Intelligent management system for network flow data

Abstract

The invention relates to the technical field of network data management, in particular to a network flow data intelligent management system, which comprises a plurality of user sides, a data storage module, an access analysis module and a channel establishment module, the data storage module is used for carrying out classified encryption and classified storage on all data, the access analysis module is used for determining access abnormal tendency characterization parameters and abnormal exchange tendency categories, and the channel establishment module is used for determining whether data access is abnormal or not according to the abnormal exchange tendency categories. According to the method, the access abnormity analysis and the secondary encryption strategy are combined, all-around security protection is provided for the data, the system can monitor and respond to abnormal behaviors in data access in real time, the integrity and confidentiality of the data are ensured, and meanwhile, the method has high flexibility and the capability of adapting to different security requirements.

Description

Technical Field

[0001] The present invention relates to the technical field of network data management, and in particular to an intelligent management system for network flow data. Background Art

[0002] Measuring network traffic data access security is a key measure to ensure the integrity of information systems and protect sensitive data. By analyzing network traffic in real time, abnormal activities, potential security vulnerabilities, and unauthorized access attempts can be effectively detected and identified. This monitoring helps to discover and respond to possible network attacks, data leaks, or other security threats, thereby protecting the data security of enterprises and individuals. In addition to preventing external attacks, monitoring can also identify internal misconduct or configuration errors to prevent accidental data leaks or system damage. In general, network traffic monitoring can not only improve the level of network security protection, but also enhance visibility into the operating status of the system, help to quickly respond to potential security incidents, and maintain the stability and reliability of information systems.

[0003] Chinese Patent Publication No.: CN116112292A discloses an abnormal behavior detection method, system and medium based on network traffic big data, the method includes: identifying user attribute information and combining feature information to generate a network access traffic monitoring map and extract feature data, collecting network environment dynamic data and processing to obtain behavior evaluation data, and then performing deviation aggregation calculation with standard specification data obtained by processing user attribute information and network environment dynamic data to obtain access behavior abnormality index, and then combining with detection threshold to perform threshold comparison to detect network traffic access behavior information status; thereby, by obtaining monitoring map to extract feature data and combining network environment dynamic data processing to obtain evaluation data, and performing deviation aggregation with standard specification data to obtain access behavior abnormality index and compare and evaluate access behavior information status, the network access information is detected and evaluated through big data processing technology; it can be seen that the abnormal behavior detection method, system and medium based on network traffic big data have the following problems: no analysis of data access requirements, and no accurate security defense measures can be taken against illegal access. Summary of the invention

[0004] To this end, the present invention provides an intelligent management system for network traffic data to overcome the problem in the prior art that data access requirements are not analyzed and accurate security defense measures cannot be taken against illegal access.

[0005] To achieve the above object, the present invention provides a network traffic data intelligent management system, comprising:

[0006] A plurality of user terminals, used to obtain data access requirement information and access identity information, wherein the access requirement information includes target port data and encryption level, and the access identity information includes access permission level;

[0007] The data storage module includes a database and a data encryption unit. The data encryption unit is used to classify and encrypt all the data in the database according to the total number of access rights levels, and to add digital fingerprints to all the data according to the encryption levels. The database is used to classify and store all the data according to the data encryption levels.

[0008] An access analysis module connected to each of the user terminals and the data storage module, for determining an access abnormality tendency characterization parameter according to the data access requirement information and the access identity information, and for determining an abnormal exchange tendency category of the data access requirement information according to the abnormal tendency characterization parameter;

[0009] A channel establishment module, which is respectively connected to each of the user terminals, the data storage module and the access analysis module, is used to establish an information transmission channel and determine whether data access is abnormal according to the abnormal exchange tendency category, including:

[0010] Obtain the corresponding digital fingerprint in the target port data, search the digital fingerprint in all data that meet the access permission level, determine the illegal exchange parameter based on the search result to determine whether there is an abnormality in the data access, and if there is an abnormality, re-encrypt the illegal access data based on the illegal exchange parameter, establish a corresponding information transmission channel and then transmit it;

[0011] Alternatively, an information transmission channel is established between the database and the user terminal, the initial hash value of the target access information in the database and the transmission hash value after passing through the information transmission channel are obtained and compared, and the accurate transmission parameters are determined according to the comparison results to determine whether there is any abnormality in data access.

