Ticketing platform network security data detection processing method and system

Abstract

The invention discloses a ticket service platform network security data detection processing method and system. The method comprises the following operation steps: acquiring a network data sequence for a cloud security control server; encoding the network data sequence to obtain an encoded sequence; extracting feature information from the coding sequence, and constructing an initial matrix according to the feature information; constructing an incidence matrix through the frequency of the feature information appearing in the network data sequence and the initial matrix; and constructing a network behavior association knowledge base through the association matrix.

Description

Technical Field

[0001] The present invention relates to the field of cloud security, and in particular to a data detection and processing method and system for network security of a ticketing platform. Background Art

[0002] Cloud security is an Internet-based computing method, through which shared hardware and software resources and information can be provided to computers and other devices on demand. Due to the rapid increase in the number of users and participants, the data security in the network platform cannot be guaranteed, and there are often criminals who steal and tamper with network information. Therefore, the security of network information data has always been a key concern of network information management.

[0003] With the rapid development of cloud computing technology, the network security issues of ticketing platforms have become increasingly prominent. The core of cloud security technology lies in understanding customer needs and designing corresponding solutions, such as full disk or file-based encryption, customer key management, intrusion detection / prevention, security information and event management (SIEM), log analysis, dual-mode authentication, physical isolation, etc. The application of these technologies is crucial to protecting network data from tampering, destruction, leakage or illegal acquisition and illegal use.

[0004] In the network security management of ticketing platforms (such as air ticketing platforms or travel service ticketing platforms or international freight ticketing platforms), information protection and prevention of network attacks are two key points. Information protection requires the ticketing system to take strict data encryption measures to ensure that the personal information of tourists (or users) is not illegally accessed during transmission and storage. At the same time, the ticketing system faces the threat of network attacks such as DDoS attacks, malware and phishing attacks. These risks can be effectively reduced through firewalls, intrusion detection systems and regular security audits;

[0005] After research, it was found that the valuable data included in network information data faces serious threats during transmission, and data leakage incidents often occur, causing certain harm to society and companies.

[0006] Therefore, when conducting security detection and processing on valuable network data, the security of data during network transmission must be ensured. Research has found that the existing network data detection process often involves the security processing of a large amount of original data, which can easily lead to problems such as long detection time and redundant operations. Summary of the invention

[0007] The purpose of the present invention is to provide a data detection and processing method and system for network security of a ticketing platform, which solves the above-mentioned technical problems pointed out in the prior art.

[0008] The present invention provides a data detection and processing method for network security of a ticketing platform, comprising the following steps:

[0009] Obtaining network data sequence from the cloud security control server;

[0010] Encode the network data sequence to obtain a coded sequence; extract feature information from the coded sequence and construct an initial matrix based on the feature information; construct a correlation matrix based on the frequency of the feature information appearing in the network data sequence and the initial matrix;

[0011] Then, a network behavior association knowledge base is constructed through the association matrix.

[0012] Preferably, feature information is extracted from the coding sequence, and an initial matrix is ​​constructed according to the feature information. The specific operation steps are as follows:

[0013] Performing a coding feature extraction operation on the coding sequence to obtain a first abnormal feature and a first behavior feature, and simultaneously counting the number of the first abnormal features and the number of the first behavior features;

[0014] Analyze the first correlation between the first abnormal feature and the first behavior feature; construct an initial matrix for the first abnormal feature and the first behavior feature according to the first correlation; the constructed initial matrix is:

[0015]

[0016] Each row of the initial matrix represents the ith behavior feature, each column represents the abnormal feature corresponding to the ith behavior feature, and each element represents the correlation relationship between the behavior feature and the abnormal feature.

[0017] Preferably, each element unit in the initial matrix represents an association relationship between corresponding feature pairs; the feature pair refers to a feature group consisting of a first abnormal feature and a first behavioral feature.

[0018] Preferably, the association matrix is ​​constructed by using the frequency of the characteristic information appearing in the network data sequence and the initial matrix, and the specific operation steps are as follows:

[0019] Analyze the initial matrix and the network data sequence to output a second correlation relationship;

[0020] Based on the second association relationship, filling the network data sequence into the initial matrix to obtain an association matrix;

[0021] The association matrix is:

[0022]

[0023] Each row of the initial matrix represents the i'th behavior feature, each column represents the abnormal feature corresponding to the i'th behavior feature, and each element represents the correlation relationship between the behavior feature and the abnormal feature.

