Network security protection intelligent construction method and device based on big data, and readable medium

Abstract

The invention discloses a network security protection intelligent construction method and device based on big data and a readable medium, relates to the field of network security protection, and solves the problem that the current public network security protection mainly depends on regular scanning and cannot monitor the network use condition of a user connected with a public network in real time. The method comprises the following steps: acquiring historical traffic log data of a user connected with a public network; acquiring a historical user address of a user connected with the public network and a historical target address when the user accesses each time, and encoding the historical user address and the historical target address; calculating a historical network active score threshold value of a user connected with the public network based on the historical traffic log data; and calculating the real-time network activity score of the currently connected user of the public network, and analyzing the network use security of the currently connected user of the public network in combination with the historical network activity score threshold and the historical user code packet, thereby realizing intelligent protection of the network use condition of the user in the public network.

Description

Technical Field

[0001] The present invention belongs to the field of network security protection, and specifically relates to a method, device and readable medium for intelligently constructing network security protection based on big data. Background Art

[0002] Network security protection is a network security technology that is dedicated to solving technical problems such as how to effectively conduct intervention control and how to ensure the security of data transmission. Network security protection technology mainly includes physical security analysis technology, network structure security analysis technology, system security analysis technology, management security analysis technology, and other security services and security mechanism strategies.

[0003] In current network security protection, network security inspections of public networks mainly rely on regular scanning. Although this method is effective in dealing with known threats, it cannot monitor the network usage of users connected to the public network in real time. In addition, real-time monitoring of the public network is lagging, which increases the network security management cost of the public network and also increases the security risks of users using the public network.

[0004] To this end, the present invention proposes a method, device and readable medium for intelligently building network security protection based on big data. Summary of the invention

[0005] The purpose of the present invention is to propose a method, device and readable medium for intelligent construction of network security protection based on big data to solve the problems raised in the above background technology.

[0006] The technical problems to be solved by the present invention are:

[0007] How to provide intelligent protection for users' network usage in public networks.

[0008] In order to achieve the above object, the present invention adopts the following technical solutions:

[0009] The intelligent construction method of network security protection based on big data is as follows:

[0010] Step S100, obtaining historical traffic log data of users connected to the public network;

[0011] Step S200, obtaining the historical user address of the user connected to the public network and the historical target address of each user access, and encoding the historical user address and the historical target address;

[0012] Step S300, calculating a historical network activity score threshold of users connected to the public network based on historical traffic log data;

[0013] Step S400, calculating the real-time network activity score of the user currently connected to the public network, and analyzing the network security of the user currently connected to the public network in combination with the historical network activity score threshold and the historical user code package.

[0014] Furthermore, the historical traffic log data includes the historical connection duration of users connected to the public network, the historical bandwidth consumption and the historical traffic consumption when the users are connected to the public network.

[0015] Furthermore, the step S200 includes the following sub-steps:

[0016] Step S2001, obtaining the historical user addresses of users connected to the public network and the historical target addresses of each user access;

[0017] Step S2002, calculating the historical user address codes of users connected to the public network and the historical target address codes of each user access through a calculation formula;

[0018] Step S2003, integrating the historical user address codes and the historical target address codes of each user visit into a historical user code package of the public network.

[0019] Furthermore, the calculation formula of the historical user address code is: YH = a1 × 256 3 +a2×256 2 +a3×256 1 +a4, where a1, a2, a3 and a4 represent the eight-bit bytes of the historical user address respectively, and the value range of a1, a2, a3 and a4 is 0-255;

[0020] The calculation formula for the historical target address encoding is: MBj = b1 × 256 3 +b2×256 2 +b3×256 1 +b4, where j is the number of the historical target address code, b1, b2, b3 and b4 represent the eight-bit bytes of the historical target address each time the user accesses, and the value range of b1, b2, b3 and b4 is 0-255.

[0021] Furthermore, the step S300 includes the following sub-steps:

[0022] Step S3001, obtaining the historical traffic log data of the user connected to the public network, obtaining the historical connection time SCi of the user connecting to the public network, the historical bandwidth consumption DKi and the historical traffic consumption LLi consumed by the user when connecting to the public network, where i is the user number;

[0023] Step S3002: Based on the historical traffic log data of the user connected to the public network, the historical network activity score of the user connected to the public network is calculated by a formula. The historical network activity score formula is as follows:

[0024] R = w1×SCi+w2×DKi+w3×LLi, where w1, w2 and w3 are weight coefficients with fixed values, and w1>w2>w3;

[0025] Step S3003, drawing a historical network activity score histogram based on the historical network activity scores of users connected to the public network;

[0026] Step S3004: Calculate the historical network activity score threshold of the user connected to the public network through the historical network activity score.

