A data detection and processing method and system for network security of a ticketing platform

Abstract

The present invention discloses a data detection and processing method and system for the network security of a ticketing platform. The method comprises the following operating steps: obtaining a network data sequence from a cloud security control server; encoding the network data sequence to obtain a coded sequence; extracting feature information from the coded sequence and constructing an initial matrix based on the feature information; constructing a correlation matrix based on the frequency of the feature information appearing in the network data sequence and the initial matrix; and then constructing a network behavior correlation knowledge base based on the correlation matrix.

Description

Technical Field

[0001] The present invention relates to the field of cloud security, and in particular to a data detection and processing method and system for network security of a ticketing platform. Background Art

[0002] Cloud security is an internet-based computing method that enables shared hardware and software resources and information to be provided on demand to computers and other devices. Due to the rapid increase in the number of users and participants, data security within online platforms cannot be guaranteed. Theft and tampering of online information by criminals are common, making the security of online data a key concern in network information management.

[0003] With the rapid development of cloud computing, ticketing platform network security issues are becoming increasingly prominent. The core of cloud security technology lies in understanding customer needs and designing appropriate solutions, such as full-disk or file-based encryption, customer key management, intrusion detection / prevention, security information and event management (SIEM), log analysis, two-factor authentication, and physical isolation. The application of these technologies is crucial for protecting network data from tampering, destruction, leakage, unauthorized access, and exploitation.

[0004] Information protection and cyberattack prevention are key aspects of network security management for ticketing platforms (e.g., air ticketing platforms, travel service ticketing platforms, or international freight ticketing platforms). Information protection requires the ticketing system to implement strict data encryption measures to prevent unauthorized access to visitors' (or users') personal information during transmission and storage. Ticketing systems are also threatened by cyberattacks such as DDoS attacks, malware, and phishing attacks. These risks can be effectively mitigated through firewalls, intrusion detection systems, and regular security audits.

[0005] Research has found that valuable data included in network information data faces serious threats during transmission, and data leakage incidents often occur, causing certain damage to society and companies.

[0006] Therefore, when conducting security inspections on valuable network data, it is necessary to ensure the security of the data during network transmission. Research has found that the existing network data inspection process often involves the security processing of a large amount of raw data, which easily leads to problems such as long inspection time and redundant operations. Summary of the Invention

[0007] The purpose of the present invention is to provide a data detection and processing method and system for ticketing platform network security, which solves the above-mentioned technical problems pointed out in the prior art.

[0008] The present invention provides a data detection and processing method for network security of a ticketing platform, comprising the following steps:

[0009] Obtain network data sequence from the cloud security control server;

[0010] Encoding the network data sequence to obtain a coding sequence; extracting characteristic information from the coding sequence and constructing an initial matrix based on the characteristic information; constructing a correlation matrix based on the frequency of the characteristic information appearing in the network data sequence and the initial matrix;

[0011] Then, a network behavior association knowledge base is constructed through the association matrix.

[0012] Preferably, feature information is extracted from the coding sequence, and an initial matrix is constructed based on the feature information. The specific operation steps are as follows:

[0013] Performing a coding feature extraction operation on the coding sequence to obtain a first abnormal feature and a first behavior feature, and simultaneously counting the number of the first abnormal features and the number of the first behavior features;

[0014] Analyze the first correlation between the first abnormal feature and the first behavior feature; construct an initial matrix for the first abnormal feature and the first behavior feature according to the first correlation; the constructed initial matrix is:

[0015]

[0016] Each row of the initial matrix represents the i-th behavior feature, each column represents the abnormal feature corresponding to the i-th behavior feature, and each element represents the correlation relationship between the behavior feature and the abnormal feature.

[0017] Preferably, each element unit in the initial matrix represents an association relationship between corresponding feature pairs; the feature pair refers to a feature group consisting of the first abnormal feature and the first behavioral feature.

[0018] Preferably, the correlation matrix is constructed by using the frequency of the characteristic information appearing in the network data sequence and the initial matrix, and the specific operation steps are as follows:

[0019] Analyze the initial matrix and the network data sequence to output a second correlation relationship;

[0020] Based on the second association relationship, filling the network data sequence into the initial matrix to obtain an association matrix;

[0021] The correlation matrix is:

[0022]

[0023] Each row of the initial matrix represents the i'th behavior feature, each column represents the abnormal feature corresponding to the i'th behavior feature, and each element represents the correlation relationship between the behavior feature and the abnormal feature.

