Visual data security analysis method and system based on big data

Abstract

The invention discloses a visual data security analysis method and system based on big data, relates to the technical field of data security, and solves the technical problems that the cause of visual data exception is difficult to determine, an efficient identification and analysis mechanism is lacked, and a decision cannot be well provided for network security protection. According to the invention, real-time flow monitoring is carried out on the network link in the time period which can be set by an operator, and whether the flow change is abnormal or not is accurately judged through comparison with the preset value obtained based on historical data analysis, so that the mode can adapt to different network environments and service requirements, the accuracy and flexibility of abnormal flow detection are improved, and the working efficiency is improved. The problem that a traditional method lacks pertinence and dynamic adaptability in flow monitoring is solved, a multi-level and multi-dimensional analysis method can more accurately position the source and the property of the security risk, and a more detailed basis is provided for formulating an effective security strategy.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and in particular to a visual data security analysis method and system based on big data. Background Art

[0002] With the rapid development of information technology, the amount of data has exploded, and the network environment of enterprises and organizations has become increasingly complex. In this context, data security faces unprecedented challenges. Numerous security devices such as firewalls, intrusion detection systems, and antivirus software continue to generate massive amounts of log data, while audit data of systems and applications continues to accumulate. In addition, external threat intelligence data is also pouring in.

[0003] According to publication number CN116707940A, a data security visualization analysis method and system based on big data are disclosed, including building a security evaluation strategy, obtaining the real-time security factor at any time after the terminal device accesses the intranet through the security evaluation strategy, presetting the corresponding minimum pass coefficient for each page of the intranet, and comparing the real-time security factor with the preset minimum pass coefficient before the terminal device accesses each web page.

[0004] However, when analyzing visualized data, some existing technologies find it difficult to quickly and accurately determine whether traffic changes are abnormal and the real reasons behind the anomalies when faced with large-scale network link traffic data. They also lack efficient identification and analysis mechanisms for security risks caused by user operations and system operations themselves, and are unable to provide timely and effective decision-making basis for network security protection, making network systems vulnerable to various security attacks and data leakage risks, seriously affecting the normal operations and information asset security of enterprises and organizations. Summary of the invention

[0005] In view of the shortcomings of the prior art, the present invention provides a visual data security analysis method and system based on big data, which solves the problems of difficulty in determining the causes of visual data anomalies, lack of efficient identification and analysis mechanisms, and inability to provide good decision-making for network security protection.

[0006] To achieve the above objectives, the present invention is implemented through the following technical solutions: a visual data security analysis method based on big data, the method specifically comprises the following steps: Step 1: collect visualization data, and preprocess the collected visualization data to obtain preprocessed data; Step 2: monitor the network links according to the obtained pre-processed data, monitor the real-time traffic changes of different network links within a time period, and generate change monitoring results. The specific change monitoring results include normal traffic change results and abnormal traffic change results; Step 3: Analyze the abnormal flow change results obtained, and generate regular change results and irregular change results by analyzing the regularity of flow change conditions corresponding to the same period in historical data; Step 4: Analyze the regular change results, identify the data type of the real-time changing traffic, and perform risk analysis on the real-time traffic of different data types to obtain risk analysis results. Analyze the irregular change results, collect traffic packet information, perform periodic monitoring, and generate risk analysis results in combination with the corresponding traffic protocol distribution. Step 5: Analyze the normal flow change results obtained by monitoring the periodic flow change values ​​and generating monitoring results based on the adjacent periodic flow change values.

[0007] As a further solution of the present invention, the specific method of generating the change monitoring result in step 2 is: Obtain all network links and label them as i, where i=1, 2, ..., j, where j represents the number of network links. Then obtain the real-time flow change of preprocessed data in network link i with time t as a period, obtain the real-time flow change value, and compare the real-time flow change value with the preset value. If the real-time traffic change value is greater than the preset value, an abnormal traffic change result is generated, otherwise a normal traffic change result is generated.

[0008] As a further solution of the present invention, the specific method of analyzing the abnormal flow change result in step 3 is: The network link corresponding to the abnormal traffic change result is obtained and recorded as the abnormal link. At the same time, the historical data corresponding to the abnormal link is obtained, and the abnormal time period corresponding to the abnormal link is obtained. Then, the data of the same time period in the historical data is obtained based on the abnormal time period and recorded as comparative data. At the same time, the real-time traffic change corresponding to the comparative data is analyzed. If the real-time traffic changes are the same, a regular change result is generated. Conversely, if the real-time traffic changes are different, an irregular change result is generated.

