Computer network security control system based on big data

Abstract

The invention discloses a computer network security control system based on big data, and relates to the technical field of network security, and the system comprises a data model module which comprises a risk data model and a feature data model; the data input module comprises a flow acquisition unit and an analysis unit; the flow acquisition unit is used for capturing a data packet passing through a corresponding connection port in real time and transmitting the data packet to the analysis unit; and the analysis unit is internally provided with a feature matching model, the feature matching model is formulated based on the feature data unit, and after the data packet is received, the analysis unit compares the data packet with the feature matching model. By dynamically comparing the risk data model and the feature data model, the abnormal behaviors in the network traffic can be identified and classified in real time, so that the response speed of the system to potential network attacks is greatly improved, and according to the number and the type of the data packets, the abnormal behaviors in the network traffic can be identified and classified. And dynamically selecting a proper risk data model and a characteristic data model for comparison processing.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a computer network security control system based on big data. Background Art

[0002] With the rapid development of the Internet and the Internet of Things, the scale and complexity of computer networks are increasing, and network security issues are becoming more serious. Although traditional computer network security control methods can cope with basic security threats to a certain extent, they often have problems such as low efficiency, excessive resource consumption, and untimely response when facing large-scale network traffic and diverse attack methods.

[0003] After searching, a Chinese patent (publication number: CN114866246B) discloses a computer network security intrusion detection method based on big data, which includes: obtaining a character map based on the pixel values ​​corresponding to the characters in the domain name string and the entropy of the domain name string; obtaining a new domain name string based on the characters corresponding to the character values ​​reconstructed by each character, and obtaining a new character map corresponding to the new domain name string; inputting the character map and the new character map corresponding to the domain name string into the domain name detection network, and outputting the probability that the domain name belongs to a normal domain name and an abnormal domain name.

[0004] With the continuous expansion of network scale and the increasing complexity of network attack methods, traditional security protection methods based on rules and static models have been unable to meet the needs of modern network security. Dynamic model updates, traffic analysis and real-time response mechanisms based on big data have become the development trend of future network security technology. For this reason, a new network security control system is urgently needed. Therefore, the present invention proposes a computer network security control system based on big data. Summary of the invention

[0005] The purpose of the present invention is to provide a computer network security control system based on big data to solve the problems mentioned in the above background technology.

[0006] The present invention can be implemented by the following technical solutions: A computer network security control system based on big data, including a data model module, a data input module and a data analysis module;

[0007] The data model module includes a risk database unit and a feature data unit, the risk database unit is established based on network attacks or network risks in big data, including a risk data model, and the feature data unit is established based on big data features of the corresponding computer network, including a feature data model;

[0008] When the data input module is connected to the corresponding computer network through the connection port and transmits the data, the data input module identifies and marks the characteristics of the input data to facilitate subsequent processing. The data input module includes: a flow collection unit and a parsing unit;

[0009] The flow collection unit is used to capture data packets passing through the corresponding connection port and transmit them to the analysis unit;

[0010] The parsing unit has a built-in feature matching model, which is formulated based on the feature data unit. After receiving a data packet, the parsing unit compares the data packet with the feature matching model, and identifies and marks feature points in the data packet that meet the feature matching model.

[0011] The data analysis module is used to receive the data packets processed by the parsing unit, and the data analysis module includes a comparison unit, a processing unit, an early warning unit and a mapping unit;

[0012] The comparison unit retrieves the risk data model and the feature data model from the data model module, and after receiving the data packet, dynamically compares the data packet with the risk data model and the feature data model. The comparison unit dynamically uses the risk data model and the feature data model for comparison based on the number and type of the data packet, and obtains the comparison result, thereby reducing the system load while improving work efficiency;

[0013] The processing unit classifies the comparison results and converts the corresponding data packets into one of safe data, suspicious data or dangerous data, and the processing unit transmits the data packets converted into safe data to the corresponding computer network for subsequent processing;

[0014] After the comparison result classification, the early warning unit matches the data packet converted into dangerous data with the risk database unit of the data model module to generate a corresponding emergency treatment plan;

[0015] The mapping unit processes the data packets converted into suspicious data, extracts the marked feature points in the corresponding data packets to obtain feature packets, and fills the missing parts in the feature packets with big data features based on the feature data units in the data model module to generate a converted data packet set, and finally the mapping unit transmits the converted data packet set to the processing unit.