[0024] Preferably, the network data sequence is used to fill an initial matrix to obtain a correlation matrix. The specific operation steps are as follows:

[0025] By using the second correlation relationship between the network data sequence and the initial matrix, counting the frequency T of the second abnormal feature and the second behavioral feature in the network data sequence;

[0026] The frequency T is calculated as follows:

[0027] T=(R1, B1)+(R2, B2)+…+(Ro, Bo);

[0028] Where Ro is the oth second abnormal feature, Bo is the oth second behavioral feature, and the total frequency of the two in the network data sequence is obtained by adding the number of second abnormal features and the number of second behavioral features;

[0029] assigning a first dynamic weight g to the abnormal feature and the behavioral feature simultaneously according to the frequencies of occurrence of the second abnormal feature and the second behavioral feature in the network data sequence;

[0030] The higher the frequency of occurrence of the second abnormal feature and the second behavioral feature, the greater the first dynamic weight assigned;

[0031] According to the positions of each first abnormal feature and the first behavioral feature in the initial matrix, the first dynamic weight is filled into the element unit position in the corresponding initial matrix to obtain a correlation matrix.

[0032] Preferably, the first dynamic weight g is:

[0033]

[0034] Where g is the first dynamic weight assigned; T represents the frequency of occurrence of the second abnormal feature and the second behavioral feature, R represents the second abnormal feature, and B represents the second behavioral feature; Rov represents the occurrence of the o-th second abnormal feature at the v-th frequency; Bov represents the occurrence of the o-th second behavioral feature at the v-th frequency; and exp represents an exponential function with the natural constant, e, as the base.

[0035] Preferably, the first dynamic weight is filled into the element unit position in the corresponding initial matrix according to the position of each first abnormal feature and the first behavioral feature in the initial matrix to obtain a correlation matrix. The specific operation steps are as follows:

[0036] Constructing a feature connection graph based on the second abnormal feature and the second behavioral feature in the network data sequence; each node in the feature connection graph represents a feature;

[0037] A second dynamic weight is assigned to each edge of the feature connection graph, and the feature of each node in the feature connection graph and the second dynamic weight of each edge in the feature connection graph are mapped into the initial matrix to obtain a correlation matrix.

[0038] Preferably, the rows and columns in the initial matrix correspond to nodes in the feature connection graph respectively, and the weight of the element unit of the initial matrix is represented by the second dynamic weight of the corresponding edge in the feature connection graph.

[0039] Accordingly, the present invention also proposes a data detection and processing system for network security of a ticketing platform, comprising: a collection module, a correlation module, and a construction module;

[0040] The acquisition module is used to obtain network data sequences from the cloud security control server;

[0041] The association module is used to encode the network data sequence to obtain a coding sequence; extract feature information from the coding sequence and construct an initial matrix based on the feature information; and construct a correlation matrix based on the frequency of the feature information appearing in the network data sequence and the initial matrix;

[0042] The construction module is used to construct a network behavior association knowledge base through the association matrix.

[0043] Correspondingly, the present invention also proposes a storage medium, in which a computer program is stored. When the computer program is executed by a processor, the steps of the data detection and processing method for network security of a ticketing platform are implemented as described in any of the above items.

[0044] Compared with the prior art, the embodiments of the present invention have at least the following technical advantages:

[0045] From the analysis of the data detection and processing method for network security of a ticketing platform provided by the present invention, it can be known that in specific applications, a network data sequence is collected through a cloud security control server, and various identity information of users inside the cloud security control server can be understood based on the network data sequence; and by encoding the network data sequence to obtain a coding sequence, the network data sequence can be converted into a format that is easier to identify and process, so as to facilitate subsequent analysis and detection; and further analyzing the coding sequence to extract the first abnormal feature and the first behavioral feature, which belong to the data information in the network data sequence, and the abnormal behavior existing in the user's activity at a specific time flow of the network data sequence is understood, thereby extracting key features; through a certain first abnormal feature, it can be understood which first behavioral feature is caused, so as to know the correlation between the two; an initial matrix is constructed through the correlation relationship, and the rows and columns of the initial matrix are used to quickly find which behavioral feature causes the abnormal feature;