[0012] Furthermore, the data encryption unit in the data storage module adds a digital fingerprint in a targeted manner according to the encryption level, including:

[0013] The data encryption unit determines the number of types of digital fingerprints for each data segment according to the maximum value of the encryption level;

[0014] Adding digital fingerprints of corresponding types to each data segment;

[0015] The encryption level corresponds to the digital fingerprint type one by one.

[0016] Furthermore, the access analysis module determines an access abnormality tendency characterization parameter according to the data access requirement information and the access identity information, and the access abnormality tendency characterization parameter is determined according to formula (1),

[0017]

[0018] In formula (1), K is the parameter characterizing the abnormal tendency, n1 is the encryption level, n0 is the access permission level, N1 is the data volume of the target port data, and N0 is the security data volume corresponding to the access permission level.

[0019] Furthermore, the access analysis module determines the abnormal exchange tendency category of the data access demand information according to the access abnormal tendency characterization parameter, including:

[0020] If the access abnormal tendency characterization parameter is greater than or equal to the standard abnormal tendency characterization parameter, the abnormal exchange tendency category of the data access demand information is a strong abnormal exchange tendency category;

[0021] If the access abnormal tendency characterization parameter is less than the standard abnormal tendency characterization parameter, the abnormal exchange tendency category of the data access demand information is a weak abnormal exchange tendency category.

[0022] Furthermore, the channel establishment module determines whether data access is abnormal according to the abnormal exchange tendency category, including:

[0023] If the abnormal exchange tendency category is a strong abnormal exchange tendency category, the channel establishment module determines the illegal exchange parameter based on the search result of the corresponding digital fingerprint in the acquired target port data in all data that meet the access permission level, and determines whether the data access is abnormal based on the illegal exchange parameter;

[0024] If the abnormal exchange tendency category is a weak abnormal exchange tendency category, the channel establishment module establishes an information transmission channel between the database and the user terminal, obtains the initial hash value of the target access information in the database and the transmission hash value after passing through the information transmission channel and compares them, and determines the transmission accurate parameters based on the comparison results to determine whether there is an abnormality in data access.

[0025] Furthermore, the channel establishment module determines the illegal exchange parameter according to the search result, and the illegal exchange parameter is determined according to formula (2):

[0026]

[0027] In formula (2), H is the illegal exchange parameter, mi is the number of digital fingerprints that can be identified in the i-th data segment, m0 is the total number of digital fingerprints in the data segment, n0 is the access permission level, nm is the maximum value of the encryption level, h is the total number of data segments of the target port data, and i is an integer greater than 0.

[0028] Furthermore, the channel establishment module determines whether data access is abnormal according to the illegal exchange parameter, including:

[0029] If the illegal exchange parameter is greater than or equal to the standard illegal parameter, it is determined that the data access is abnormal;

[0030] If the illegal exchange parameter is smaller than the standard illegal parameter, it is determined that there is no abnormality in the data access.

[0031] Furthermore, the channel establishment module performs secondary encryption on the illegal access data according to the illegal exchange parameter, including:

[0032] The channel establishment module calculates the violation difference between the violation exchange parameter and the standard violation parameter;

[0033] Determine the amount of interference data inserted by secondary encryption in each data segment according to the violation difference;

[0034] The amount of interference data is positively correlated with the violation difference.