[0027] Furthermore, the process of obtaining the historical network activity score threshold is as follows:

[0028] The mean and standard deviation of the historical network activity scores of users connected to the public network are calculated respectively;

[0029] The historical network activity score threshold is calculated using the formula, which is as follows:

[0030] Historical network activity score threshold = mean + k × standard deviation, where k is a fixed weight coefficient.

[0031] Furthermore, the step S400 includes the following sub-steps:

[0032] Step S4001, obtaining real-time traffic log data of users connected to the public network, calculating the real-time network activity score of the users connected to the public network, and comparing the real-time network activity score with a historical network activity score threshold;

[0033] Among them, the real-time traffic log data includes the real-time connection duration of the user currently connected to the public network, the real-time bandwidth consumption and real-time traffic consumption of the current user when connected to the public network, and the calculation process of the real-time network activity score is the same as that of the historical network activity score;

[0034] Step S4002: If the real-time network activity score is less than or equal to the historical network activity score threshold, it is determined to be normal behavior;

[0035] If the real-time network activity score is greater than the historical network activity score threshold, proceed to the next step;

[0036] Step S4003, obtaining a historical user code packet of the public network, obtaining a historical user address code and a historical target address code of each user access, and then obtaining a real-time target address of each user access, and calculating a corresponding real-time target address code;

[0037] Step S4004, comparing the real-time user address code with the historical user address code.

[0038] Furthermore, the step S400 further includes the following sub-steps:

[0039] Step S4005, if the real-time user address code is the same as the historical user address code, then obtain the real-time target address of each user access, calculate the corresponding real-time target address code, and proceed to the next step;

[0040] If the real-time user address code is different from the historical user address code, the identity of the user corresponding to the real-time user address code is verified. If the user identity is a normal user, the real-time user address code is saved in the historical user code package and the next step is entered. If the user identity is an abnormal user, the network access of the user currently connected to the public network is disconnected;

[0041] Step S4006, comparing the real-time target address code with the historical target address code in the historical user code packet one by one;

[0042] Step S4007, if the real-time target address code is the same as any historical target address code, no operation is performed;

[0043] If the real-time target address code is different from all historical target address codes, proceed to the next step;

[0044] Step S4008, based on big data, security monitoring is performed on the real-time target addresses of users connected to the public network when accessing the network;

[0045] When the real-time target address is an unknown target address, the network access of the user currently connected to the public network is disconnected;

[0046] When the real-time target address is a known target address, the real-time target address code corresponding to the real-time target address is saved in the user code package.

[0047] An electronic device, comprising:

[0048] A memory storing a computer program;

[0049] A processor is communicatively connected to the memory, and when the computer program is executed by the processor, an intelligent construction method for network security protection is implemented.

[0050] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements an intelligent construction method for network security protection.

[0051] In summary, due to the adoption of the above technical solution, the beneficial effects of the present invention are:

[0052] The present invention first obtains the historical user addresses of users connected to the public network and the historical target addresses of each user access, and encodes the historical user addresses and historical target addresses, and simultaneously obtains the historical traffic log data of users connected to the public network, and then calculates the historical network activity score threshold of users connected to the public network through the historical traffic log data. When the user actually uses the network, the real-time network activity score of the user currently connected to the public network is analyzed, and the network security of the user currently connected to the public network is analyzed in combination with the historical network activity score threshold and the historical user encoding package. The present invention realizes intelligent protection of the network usage of users in the public network. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] In order to facilitate understanding by those skilled in the art, the present invention is further described below with reference to the accompanying drawings.

[0054] Figure 1 is the overall system block diagram of the present invention;

[0055] Figure 2 is the histogram of historical network activity scores;

[0056] Figure 3 It is a schematic diagram of the structure of the electronic device in the present invention. DETAILED DESCRIPTION

[0057] The technical solution of the present invention will be clearly and completely described below in conjunction with the embodiments. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0058] Example 1: Please refer to Figure 1-Figure 2 As shown, the technical solution provided by the present invention is: a method for intelligently constructing network security protection based on big data. In this embodiment, the method is mainly used to analyze the network security of users connected to the public network when the user connects to the public network. The public network includes the local area network of the shopping mall or the local area network of the company. In this embodiment, the public network is preferably the local area network of the company. The method is specifically as follows:

[0059] Step S100, obtaining historical traffic log data of users connected to the public network;

[0060] Specifically, the historical traffic log data includes the historical connection duration of users connected to the public network, the historical bandwidth consumption and the historical traffic consumption when users connect to the public network.