[0046] Furthermore, the initial matrix and the network data sequence are analyzed to generate a second correlation relationship; the frequency of the second abnormal feature and the second behavioral feature appearing in the network data sequence is counted through the second correlation relationship, and the number of times and time intervals of abnormal behaviors in the network data sequence are consolidated according to the frequency of occurrence, so as to judge whether the network data sequence is in a safe process, and a feature connection graph is constructed according to the second abnormal feature and the second behavioral feature. The feature connection graph can better indicate the relationship between each feature in the network data sequence in the form of nodes and edges, and is helpful to discover abnormal behaviors in the network data sequence, and discover potential data quality problems or unknown data problems through these abnormal behaviors;

[0047] Furthermore, the feature connection graph is mapped into the initial matrix, and the second dynamic weight of the feature connection graph is used as the weight of the initial matrix. The second dynamic weight not only considers the direct connection between features, but also makes cloud security network data analysis and anomaly detection more efficient and easy. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 This is an overall flow chart of a data detection and processing method for network security of a ticketing platform in Example 1;

[0049] Figure 2 This is a flowchart of constructing an initial matrix for a data detection and processing method for network security of a ticketing platform in Example 1;

[0050] Figure 3 This is a correlation diagram between the initial matrix and the network data sequence of a data detection and processing method for network security of a ticketing platform in Example 1;

[0051] Figure 4This is a first dynamic weight filling flow chart of a data detection and processing method for network security of a ticketing platform in Example 1;

[0052] Figure 5 Fill in the flow chart for the characteristic connection diagram of a data detection and processing method for network security of a ticketing platform in Example 1;

[0053] Figure 6 This is a flow chart of a data detection and processing system for network security of a ticketing platform in Example 2;

[0054] Figure 7 This is a schematic structural diagram of a storage medium for a data detection and processing method for network security of a ticketing platform in Example 3.

[0055] Reference numerals: acquisition module 10 , association module 20 , construction module 30 ; memory 1110 ; communication interface 1120 ; processor 1130 ; computer storage medium 1140 . DETAILED DESCRIPTION

[0056] The technical solution of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the embodiments described are only some embodiments of the present invention, not all embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0057] The present invention will be further described in detail below through specific embodiments in conjunction with the accompanying drawings.

[0058] Example 1

[0059] This embodiment provides a data detection and processing method for network security of a ticketing platform, including the following steps:

[0060] S10: Obtaining a network data sequence from the cloud security control server;

[0061] It should be noted that the network data sequence obtained through the cloud security control server contains various types of user identity data information. At the same time, it also contains some abnormal behaviors that may exist in the network data sequence. For example, when the user's identity information is kept, it is easy for some users to operate too frequently, resulting in abnormal behaviors that do not conform to normal operations;

[0062] S20: Encode the network data sequence to obtain a coded sequence; extract feature information from the coded sequence and construct an initial matrix based on the feature information; and construct a correlation matrix based on the frequency of the feature information appearing in the network data sequence and the initial matrix.

[0063] It should be noted that the network data sequence is encoded to obtain a coded sequence; the network data sequence is converted into a format that is easier to process and analyze through encoding, and the amount of data is reduced through encoding while retaining key information for subsequent analysis; feature information is extracted from the coded sequence and the network data sequence, and a correlation matrix is constructed based on the correlation between the feature information (i.e., abnormal behavior is analyzed based on the coded sequence, a matrix is preliminarily constructed based on the abnormal behavior, and a correlation matrix is constructed based on the correlation between the analysis of the network data sequence and the abnormal behavior of the coded sequence);

[0064] S30: Then construct a network behavior association knowledge base through the association matrix.

[0065] It should be noted that, finally, the network behavior association knowledge base is used to analyze the root cause of the abnormal behavior of the network data to be detected, and the abnormal network behavior appearing in the network data is solved by the root cause of the abnormal behavior, thereby achieving the security of the network data;

[0066] Furthermore, when the same network data is subsequently tested again, operations can be performed more quickly to reduce the testing time and avoid attacks caused by abnormal behaviors due to excessive testing time. At the same time, when constructing the correlation matrix, security protection is provided for those behaviors that are prone to abnormal activities, and subsequent correlation matrices are automatically protected.

[0067] The network behavior association knowledge base in the embodiment of the present invention constructs a network behavior association matrix by encoding and extracting features from network data sequences, which reflects the intrinsic connections between network behaviors.