[0024] Preferably, the network data sequence is used to fill an initial matrix to obtain a correlation matrix, and the specific operation steps are as follows:

[0025] By using the second correlation relationship between the network data sequence and the initial matrix, counting the frequency T of the occurrence of the second abnormal feature and the second behavior feature in the network data sequence;

[0026] The frequency T calculation formula is:

[0027] T=(R1, B1)+(R2, B2)+…+(Ro, Bo);

[0028] In the formula, Ro is the oth second abnormal feature, Bo is the oth second behavior feature, and the number of second abnormal features and the number of second behavior features are added to obtain the total frequency of the two in the network data sequence;

[0029] According to the frequencies of occurrence of the second abnormal feature and the second behavioral feature in the network data sequence, a first dynamic weight g is simultaneously assigned to the abnormal feature and the behavioral feature;

[0030] The higher the frequency of occurrence of the second abnormal feature and the second behavior feature, the greater the first dynamic weight assigned;

[0031] According to the positions of each first abnormal feature and the first behavior feature in the initial matrix, the first dynamic weight is filled into the element unit position in the corresponding initial matrix to obtain a correlation matrix.

[0032] Preferably, the first dynamic weight g is:

[0033]

[0034] Where g is the first dynamic weight assigned; T represents the frequency of occurrence of the second abnormal feature and the second behavior feature, R represents the second abnormal feature, and B represents the second behavior feature; Rov represents the occurrence of the oth second abnormal feature at the vth frequency; Bov represents the occurrence of the oth second behavior feature at the vth frequency; exp represents an exponential function with the natural constant, e, as the base.

[0035] Preferably, the first dynamic weight is filled into the element unit position in the corresponding initial matrix according to the position of each first abnormal feature and the first behavior feature in the initial matrix to obtain a correlation matrix, and the specific operation steps are as follows:

[0036] Constructing a feature connection graph according to the second abnormal feature and the second behavior feature in the network data sequence; each node in the feature connection graph represents a feature;

[0037] A second dynamic weight is assigned to each edge of the feature connection graph, and the feature of each node in the feature connection graph and the second dynamic weight of each edge in the feature connection graph are mapped into the initial matrix to obtain a correlation matrix.

[0038] Preferably, the rows and columns in the initial matrix correspond to nodes in the feature connection graph respectively, and the weight of the element unit of the initial matrix is ​​represented by the second dynamic weight of the corresponding edge in the feature connection graph.

[0039] Accordingly, the present invention also proposes a data detection and processing system for network security of a ticketing platform, comprising: a collection module, an association module, and a construction module;

[0040] The acquisition module is used to obtain network data sequences from the cloud security control server;

[0041] The association module is used to encode the network data sequence to obtain a coded sequence; extract feature information from the coded sequence and construct an initial matrix based on the feature information; and construct an association matrix based on the frequency of the feature information appearing in the network data sequence and the initial matrix;

[0042] The construction module is used to construct a network behavior association knowledge base through the association matrix.

[0043] Correspondingly, the present invention also proposes a storage medium, in which a computer program is stored. When the computer program is executed by a processor, the steps of the data detection and processing method for network security of a ticketing platform are implemented as described in any of the above items.

[0044] Compared with the prior art, the embodiments of the present invention have at least the following technical advantages:

[0045] By analyzing the data detection and processing method for network security of a ticketing platform provided by the present invention, it can be known that in specific applications, a network data sequence is collected through a cloud security control server, and various identity information of users inside the cloud security control server can be understood according to the network data sequence; and by encoding the network data sequence to obtain a coding sequence, the network data sequence can be converted into a format that is easier to identify and process, so as to facilitate subsequent analysis and detection; and further analyzing the coding sequence to extract the first abnormal feature and the first behavioral feature, which belong to the data information in the network data sequence, and the abnormal behavior existing in the user's activities at a specific time flow of the network data sequence is understood, thereby extracting key features; through a certain first abnormal feature, it can be understood which first behavioral feature is caused, so as to know the correlation between the two; an initial matrix is ​​constructed through the correlation relationship, and the abnormal feature that appears is quickly found out by which behavioral feature according to the rows and columns of the initial matrix;

[0046] Further, the initial matrix and the network data sequence are analyzed to generate a second correlation relationship; the frequency of the second abnormal feature and the second behavior feature in the network data sequence is counted through the second correlation relationship, and the number of times and time intervals of abnormal behaviors in the network data sequence are understood based on the frequency of occurrence, so as to judge whether the network data sequence is in a safe process, and a feature connection graph is constructed based on the second abnormal feature and the second behavior feature. The feature connection graph can better indicate the relationship between each feature in the network data sequence in the form of nodes and edges, and is helpful to discover abnormal behaviors in the network data sequence, and discover potential data quality problems or unknown data problems through these abnormal behaviors;