[0061] Step S200, obtaining the historical user address of the user connected to the public network and the historical target address of each user access, and encoding the historical user address and the historical target address; wherein the historical target address is a website address that is safe and can be accessed normally;

[0062] In this embodiment, step S200 includes the following sub-steps:

[0063] Step S2001, obtaining the historical user addresses of users connected to the public network and the historical target addresses of each user access;

[0064] Step S2002, obtaining the historical user address codes of users connected to the public network and the historical target address codes of each user access through formula calculation;

[0065] The historical user address encoding formula is: YH = a1 × 256 3 +a2×256 2 +a3×256 1 +a4, where a1, a2, a3 and a4 represent the eight-bit bytes of the historical user address respectively, and the value range of a1, a2, a3 and a4 is 0-255;

[0066] The historical target address encoding formula is: MBj = b1 × 256 3 +b2×256 2 +b3×256 1 +b4, where j is the number of the historical target address code, b1, b2, b3 and b4 represent the eight-bit bytes of the historical target address of each user access, and the value range of b1, b2, b3 and b4 is 0-255;

[0067] For example, when the historical user address is 192.168.1.1 and the historical target address is 203.0.113.5, YH=192×256 3 +168×256 2 +1×256 1 +1, at this time YH=3232235777, MBj=203×256 3 +0×256 2 +113×256 1 +5, at this time MBj=3415731717;

[0068] Step S2003, integrating the historical user address codes and the historical target address codes of each user visit into a historical user code package of the public network.

[0069] Step S300, calculating a historical network activity score threshold of users connected to the public network based on historical traffic log data;

[0070] In this embodiment, step S300 includes the following sub-steps:

[0071] Step S3001, obtaining the historical traffic log data of the user connected to the public network, obtaining the historical connection time SCi of the user connecting to the public network, the historical bandwidth consumption DKi and the historical traffic consumption LLi consumed by the user when connecting to the public network, where i is the user number;

[0072] Step S3002: Based on the historical traffic log data of the user connected to the public network, the historical network activity score of the user connected to the public network is calculated by a formula. The historical network activity score formula is as follows:

[0073] R = w1×SCi+w2×DKi+w3×LLi, where w1, w2 and w3 are weight coefficients with fixed values, and w1>w2>w3;

[0074] Step S3003, see Figure 2 As shown, a histogram of historical network activity scores is drawn based on the historical network activity scores of users connected to the public network;

[0075] It should be explained that the horizontal axis of the historical network activity score histogram represents the historical network activity scores of users connected to the public network, and the vertical axis represents the number of times the historical network activity scores appear in each historical network activity score interval;

[0076] Step S3004, obtaining a historical network activity score threshold of users connected to the public network through historical network activity score calculation;

[0077] Specifically, the mean and standard deviation of the historical network activity scores of users connected to the public network are calculated respectively, and the historical network activity score threshold is calculated using the formula. The formula is as follows:

[0078] Historical network activity score threshold = mean + k × standard deviation, where k is a fixed weight coefficient, usually k = 2 or k = 3;

[0079] It should be explained that in the standard normal distribution, the data distribution pattern is: 68.27% of the data are within the range of mean ± 1 × standard deviation, 95.45% of the data are within the range of mean ± 2 × standard deviation, and 99.73% of the data are within the range of mean ± 3 × standard deviation; when k = 2, it is used to mark data points that deviate from the mean, and there are false positives, and the remaining 4.55% of the data are marked as abnormal; when k = 3, it is used to reduce false positives, and the remaining 0.27% of the data are marked as abnormal;

[0080] Exemplarily, when the mean of the historical network activity scores=65, the standard deviation=5, and k=3, the historical network activity score threshold=80.

[0081] Step S400, calculating the real-time network activity score of the user currently connected to the public network, and analyzing the network security of the user currently connected to the public network in combination with the historical network activity score threshold and the historical user code packet;

[0082] In this embodiment, step S400 includes the following sub-steps:

[0083] Step S4001, obtaining real-time traffic log data of users connected to the public network, calculating the real-time network activity score of the users connected to the public network, and comparing the real-time network activity score with a historical network activity score threshold;

[0084] Among them, the real-time traffic log data includes the real-time connection duration of the user currently connected to the public network, the real-time bandwidth consumption and real-time traffic consumption of the current user when connected to the public network, and the calculation process of the real-time network activity score is the same as that of the historical network activity score;

[0085] Step S4002: If the real-time network activity score is less than or equal to the historical network activity score threshold, it is determined to be normal behavior;

[0086] If the real-time network activity score is greater than the historical network activity score threshold, proceed to the next step;