[0035] Furthermore, the channel establishment module determines whether data access is abnormal according to the transmission accuracy parameter, including:

[0036] The channel establishment module compares the number of hash values ​​that have not changed after transmission with the number of hash values ​​before transmission to obtain accurate transmission parameters;

[0037] If the transmission accuracy parameter is greater than or equal to the standard transmission accuracy parameter, it is determined that there is no abnormality in the data access;

[0038] If the transmission accuracy parameter is less than the standard transmission accuracy parameter, it is determined that there is an abnormality in the data access.

[0039] Furthermore, the channel establishment module also includes an alarm unit, which is used to issue a corresponding alarm according to the determination result that there is an abnormality in data access.

[0040] Compared with the prior art, the beneficial effect of the present invention is that the network traffic data intelligent management system of the present invention provides a comprehensive way to ensure data security during network data transmission and sharing through multi-level security control and advanced encryption technology. The system can dynamically classify and store data according to user access rights and data encryption levels to ensure that only authorized users can access data of corresponding levels. By using digital fingerprint technology, the system enhances the traceability and anti-counterfeiting capabilities of data. At the same time, through the access anomaly analysis module, it can monitor and respond to potential data leakage risks in real time. When abnormal access is detected, the system adopts a secondary encryption mechanism to further improve data security. The system also includes a hash value comparison function to ensure the integrity and accuracy of data transmission. The use of illegal access quantification and adaptive security policies enables the system to flexibly respond to different security threats, and the real-time monitoring and alarm functions provide a guarantee for rapid response.

[0041] Furthermore, in the present invention, each encryption level corresponds to an exclusive type of digital fingerprint, which can determine the encryption level that can be successfully accessed by the current access permission level, that is, all data including this digital fingerprint can be accessed. Multiple types of digital fingerprints help to more quickly and accurately determine whether the data accessed by the current user is allowed to be accessed by the current access permission level, and provide a computational basis for subsequently determining whether the access is abnormal.

[0042] Furthermore, in the present invention, the access abnormality tendency characterization parameter is determined according to the access permission level and the amount of data accessed, which can determine whether the current user directly accesses across the access permission level, and can also determine whether there is a data security risk of data leakage based on the amount of data accessed in a single visit. Therefore, the access tendency category determined by the access abnormality tendency characterization parameter is more representative.

[0043] Furthermore, in the present invention, the strength of the tendency of abnormality in this access is determined by the access anomaly tendency characterization parameter. The larger the access anomaly tendency characterization parameter, the greater the possibility that the current user's access to the data is abnormal. The possible cause of the abnormality is that the access rights to data exceeding the access right level are obtained through illegal operations, thereby threatening data security. The smaller the access anomaly tendency characterization parameter, the more illegal situations can be excluded. The accuracy of the access data needs to be guaranteed. Therefore, the present invention takes into account the specific circumstances of different access data and adaptively selects the abnormality analysis method, which ensures the access accuracy while ensuring the security of data operation.

[0044] Furthermore, in the present invention, determining the secondary encryption of illegally accessed data based on illegal exchange parameters can effectively ensure the security of the data. That is, in the case that the data is illegally accessed by the user, the data is encrypted before being transmitted through the information transmission channel, which can still ensure the security of the data and allow enough time to take other processing measures. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 This is a schematic diagram of the structure of an intelligent management system for network traffic data according to an embodiment of the present invention;

[0046] Figure 2 A logic diagram for determining abnormal exchange tendency categories of data access demand information for an embodiment of the present invention;

[0047] Figure 3 A logic diagram for determining whether data access is abnormal according to illegal exchange parameters in an embodiment of the present invention;

[0048] Figure 4 This is a logic diagram for determining whether data access is abnormal based on transmission accuracy parameters in an embodiment of the present invention. DETAILED DESCRIPTION

[0049] In order to make the objects and advantages of the present invention more clearly understood, the present invention is further described below in conjunction with embodiments; it should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0050] The preferred embodiments of the present invention are described below with reference to the accompanying drawings. It should be understood by those skilled in the art that these embodiments are only used to explain the technical principles of the present invention and are not intended to limit the protection scope of the present invention.

