Information security protection system based on big data
By designing a big data-based information security protection system, the problem that traditional systems cannot efficiently process and analyze massive enterprise business data is solved, and efficient processing of enterprise business data and prediction and intervention of security threats are achieved, and information security is effectively protected. .
Patent Information
- Application Number
- CN202411670542.X
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-21
- Publication Date
- 2025-02-21
- Estimated Expiration
- Not applicable · inactive patent
AI Technical Summary
Traditional information protection systems cannot efficiently process and analyze massive enterprise operating data, cannot predict potential security threats, and cannot intervene before an attack occurs.
An information security protection system based on big data is designed, including data acquisition module, data processing module, data mining module, data storage module, data analysis module and security decision-making module. The system realizes efficient processing of enterprise business data and predicts and interventions of security threats through multiple modules of collection, processing, mining, storage, analysis and decision-making.
The system can efficiently process and analyze massive enterprise operating data, predict potential security threats, and intervene before an attack occurs to effectively protect information security.
Smart Images
Figure CN119494109A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of information security, and in particular to an information security protection system based on big data. Background Art
[0002] With the development of Internet technology, more and more network companies have emerged. A large amount of data is stored on the servers of enterprises, including corporate secrets and a large amount of user privacy data. Once the data is leaked due to malicious attacks, it will cause the leakage of corporate secrets and threaten the user information security and privacy protection. In the prior art, traditional information protection systems are unable to efficiently process and analyze massive amounts of business data, are unable to predict potential security threats, and help prevent attackers from intervening before the attack. To this end, an information security protection system based on big data is now provided. Summary of the invention
[0003] In order to solve the above technical problems, the purpose of the present invention is to provide an information security protection system based on big data.
[0004] The object of the present invention can be achieved by the following technical solutions: an information security protection system based on big data, comprising a control center, wherein the control center is communicatively connected with a data acquisition module, a data processing module, a data mining module, a data storage module, a data analysis module and a security decision module; The data collection module is used to collect enterprise operation data from the enterprise's server; The data processing module is used to process the privacy data in the enterprise operation data and complete the encryption of the privacy data; The data mining module is used to perform data mining on the enterprise operation data processed by the data processing module; The data storage module is used to perform distributed storage on the mined business operation data; The data analysis module is used to analyze the stored business operation data to determine whether there are any anomalies in the business operation data; The security decision module is used to formulate corresponding security policies according to the analysis results.
[0005] Furthermore, the process of the data collection module collecting the enterprise operation data from the enterprise's server includes: The data acquisition module is composed of several data acquisition terminals. Each data acquisition terminal is configured and a corresponding configuration channel is generated. The server of the corresponding enterprise is linked through the generated configuration channel. The data acquisition terminal obtains the enterprise operation data in the corresponding server through the configuration channel and sends the obtained enterprise operation data to the data processing module. Furthermore, the configuration content of the data acquisition terminal includes: Pre-configure the server's IP address and communication port in the configuration file of the data collection terminal, configure the timeout time for connecting to the server and the number and interval of reconnections when the connection fails in the configuration file, set the timeout time for connecting to the server to 30 seconds, set the number of connection failures to 3 times and the interval to 10 seconds, set the data collection terminal to collect business data once a second, and when the data collection terminal is started, label the data collection terminal as i, i=1, 2, 3, ..., n, where n is an integer, and generate a terminal unique identifier and terminal status information according to the label; The terminal status information refers to two states of the terminal, namely, working state and fault state, and the private data includes the user's personal information and bank account number.
[0006] The process of the data processing module processing the privacy data in the enterprise operation data includes: Generate a random 128-bit binary key, convert the private data into a corresponding decimal data stream, and decompose the converted data stream into several data blocks with a data length of 128; When the data length of a data block is not a multiple of 128, pad the data block, and the padding length is equal to the remainder of the data block size minus the privacy data length divided by the data block size. According to the calculated padding length, a corresponding number of padding bytes are added at the end of the data, and the value of the padding bytes is equal to the padding length; Set a mapping table, replace the bytes of the data block according to the mapping table, where the replacement result is "0" or "1", obtain the corresponding binary data stream, compare the replaced data block with the key bit by bit, when the corresponding bit values are different, the result is 1, when the corresponding bit values are the same, the result is 0, divide the compared data block into several 4x4 matrices, perform multiple rounds of encryption cycles on the data block, each round of encryption cycle includes keeping the first row of each 4x4 matrix unchanged, cyclically shifting the second row to the left by one byte, cyclically shifting the third row to the left by two bytes, and cyclically shifting the fourth row to the left by three bytes, converting the 4x4 matrix into a data block and performing an XOR operation with the key; By analogy, the data block obtained in the last round of encryption is the final encrypted private data; The encrypted private data and unencrypted non-private data are transmitted to the data mining module for data mining.