[0068] This network behavior association knowledge base can then be used to analyze anomalies in network behavior, enabling analysis and tracking of abnormal network behavior. Therefore, this network behavior association knowledge base records the associations between various behavioral features in network data sequences, supporting the identification and response to abnormal network behavior, and is the final output of this embodiment.

[0069] Specifically, in step S20, feature information is extracted from the coding sequence, and an initial matrix is constructed based on the feature information. The specific operation steps are as follows:

[0070] S201: performing a coding feature extraction operation on the coding sequence to obtain a first abnormal feature and a first behavior feature, and simultaneously counting the number of the first abnormal features and the number of the first behavior features;

[0071] It should be noted that the first abnormal feature and the first behavioral feature extracted from the coding sequence are data information in the network data sequence;

[0072] The behavioral characteristics of the data information are the user's activities at a specific time and flow (e.g., the user's login at a specific time, and whether there is any activity that deviates from the normal behavior pattern); the first abnormality characteristic is the abnormal behavior in the network protocol that does not conform to the normal protocol behavior; the first behavioral characteristics and abnormal characteristics can reduce the time required to generate the association matrix later; extract and retain key features, which can also be potential threats and anomalies;

[0073] S202: Analyze the first correlation between the first abnormal feature and the first behavior feature; construct an initial matrix for the first abnormal feature and the first behavior feature according to the first correlation; the constructed initial matrix is:

[0074]

[0075] Each row of the initial matrix represents the i-th behavioral feature, each column represents the abnormal feature corresponding to the i-th behavioral feature, and each element represents the correlation between the behavioral feature and the abnormal feature;

[0076] Each element unit in the initial matrix represents the association relationship between the corresponding feature pair (i.e., the first abnormal feature and the first behavioral feature); the feature pair refers to a feature group consisting of the first abnormal feature and the first behavioral feature;

[0077] It should be noted that the first correlation between the first abnormal feature and the first behavioral feature is analyzed, such as whether a certain abnormal feature is directly caused by a certain behavioral feature or indirectly caused by it; an initial matrix (i.e., a feature matrix, which is a matrix framework, by constructing the initial matrix, it can be observed which first behavioral features are directly or indirectly associated with which first abnormal features, and when a certain abnormality occurs again, the behavioral features can be quickly found by viewing the corresponding rows and columns in the initial matrix); since each first abnormal feature may represent a different abnormality type or form, using them as rows of the initial matrix can show the specific situation of each first abnormal feature; and since behavioral features have a wide variety, using them as columns of the initial matrix can show the impact of different first behavioral features on abnormal features;

[0078] In step S20, the correlation matrix is constructed by the frequency of the characteristic information appearing in the network data sequence and the initial matrix. The specific operation steps are as follows:

[0079] S21: Analyze the initial matrix and the network data sequence to output a second correlation relationship (the second relationship is constructed to increase the difficulty of decryption and decoding);

[0080] S22: Based on the second association relationship, fill the network data sequence into the initial matrix to obtain an association matrix;

[0081] The correlation matrix is:

[0082]

[0083] Each row of the initial matrix represents the i'th behavioral feature, each column represents the abnormal feature corresponding to the i'th behavioral feature, and each element represents the correlation relationship between the behavioral feature and the abnormal feature;

[0084] It should be noted that the analysis of the second correlation between the initial matrix and the network data sequence can comprehensively reflect the anomalies and behavior patterns in the network data sequence through abnormal characteristics and behavioral characteristics, so the relationship between the initial matrix and the network data sequence is indirectly obtained;

[0085] Through the second correlation relationship between the initial matrix and the network data sequence, the network data sequence is filled into the initial matrix to obtain the correlation matrix;

[0086] In step S10, the network data sequence contains various identity information, abnormal features, and behavioral features of the user, and the initial matrix is constructed using the first abnormal feature and the first behavioral feature (i.e., the first abnormal feature and the first behavioral feature are data information in the network data sequence);

[0087] After the initial matrix is constructed, the cloud security control server further performs correlation analysis on the features in the network data sequence (such as user identity information, other abnormal features, other behavioral features, etc.). Through statistical methods, it can identify the potential connections between these features, thereby constructing a second correlation relationship with the initial matrix;

[0088] For example:

[0089] Assume that the initial matrix is constructed based on the number of abnormal logins (the first abnormal characteristic) and the frequency of accessing specific sensitive pages (the first behavioral characteristic). Through correlation analysis, the cloud security control server finds that younger users (one of the user identity information) generally have more abnormal logins than older users. They also access sensitive pages more frequently. This may be related to younger users changing devices or passwords more frequently and having higher levels of network activity.