[0051] It should be noted that, in the description of the present invention, terms such as "up", "down", "left", "right", "inside" and "outside" indicating directions or positional relationships are based on the directions or positional relationships shown in the drawings. This is merely for the convenience of description and does not indicate or imply that the device or element must have a specific orientation, be constructed and operated in a specific orientation. Therefore, it cannot be understood as a limitation on the present invention.

[0052] In addition, it should be noted that in the description of the present invention, unless otherwise clearly specified and limited, the terms "installed", "connected", and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal communication of two components. For those skilled in the art, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0053] See also Figure 1 As shown, it is a schematic diagram of the structure of an intelligent management system for network traffic data according to an embodiment of the present invention; the present invention provides an intelligent management system for network traffic data, comprising:

[0054] A plurality of user terminals, used to obtain data access requirement information and access identity information, wherein the access requirement information includes target port data and encryption level, and the access identity information includes access permission level;

[0055] The data storage module includes a database and a data encryption unit. The data encryption unit is used to classify and encrypt all the data in the database according to the total number of access rights levels, and to add digital fingerprints to all the data according to the encryption levels. The database is used to classify and store all the data according to the data encryption levels.

[0056] An access analysis module connected to each of the user terminals and the data storage module, for determining an access abnormality tendency characterization parameter according to the data access requirement information and the access identity information, and for determining an abnormal exchange tendency category of the data access requirement information according to the abnormal tendency characterization parameter;

[0057] A channel establishment module, which is respectively connected to each of the user terminals, the data storage module and the access analysis module, is used to establish an information transmission channel and determine whether data access is abnormal according to the abnormal exchange tendency category, including:

[0058] Obtain the corresponding digital fingerprint in the target port data, search the digital fingerprint in all data that meet the access permission level, determine the illegal exchange parameter based on the search result to determine whether there is an abnormality in the data access, and if there is an abnormality, re-encrypt the illegal access data based on the illegal exchange parameter, establish a corresponding information transmission channel and then transmit it;

[0059] Alternatively, an information transmission channel is established between the database and the user terminal, the initial hash value of the target access information in the database and the transmission hash value after passing through the information transmission channel are obtained and compared, and the accurate transmission parameters are determined according to the comparison results to determine whether there is any abnormality in data access.

[0060] In implementation, the user end includes any operating end that can interact with the user and obtain user needs and user identity information, such as an application in a mobile phone. This will not be repeated. The maximum values ​​of the encryption level and the access permission level are the same, and the number is not less than 5.

[0061] The data storage module classifies and encrypts all the data in the database according to the total number of access permission levels, and encrypts the entire database in a hierarchical manner according to the total number of access permission levels set. The higher the encryption level, the larger the corresponding numerical value. For example, if the maximum access permission level is 7, the classification level for hierarchical encryption of the database is 7. In addition, the data storage module classifies and encrypts the data and stores it in a classified manner, which is a prior art and is not specifically limited.

[0062] In implementation, the access analysis module and the channel establishment module are composed of logic components, and the logic components include a field programmable processor, a computer, and a microprocessor in the computer.

[0063] By monitoring and analyzing network traffic in real time, the intelligent management system can quickly identify potential security threats, such as malware, phishing attacks, or unauthorized data access attempts, and take timely measures to block these threats; it can also encrypt sensitive data and ensure that only authorized users can access it, thereby protecting data from being leaked or abused.

[0064] The network traffic data intelligent management system of the present invention provides a comprehensive way to ensure data security during network data transmission sharing through multi-level security control and advanced encryption technology. The system can dynamically classify and store data according to user access rights and data encryption levels to ensure that only authorized users can access data of corresponding levels. By using digital fingerprint technology, the system enhances the traceability and anti-counterfeiting capabilities of data. At the same time, through the access anomaly analysis module, it can monitor and respond to potential data leakage risks in real time. When abnormal access is detected, the system adopts a secondary encryption mechanism to further improve data security. The system also includes a hash value comparison function to ensure the integrity and accuracy of data transmission. The use of illegal access quantification and adaptive security policies enables the system to flexibly respond to different data accesses of abnormal network data transmission, and the real-time monitoring and alarm functions provide a guarantee for rapid response.