[0007] Furthermore, the process of the data mining module performing data mining on the enterprise operation data processed by the data processing module includes: Construct a coordinate system, quantify the business operation data, and map the quantification results into the coordinate system to obtain the corresponding data sample points; For each data sample point, calculate the distance between it and the n data sample points closest to it, where n is a positive integer; x1, x2 represent the horizontal coordinates, y1, y2 represent the vertical coordinates, the coordinates of data sample point A and data sample point B are (x1, y1) and (x2, y2) respectively. Defined as the square of the distance between data sample point A and data sample point B on the X-axis, Defined as the square of the distance between data sample point A and data sample point B on the y-axis, d^2 is defined as the square of the distance between two data sample points, and d is defined as the distance between two data sample points; The maximum value of the distance between a data sample point and the n data sample points closest to it is defined as the reachable distance, the sum of the reciprocals of the reachable distances of the n data sample points closest to the data sample point is defined as the local reachable density of the data sample point, and the sum of the ratios of the local reachable density of a data sample point to the local reachable density of the n data sample points closest to it is defined as the local anomaly factor value of the data sample point. Abnormal samples are identified by comparing the local anomaly factor value of each data sample point. When the local anomaly factor value of a data sample point is significantly different from the local anomaly factor values of other data sample points, the data sample point is determined to be an abnormal sample, otherwise it is determined to be a normal sample, and the mined business data of the enterprise is sent to the data storage module for storage.
[0008] Furthermore, the process of the data storage module distributing and storing the mined business operation data includes: A first storage unit and a second storage unit are provided, wherein the first storage unit and the second storage unit are respectively provided with a plurality of storage subunits, wherein the first storage unit is used to store normal samples, and the second storage unit is used to store abnormal samples, and data is stored in the plurality of storage subunits, wherein the storage subunits do not interfere with each other, and each storage subunit is provided with a location positioning terminal for positioning storage information; After being transmitted to the data storage module, the normal samples and the abnormal samples are respectively stored in the first storage unit and the second storage unit. The first storage unit and the second storage unit distribute the normal samples and the abnormal samples to different storage sub-units according to the load of the storage device. The first storage unit and the second storage unit copy the normal samples and the abnormal samples to multiple storage sub-units. When a storage sub-unit fails, the first storage unit and the second storage unit obtain samples of the failed storage sub-unit from other storage sub-units.
[0009] Furthermore, the process of the data analysis module analyzing the stored business operation data includes: The data analysis module obtains real-time threat intelligence data from public threat intelligence sharing platforms and security research institutions. The threat intelligence data includes known malicious IP addresses. The data analysis module obtains information about ongoing and planned network attacks from hacker forums, wherein the network attack information includes unknown malicious IP addresses; The data analysis module subscribes to a blacklist service from a security vendor that provides the blacklist service, wherein the blacklist includes malicious IP addresses; Set the acquired malicious IP addresses to the malicious IP address list; The source of the abnormal sample is compared with the malicious IP address list, and the similarity between the source of the abnormal sample and the IP in the malicious IP address list is obtained based on the comparison result. Based on the obtained similarity, the type of the source of the abnormal sample is determined.
[0010] Furthermore, the security decision module formulates corresponding security policies according to the analysis results, including: When the source type of the abnormal sample is a malicious attack IP, the IP address of the abnormal sample will be banned and the abnormal sample will be added to the blacklist; When the source type of the abnormal sample is an abnormal behavior IP, the abnormal sample is sent to the control center and an alarm is issued.