[0047] Furthermore, the feature connection graph is mapped into the initial matrix, and the second dynamic weight of the feature connection graph is used as the weight of the initial matrix. The second dynamic weight not only considers the direct connection between the features, but also makes the cloud security network data analysis and anomaly detection more efficient and easy. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 This is an overall flow chart of a data detection and processing method for network security of a ticketing platform in Example 1;

[0049] Figure 2 It is a flowchart of constructing an initial matrix of a data detection and processing method for network security of a ticketing platform in Embodiment 1;

[0050] Figure 3 It is a correlation diagram between an initial matrix and a network data sequence of a data detection and processing method for network security of a ticketing platform in Embodiment 1;

[0051] Figure 4A first dynamic weight filling flow chart of a data detection and processing method for network security of a ticketing platform in Embodiment 1;

[0052] Figure 5 Fill in the flow chart for the characteristic connection diagram of a data detection and processing method for network security of a ticketing platform in Embodiment 1;

[0053] Figure 6 This is a flow chart of a data detection and processing system for network security of a ticketing platform in Embodiment 2;

[0054] Figure 7 This is a schematic diagram of the structure of a storage medium for a data detection and processing method for network security of a ticketing platform in Example 3.

[0055] Reference numerals: acquisition module 10 , association module 20 , construction module 30 ; memory 1110 ; communication interface 1120 ; processor 1130 ; computer storage medium 1140 . DETAILED DESCRIPTION

[0056] The technical solution of the present invention will be described clearly and completely below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0057] The present invention is further described in detail below through specific embodiments in conjunction with the accompanying drawings.

[0058] Embodiment 1

[0059] This embodiment provides a data detection and processing method for network security of a ticketing platform, including the following steps:

[0060] S10: Obtaining a network data sequence from a cloud security control server;

[0061] It should be noted that the network data sequence is obtained through the cloud security control server, and the network data sequence contains various identity data information of the user. At the same time, it also contains some abnormal behaviors that may exist in the network data sequence. For example, when the identity information of the user is kept, it is easy for some users to operate too frequently, resulting in abnormal behaviors that do not conform to normal operations;

[0062] S20: Encode the network data sequence to obtain a coded sequence; extract feature information from the coded sequence and construct an initial matrix according to the feature information; construct a correlation matrix according to the frequency of the feature information appearing in the network data sequence and the initial matrix;

[0063] It should be noted that the network data sequence is encoded to obtain a coded sequence; the network data sequence is converted into a format that is easier to process and analyze through encoding, and the amount of data is reduced through encoding, while retaining key information for subsequent analysis; feature information is extracted from the coded sequence and the network data sequence, and a correlation matrix is ​​constructed based on the correlation between the feature information (i.e., abnormal behavior is analyzed based on the coded sequence, a matrix is ​​preliminarily constructed based on the abnormal behavior, and a correlation matrix is ​​constructed based on the correlation between the analysis of the network data sequence and the abnormal behavior of the coded sequence);

[0064] S30: Then construct a network behavior association knowledge base through the association matrix.

[0065] It should be noted that, finally, the network behavior association knowledge base is used to analyze the root cause of the abnormal behavior of the network data to be detected, and the abnormal network behavior appearing in the network data is solved through the root cause of the abnormal behavior, so as to obtain the security of the network data;

[0066] And when the same network data is detected again in the future, the operation can be performed faster to reduce the detection time and avoid being attacked by abnormal behavior due to the detection time being too long. At the same time, when constructing the association matrix, security protection is provided for those behaviors that are prone to abnormal activities, and the subsequent association matrix is ​​automatically protected.

[0067] The network behavior association knowledge base in the embodiment of the present invention constructs a network behavior association matrix by encoding and extracting features from network data sequences, which reflects the intrinsic connections between network behaviors.

[0068] The network behavior association knowledge base can then be used to analyze the abnormality of network behavior and realize the analysis and tracking of abnormal network behavior. Therefore, the network behavior association knowledge base records the association between various behavior features in the network data sequence, which can be used to support the identification and response of abnormal network behavior, and is the final output result of this embodiment.