[0065] Specifically, the data encryption unit in the data storage module adds a digital fingerprint according to the encryption level, including:

[0066] The data encryption unit determines the number of types of digital fingerprints for each data segment according to the maximum value of the encryption level;

[0067] Adding digital fingerprints of corresponding types to each data segment;

[0068] The encryption level corresponds to the digital fingerprint type one by one.

[0069] In practice, the higher the access permission level, the more types of digital fingerprints can be identified, that is, the highest access permission level can identify all types of digital fingerprints, while for lower access permission levels, the types of digital fingerprints that can be identified are also fewer. For example, when a user with an access permission level of 1 accesses data, he can only obtain data with an encryption level of 1. It can be understood that the number of digital fingerprints contained in the data is the same as the maximum value of the encryption level, but only this one can be successfully identified. Data with an encryption level of 2 cannot be directly read by users with an access permission level of 1.

[0070] It can be understood that the number of digital fingerprints in each data segment is greater than or equal to 1, and the greater the maximum encryption level corresponding to the data segment, the greater the number of digital fingerprints.

[0071] In the present invention, each encryption level corresponds to an exclusive type of digital fingerprint, which can determine the encryption level that can be successfully accessed by the current access permission level, that is, all data including this digital fingerprint can be accessed. Multiple digital fingerprint types help to more quickly and accurately determine whether the data accessed by the current user is allowed to be accessed by the current access permission level, and provide a calculation basis for subsequently determining whether the access is abnormal.

[0072] See also Figure 2 As shown, it is a logic diagram of determining the abnormal exchange tendency category of data access demand information in an embodiment of the present invention. The access analysis module determines the access abnormal tendency characterization parameter according to the data access demand information and the access identity information. The access abnormal tendency characterization parameter is determined according to formula (1).

[0073]

[0074] In formula (1), K is the parameter characterizing the abnormal tendency, n1 is the encryption level, n0 is the access permission level, N1 is the data volume of the target port data, and N0 is the security data volume corresponding to the access permission level.

[0075] In implementation, the amount of secure data corresponding to an access permission level is 0.5 times the amount of total data corresponding to the access permission level.

[0076] It can be understood that under normal access conditions, the encryption level in the access request information should be less than or equal to the access permission level. If it is greater than the access permission level, it can be judged as a violation. In addition, the amount of data accessed in a single time should not exceed the amount of secure data. If the amount of data accessed is too large, it can be judged as a data security risk of data leakage.

[0077] Specifically, the access analysis module determines the abnormal exchange tendency category of the data access demand information according to the access abnormal tendency characterization parameter, including:

[0078] If the access abnormal tendency characterization parameter is greater than or equal to the standard abnormal tendency characterization parameter, the abnormal exchange tendency category of the data access demand information is a strong abnormal exchange tendency category;

[0079] If the access abnormal tendency characterization parameter is less than the standard abnormal tendency characterization parameter, the abnormal exchange tendency category of the data access demand information is a weak abnormal exchange tendency category.

[0080] In the present invention, the access abnormality tendency characterization parameter is determined according to the access permission level and the amount of data accessed. It can determine whether the current user has directly accessed across the access permission level, and can also determine whether there is a data security risk of data leakage based on the amount of data accessed in a single visit. Therefore, the access tendency category determined by the access abnormality tendency characterization parameter is more representative.

[0081] In implementation, the standard abnormal tendency characterization parameter is selected in the interval [0.8,1.1].