[0009] As a further solution of the present invention, the specific method of analyzing the regular change results in step 3 is: Obtain preprocessed data corresponding to the regular change result, and classify the data types of the preprocessed data to obtain operation data and system data, and then analyze the classified operation data and system data respectively; Analyze the classified operation data to obtain user operation information, which includes operation frequency and operation amount. Then substitute the operation frequency and operation amount into the formula , where P represents the operation frequency, L represents the operation amount, a1 and a2 represent the corresponding weight coefficients, and the user's operation value Q is calculated according to the formula, and then the operation value Q is compared with the threshold Qy to generate normal information and risk information; The specific method of analyzing the classified system data is: obtaining the system log, and analyzing whether there is any non-system operation based on the system log, if so, generating risk information, otherwise generating normal information.

[0010] As a further solution of the present invention, the specific method of comparing the operation value Q with the threshold Qy in step 3 to generate normal information and risk information is: If the operation value Q is greater than the threshold value Qy, it means that there is a risk in the real-time traffic change and risk information is generated. Conversely, if the operation value Q is less than the threshold value Qy, it means that the real-time traffic change is normal and normal information is generated.

[0011] As a further solution of the present invention, the specific method of analyzing the irregular change results in step 4 is: Obtain the traffic packet information corresponding to the abnormal link, and obtain the corresponding traffic protocol distribution at the same time, and analyze and judge the two comprehensively. If the traffic protocol distribution is unstable and the corresponding traffic packet transmission is a large traffic packet transmission, high-risk information is generated comprehensively. If the traffic protocol distribution is unstable and the corresponding traffic packet transmission is a traffic packet transmission, medium-risk information is generated comprehensively. If the traffic protocol distribution is hot and the corresponding traffic packet transmission is a small traffic packet transmission, low-risk information is generated.

[0012] As a further solution of the present invention, the specific method of analyzing the normal flow change result in step 5 is: Obtain the flow change value, and simultaneously obtain the flow change value corresponding to the adjacent time period, and compare the two flow change values. If the difference between the two flow changes is a stable change, a stable change signal is generated, and normal monitoring is performed at the same time. On the contrary, if the difference between the two flow changes is an unstable change, an unstable change signal is generated, and secondary analysis is performed; Get the unstable change signal and determine the numerical value of the difference between the two flow changes. If the flow change difference between adjacent periods is greater than the flow change difference in the current period, generate risk information. Conversely, if the flow change difference between adjacent periods is less than the flow change difference in the current period, mark the current period, and obtain the user operations corresponding to the current period, and analyze them to generate risk analysis results.

[0013] A visual data security analysis system based on big data, comprising: a visual data acquisition unit, a link identification and analysis unit, a normal monitoring unit, a risk analysis unit and an analysis result output unit; A visualization data acquisition unit, which is used to acquire visualization data, process the visualization data to obtain pre-processed data, and transmit the obtained pre-processed data to the link identification and analysis unit; A link identification and analysis unit, which is used to analyze the acquired pre-processed data, monitor the network links according to the acquired pre-processed data, monitor the real-time traffic changes of different network links within a time period, and generate change monitoring results. The specific change monitoring results include normal traffic change results and abnormal traffic change results. The normal traffic change results are transmitted to the normal monitoring unit, and the abnormal traffic change results are transmitted to the risk analysis unit. A normal monitoring unit, which is used to analyze the normal flow change results obtained, monitor the periodic flow change values, and generate monitoring results according to the adjacent periodic flow change values, and transmit the obtained monitoring results to the analysis result output unit; A risk analysis unit, which is used to analyze the abnormal results of traffic changes obtained, generate regular change results and irregular change results by performing regularity analysis on the traffic changes corresponding to the same time period in the historical data, analyze the obtained regular change results, identify the data type of the real-time changing traffic, and perform risk analysis on the real-time traffic of different data types to obtain risk analysis results, analyze the obtained irregular change results, collect traffic packet information, perform periodic monitoring, and perform risk analysis in combination with the corresponding traffic protocol distribution to generate risk analysis results, and transmit the obtained risk analysis results to the analysis result output unit; The analysis result output unit is used to display the acquired analysis results and monitoring results to the corresponding operators.