[0087] Step S4003, obtaining a historical user code packet of the public network, obtaining a historical user address code and a historical target address code of each user access, and then obtaining a real-time target address of each user access, and calculating a corresponding real-time target address code;

[0088] Step S4004, comparing the real-time user address code with the historical user address code;

[0089] Step S4005, if the real-time user address code is the same as the historical user address code, then obtain the real-time target address of each user access, calculate the corresponding real-time target address code, and proceed to the next step;

[0090] If the real-time user address code is different from the historical user address code, the identity of the user corresponding to the real-time user address code is verified. If the user identity is a normal user, the real-time user address code is saved in the historical user code package and the next step is entered. If the user identity is an abnormal user, the network access of the user currently connected to the public network is disconnected;

[0091] Step S4006, comparing the real-time target address code with the historical target address code in the historical user code packet one by one;

[0092] Step S4007, if the real-time target address code is the same as any historical target address code, no operation is performed;

[0093] If the real-time target address code is different from all historical target address codes, proceed to the next step;

[0094] Step S4008, based on big data, security monitoring is performed on the real-time target addresses of users connected to the public network when accessing the network;

[0095] When the real-time target address is an unknown target address, the network access of the user currently connected to the public network is disconnected;

[0096] When the real-time target address is a known target address, the real-time target address code corresponding to the real-time target address is saved in the user code package;

[0097] In this application, if corresponding calculation formulas appear, the above calculation formulas are all dimensionless and take their numerical calculations. The weight coefficients, proportional coefficients and other coefficients in the formulas are set to a result value obtained by quantifying each parameter. The size of the weight coefficient and the proportional coefficient can be determined as long as it does not affect the proportional relationship between the parameter and the result value.

[0098] Embodiment 2: Figure 3 An example of a structural diagram of an electronic device is shown in FIG. Figure 3As shown, the electronic device may include: a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus. The processor may call the logic instructions in the memory to execute a method for intelligently constructing network anomaly protection based on big data, the method comprising: obtaining historical traffic log data of users connected to the public network; obtaining the historical user addresses of users connected to the public network and the historical target addresses of each user access, and encoding the historical user addresses and historical target addresses; calculating the historical network activity score threshold of users connected to the public network based on the historical traffic log data; calculating the real-time network activity score of users currently connected to the public network, and analyzing the network security of users currently connected to the public network in combination with the historical network activity score threshold and the historical user coding package.

[0099] In addition, the logic instructions in the above-mentioned memory can be implemented in the form of software functional units and can be stored in a computer-readable storage medium when sold or used as an independent product. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art, and the computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a disk or an optical disk.

[0100] Embodiment 3: The present application also provides a computer program product, which includes a computer program stored on a computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer can execute the network anomaly protection intelligent construction method based on big data provided by the above methods, and the method includes: obtaining historical traffic log data of users connected to the public network; obtaining historical user addresses of users connected to the public network and historical target addresses of each user access, and encoding the historical user addresses and historical target addresses; calculating the historical network activity score threshold of users connected to the public network based on the historical traffic log data; calculating the real-time network activity score of users currently connected to the public network, and analyzing the network security of users currently connected to the public network in combination with the historical network activity score threshold and the historical user coding package.

[0101] Embodiment 4: The present application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to execute the above-mentioned network anomaly protection intelligent construction readable medium based on big data, the method comprising: obtaining historical traffic log data of users connected to the public network; obtaining historical user addresses of users connected to the public network and historical target addresses of each user access, and encoding the historical user addresses and historical target addresses; calculating the historical network activity score threshold of users connected to the public network based on the historical traffic log data; calculating the real-time network activity score of users currently connected to the public network, and analyzing the network security of users currently connected to the public network in combination with the historical network activity score threshold and the historical user coding package.

[0102] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0103] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0104] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for intelligently building network security protection based on big data, characterized in that: The specific method for building network security protection intelligence is as follows: Step S100, obtaining historical traffic log data of users connected to the public network; Step S200, obtaining the historical user address of the user connected to the public network and the historical target address of each user access, and encoding the historical user address and the historical target address; Step S300, calculating a historical network activity score threshold of users connected to the public network based on historical traffic log data; Step S400, calculating the real-time network activity score of the user currently connected to the public network, and analyzing the network security of the user currently connected to the public network in combination with the historical network activity score threshold and the historical user code package.

2. The method for intelligently building network security protection based on big data according to claim 1 is characterized in that: Historical traffic log data includes the historical connection duration of users connected to the public network, the historical bandwidth consumption and historical traffic consumption when users connect to the public network.