[0069] Specifically, in step S20, feature information is extracted from the coding sequence, and an initial matrix is ​​constructed according to the feature information. The specific operation steps are as follows:

[0070] S201: performing a coding feature extraction operation on the coding sequence to obtain a first abnormal feature and a first behavior feature, and simultaneously counting the number of the first abnormal features and the number of the first behavior features;

[0071] It should be noted that the first abnormal feature and the first behavior feature extracted from the coding sequence are data information in the network data sequence;

[0072] The behavior feature of the data information is the user's activity behavior at a specific time flow (i.e., at a specific time, the user's login, and whether there is any activity that deviates from the normal behavior pattern); the first abnormal feature is the abnormal behavior in the network protocol that does not conform to the normal protocol behavior; the first behavior feature and the abnormal feature can reduce the need for the subsequent generation of the association matrix; extract and retain key features, which can also be potential threats and anomalies;

[0073] S202: Analyze the first correlation between the first abnormal feature and the first behavior feature; construct an initial matrix for the first abnormal feature and the first behavior feature according to the first correlation; the constructed initial matrix is:

[0074]

[0075] Each row of the initial matrix represents the ith behavior feature, each column represents the abnormal feature corresponding to the ith behavior feature, and each element represents the correlation between the behavior feature and the abnormal feature;

[0076] Each element unit in the initial matrix represents the association relationship between the corresponding feature pair (i.e., the first abnormal feature and the first behavior feature); the feature pair refers to a feature group consisting of the first abnormal feature and the first behavior feature;

[0077] It should be noted that the first correlation between the first abnormal feature and the first behavior feature is analyzed, such as whether a certain abnormal feature is directly caused by a certain behavior feature or indirectly caused by a certain behavior feature; an initial matrix (i.e., a feature matrix, which is a matrix framework, by constructing the initial matrix, it can be observed which first behavior features are directly or indirectly associated with which first abnormal features, and when a certain abnormality occurs again, the behavior features caused by the abnormality can be quickly found by checking the corresponding rows and columns in the initial matrix); since each first abnormal feature may represent a different abnormal type or form, using them as rows of the initial matrix can show the specific situation of each first abnormal feature; and the behavior features have a wide variety, using them as columns of the initial matrix can show the influence of different first behavior features on the abnormal features;

[0078] In step S20, the association matrix is ​​constructed by the frequency of the characteristic information appearing in the network data sequence and the initial matrix. The specific operation steps are as follows:

[0079] S21: Analyze the initial matrix and the network data sequence to output a second association relationship (the second relationship is constructed to increase the difficulty of decryption and decoding);

[0080] S22: Based on the second association relationship, fill the network data sequence into the initial matrix to obtain an association matrix;

[0081] The association matrix is:

[0082]

[0083] Each row of the initial matrix represents the i'th behavior feature, each column represents the abnormal feature corresponding to the i'th behavior feature, and each element represents the correlation relationship between the behavior feature and the abnormal feature;

[0084] It should be noted that the analysis of the second correlation between the initial matrix and the network data sequence can comprehensively reflect the anomalies and behavior patterns in the network data sequence through the abnormal characteristics and behavior characteristics, so the relationship between the initial matrix and the network data sequence is indirectly obtained;

[0085] Through the second correlation relationship between the initial matrix and the network data sequence, the network data sequence is used to fill the initial matrix to obtain a correlation matrix;

[0086] In step S10, the network data sequence includes various identity information and abnormal features and behavior features of the user, and the initial matrix is ​​constructed by the first abnormal feature and the first behavior feature (that is, the first abnormal feature and the first behavior feature are data information in the network data sequence);

[0087] After the initial matrix is ​​constructed, the cloud security control server further performs correlation analysis on the features in the network data sequence (such as user identity information, other abnormal features, other behavioral features, etc.), and can identify the potential connections between these features through statistical methods, thereby constructing a second correlation relationship with the initial matrix;

[0088] For example:

[0089] Assuming that the initial matrix is ​​constructed based on the number of abnormal logins (the first abnormal feature) and the frequency of accessing specific sensitive pages (the first behavioral feature) of users, through correlation analysis, the cloud security control server finds that the number of abnormal logins of the young user group (one of the user identity information) is generally higher than that of the older users, and the frequency of accessing sensitive pages is also higher, which may be related to the fact that young users change devices or passwords more frequently and have higher network activity levels;

[0090] Further analysis found that users with a high number of abnormal logins are often accompanied by a high number of unauthorized resource accesses (other abnormal characteristics), indicating that these users may face higher security risks and require special attention;

[0091] By analyzing the user's behavior characteristics (such as access time, path, etc.), it is found that the frequency of some users accessing sensitive pages during specific time periods (such as late at night) has increased significantly, and there are significant differences from the previous normal behavior patterns, which may be related to potential security threats or abnormal behavior;