[0082] Specifically, the channel establishment module determines whether data access is abnormal according to the abnormal exchange tendency category, including:

[0083] If the abnormal exchange tendency category is a strong abnormal exchange tendency category, the channel establishment module determines the illegal exchange parameter based on the search result of the corresponding digital fingerprint in the acquired target port data in all data that meets the access permission level, and determines whether the data access is abnormal according to the illegal exchange parameter; if there is an abnormality, the illegal access data is encrypted twice according to the illegal exchange parameter and then the corresponding information transmission channel is established for transmission;

[0084] If the abnormal exchange tendency category is a weak abnormal exchange tendency category, the channel establishment module establishes an information transmission channel between the database and the user terminal, obtains the initial hash value of the target access information in the database and the transmission hash value after passing through the information transmission channel and compares them, and determines the transmission accurate parameters based on the comparison results to determine whether there is an abnormality in data access.

[0085] In implementation, the data content of all data that meets the access permission level does not exceed the scope included in the target port data.

[0086] In the present invention, the strength of the abnormal tendency of the current access is determined by the access abnormality tendency characterization parameter. The larger the access abnormality tendency characterization parameter is, the greater the possibility that the current user's access to the data is abnormal. The possible cause of the abnormality is that the access rights to data exceeding the access right level are obtained through illegal operations, thereby threatening the data security. The smaller the access abnormality tendency characterization parameter is, the more illegal situations can be excluded. The accuracy of the access data needs to be guaranteed. Therefore, the present invention takes into account the specific circumstances of different access data and adaptively selects the abnormality analysis method, which ensures the access accuracy while ensuring the security of data operation.

[0087] See also Figure 3 As shown, it is a logic diagram of determining whether data access is abnormal according to the illegal exchange parameter according to an embodiment of the present invention. The channel establishment module determines the illegal exchange parameter according to the search result, and the illegal exchange parameter is determined according to formula (2).

[0088]

[0089] In formula (2), H is the illegal exchange parameter, mi is the number of digital fingerprints that can be identified in the i-th data segment, m0 is the total number of digital fingerprints in the data segment, n0 is the access permission level, nm is the maximum value of the encryption level, h is the total number of data segments of the target port data, and i is an integer greater than 0.

[0090] In implementation, the digital fingerprint that can be identified in the data segment can be greater than the access permission level. In this case, the data is considered to be illegally accessed, and the total number of digital fingerprints in the data segment is determined according to the maximum value of the encryption level.

[0091] It is understandable that a visitor may obtain access rights to data that exceeds the access permission level through illegal operations. In this case, the data of the target port before transmission is analyzed again before data transmission, and the illegal exchange parameters are calculated. The encryption parameters of the data are determined based on the illegal exchange parameters to ensure the operational security of the data.

[0092] Specifically, the channel establishment module determines whether data access is abnormal according to the illegal exchange parameter, including:

[0093] If the illegal exchange parameter is greater than or equal to the standard illegal parameter, it is determined that the data access is abnormal;

[0094] If the illegal exchange parameter is smaller than the standard illegal parameter, it is determined that there is no abnormality in the data access.

[0095] In implementation, the standard violation parameter is selected in the interval [1.1,1.2].

[0096] Specifically, the channel establishment module performs secondary encryption on the illegal access data according to the illegal exchange parameter, including:

[0097] The channel establishment module calculates the violation difference between the violation exchange parameter and the standard violation parameter;

[0098] Determine the amount of interference data inserted by secondary encryption in each data segment according to the violation difference;

[0099] The amount of interference data is positively correlated with the violation difference.

[0100] In implementation, the channel establishment module sets an initial amount of interference data when performing secondary encryption on the illegally accessed data, which is 0.1 times the amount of data contained in the current data segment, and inserts the interference data in a non-continuous random manner.