[0090] Further analysis revealed that users with a high number of abnormal logins also tend to have a high number of unauthorized resource accesses (other abnormal characteristics), indicating that these users may face higher security risks and require special attention;

[0091] By analyzing user behavior characteristics (such as access time and path), we found that some users' access frequency to sensitive pages increased significantly during specific time periods (such as late at night), and this frequency was significantly different from their previous normal behavior patterns, which may be related to potential security threats or abnormal behavior.

[0092] Through the second association relationship, the network data sequence can be subsequently analyzed for the second abnormal feature and the second behavior feature, and the second abnormal feature and the second behavior feature can be filled into the initial matrix through the second association relationship, thereby constructing a correlation matrix. In this way, the abnormal situation can be safely detected through the close association relationship, so that the subsequent detection is safer.

[0093] In the subsequent step S221, the network data sequence has a second abnormal feature and a second behavioral feature (i.e., the second abnormal feature and the second behavioral feature are the specific number of occurrences and time intervals in the network data sequence), so the first abnormal feature and the first behavioral feature in the initial matrix are associated with the network data sequence and the second abnormal feature and the second behavioral feature in the network data sequence (i.e., the second association relationship); and the network data sequence is filled into the initial matrix network through the second association relationship, which is a feature extraction of the network data sequence (i.e., the second abnormal feature and the second behavioral feature), and each matrix element unit represents the importance and security of the node in the network;

[0094] Specifically, in step S22, the network data sequence is used to fill the initial matrix to obtain a correlation matrix. The specific operation steps are as follows:

[0095] S221: Counting the frequency T of occurrence of the second abnormal feature and the second behavior feature in the network data sequence through the second correlation relationship between the network data sequence and the initial matrix;

[0096] The frequency T is calculated as follows:

[0097] T=(R1, B1)+(R2, B2)+…+(Ro, Bo);

[0098] Where Ro is the oth second abnormal feature, Bo is the oth second behavioral feature, and the total frequency of the two in the network data sequence is obtained by adding the number of second abnormal features and the number of second behavioral features (that is, when extracting through the coding sequence, the number of first abnormal features and the number of first behavioral features can be used to determine the number of second abnormal features and the number of second behavioral features; because the coding sequence is obtained through the network data sequence, the number of abnormal features and the number of behavioral features are the same);

[0099] assigning a first dynamic weight g to the abnormal feature and the behavioral feature simultaneously according to the frequencies of occurrence of the second abnormal feature and the second behavioral feature in the network data sequence;

[0100]

[0101] Where g is the first dynamic weight assigned; T represents the frequency of occurrence of the feature (where the above-mentioned feature refers to the second abnormal feature and the second behavioral feature, that is, the frequency T of occurrence of the second abnormal feature and the second behavioral feature), R represents the second abnormal feature, and B represents the second behavioral feature; Rov represents the occurrence of the o-th second abnormal feature at the v-th frequency; Bov represents the occurrence of the o-th second behavioral feature at the v-th frequency; exp represents an exponential function with a natural constant, e, as the base;

[0102] The higher the frequency of occurrence of the second abnormal feature and the second behavioral feature, the greater the first dynamic weight assigned;

[0103] It should be noted that what is counted in step S221 is the frequency of occurrence of the second abnormal feature and the second behavioral feature in the network data sequence, which represents the specific number of times and time intervals of the second abnormal feature and the second behavioral feature in the network data sequence. By assigning dynamic weights to the abnormal behaviors in the network data sequence, the subsequent correlation matrix can be updated in real time (that is, the first abnormal feature and the first behavioral feature extracted from the coding sequence are different from the data information in the network data sequence);

[0104] The higher the frequency of the second abnormal feature and the second behavioral feature, the greater the first dynamic weight may be. According to the actual statistics of the second abnormal feature and the second behavioral feature in the historical network data sequence, the first dynamic weight is simultaneously assigned to the second abnormal feature and the second behavioral feature. The frequency of the second abnormal feature and the second behavioral feature in the network data sequence, as well as the relationship between the network data sequence and the second abnormal feature and the second behavioral feature are used as the statistical situation (that is, because by analyzing the network data sequence, it can be obtained how many times the abnormal behavior (that is, the abnormal feature and the behavioral feature) will appear in it, and the first dynamic weight is assigned to the second abnormal feature and the second behavioral feature according to the frequency of occurrence), thereby assigning the first dynamic weight to each element unit in the subsequent initial matrix. The dynamic weight reflects the strength of the association between the features in the network data sequence.