3. The method for intelligently building network security protection based on big data according to claim 2 is characterized in that: The step S200 includes the following sub-steps: Step S2001, obtaining the historical user addresses of users connected to the public network and the historical target addresses of each user access; Step S2002, calculating the historical user address codes of users connected to the public network and the historical target address codes of each user access through a calculation formula; Step S2003, integrating the historical user address codes and the historical target address codes of each user visit into a historical user code package of the public network.

4. The method for intelligently constructing network security protection based on big data according to claim 3 is characterized in that: The calculation formula for the historical user address code is: YH = a1 × 256 3 +a2×256 2 +a3×256 1 +a4, where a1, a2, a3 and a4 represent the eight-bit bytes of the historical user address respectively, and the value range of a1, a2, a3 and a4 is 0-255; The calculation formula for the historical target address encoding is: MBj = b1 × 256 3 +b2×256 2 +b3×256 1 +b4, where j is the number of the historical target address code, b1, b2, b3 and b4 represent the eight-bit bytes of the historical target address each time the user accesses, and the value range of b1, b2, b3 and b4 is 0-255.

5. The method for intelligently constructing network security protection based on big data according to claim 4 is characterized in that: The step S300 includes the following sub-steps: Step S3001, obtaining the historical traffic log data of the user connected to the public network, obtaining the historical connection time SCi of the user connecting to the public network, the historical bandwidth consumption DKi and the historical traffic consumption LLi consumed by the user when connecting to the public network, where i is the user number; Step S3002: Based on the historical traffic log data of the user connected to the public network, the historical network activity score of the user connected to the public network is calculated by a formula. The historical network activity score formula is as follows: R = w1×SCi+w2×DKi+w3×LLi, where w1, w2 and w3 are weight coefficients with fixed values, and w1>w2>w3; Step S3003, drawing a historical network activity score histogram based on the historical network activity scores of users connected to the public network; Step S3004: Calculate the historical network activity score threshold of the user connected to the public network through the historical network activity score.

6. The method for intelligently constructing network security protection based on big data according to claim 5 is characterized in that: The process of obtaining the historical network activity score threshold is as follows: The mean and standard deviation of the historical network activity scores of users connected to the public network are calculated respectively; The historical network activity score threshold is calculated using the formula, which is as follows: Historical network activity score threshold = mean + k × standard deviation, where k is a fixed weight coefficient.

7. The method for intelligently building network security protection based on big data according to claim 5 is characterized in that: The step S400 includes the following sub-steps: Step S4001, obtaining real-time traffic log data of users connected to the public network, calculating the real-time network activity score of the users connected to the public network, and comparing the real-time network activity score with a historical network activity score threshold; Among them, the real-time traffic log data includes the real-time connection duration of the user currently connected to the public network, the real-time bandwidth consumption and real-time traffic consumption of the current user when connected to the public network, and the calculation process of the real-time network activity score is the same as that of the historical network activity score; Step S4002: If the real-time network activity score is less than or equal to the historical network activity score threshold, it is determined to be normal behavior; If the real-time network activity score is greater than the historical network activity score threshold, proceed to the next step; Step S4003, obtaining a historical user code packet of the public network, obtaining a historical user address code and a historical target address code of each user access, and then obtaining a real-time target address of each user access, and calculating a corresponding real-time target address code; Step S4004, comparing the real-time user address code with the historical user address code.

8. The method for intelligently constructing network security protection based on big data according to claim 7 is characterized in that: The step S400 further includes the following sub-steps: Step S4005, if the real-time user address code is the same as the historical user address code, then obtain the real-time target address of each user access, calculate the corresponding real-time target address code, and proceed to the next step; If the real-time user address code is different from the historical user address code, the identity of the user corresponding to the real-time user address code is verified. If the user identity is a normal user, the real-time user address code is saved in the historical user code package and the next step is entered. If the user identity is an abnormal user, the network access of the user currently connected to the public network is disconnected; Step S4006, comparing the real-time target address code with the historical target address code in the historical user code packet one by one; Step S4007, if the real-time target address code is the same as any historical target address code, no operation is performed; If the real-time target address code is different from all historical target address codes, proceed to the next step; Step S4008, based on big data, security monitoring is performed on the real-time target addresses of users connected to the public network when accessing the network; When the real-time target address is an unknown target address, the network access of the user currently connected to the public network is disconnected; When the real-time target address is a known target address, the real-time target address code corresponding to the real-time target address is saved in the user code package.

9. An electronic device, characterized in that: The electronic device comprises: A memory storing a computer program; A processor is communicatively connected to the memory, and when the computer program is executed by the processor, the method described in any one of claims 1 to 8 is implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 8 is implemented.

Images