[0101] The secondary encryption method can be any of the existing encryption technologies, such as using a chaotic map (such as Logistic map, Henon map, Lorenz system, etc.) to generate a random chaotic sequence, dividing the data to be encrypted into small blocks, for example, dividing a text file into characters or bytes; generating interference data based on the chaotic sequence, which can be a random number, a random pattern or a part of the chaotic sequence itself, and inserting the interference data into the original data according to a certain rule. This can be achieved through simple replacement, insertion or more complex mathematical operations, and ultimately achieving secondary encryption of the number.

[0102] In the present invention, determining the secondary encryption of illegally accessed data based on illegal exchange parameters can effectively ensure the security of the data. That is, in the case that the data is illegally accessed by the user, the data is encrypted before being transmitted through the information transmission channel, which can still ensure the security of the data and allow enough time to carry out other security processing measures.

[0103] See also Figure 4 As shown, it is a logic diagram of determining whether data access is abnormal according to transmission accuracy parameters in an embodiment of the present invention. The channel establishment module determines whether data access is abnormal according to the transmission accuracy parameters, including:

[0104] The channel establishment module compares the number of hash values ​​that have not changed after transmission with the number of hash values ​​before transmission to obtain accurate transmission parameters;

[0105] If the transmission accuracy parameter is greater than or equal to the standard transmission accuracy parameter, it is determined that there is no abnormality in the data access;

[0106] If the transmission accuracy parameter is less than the standard transmission accuracy parameter, it is determined that there is an abnormality in the data access.

[0107] In implementation, the standard transmission accuracy parameters are selected in the interval [0.85,0.95].

[0108] It can be understood that determining whether there is an abnormality in access based on the transmission accuracy parameter determines whether there is an abnormality in the accuracy of the access data.

[0109] Specifically, the channel establishment module further includes an alarm unit, which is used to issue a corresponding alarm according to the determination result that there is an abnormality in data access.

[0110] So far, the technical solutions of the present invention have been described in conjunction with the preferred embodiments shown in the accompanying drawings. However, it is easy for those skilled in the art to understand that the protection scope of the present invention is obviously not limited to these specific embodiments. Without departing from the principle of the present invention, those skilled in the art can make equivalent changes or substitutions to the relevant technical features, and the technical solutions after these changes or substitutions will fall within the protection scope of the present invention.

[0111] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A network traffic data intelligent management system, characterized in that: include: A plurality of user terminals, used to obtain data access requirement information and access identity information, wherein the access requirement information includes target port data and encryption level, and the access identity information includes access permission level; The data storage module includes a database and a data encryption unit. The data encryption unit is used to classify and encrypt all the data in the database according to the total number of access rights levels, and to add digital fingerprints to all the data according to the encryption levels. The database is used to classify and store all the data according to the data encryption levels. An access analysis module connected to each of the user terminals and the data storage module, for determining an access abnormality tendency characterization parameter according to the data access requirement information and the access identity information, and for determining an abnormal exchange tendency category of the data access requirement information according to the abnormal tendency characterization parameter; A channel establishment module, which is respectively connected to each of the user terminals, the data storage module and the access analysis module, is used to establish an information transmission channel and determine whether data access is abnormal according to the abnormal exchange tendency category, including: Obtain the corresponding digital fingerprint in the target port data, search the digital fingerprint in all data that meet the access permission level, determine the illegal exchange parameter based on the search result to determine whether there is an abnormality in the data access, and if there is an abnormality, re-encrypt the illegal access data based on the illegal exchange parameter, establish a corresponding information transmission channel and then transmit it; Alternatively, an information transmission channel is established between the database and the user terminal, the initial hash value of the target access information in the database and the transmission hash value after passing through the information transmission channel are obtained and compared, and the accurate transmission parameters are determined according to the comparison results to determine whether there is any abnormality in data access.

2. The network traffic data intelligent management system according to claim 1, characterized in that: The data encryption unit in the data storage module adds a digital fingerprint in a targeted manner according to the encryption level, including: The data encryption unit determines the number of types of digital fingerprints for each data segment according to the maximum value of the encryption level; Adding digital fingerprints of corresponding types to each data segment; The encryption level corresponds to the digital fingerprint type one by one.