[0016] A further technical improvement of the present invention is that the method for establishing the feature matching model comprises the following steps:

[0017] Step 1: Define feature data units;

[0018] The feature data unit is established based on the corresponding computer network features captured in the big data, including:

[0019] a. Traffic characteristics;

[0020] b. Protocol characteristics;

[0021] c. Behavioral characteristics;

[0022] d. Online behavior;

[0023] Step 2: Extract the original data of the corresponding computer network from the big data, obtain the key features after processing, and organize the key features of the computer network into structured feature data units;

[0024] Step 3: Select the required key features, form a feature matching model, and use historical data for training;

[0025] During training, training data with labeled features are prepared to match the feature matching model, and a cross-validation method is used to optimize the feature matching model.

[0026] A further technical improvement of the present invention is that: the comparison unit is preset with a risk level, and when the comparison unit compares the data packet through the characteristic data model, a corresponding risk value is generated based on the number of characteristic points of the data packet matching the characteristic data model;

[0027] The risk value is inversely proportional to the number of feature points that match the data packet, that is, the more feature points the data packet matches with the feature data model, the lower the corresponding risk value, indicating that the characteristics of the data packet are more consistent with the normal communication mode of the computer network, and therefore the risk is lower;

[0028] The comparison unit assigns different weights to each feature point within the recognition range based on different recognition ranges;

[0029] When calculating the risk value of a feature point, its contribution to the final detection result is dynamically calculated based on the weight of the feature point. The fewer the number of matching feature points, the higher the corresponding risk value, indicating that there may be anomalies and a higher risk.

[0030] A further technical improvement of the present invention is that: the comparison unit adopts a dynamic comparison mechanism for the data packets, and in the same time period, if the number of input data packets exceeds a preset number threshold, the comparison unit changes the recognition range of the data packets;

[0031] When the number of data packets is large, the comparison unit dynamically adjusts the recognition range based on the pressure of the current network traffic to optimize the allocation of resources;

[0032] When there are a large number of data packets, the comparison unit reduces the number of feature points checked for each data packet to reduce the system burden;

[0033] When the comparison unit is under low load, it checks more feature points and performs a comprehensive analysis;

[0034] When the comparison unit is highly loaded, it narrows the recognition range and only checks key features, or reduces the analysis of some redundant feature points.

[0035] A further technical improvement of the present invention is that: the comparison unit assigns different weights to each feature point within the recognition range based on different recognition ranges;

[0036] When calculating the risk value of a feature point, its contribution to the final detection result is dynamically calculated based on the weight of the feature point.

[0037] A further technical improvement of the present invention is that after the recognition range is changed, the comparison unit dynamically adjusts the correlation between each feature point in each recognition range according to the correlation between each feature point in the changed recognition range, and the dynamic adjustment step includes:

[0038] S1, calculate the recognition range coefficient;

[0039] S2, dynamically adjust the recognition range and feature point weights;

[0040] The weight of each feature point within the recognition range is adjusted based on the correlation between the feature points and the recognition range;

[0041] The formula used is

[0042] Among them, ω i ′ is the weight of feature point i after adjustment in the new recognition range;

[0043] ω i is the initial weight of feature point i;

[0044] αF is the flow coefficient, which indicates the effect of flow on the identification range;

[0045] p ij is the correlation coefficient between feature point i and feature point j;

[0046] ω j is the initial or adjusted weight of feature point j;

[0047] R is the collection of feature points within the current recognition range;

[0048] S3. When the recognition range is reduced, the comparison unit preferentially selects feature points with strong correlation for processing, increases the weight of these feature points, and reduces the weight of other less relevant feature points;

[0049] S4, calculating a matching score;

[0050] After adjusting the weights, the comparison unit calculates the matching scores between the data packet and the feature points. The matching score of each feature point is determined by its weight and whether it matches.

[0051] A further technical improvement of the present invention is that the step of calculating the correlation coefficient between the feature points includes the following method:

[0052] Q1. Collect the values ​​of feature points i and j in all data packets. In this embodiment, N data packets are provided.