[0011] Compared with the prior art, the beneficial effects of the present invention are as follows: the enterprise operation data is collected by the data collection module, the collected enterprise operation data is processed by the data processing module, the privacy data is encrypted, the processed enterprise operation data is transmitted to the data mining module for mining, the data mining module mines the enterprise operation data processed by the data processing module, and the mined enterprise operation data is sent to the data storage module for distributed storage, the data analysis module analyzes the stored enterprise operation data to analyze whether there is anomaly in the enterprise operation data, the data analysis module obtains malicious IP addresses from public threat intelligence sources, hacker forums, and blacklists provided by security vendors, and the obtained malicious I The P address is set to a malicious IP address list, and the source of the abnormal sample is compared with the malicious IP address list. The similarity between the source of the abnormal sample and the IP in the malicious IP address list is obtained based on the comparison result. According to the obtained similarity, the type of the source of the abnormal sample is determined, and the abnormal sample is sent to the security decision-making module through the control center. When the source type of the abnormal sample is a malicious attack IP, the IP address of the abnormal sample is banned and the abnormal sample is added to the blacklist. When the source type of the abnormal sample is an abnormal behavior IP, the abnormal sample is sent to the control center and an alarm is issued, which efficiently processes and analyzes massive amounts of business data, intervenes before the attacker attacks, and protects the security of information. BRIEF DESCRIPTION OF THE DRAWINGS
[0012] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present invention. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.
[0013] Figure 1 It is a schematic diagram of the present invention. DETAILED DESCRIPTION
[0014] like Figure 1 As shown, an information security protection system based on big data includes a control center, and the control center is communicatively connected with a data acquisition module, a data processing module, a data mining module, a data storage module, a data analysis module and a security decision module; The data collection module is used to collect enterprise operation data from the enterprise's server. The specific process includes: The data acquisition module is composed of several data acquisition terminals. Each data acquisition terminal is configured and a corresponding configuration channel is generated. The server of the corresponding enterprise is linked through the generated configuration channel. The data acquisition terminal obtains the enterprise operation data in the corresponding server through the configuration channel and sends the obtained enterprise operation data to the data processing module. It should be further explained that, in the specific implementation process, the configuration content of the data acquisition terminal includes: Pre-configure the server's IP address and communication port in the configuration file of the data acquisition terminal, configure the timeout for connecting to the server and the number and interval of reconnections when the connection fails in the configuration file, set the timeout for connecting to the server to 30 seconds, set the number of connection failures to 3 and the interval to 10 seconds, the data acquisition terminal periodically collects enterprise business data, and sets the data acquisition terminal to collect enterprise business data once per second. When the data acquisition terminal is started, the data acquisition terminal is numbered as i, i=1, 2, 3, ..., n, where n is an integer, and a terminal unique identifier and terminal status information are generated according to the number. The terminal status information refers to two states of the terminal, namely, working state and fault state.
[0015] The data processing module is used to process the privacy data in the enterprise operation data and complete the encryption of the privacy data. The specific process includes: The privacy data includes the user's personal information and bank account number; Generate a random 128-bit binary key, convert the private data into a corresponding decimal data stream, and decompose the converted data stream into several data blocks with a data length of 128; When the data length of a data block is not a multiple of 128, pad the data block, and the padding length is equal to the remainder of the data block size minus the privacy data length divided by the data block size. According to the calculated padding length, a corresponding number of padding bytes are added at the end of the data, and the value of the padding bytes is equal to the padding length; For example: When the length of the private data is 124, the padding length of the private data is 4, and the padding byte 4444 is added to the end of the private data; Set a mapping table and replace the bytes of the data block according to the mapping table. 0 and 1 are mapped to 0 and 1, 2, 3, 4, 5 are mapped to 0, and 6, 7, 8, 9 are mapped to 1; For example: If the data block is set to 1234567890, the replacement result is 1000011110; The bytes of the data block are replaced according to the mapping table to obtain the corresponding binary data stream, and the replaced data block is compared with the key bit by bit. When the corresponding bit values are different, the result is 1, and when the corresponding bit values are the same, the result is 0. The compared data block is divided into several 4x4 matrices, and multiple rounds of encryption cycles are performed on the data block. Each round of encryption cycle includes keeping the first row of each 4x4 matrix unchanged, cyclically shifting the second row to the left by one byte, cyclically shifting the third row to the left by two bytes, and cyclically shifting the fourth row to the left by three bytes, and converting the 4x4 matrix into a data block and performing an XOR operation with the key; Similarly, the data block obtained by the last round of encryption is used as the final encrypted private data; The encrypted private data and unencrypted non-private data are transmitted to the data mining module for data mining.