3. The network traffic data intelligent management system according to claim 2 is characterized in that: The access analysis module determines the access abnormality tendency characterization parameter according to the data access requirement information and the access identity information. The access abnormality tendency characterization parameter is determined according to formula (1): In formula (1), K is the parameter characterizing the abnormal tendency, n1 is the encryption level, n0 is the access permission level, N1 is the data volume of the target port data, and N0 is the security data volume corresponding to the access permission level.

4. The network traffic data intelligent management system according to claim 3 is characterized in that: The access analysis module determines the abnormal exchange tendency category of the data access demand information according to the access abnormal tendency characterization parameter, including: If the access abnormal tendency characterization parameter is greater than or equal to the standard abnormal tendency characterization parameter, the abnormal exchange tendency category of the data access demand information is a strong abnormal exchange tendency category; If the access abnormal tendency characterization parameter is less than the standard abnormal tendency characterization parameter, the abnormal exchange tendency category of the data access demand information is a weak abnormal exchange tendency category.

5. The network traffic data intelligent management system according to claim 4, characterized in that: The channel establishment module determines whether data access is abnormal according to the abnormal exchange tendency category, including: If the abnormal exchange tendency category is a strong abnormal exchange tendency category, the channel establishment module determines the illegal exchange parameter based on the search result of the corresponding digital fingerprint in the acquired target port data in all data that meet the access permission level, and determines whether the data access is abnormal based on the illegal exchange parameter; If the abnormal exchange tendency category is a weak abnormal exchange tendency category, the channel establishment module establishes an information transmission channel between the database and the user terminal, obtains the initial hash value of the target access information in the database and the transmission hash value after passing through the information transmission channel and compares them, and determines the transmission accurate parameters based on the comparison results to determine whether there is an abnormality in data access.

6. The network traffic data intelligent management system according to claim 5, characterized in that: The channel establishment module determines the illegal exchange parameter according to the search result, and the illegal exchange parameter is determined according to formula (2): In formula (2), H is the illegal exchange parameter, mi is the number of digital fingerprints that can be identified in the i-th data segment, m0 is the total number of digital fingerprints in the data segment, n0 is the access permission level, nm is the maximum value of the encryption level, h is the total number of data segments of the target port data, and i is an integer greater than 0.

7. The network traffic data intelligent management system according to claim 6, characterized in that: The channel establishment module determines whether data access is abnormal according to the illegal exchange parameter, including: If the illegal exchange parameter is greater than or equal to the standard illegal parameter, it is determined that the data access is abnormal; If the illegal exchange parameter is smaller than the standard illegal parameter, it is determined that there is no abnormality in the data access.

8. The network traffic data intelligent management system according to claim 7, characterized in that: The channel establishment module performs secondary encryption on the illegal access data according to the illegal exchange parameter, including: The channel establishment module calculates the violation difference between the violation exchange parameter and the standard violation parameter; Determine the amount of interference data inserted by secondary encryption in each data segment according to the violation difference; The amount of interference data is positively correlated with the violation difference.

9. The network traffic data intelligent management system according to claim 8, characterized in that: The channel establishment module determines whether there is an abnormality in data access according to the transmission accuracy parameter, including: The channel establishment module compares the number of hash values ​​that have not changed after transmission with the number of hash values ​​before transmission to obtain accurate transmission parameters; If the transmission accuracy parameter is greater than or equal to the standard transmission accuracy parameter, it is determined that there is no abnormality in the data access; If the transmission accuracy parameter is less than the standard transmission accuracy parameter, it is determined that there is an abnormality in the data access.

10. The network traffic data intelligent management system according to claim 9, characterized in that: The channel establishment module also includes an alarm unit, which is used to issue a corresponding alarm according to the determination result that there is an abnormality in data access.

Images