[0014] The present invention provides a visual data security analysis method and system based on big data. Compared with the prior art, it has the following beneficial effects: The present invention proposes to monitor the real-time traffic of the network link in a time period that can be set by the operator, and accurately judges whether the traffic change is abnormal by comparing it with the preset value obtained based on historical data analysis. This method can adapt to different network environments and business needs, improve the accuracy and flexibility of abnormal traffic detection, and overcome the problem that traditional methods lack pertinence and dynamic adaptability in traffic monitoring; For abnormal traffic change results, it can not only distinguish regular changes from irregular changes, but also conduct further in-depth analysis. For regular change results, it comprehensively assesses risks by classifying and analyzing operation data and system data, taking into account factors such as operation frequency, operation volume, and non-system operations in system logs; for irregular change results, it divides risk levels based on traffic packet information and traffic protocol distribution. This multi-level and multi-dimensional analysis method can more accurately locate the source and nature of security risks, and provide a more detailed basis for formulating effective security strategies; When processing normal results of traffic changes, by monitoring the stability of traffic change values ​​in adjacent periods, potential unstable changes can be discovered in a timely manner, and the source and degree of risk can be further analyzed and determined when unstable changes occur. This helps to discover potential security risks in advance under seemingly normal traffic conditions, making up for the lack of sensitivity of traditional technologies to potential risks in normal traffic monitoring, and improving the integrity and foresight of the entire network security protection system. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 It is a step method diagram of the present invention; Figure 2 This is a block diagram of the system principle of the present invention. DETAILED DESCRIPTION

[0016] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0017] For example, see Figure 1 The present application provides a visual data security analysis method based on big data, which specifically includes the following steps: Step 1: collect visualization data, and preprocess the collected visualization data to obtain preprocessed data.

[0018] Collect log data from various security devices such as firewalls, intrusion detection systems, antivirus software, etc. These logs contain key security information such as network connection attempts, malware detection records, user authentication information, etc.

[0019] Collect audit data of systems and applications, including database access records, file access and modification records, etc., to understand the activities of internal systems.

[0020] External threat intelligence data is also an important source, such as lists of known malicious IP addresses, the latest vulnerability information, etc., which can help identify potential threats from outside.

[0021] Remove duplicate data records, as duplicate data may interfere with analysis results and take up unnecessary storage space. For example, in firewall logs, there may be a large number of duplicate port scan attempt records that need to be deduplicated.

[0022] Handle missing values. For some key data fields (such as user account information, IP address, etc.), missing values ​​need to be filled or marked according to the specific situation. If there are too many missing values, the reliability of the data may need to be considered.

[0023] Standardize data to convert data in different formats into a unified format. For example, timestamps can be standardized into a specific date and time format for subsequent time series analysis.

[0024] After the above processing, the preprocessed data is obtained.

[0025] Step 2: monitor the network links based on the obtained preprocessed data, monitor the real-time traffic changes of different network links within a time period, and generate change monitoring results. The specific change monitoring results include normal traffic change results and abnormal traffic change results.

[0026] All network links are obtained and labeled as i, where i=1, 2, ..., j, where j represents the number of network links. Then, the real-time flow change of pre-processed data in network link i is obtained with time t as a period, and the specific value of time t is set by the operator. For example, the time period t can be set to 5 minutes, which means that the system will collect the change information of the number of data uploads and downloads in each network link every 5 minutes to understand the dynamic change of the flow and obtain the real-time flow change value. At the same time, the real-time flow change value is compared with the preset value, and the specific value of the preset value is set by the operator, which is specifically obtained based on the historical data analysis of the corresponding network link, and the preset value is calculated by calculating the average flow change corresponding to the network link under normal circumstances as the preset value; If the real-time traffic change value is greater than the preset value, it means that the corresponding network link i is abnormal, and an abnormal traffic change result is generated. Conversely, if the real-time traffic change value is less than the preset value, it means that the corresponding network link i is normal, and a normal traffic change result is generated.

[0027] Step three, analyze the abnormal flow change results obtained, and generate regular change results and irregular change results by performing regularity analysis on the flow change conditions corresponding to the same period in the historical data.

[0028] The network link corresponding to the abnormal traffic change result is obtained and recorded as the abnormal link. At the same time, the historical data corresponding to the abnormal link is obtained, and the abnormal time period corresponding to the abnormal link is obtained. Then, the data of the same time period in the historical data is obtained based on the abnormal time period and recorded as the comparison data. For example, the traffic data of the link connecting the marketing department from 10:00 to 10:30 every morning in the past month (such as October 15, 2024 to November 14, 2024) is extracted from the stored historical data. At the same time, the real-time traffic change corresponding to the comparison data is analyzed, and here it is judged based on the real-time traffic change value. If the real-time traffic change is the same, a regular change result is generated. Conversely, if the real-time traffic change is different, an irregular change result is generated. Specifically, if the comparison data in the same time period in the historical data are the same, it means that it is regular in the time period. If the change is different, it means that it is irregular in the time period.