[0016] The data mining module is used to perform data mining on the business operation data processed by the data processing module. The specific process includes: Construct a coordinate system, quantify the business operation data, and map the quantification results into the coordinate system to obtain the corresponding data sample points; For each data sample point, calculate the distance between it and the n data sample points closest to it, where n is a positive integer; x1, x2 represent the horizontal coordinates, y1, y2 represent the vertical coordinates, the coordinates of data sample point A and data sample point B are (x1, y1) and (x2, y2) respectively. It is defined as the square of the distance between data sample point A and data sample point B on the X-axis, where The calculation formula is: ; Will It is defined as the square of the distance between data sample point A and data sample point B on the y-axis, where The calculation formula is: ; Will is defined as the square of the distance between two data sample points, where The calculation formula is: ; Will is defined as the distance between two data samples, where The calculation formula is: ; The maximum value of the distance between a data sample point and the n data sample points closest to it is defined as the reachable distance , where the calculation formula for the reachable distance is: ; The sum of the reciprocals of the reachable distances of the n data sample points closest to the data sample point is defined as the local reachable density S of the data sample point, where the calculation formula for the local reachable density is: ; The sum of the ratios of the local reachable density of a data sample point to the local reachable densities of the n data sample points closest to it is defined as the local anomaly factor value F of the data sample point, where the calculation formula for the local anomaly factor value is: ; For each data sample point, calculate the reachable distance of the data sample point, calculate the local reachable density of the data sample point, and calculate the local anomaly factor value of the data sample point. Identify abnormal samples by comparing the local anomaly factor value of each data sample point. When the local anomaly factor value of a data sample point is significantly different from the local anomaly factor values of other data sample points, determine this data sample point to be an abnormal sample, otherwise determine this data sample point to be a normal sample, and send the mined business data to the data storage module for storage.
[0017] The data storage module is used to perform distributed storage on the mined business operation data. The specific process includes: A first storage unit and a second storage unit are provided, wherein the first storage unit and the second storage unit are respectively provided with a plurality of storage subunits, wherein the first storage unit is used to store normal samples, and the second storage unit is used to store abnormal samples, and data is stored in the plurality of storage subunits, wherein the storage subunits do not interfere with each other, and each storage subunit is provided with a location positioning terminal for positioning storage information; After being transmitted to the data storage module, the normal samples and the abnormal samples are respectively stored in the first storage unit and the second storage unit. The first storage unit and the second storage unit distribute the normal samples and the abnormal samples to different storage sub-units according to the load of the storage device. The first storage unit and the second storage unit copy the normal samples and the abnormal samples to multiple storage sub-units. When a storage sub-unit fails, the first storage unit and the second storage unit obtain samples of the failed storage sub-unit from other storage sub-units.
[0018] The data analysis module is used to analyze the stored business data of the enterprise to determine whether there are any anomalies in the business data. The specific process includes: The data analysis module obtains real-time threat intelligence data from public threat intelligence sharing platforms and security research institutions. The threat intelligence data includes known malicious IP addresses. The data analysis module obtains information about ongoing and planned network attacks from hacker forums, wherein the network attack information includes unknown malicious IP addresses; The data analysis module subscribes to a blacklist service from a security vendor that provides the blacklist service, wherein the blacklist includes malicious IP addresses; The acquired malicious IP addresses are set into a malicious IP address list; The source of the abnormal sample is compared with the malicious IP address list, and the similarity between the source of the abnormal sample and the IP in the malicious IP address list is obtained based on the comparison result. Based on the obtained similarity, the type of the source of the abnormal sample is determined.
[0019] The security decision module is used to formulate corresponding security policies according to the analysis results. The specific process includes: When the source type of the abnormal sample is a malicious attack IP, the IP address of the abnormal sample will be banned and the abnormal sample will be added to the blacklist; When the source type of the abnormal sample is an abnormal behavior IP, the abnormal sample is sent to the control center and an alarm is issued.
[0020] The above embodiments are only used to illustrate the technical method of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical method of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical method of the present invention.
Claims
1. An information security protection system based on big data, including a control center, characterized in that: The control center is communicatively connected with a data acquisition module, a data processing module, a data mining module, a data storage module, a data analysis module and a security decision-making module; The data collection module is used to collect enterprise operation data from the enterprise's server; The data processing module is used to process the privacy data in the enterprise operation data and complete the encryption of the privacy data; The data mining module is used to perform data mining on the enterprise operation data processed by the data processing module; The data storage module is used to perform distributed storage on the mined business operation data; The data analysis module is used to analyze the stored business operation data to determine whether there are any anomalies in the business operation data; The security decision module is used to formulate corresponding security policies according to the analysis results.