[0092] Through the second association relationship, the network data sequence can be subsequently analyzed for the second abnormal feature and the second behavior feature, and the second abnormal feature and the second behavior feature can be filled into the initial matrix through the second association relationship, so as to construct the association matrix, so that the abnormal situation can be safely detected through the close association relationship, so that the subsequent detection is safer;

[0093] In the subsequent step S221, the network data sequence has a second abnormal feature and a second behavior feature (i.e., the second abnormal feature and the second behavior feature are the specific number of occurrences and time intervals in the network data sequence), so the first abnormal feature and the first behavior feature in the initial matrix and the network data sequence have an association relationship (i.e., a second association relationship) with the second abnormal feature and the second behavior feature in the network data sequence; and the network data sequence is filled into the initial matrix network through the second association relationship, which is a feature extraction of the network data sequence (i.e., the second abnormal feature and the second behavior feature), and each matrix element unit represents the importance and security of the node in the network;

[0094] Specifically, in step S22, the network data sequence is used to fill the initial matrix to obtain a correlation matrix. The specific operation steps are as follows:

[0095] S221: Counting the frequency T of the second abnormal feature and the second behavior feature in the network data sequence through the second association relationship between the network data sequence and the initial matrix;

[0096] The frequency T calculation formula is:

[0097] T=(R1, B1)+(R2, B2)+…+(Ro, Bo);

[0098] Where Ro is the oth second abnormal feature, Bo is the oth second behavior feature, and the number of second abnormal features and the number of second behavior features (that is, when the encoding sequence is extracted, the number of first abnormal features and the number of first behavior features can be used to determine the number of second abnormal features and the number of second behavior features; because the encoding sequence is obtained through the network data sequence, the number of abnormal features and the number of behavior features are the same) are added to obtain the total frequency of the two in the network data sequence;

[0099] According to the frequencies of occurrence of the second abnormal feature and the second behavioral feature in the network data sequence, a first dynamic weight g is simultaneously assigned to the abnormal feature and the behavioral feature;

[0100]

[0101] Wherein, g is the first dynamic weight assigned; T represents the frequency of occurrence of the feature (wherein the above-mentioned feature refers to the second abnormal feature and the second behavior feature, that is, the frequency T of occurrence of the second abnormal feature and the second behavior feature), R represents the second abnormal feature, and B represents the second behavior feature; Rov represents that the oth second abnormal feature appears at the vth frequency; Bov represents that the oth second behavior feature appears at the vth frequency; exp represents an exponential function with a natural constant, e, as the base;

[0102] The higher the frequency of occurrence of the second abnormal feature and the second behavior feature, the greater the first dynamic weight assigned;

[0103] It should be noted that what is counted in step S221 is the frequency of occurrence of the second abnormal feature and the second behavior feature in the network data sequence, which represents the number of times and time intervals of the specific occurrence of the second abnormal feature and the second behavior feature in the network data sequence. Through these, dynamic weights are assigned to the abnormal behaviors in the network data sequence, so that the subsequent association matrix can be updated in real time (that is, the first abnormal feature and the first behavior feature extracted from the coding sequence are different from the data information in the network data sequence);

[0104] The higher the frequency of the second abnormal feature and the second behavior feature, the greater the first dynamic weight may be; according to the actual statistics of the second abnormal feature and the second behavior feature in the historical network data sequence, the first dynamic weight is simultaneously assigned to the second abnormal feature and the second behavior feature, and the frequency of the second abnormal feature and the second behavior feature in the network data sequence, as well as the relationship between the network data sequence and the second abnormal feature and the second behavior feature are used as statistics (that is, by analyzing the network data sequence, it can be obtained how many times the abnormal behavior (that is, the abnormal feature and the behavior feature) will appear in it, and the first dynamic weight is assigned to the second abnormal feature and the second behavior feature according to the frequency of occurrence), so as to assign the first dynamic weight to each element unit in the subsequent initial matrix, and the dynamic weight reflects the strength of the association relationship between the features in the network data sequence;

[0105] The first dynamic weight is equivalent to updating the first dynamic weight and thus updating the association matrix according to the frequency of occurrence of the second abnormal feature and the second behavior feature in the network data sequence after the association matrix is ​​established.