[0029] Step 4: Analyze the obtained regular change results, identify the data type of the real-time changing traffic, and perform risk analysis on the real-time traffic of different data types to obtain risk analysis results.

[0030] Obtain preprocessed data corresponding to the regular change results, and classify the data types of the preprocessed data to obtain operation data and system data. The operation data here refers to the data generated by user operations, while the system data is the data generated by the system itself, such as system updates or data backups. Then, analyze the classified operation data and system data separately; The specific method of analyzing the classified operation data is as follows: obtaining user operation information, and the user operation information includes operation frequency and operation amount, and the operation frequency is obtained by analyzing the number of operations within the scheduled time. The specific formula is operation frequency = number of operations ÷ scheduled time, and the value of the scheduled time is set by the operator, and the operation amount represents the corresponding data amount. Then substitute the operation frequency and operation amount into the formula , where P represents the operation frequency, L represents the operation amount, a1 and a2 represent the corresponding weight coefficients, and the user's operation value Q is calculated according to the formula, and then the operation value Q is compared with the threshold value Qy, and the value of the threshold value is set by the operator; If the operation value Q is greater than the threshold value Qy, it means that there is a risk in the real-time traffic change, and risk information is generated. Conversely, if the operation value Q is less than the threshold value Qy, it means that the real-time traffic change is normal, and normal information is generated; The specific method of analyzing the classified system data is: obtaining the system log, and analyzing whether there is any non-system operation based on the system log, and the non-system operation here means the record that is contrary to the normal system operation mode. If it exists, risk information is generated, otherwise, normal information is generated.

[0031] For example, during network security monitoring, a large number of data read requests from an unfamiliar external IP address were found in the system log, and these requests were for the company's core sensitive data files. However, the normal business logic and operating procedures of the system would not have such operations from this external IP. This can be determined as the presence of non-system operations, which further indicates that there is a risk.

[0032] Step five, analyze the irregular change results obtained by collecting traffic packet information and performing periodic monitoring, and generate risk analysis results by combining risk analysis with corresponding traffic protocol distribution.

[0033] The traffic packet information corresponding to the abnormal link is obtained, and the traffic packet information here includes the size and frequency of the traffic packet. At the same time, the corresponding traffic protocol distribution is obtained, and the two are comprehensively analyzed and judged. If the traffic protocol distribution is unstable and the corresponding traffic packet transmission is a large traffic packet transmission, high-risk information is comprehensively generated. If the traffic protocol distribution is unstable and the corresponding traffic packet transmission is a traffic packet transmission, medium-risk information is comprehensively generated. If the traffic protocol distribution is stable and the corresponding traffic packet transmission is a small traffic packet transmission, low-risk information is generated.

[0034] Embodiment 2, as Embodiment 2 of the present invention, this embodiment is implemented on the basis of Embodiment 1, and the difference from Embodiment 1 is as follows: This embodiment analyzes the normal flow change result obtained, monitors the periodic flow change value, and generates a monitoring result based on the adjacent periodic flow change values.

[0035] Obtain the flow change value, and simultaneously obtain the flow change value corresponding to the adjacent time period, and the adjacent time period here can be represented as the previous adjacent time period or the next adjacent time period, and compare the two flow change values, and the two flow change values ​​here respectively represent the change values ​​of the current time period and the adjacent time period. If the difference between the two flow changes is a stable change, a stable change signal is generated, and normal monitoring is performed at the same time. On the contrary, if the difference between the two flow changes is an unstable change, an unstable change signal is generated, and secondary analysis is performed; An unstable change signal is obtained, and the numerical size of the difference between the two flow changes is determined. If the flow change difference between adjacent periods is greater than the flow change difference in the current period, risk information is generated. Otherwise, if the flow change difference between adjacent periods is less than the flow change difference in the current period, the current period is marked. At the same time, the user operation corresponding to the current period is obtained, and analyzed to generate a risk analysis result. The specific analysis method here is the same as the processing process of step four in Example 1.

[0036] Embodiment 3, as the embodiment 3 of the present invention, focuses on combining the embodiment processes of embodiment 1 and embodiment 2 for implementation.

