and Response Module assesses the risk level based on the analysis results and automatically selects appropriate defense strategies, such as isolating infected devices and blocking suspicious connections, to rapidly implement appropriate defensive measures.

[0036] Finally, the user interface provides an intuitive and easy-to-use interface, allowing administrators to easily view system status, manage rule configurations, and query historical records. The user interface supports graphical displays of system operation status and provides detailed log query capabilities, making it easier for administrators to track and analyze security events, thereby better managing and maintaining system security.

[0037] In practical applications, this system can be deployed at key nodes within an enterprise's internal network. Through the collaborative work of these modules, the present invention effectively monitors and defends against various security threats, protecting both corporate and personal network security. The entire process is highly automated, significantly reducing the need for manual intervention while ensuring efficient system operation.

[0038] It should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that includes a list of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus.

[0039] While embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions, and variations may be made to these embodiments without departing from the principles and spirit of the invention, and that the scope of the invention is defined by the appended claims and their equivalents.

[0040] The present invention and its embodiments are described above. This description is not restrictive. The drawings show only one embodiment of the present invention, and the actual structure is not limited thereto. In short, if a person skilled in the art is inspired by this and, without departing from the purpose of the present invention, designs structures and embodiments similar to this technical solution without inventiveness, they shall fall within the scope of protection of the present invention.

Claims

1. A computer information security protection system based on big data, characterized in that: include: Data collection module, used to collect network logs, system logs, application logs and other information from multiple data sources; The preprocessing module is used to perform preprocessing operations such as cleaning and formatting on the collected data to improve data quality and availability; Big data analysis engine, using machine learning and / or deep learning techniques to analyze pre-processed data and identify potential security threats; The threat assessment and response module evaluates detected security incidents based on big data analysis results and automatically triggers corresponding defense measures; The user interface provides an intuitive and easy-to-use operation interface, allowing administrators to easily view system status, manage rule configurations, and query historical records.

2. A computer information security protection system based on big data according to claim 1, characterized in that: The data acquisition module can support multiple data formats and protocols to ensure that required information can be obtained from different data sources.

3. A computer information security protection system based on big data according to claim 1, characterized in that: The preprocessing module includes data denoising, missing value filling and outlier detection functions to ensure the validity and accuracy of the data.

4. A computer information security protection system based on big data according to claim 1, characterized in that: The big data analysis engine can automatically identify new attack patterns through training models and improve the ability to detect unknown threats.

5. A computer information security protection system based on big data according to claim 1, characterized in that: The threat assessment and response module can automatically select appropriate defense strategies according to the severity of the security incident, including isolating infected devices and blocking suspicious connections.

6. A computer information security protection system based on big data according to claim 1, characterized in that: The user interface supports graphical display of system operation status and provides detailed log query function, which is convenient for administrators to track and analyze security events.

7. The method for using a computer information security protection system based on big data according to claim 1, characterized in that: The following steps are involved: Step 1: Collect necessary log information from multiple data sources through the data collection module; Step 2: Use the preprocessing module to clean and format the collected data to ensure data quality; Step 3: Use the big data analysis engine to conduct in-depth analysis of the pre-processed data to identify potential security threats; Step 4: The threat assessment and response module assesses the risk level of the security incident based on the analysis results and takes corresponding defensive measures; Step 5: Provide system status display, rule management, log query and other functions through the user interface to facilitate administrators to operate and manage.

Images