[0105] The first dynamic weight is equivalent to updating the first dynamic weight and thus updating the association matrix after establishing the association matrix according to the frequency of occurrence of the second abnormal feature and the second behavior feature in the network data sequence.

[0106] S222: Filling the first dynamic weights into the corresponding element unit positions in the initial matrix according to the positions of each first abnormal feature and the first behavioral feature in the initial matrix to obtain a correlation matrix (i.e., the first dynamic weights are assigned according to the frequencies of the second abnormal features and the second behavioral features appearing in the network data sequence, so when the first dynamic weights are filled into the initial matrix, the second abnormal features and the second behavioral features of the network data sequence are indirectly filled into the initial matrix);

[0107] It should be noted that the first dynamic weight is assigned by calculating the frequency of the second abnormal feature and the second behavioral feature appearing in the network data sequence, and the first dynamic weight is filled in according to the element unit position of each first abnormal feature and the first behavioral feature in the initial matrix constructed by the second abnormal feature and the second behavioral feature, so as to obtain an association matrix; each element unit in the above association matrix reflects the association strength and importance of the corresponding feature (i.e., the abnormal feature and the behavioral feature) in the network data; the first dynamic weight can be adjusted as the network data sequence is updated in real time, so that the association matrix can reflect the dynamic changes of the network environment and enhance the flexibility of cloud security;

[0108] Specifically, in step S222, the first dynamic weight is filled into the element unit position in the corresponding initial matrix according to the position of each first abnormal feature and the first behavioral feature in the initial matrix to obtain a correlation matrix. The specific operation steps are as follows:

[0109] S2221: Constructing a feature connection graph based on the second abnormal feature and the second behavioral feature in the network data sequence; each node in the feature connection graph represents a feature;

[0110] It should be noted that the feature connection graph is constructed by the features of the network data sequence. Each feature node in the feature connection graph represents a feature, and the edges between feature nodes represent the relationship between each feature.

[0111] Analyzing the correlation (i.e., association) between the second abnormal feature and the second behavioral feature using statistical methods; determining which features have significant correlations, and identifying the causal relationship between the second abnormal feature and the second behavioral feature using causal reasoning methods, thereby identifying a potential connection between the second abnormal feature and the second behavioral feature;

[0112] The second abnormal feature and the second behavioral feature are used as nodes in the feature connection graph. The edges between the nodes are determined based on the relationship between the second abnormal feature and the second behavioral feature (such as correlation, causality, etc.). The nodes are connected through the edges to form a feature connection graph. For example:

[0113] By monitoring network data on user activity, the cloud security control server discovered that user A had posted 10 times more content than usual in the past week, and had received an unusually high number of likes and comments. These activities were outside of user A's historical behavior patterns and were therefore identified as the second abnormality.

[0114] At the same time, the cloud security control server analyzed user A's daily behavior and found that he usually posted an average of 1-2 pieces of content per day, mainly focusing on technology topics, and maintained interaction with a fixed group of friends and followers.

[0115] In the connection graph, the cloud security control server observed that user A had established new connections with a group of users with whom he had rarely interacted before. These new users also exhibited similar abnormal activity patterns (such as a large number of likes and comments on user A's content). In addition, these new users also liked and commented on each other's content, forming a close-knit community.

[0116] By comparing the second abnormal feature with the second behavioral feature and analyzing the connection graph, the cloud security control server can infer that user A's abnormal activity may be related to this newly formed community;

[0117] Further investigation revealed that the community was controlled by an external organization or individual, who manipulated the behavior of User A and other members to create false hot topics or promote information. User A's unusual activity was actually part of a larger-scale manipulation effort.

[0118] By constructing a feature connection graph, we can express complex network data structures. By mapping the initial matrix with the subsequent feature connection graph, we can find that a second abnormal feature is the main reason for the change of the second behavioral feature. Then, we can control the abnormal feature to influence the behavioral feature, thereby optimizing the performance of the cloud security control server or preventing adverse consequences, thereby achieving the security of the subsequent correlation matrix detection.