[0037] Example 4, please refer to Figure 2 The present application provides a visual data security analysis system based on big data, including: a visual data acquisition unit, a link identification and analysis unit, a normal monitoring unit, a risk analysis unit and an analysis result output unit, and the above functional units are unidirectionally electrically connected.

[0038] A visualization data acquisition unit, which is used to acquire visualization data, process the visualization data to obtain pre-processed data, and transmit the obtained pre-processed data to the link identification and analysis unit; A link identification and analysis unit, which is used to analyze the acquired pre-processed data, monitor the network links according to the acquired pre-processed data, monitor the real-time traffic changes of different network links within a time period, and generate change monitoring results. The specific change monitoring results include normal traffic change results and abnormal traffic change results. The processing method here is the same as the processing process of step 2 in embodiment 1. At the same time, the normal traffic change results are transmitted to the normal monitoring unit, and the abnormal traffic change results are transmitted to the risk analysis unit. A normal monitoring unit, which is used to analyze the normal flow change results obtained, monitor the periodic flow change values, and generate monitoring results according to the adjacent periodic flow change values. The processing method here is the same as the processing process in Example 2, and the obtained monitoring results are transmitted to the analysis result output unit; A risk analysis unit, which is used to analyze the abnormal results of traffic changes obtained, and generate regular change results and irregular change results by performing regularity analysis on the traffic changes corresponding to the same time period in the historical data. The processing method here is the same as the processing process of step three in Example 1. The obtained regular change results are analyzed, the data type of the real-time changing traffic is identified, and risk analysis is performed on real-time traffic of different data types to obtain risk analysis results. The processing method here is the same as the processing process of step four in Example 1. The obtained irregular change results are analyzed, and the risk analysis results are generated by collecting traffic packet information and performing periodic monitoring, and performing risk analysis in combination with the corresponding traffic protocol distribution. The processing method here is the same as the processing process of step five in Example 1, and the obtained risk analysis results are transmitted to the analysis result output unit; The analysis result output unit is used to display the acquired analysis results and monitoring results to the corresponding operators.

[0039] Some of the data in the above formulas are dimensionless and numerically calculated. Meanwhile, the contents not described in detail in this specification belong to the prior art known to those skilled in the art.

[0040] The above embodiments are only used to illustrate the technical method of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical method of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical method of the present invention.

Claims

1. A visual data security analysis method based on big data, characterized in that: The method specifically comprises the following steps: Step 1: collect visualization data, and preprocess the collected visualization data to obtain preprocessed data; Step 2: monitor the network links according to the obtained pre-processed data, monitor the real-time traffic changes of different network links within a time period, and generate change monitoring results. The specific change monitoring results include normal traffic change results and abnormal traffic change results; Step 3: Analyze the abnormal flow change results obtained, and generate regular change results and irregular change results by analyzing the regularity of flow change conditions corresponding to the same period in historical data; Step 4: Analyze the regular change results, identify the data type of the real-time changing traffic, and perform risk analysis on the real-time traffic of different data types to obtain risk analysis results. Analyze the irregular change results, collect traffic packet information, perform periodic monitoring, and generate risk analysis results in combination with the corresponding traffic protocol distribution. Step 5: Analyze the normal flow change results obtained by monitoring the periodic flow change values ​​and generating monitoring results based on the adjacent periodic flow change values.

2. According to the big data-based visual data security analysis method of claim 1, it is characterized in that: The specific method of generating the change monitoring result in step 2 is: Obtain all network links and label them as i, where i=1, 2, ..., j, where j represents the number of network links. Then obtain the real-time flow change of preprocessed data in network link i with time t as a period, obtain the real-time flow change value, and compare the real-time flow change value with the preset value. If the real-time traffic change value is greater than the preset value, an abnormal traffic change result is generated, otherwise a normal traffic change result is generated.

3. According to the big data-based visual data security analysis method of claim 1, it is characterized in that: The specific method of analyzing the abnormal flow change results in step 3 is: The network link corresponding to the abnormal traffic change result is obtained and recorded as the abnormal link. At the same time, the historical data corresponding to the abnormal link is obtained, and the abnormal time period corresponding to the abnormal link is obtained. Then, the data of the same time period in the historical data is obtained based on the abnormal time period and recorded as comparative data. At the same time, the real-time traffic change corresponding to the comparative data is analyzed. If the real-time traffic changes are the same, a regular change result is generated. Conversely, if the real-time traffic changes are different, an irregular change result is generated.