[0053] The corresponding eigenvalue sets are:

[0054] X i ={X i,1 ,X i,2 ,...,X i,N}, where X i,N is the value of feature point i in the kth data packet;

[0055] X j ={X j,1 ,X j,2 ,...,X j,N}, where X j,N is the value of feature point j in k data packets;

[0056] Q2, calculate the mean of feature point i and feature point j in all data packets respectively;

[0057] The mean of feature point i The formula is:

[0058] The mean of feature point j The formula is:

[0059] Q3, by calculating the covariance Cov(X i ,X j ), measures whether the values ​​of feature points i and j change together, and the formula used for covariance is:

[0060]

[0061] Q4, calculate the variance Var(X i ) and Var(X j ), the variance measures how the value of a single feature point fluctuates around its mean;

[0062] The formula used for feature point i is:

[0063] The formula used for feature point j is:

[0064] Q5, calculate the standard deviation of feature point i and feature point j, the standard deviation is the square root σ of feature point i in step Q4 i and the square root of the variance of feature point j, σ j , indicating the fluctuation range of the data;

[0065] The formula used for feature point i is:

[0066] The formula used for feature point j is:

[0067] Q6. Use the covariance and standard deviation of feature points i and j to calculate the correlation coefficient p ij , that is, the linear correlation degree between feature point i and feature point j, the formula used is:

[0068]

[0069] When p ij =1, feature point i and feature point j are completely positively correlated, and feature point i and feature point j increase or decrease together;

[0070] When p ij = -1, feature point i and feature point j are completely negatively correlated, and the increase or decrease relationship between feature point i and feature point j is opposite;

[0071] When p ij When =0, there is no linear correlation between feature point i and feature point j, and the two are independent of each other.

[0072] A further technical improvement of the present invention is that: the data model module divides the risk data model and the feature data model into multiple independent parts according to different dimensions, including time, function, and feature type, and calculates the size of different independent parts;

[0073] The data analysis module generates a flow curve within a preset period based on the big data of historical flow, and generates the expected update time of each independent part based on the time point and duration in the flow curve;

[0074] The flow curve includes peaks and valleys. Through time series analysis, the periodic characteristics of the flow are identified, which facilitates the drawing of the flow curve. In this embodiment, it is divided into high flow period, normal flow period and low flow period;

[0075] After the expected time is reached, the real-time data flow is compared with the flow curve. If the real-time data flow matches the flow curve, the corresponding independent parts in the risk data model and the feature data model are updated;

[0076] If the real-time data flow does not match the flow curve, the independent part will be selectively updated, and the staff will judge and execute whether to update it.

[0077] Compared with the prior art, the present invention has the following beneficial effects:

[0078] The present invention can identify and classify abnormal behaviors in network traffic in real time by dynamically comparing risk data models and feature data models, thereby greatly improving the system's response speed to potential network attacks, and dynamically selecting appropriate risk data models and feature data models for comparison processing according to the number and type of data packets, thereby effectively allocating computing resources, avoiding system over-computing under high load, reducing the burden on the system, and improving work efficiency;

[0079] In addition, the model update mechanism based on big data analysis can promptly reflect changes in network traffic, ensuring that the system can quickly identify and respond to potential security threats when traffic surges or sudden attacks occur. It can also automatically identify and mark traffic data through feature matching models, and effectively distinguish normal traffic from malicious traffic under various attack modes. The system can perform appropriate security processing based on different traffic types, avoid false alarms and missed alarms, and improve the accuracy of network security protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0080] In order to facilitate understanding by those skilled in the art, the present invention is further described below with reference to the accompanying drawings.

[0081] Figure 1 It is a system block diagram of the present invention. DETAILED DESCRIPTION

[0082] In order to further explain the technical means and effects adopted by the present invention to achieve the predetermined invention purpose, the specific implementation methods, structures, features and effects of the present invention are described in detail below in conjunction with the accompanying drawings and preferred embodiments.