[0119] S2222: assigning a second dynamic weight to each edge of the feature connection graph, mapping the feature of each node in the feature connection graph and the second dynamic weight of each edge in the feature connection graph into the initial matrix to obtain a correlation matrix;

[0120] The rows and columns in the initial matrix correspond to nodes in the feature connection graph (i.e., abnormal features and behavioral features), and the weight of the element unit of the initial matrix is represented by the second dynamic weight of the corresponding edge in the feature connection graph;

[0121] It should be noted that by assigning a second dynamic weight to each edge in the feature connection graph, and calculating the evaluation score of the correlation strength between features using methods such as expert evaluation based on the frequency, duration, and change trend of features in network traffic data, and assigning a second dynamic weight to each edge in the feature connection graph based on the evaluation score, the correlation between features can be more accurately represented. These second dynamic weights not only consider the direct connection between features, but also incorporate the global information of network data (i.e., network data sequence) and the influence of features in the network, making the representation of the correlation relationship more comprehensive; through the second dynamic weight assignment process and projecting it into the correlation matrix, cloud security network data analysis and anomaly detection can be made more efficient and easier;

[0122] Mapping the feature connection graph to the initial matrix simplifies the complex second dynamic weight distribution and projection. The rows and columns of the association matrix correspond to feature nodes, and the element units represent the association weights between feature pairs, making cloud security network data analysis and anomaly detection easier.

[0123] Because the weights of the correlation matrix are determined dynamically (i.e., weights can represent the strength of association, similarity, or other metrics between two features or nodes), they can be adjusted based on real-time updates of network data. Therefore, the correlation matrix can reflect dynamic changes in the network environment. This dynamic flexibility makes the correlation matrix more practical and accurate in cloud security fields such as anomaly detection and behavior analysis.

[0124] Example 2

[0125] This embodiment also provides a data detection and processing system for network security of a ticketing platform, comprising: a collection module 10, an association module 20, and a construction module 30;

[0126] The acquisition module 10 is used to obtain network data sequences from the cloud security control server;

[0127] The association module 20 is used to encode the network data sequence to obtain a coding sequence; extract feature information from the coding sequence and construct an initial matrix based on the feature information; and construct a correlation matrix based on the frequency of the feature information appearing in the network data sequence and the initial matrix.

[0128] The construction module 30 is used to construct a network behavior association knowledge base through the association matrix.

[0129] Example 3

[0130] On the other hand, this embodiment 3 is based on the data detection and processing method for the network security of a ticketing platform provided in the embodiment 1 of the invention, and further provides a computer storage medium 1140 (hereinafter referred to as storage medium). Figure 7FIG. 1 is a schematic diagram of a computer storage medium structure framework provided in Embodiment 3 of the present invention, which includes:

[0131] Memory 1110, for storing computer programs;

[0132] The communication interface 1120 is used to connect the memory 1110 to the processor 1130;

[0133] The processor 1130 is configured to execute a computer program to implement a data detection and processing method for network security of a ticketing platform involved in the first embodiment disclosed in combination with any of the above-mentioned implementation modes.

[0134] In summary, the data detection and processing method and system for the network security of a ticketing platform proposed in the example of the present invention collects a network data sequence through a cloud security control server, and can understand various identity information of users inside the cloud security control server based on the network data sequence; and by encoding the network data sequence to obtain a coding sequence, the network data sequence can be converted into a format that is easier to identify and process, so as to facilitate subsequent analysis; and further analyze the coding sequence to extract the first abnormal feature and the first behavioral feature, which belong to the data information in the network data sequence, and understand the abnormal behavior in the user's activities at a specific time flow of the network data sequence, thereby extracting key features; through a certain first abnormal feature, it can be understood which first behavioral feature is caused, so as to know the correlation between the two; an initial matrix is constructed through the correlation relationship, and the rows and columns of the initial matrix are used to quickly find which behavioral feature causes the abnormal feature;

[0135] Furthermore, the initial matrix and the network data sequence are analyzed to generate a second correlation relationship; the frequency of the second abnormal feature and the second behavioral feature appearing in the network data sequence is counted through the second correlation relationship, and the number of times and time intervals of abnormal behaviors in the network data sequence are consolidated according to the frequency of occurrence, so as to judge whether the network data sequence is in a safe process, and a feature connection graph is constructed according to the second abnormal feature and the second behavioral feature. The feature connection graph can better indicate the relationship between each feature in the network data sequence in the form of nodes and edges, and is helpful to discover abnormal behaviors in the network data sequence, and discover potential data quality problems or unknown data problems through these abnormal behaviors;

[0136] Furthermore, the feature connection graph is mapped into the initial matrix, and the second dynamic weight of the feature connection graph is used as the weight of the initial matrix. The second dynamic weight not only considers the direct connection between features, but also makes cloud security network data analysis and anomaly detection more efficient and easy.