4. According to the big data-based visual data security analysis method of claim 1, it is characterized in that: The specific method of analyzing the regular change results in step 3 is: Obtain preprocessed data corresponding to the regular change result, and classify the data types of the preprocessed data to obtain operation data and system data, and then analyze the classified operation data and system data respectively; Analyze the classified operation data to obtain user operation information, which includes operation frequency and operation amount. Then substitute the operation frequency and operation amount into the formula , where P represents the operation frequency, L represents the operation amount, a1 and a2 represent the corresponding weight coefficients, and the user's operation value Q is calculated according to the formula, and then the operation value Q is compared with the threshold Qy to generate normal information and risk information; The specific method of analyzing the classified system data is: obtaining the system log, and analyzing whether there is any non-system operation based on the system log. If so, risk information is generated; otherwise, normal information is generated.

5. The method for visual data security analysis based on big data according to claim 4 is characterized in that: The specific method of comparing the operation value Q with the threshold Qy in step 3 to generate normal information and risk information is: If the operation value Q is greater than the threshold value Qy, it means that there is a risk in the real-time traffic change and risk information is generated. Conversely, if the operation value Q is less than the threshold value Qy, it means that the real-time traffic change is normal and normal information is generated.

6. The method for visual data security analysis based on big data according to claim 1, characterized in that: The specific method of analyzing the irregular change results in step 4 is: Obtain the traffic packet information corresponding to the abnormal link, and obtain the corresponding traffic protocol distribution at the same time, and comprehensively analyze and judge the two. If the traffic protocol distribution is unstable and the corresponding traffic packet transmission is a large traffic packet transmission, high-risk information is comprehensively generated. If the traffic protocol distribution is unstable and the corresponding traffic packet transmission is a traffic packet transmission, medium-risk information is comprehensively generated. If the traffic protocol distribution is stable and the corresponding traffic packet transmission is a small traffic packet transmission, low-risk information is generated.

7. The method for visual data security analysis based on big data according to claim 1 is characterized in that: The specific method of analyzing the normal flow change result in step 5 is: Obtain the flow change value, and simultaneously obtain the flow change value corresponding to the adjacent time period, and compare the two flow change values. If the difference between the two flow changes is a stable change, a stable change signal is generated, and normal monitoring is performed at the same time. On the contrary, if the difference between the two flow changes is an unstable change, an unstable change signal is generated, and secondary analysis is performed; Get the unstable change signal and determine the numerical value of the difference between the two flow changes. If the flow change difference between adjacent periods is greater than the flow change difference in the current period, generate risk information. Conversely, if the flow change difference between adjacent periods is less than the flow change difference in the current period, mark the current period, and obtain the user operations corresponding to the current period, and analyze them to generate risk analysis results.

8. A visual data security analysis system based on big data, used to execute a visual data security analysis method based on big data according to any one of claims 1 to 7, characterized in that: include: Visual data acquisition unit, link identification and analysis unit, normal monitoring unit, risk analysis unit and analysis result output unit; A visualization data acquisition unit, which is used to acquire visualization data, process the visualization data to obtain pre-processed data, and transmit the obtained pre-processed data to the link identification and analysis unit; A link identification and analysis unit, which is used to analyze the acquired pre-processed data, monitor the network links according to the acquired pre-processed data, monitor the real-time traffic changes of different network links within a time period, and generate change monitoring results. The specific change monitoring results include normal traffic change results and abnormal traffic change results. The normal traffic change results are transmitted to the normal monitoring unit, and the abnormal traffic change results are transmitted to the risk analysis unit. A normal monitoring unit, which is used to analyze the normal flow change results obtained, monitor the periodic flow change values, and generate monitoring results according to the adjacent periodic flow change values, and transmit the obtained monitoring results to the analysis result output unit; A risk analysis unit, which is used to analyze the abnormal results of traffic changes obtained, generate regular change results and irregular change results by performing regularity analysis on the traffic changes corresponding to the same time period in the historical data, analyze the obtained regular change results, identify the data type of the real-time changing traffic, and perform risk analysis on the real-time traffic of different data types to obtain risk analysis results, analyze the obtained irregular change results, collect traffic packet information, perform periodic monitoring, and perform risk analysis in combination with the corresponding traffic protocol distribution to generate risk analysis results, and transmit the obtained risk analysis results to the analysis result output unit; The analysis result output unit is used to display the acquired analysis results and monitoring results to the corresponding operators.

Images