[0106] S222: filling the first dynamic weight into the element unit position in the corresponding initial matrix according to the position of each first abnormal feature and the first behavior feature in the initial matrix, and obtaining the association matrix (that is, the first dynamic weight is allocated according to the frequency of the second abnormal feature and the second behavior feature appearing in the network data sequence, so when the first dynamic weight is filled into the initial matrix, the second abnormal feature and the second behavior feature of the indirect network data sequence are filled into the initial matrix);

[0107] It should be noted that the first dynamic weight is assigned by calculating the frequency of the second abnormal feature and the second behavior feature appearing in the network data sequence, and the first dynamic weight is filled in according to the element unit position of each first abnormal feature and the first behavior feature in the initial matrix constructed by the second abnormal feature and the second behavior feature, so that the association matrix can be obtained; each element unit in the above association matrix reflects the association strength and importance of the corresponding feature (i.e., the abnormal feature and the behavior feature) in the network data; the first dynamic weight can be adjusted with the real-time update of the network data sequence, so that the association matrix can reflect the dynamic changes of the network environment and enhance the flexibility of cloud security;

[0108] Specifically, in step S222, the first dynamic weight is filled into the element unit position in the corresponding initial matrix according to the position of each first abnormal feature and the first behavior feature in the initial matrix to obtain a correlation matrix. The specific operation steps are as follows:

[0109] S2221: constructing a feature connection graph according to the second abnormal feature and the second behavior feature in the network data sequence; each node in the feature connection graph represents a feature;

[0110] It should be noted that the feature connection graph is constructed through the features of the network data sequence. Each feature node in the feature connection graph represents a feature, and the edges between the feature nodes represent the relationship between each feature.

[0111] Analyze the correlation (i.e., association) between the second abnormal feature and the second behavioral feature using statistical methods; determine which features have significant correlations, and identify the causal relationship between the second abnormal feature and the second behavioral feature using causal reasoning methods, so as to identify the potential connection between the second abnormal feature and the second behavioral feature;

[0112] The second abnormal feature and the second behavior feature are used as nodes in the feature connection graph. The edges between the nodes are determined according to the relationship between the second abnormal feature and the second behavior feature (such as correlation, causal relationship, etc.). The nodes are connected through the edges to form a feature connection graph. For example:

[0113] By monitoring the network data of user activities, the cloud security control server discovered that user A suddenly posted 10 times more content than usual in the past week, and received an abnormally high number of likes and comments. These activities exceeded user A's historical behavior patterns and were therefore identified as the second abnormal feature;

[0114] At the same time, the cloud security control server analyzes the daily behavior characteristics of user A and finds that he usually posts 1-2 pieces of content per day on average, mainly focusing on technology topics, and interacting with a fixed group of friends and followers;

[0115] In the connection graph, the cloud security control server observed that user A established new connections with a group of users with whom he had rarely interacted before, and these new users also showed similar abnormal activity patterns (such as a large number of likes and comments on user A's content); in addition, these new users also liked and commented on each other's content, forming a close community;

[0116] By comparing the second abnormal feature with the second behavior feature and combining it with the analysis of the connection graph, the cloud security control server can infer that the abnormal activity of user A may be related to the newly formed community;

[0117] Further investigation revealed that the community was controlled by an external organization or individual, who manipulated the behavior of user A and other members to create false hot topics or promotional information. User A's abnormal activities were actually part of this larger-scale manipulation behavior.

[0118] By constructing a feature connection graph, a complex network data structure can be expressed. By mapping the initial matrix through the subsequent feature connection graph, it can be found that a second abnormal feature is the main reason for the change of the second behavior feature. Then, the behavior feature can be affected by controlling the abnormal feature, thereby achieving the purpose of optimizing the performance of the cloud security control server or preventing adverse consequences, thereby achieving the security of the subsequent correlation matrix detection;

[0119] S2222: assigning a second dynamic weight to each edge of the feature connection graph, mapping the feature of each node in the feature connection graph and the second dynamic weight of each edge in the feature connection graph into the initial matrix to obtain a correlation matrix;

[0120] The rows and columns in the initial matrix correspond to nodes in the feature connection graph (i.e., abnormal features and behavioral features), respectively, and the weights of the element units of the initial matrix are represented by the second dynamic weights of the corresponding edges in the feature connection graph;

[0121] It should be noted that by assigning a second dynamic weight to each edge in the feature connection graph, the frequency, duration, and change trend of the features in the network traffic data are used to calculate the evaluation score of the correlation strength between the features using methods such as expert evaluation, and the second dynamic weight is assigned to each edge in the feature connection graph through the evaluation score, so that the correlation between the features can be more accurately represented. These second dynamic weights not only consider the direct connection between the features, but also incorporate the global information of the network data (i.e., the network data sequence) and the influence of the features in the network, making the representation of the association relationship more comprehensive; through the second dynamic weight allocation process and projecting it into the association matrix, cloud security network data analysis and anomaly detection can be made more efficient and easy;

[0122] Mapping the feature connection graph to the initial matrix can simplify the complex second dynamic weight allocation and project it. The rows and columns of the association matrix correspond to the feature nodes, and the element units represent the association weights between feature pairs, making cloud security network data analysis and anomaly detection easier.