[0137] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit them. A person skilled in the art may modify the technical solutions described in the above embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A data detection and processing method for network security of a ticketing platform, characterized in that: The following steps are included: Obtain network data sequence from the cloud security control server; Encoding the network data sequence to obtain a coding sequence; extracting feature information from the coding sequence, and constructing an initial matrix based on the feature information; Constructing a correlation matrix through the frequency of occurrence of characteristic information in the network data sequence and the initial matrix; Then, a network behavior association knowledge base is constructed through the association matrix; Extract characteristic information from the coding sequence and construct an initial matrix based on the characteristic information. The specific steps are as follows: Performing a coding feature extraction operation on the coding sequence to obtain a first abnormal feature and a first behavior feature, and simultaneously counting the number of the first abnormal features and the number of the first behavior features; Analyze the first correlation between the first abnormal feature and the first behavior feature; construct an initial matrix for the first abnormal feature and the first behavior feature according to the first correlation; the constructed initial matrix is: ； Each row of the initial matrix represents the i-th behavioral feature, each column represents the abnormal feature corresponding to the i-th behavioral feature, and each element represents the correlation between the behavioral feature and the abnormal feature; Each element unit in the initial matrix represents the association relationship between the corresponding feature pairs; the feature pair refers to a feature group consisting of the first abnormal feature and the first behavioral feature; The association matrix is constructed by using the frequency of the characteristic information appearing in the network data sequence and the initial matrix. The specific operation steps are as follows: Analyze the initial matrix and the network data sequence to output a second correlation relationship; Based on the second association relationship, filling the network data sequence into the initial matrix to obtain an association matrix; The correlation matrix is: ； Each row of the initial matrix represents the i-th ， behavioral features, each column represents the i-th ， The abnormal features corresponding to the behavioral features, each element represents the correlation between the behavioral features and the abnormal features; The network data sequence is used to fill the initial matrix to obtain the correlation matrix. The specific steps are as follows: By using the second correlation relationship between the network data sequence and the initial matrix, counting the frequency T of the second abnormal feature and the second behavioral feature in the network data sequence; assigning a first dynamic weight to both the abnormal feature and the behavioral feature according to the frequencies of occurrence of the second abnormal feature and the second behavioral feature in the network data sequence; Filling the first dynamic weight into the element unit position in the corresponding initial matrix according to the position of each first abnormal feature and the first behavioral feature in the initial matrix to obtain a correlation matrix; According to the positions of each first abnormal feature and the first behavioral feature in the initial matrix, the first dynamic weight is filled into the element unit position in the corresponding initial matrix to obtain the correlation matrix. The specific operation steps are as follows: Constructing a feature connection graph based on the second abnormal feature and the second behavioral feature in the network data sequence; each node in the feature connection graph represents a feature; Assigning a second dynamic weight to each edge of the feature connection graph, mapping the features of each node in the feature connection graph and the second dynamic weight of each edge in the feature connection graph into the initial matrix to obtain an association matrix; The rows and columns in the initial matrix correspond to nodes in the feature connection graph respectively, and the weight of the element unit of the initial matrix is represented by the second dynamic weight of the corresponding edge in the feature connection graph.

2. A data detection and processing system for the network security of a ticketing platform, used to implement the data detection and processing method for the network security of a ticketing platform described in claim 1, characterized in that: include: Acquisition module, association module, construction module; The acquisition module is used to obtain network data sequences from the cloud security control server; The association module is used to encode the network data sequence to obtain a coding sequence; extract feature information from the coding sequence, and construct an initial matrix based on the feature information; Constructing a correlation matrix through the frequency of occurrence of characteristic information in the network data sequence and the initial matrix; The construction module is used to construct a network behavior association knowledge base through the association matrix.

3. A storage medium, characterized in that: The storage medium stores a computer program, which, when executed by a processor, implements the steps of the data detection and processing method for network security of a ticketing platform as described in claim 1.

Images