2. According to claim 1, the information security protection system based on big data is characterized in that: The process of the data collection module collecting the enterprise operation data from the enterprise's server includes: The data acquisition module is composed of several data acquisition terminals. Each data acquisition terminal is configured and a corresponding configuration channel is generated. The server of the corresponding enterprise is linked through the generated configuration channel. The data acquisition terminal obtains the enterprise operation data in the corresponding server through the configuration channel and sends the obtained enterprise operation data to the data processing module.
3. According to claim 2, the information security protection system based on big data is characterized in that: The configuration content of the data acquisition terminal includes: The server's IP address and communication port are pre-configured in the configuration file of the data collection terminal. The timeout period for connecting to the server and the number and interval of reconnections when the connection fails are configured in the configuration file. The data collection terminal periodically collects business data of the enterprise. When the data collection terminal is started, a corresponding unique identifier and terminal status information are generated for the data collection terminal.
4. The information security protection system based on big data according to claim 2 is characterized in that: The process of the data processing module processing the privacy data in the enterprise operation data includes: Generate a random 128-bit binary key, convert the private data into a corresponding decimal data stream, and decompose the converted data stream into several data blocks with a data length of 128; When the data length of the data block is not a multiple of 128, padding the data block; Set up a mapping table, replace the bytes of the data block according to the mapping table, obtain the corresponding binary data stream, compare the replaced data block with the key bit by bit, when the corresponding bit values are different, the result is 1, when the corresponding bit values are the same, the result is 0, perform multiple rounds of encryption cycles on the data block, and obtain the encrypted private data; The encrypted private data and unencrypted non-private data are transmitted to the data mining module for data mining.
5. The information security protection system based on big data according to claim 4 is characterized in that: The process of the data mining module mining the enterprise operation data processed by the data processing module includes: Construct a coordinate system, quantify the business operation data, and map the quantification results into the coordinate system to obtain the corresponding data sample points; The local reachable density and local anomaly factor value of each data sample point are obtained. Based on the obtained local reachable density and local anomaly factor value, the corresponding business data is mined to determine whether there are anomalies. If there are anomalies, the corresponding business data is marked as an abnormal sample. If there are no anomalies, the corresponding business data is marked as a normal sample. The mined business data is distributedly stored through the data storage module.
6. The information security protection system based on big data according to claim 5 is characterized in that: The process of the data storage module distributing and storing the mined business operation data includes: A first storage unit and a second storage unit are provided, wherein the first storage unit and the second storage unit are respectively provided with a plurality of storage subunits, wherein the first storage unit is used to store normal samples, and the second storage unit is used to store abnormal samples, and data is stored in the plurality of storage subunits, wherein the storage subunits do not interfere with each other, and each storage subunit is provided with a location positioning terminal for positioning storage information; After being transmitted to the data storage module, the normal samples and the abnormal samples are respectively stored in the first storage unit and the second storage unit. The first storage unit and the second storage unit distribute the normal samples and the abnormal samples to different storage sub-units according to the load of the storage device. The first storage unit and the second storage unit copy the normal samples and the abnormal samples to multiple storage sub-units. When a storage sub-unit fails, the first storage unit and the second storage unit obtain samples of the failed storage sub-unit from other storage sub-units.
7. The information security protection system based on big data according to claim 6 is characterized in that: The process of the data analysis module analyzing the business operation data stored in the data storage module includes: Set up a malicious IP address list, compare the source of the abnormal sample with the malicious IP address list, obtain the similarity between the source of the abnormal sample and the IP in the malicious IP address list based on the comparison result, and determine the type of the source of the abnormal sample based on the obtained similarity.
8. The information security protection system based on big data according to claim 7 is characterized in that: The process of the security decision module formulating corresponding security policies based on the analysis results includes: When the source type of the abnormal sample is a malicious attack IP, the IP address of the abnormal sample will be banned and the abnormal sample will be added to the blacklist; When the source type of the abnormal sample is an abnormal behavior IP, the abnormal sample is sent to the control center and an alarm is issued.