[0123] Since the weights of the association matrix are determined by dynamic weights (i.e., the weights can represent the strength of association, similarity, or other metrics between two features or nodes), they can be adjusted according to the real-time update of network data. Therefore, the association matrix can reflect the dynamic changes of the network environment. This dynamic flexibility makes the association matrix more practical and accurate in cloud security fields such as anomaly detection and behavior analysis.

[0124] Embodiment 2

[0125] This embodiment also provides a data detection and processing system for network security of a ticketing platform, including: a collection module 10, an association module 20, and a construction module 30;

[0126] The acquisition module 10 is used to obtain a network data sequence from the cloud security control server;

[0127] The association module 20 is used to encode the network data sequence to obtain a coded sequence; extract feature information from the coded sequence and construct an initial matrix based on the feature information; and construct a correlation matrix based on the frequency of the feature information appearing in the network data sequence and the initial matrix;

[0128] The construction module 30 is used to construct a network behavior association knowledge base through the association matrix.

[0129] Embodiment 3

[0130] On the other hand, this third embodiment is based on the data detection and processing method for the network security of a ticketing platform provided in the first embodiment of the invention, and further provides a computer storage medium 1140 (hereinafter referred to as storage medium). Figure 7FIG. 1 is a schematic diagram of a computer storage medium structure framework provided in Embodiment 3 of the present invention, which includes:

[0131] A memory 1110, used for storing computer programs;

[0132] The communication interface 1120 is used to connect the memory 1110 to the processor 1130;

[0133] Processor 1130 is used to execute a computer program to implement a data detection and processing method for network security of a ticketing platform involved in Example 1 disclosed in combination with any of the above-mentioned implementation methods.

[0134] In summary, a data detection and processing method and system for network security of a ticketing platform proposed in an example of the present invention collects network data sequences through a cloud security control server, and various identity information of users inside the cloud security control server can be understood according to the network data sequences; and by encoding the network data sequences to obtain a coding sequence, the network data sequences can be converted into a format that is easier to identify and process, so as to facilitate subsequent analysis; and further analyze the coding sequence to extract the first abnormal feature and the first behavioral feature, which belong to the data information in the network data sequence, and understand the abnormal behavior existing in the user's activities at a specific time flow of the network data sequence, thereby extracting key features; through a certain first abnormal feature, it can be understood which first behavioral feature is caused, so as to know the correlation between the two; an initial matrix is ​​constructed through the correlation relationship, and the abnormal feature that appears is quickly found out by which behavioral feature according to the rows and columns of the initial matrix;

[0135] Further, the initial matrix and the network data sequence are analyzed to generate a second correlation relationship; the frequency of the second abnormal feature and the second behavior feature in the network data sequence is counted through the second correlation relationship, and the number of times and time intervals of abnormal behaviors in the network data sequence are understood based on the frequency of occurrence, so as to judge whether the network data sequence is in a safe process, and a feature connection graph is constructed based on the second abnormal feature and the second behavior feature. The feature connection graph can better indicate the relationship between each feature in the network data sequence in the form of nodes and edges, and is helpful to discover abnormal behaviors in the network data sequence, and discover potential data quality problems or unknown data problems through these abnormal behaviors;

[0136] Furthermore, the feature connection graph is mapped into the initial matrix, and the second dynamic weight of the feature connection graph is used as the weight of the initial matrix. The second dynamic weight not only considers the direct connection between the features, but also makes the cloud security network data analysis and anomaly detection more efficient and easy.

[0137] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. A person skilled in the art may modify the technical solutions described in the above embodiments, or replace part or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A data detection and processing method for network security of a ticketing platform, characterized in that: The steps include: Obtain network data sequence from the cloud security control server; Encoding the network data sequence to obtain a coded sequence; extracting feature information from the coded sequence, and constructing an initial matrix according to the feature information; Constructing a correlation matrix through the frequency of occurrence of characteristic information in the network data sequence and the initial matrix; Then, a network behavior association knowledge base is constructed through the association matrix.

2. According to claim 1, a data detection and processing method for ticketing platform network security is characterized in that: Extract characteristic information from the coding sequence and construct an initial matrix based on the characteristic information. The specific operation steps are as follows: Performing a coding feature extraction operation on the coding sequence to obtain a first abnormal feature and a first behavior feature, and simultaneously counting the number of the first abnormal features and the number of the first behavior features; Analyze the first correlation between the first abnormal feature and the first behavior feature; construct an initial matrix for the first abnormal feature and the first behavior feature according to the first correlation; the constructed initial matrix is: Each row of the initial matrix represents the ith behavior feature, each column represents the abnormal feature corresponding to the ith behavior feature, and each element represents the correlation relationship between the behavior feature and the abnormal feature.

3. According to claim 2, a data detection and processing method for ticketing platform network security is characterized in that: Each element unit in the initial matrix represents the association relationship between corresponding feature pairs; the feature pair refers to a feature group consisting of a first abnormal feature and a first behavior feature.

4. According to claim 3, a data detection and processing method for network security of a ticketing platform is characterized in that: The association matrix is ​​constructed by using the frequency of the characteristic information appearing in the network data sequence and the initial matrix. The specific operation steps are as follows: Analyze the initial matrix and the network data sequence to output a second correlation relationship; Based on the second association relationship, filling the network data sequence into the initial matrix to obtain an association matrix; The association matrix is: Each row of the initial matrix represents the i'th behavior feature, each column represents the abnormal feature corresponding to the i'th behavior feature, and each element represents the correlation relationship between the behavior feature and the abnormal feature.

5. According to claim 4, a data detection and processing method for network security of a ticketing platform is characterized in that: The network data sequence is used to fill the initial matrix to obtain the correlation matrix. The specific operation steps are as follows: By using the second correlation relationship between the network data sequence and the initial matrix, counting the frequency T of the occurrence of the second abnormal feature and the second behavior feature in the network data sequence; The frequency T calculation formula is: T=(R1, B1)+(R2, B2)+…+(Ro, Bo); In the formula, Ro is the oth second abnormal feature, Bo is the oth second behavior feature, and the number of second abnormal features and the number of second behavior features are added to obtain the total frequency of the two in the network data sequence; According to the frequency of occurrence of the second abnormal feature and the second behavior feature in the network data sequence, a first dynamic weight g is simultaneously assigned to the abnormal feature and the behavior feature. According to the frequency of occurrence, a first dynamic weight g is simultaneously assigned to the abnormal feature and the behavior feature; According to the positions of each first abnormal feature and the first behavior feature in the initial matrix, the first dynamic weight is filled into the element unit position in the corresponding initial matrix to obtain a correlation matrix.

6. According to claim 5, a data detection and processing method for network security of a ticketing platform is characterized in that: The first dynamic weight g is: Where g is the first dynamic weight assigned; T represents the frequency of the second abnormal feature and the second behavior feature; R represents the second abnormal feature; and B represents the second behavior feature; Rov means that the o-th second abnormal feature appears at the v-th frequency; Bov means that the o-th second behavior feature appears at the v-th frequency; exp means an exponential function with the natural constant, e, as the base.

7. According to claim 6, a data detection and processing method for network security of a ticketing platform is characterized in that: According to the positions of each first abnormal feature and the first behavior feature in the initial matrix, the first dynamic weight is filled into the element unit position in the corresponding initial matrix to obtain the association matrix. The specific operation steps are as follows: Constructing a feature connection graph according to the second abnormal feature and the second behavior feature in the network data sequence; each node in the feature connection graph represents a feature; A second dynamic weight is assigned to each edge of the feature connection graph, and the feature of each node in the feature connection graph and the second dynamic weight of each edge in the feature connection graph are mapped into the initial matrix to obtain a correlation matrix.

8. According to claim 7, a data detection and processing method for network security of a ticketing platform is characterized in that: The rows and columns in the initial matrix correspond to nodes in the feature connection graph respectively, and the weights of the element units of the initial matrix are represented by the second dynamic weights of the corresponding edges in the feature connection graph.

9. A data detection and processing system for network security of a ticketing platform, characterized in that: include: Acquisition module, association module, construction module; The acquisition module is used to obtain network data sequences from the cloud security control server; The association module is used to encode the network data sequence to obtain a coded sequence; extract feature information from the coded sequence, and construct an initial matrix according to the feature information; Constructing a correlation matrix through the frequency of occurrence of characteristic information in the network data sequence and the initial matrix; The construction module is used to construct a network behavior association knowledge base through the association matrix.

10. A storage medium, characterized in that: The storage medium stores a computer program, which, when executed by a processor, implements the steps of a data detection and processing method for network security of a ticketing platform as described in any one of claims 1 to 8.

Images