[0083] See also Figure 1 As shown, the present invention provides a computer network security control system based on big data, including a data model module, a data input module and a data analysis module;

[0084] The data model module includes a risk database unit and a feature data unit, the risk database unit is established based on network attacks or network risks in big data, including a risk data model, and the feature data unit is established based on big data features of the corresponding computer network, including a feature data model;

[0085] The data model module divides the risk data model and the feature data model into multiple independent parts according to different dimensions, including time, function, and feature type, and calculates the size of different independent parts;

[0086] When the data input module is connected to the corresponding computer network through the connection port and transmits the data, the data input module identifies and marks the characteristics of the input data to facilitate subsequent processing. The data input module includes: a flow collection unit and a parsing unit;

[0087] The flow collection unit is used to capture data packets passing through the corresponding connection port and transmit them to the analysis unit;

[0088] The parsing unit has a built-in feature matching model, which is formulated based on the feature data unit. After receiving a data packet, the parsing unit compares the data packet with the feature matching model, and identifies and marks feature points in the data packet that meet the feature matching model.

[0089] The method for establishing the feature matching model comprises the following steps:

[0090] Step 1: Define feature data units;

[0091] The feature data unit is established based on the corresponding computer network features captured in the big data, including:

[0092] a: Traffic characteristics;

[0093] Traffic magnitude: number of data packets, total bandwidth consumption of traffic, and time distribution of traffic;

[0094] Traffic direction: whether traffic is sent from the source to the destination or in the reverse direction;

[0095] Time distribution of traffic: the periodicity and volatility of network traffic, and whether there is burst traffic;

[0096] Packet size: the size of each packet, the average size, the maximum and minimum packet size;

[0097] b. Protocol characteristics, including protocol type, protocol field characteristics and port characteristics;

[0098] Protocol types include the usage frequency and behavior of TCP, UDP, I CMP, HTTP, DNS and other protocols;

[0099] The protocol field features include the TCP connection flag and the HTTP request method;

[0100] Port features include the distribution of source and destination ports, and whether there is abnormal port usage;

[0101] c. Behavioral characteristics, including connection duration, connection frequency, and packet interval;

[0102] Connection duration is the length of time the network connection is connected, and whether the connection conforms to regular opening and closing times;

[0103] Connection frequency is: the number of connections per source / destination IP, and the fluctuation of connection frequency;

[0104] The packet interval is the time interval between adjacent packets, and whether there is an abnormal time interval;

[0105] d. Network behavior, including network communication patterns, traffic fluctuations, and protocol usage patterns;

[0106] Step 2: Extract the original data of the corresponding computer network from the big data, obtain the key features after processing, and organize the key features of the computer network into structured feature data units;

[0107] The processing of computer network raw data includes data cleaning, data standardization and discretization;

[0108] Data cleaning is used to remove duplicate data from the original data, process missing values, and remove noise;

[0109] Data standardization is used to standardize the features of the cleaned raw data to eliminate dimensional differences;

[0110] Discretization is used to convert the continuous features of the original data into discrete features;

[0111] Step 3: Select the required key features, form a feature matching model, and use historical data for training;

[0112] During training, training data with labeled features is prepared to match the feature matching model, and a cross-validation method is used to optimize the feature matching model;

[0113] The data analysis module is used to receive the data packets processed by the parsing unit, and the data analysis module includes a comparison unit, a processing unit, an early warning unit and a mapping unit;

[0114] The comparison unit retrieves the risk data model and the feature data model from the data model module, and after receiving the data packet, dynamically compares the data packet with the risk data model and the feature data model. The comparison unit dynamically uses the risk data model and the feature data model for comparison based on the number and type of the data packet, and obtains the comparison result, thereby reducing the system load while improving work efficiency;

[0115] The comparison unit is preset with a risk level, and when the comparison unit compares the data packet through the characteristic data model, a corresponding risk value is generated based on the number of characteristic points of the data packet matching the characteristic data model;

[0116] The risk value is inversely proportional to the number of feature points that match the data packet, that is, the more feature points the data packet matches with the feature data model, the lower the corresponding risk value, indicating that the characteristics of the data packet are more consistent with the normal communication mode of the computer network, and therefore the risk is lower;

[0117] The fewer the number of feature points that match the data packet with the feature data model, the higher the corresponding risk value, indicating that there may be anomalies and a higher risk.

[0118] The processing unit classifies the comparison results and converts the corresponding data packets into one of safe data, suspicious data or dangerous data, and the processing unit transmits the data packets converted into safe data to the corresponding computer network for subsequent processing;

[0119] In this embodiment, the data packet has five feature points, which are defined in the feature matching model: IP address, port number, protocol type, data packet size, and transmission rate. After the system receives a data packet, it checks these five features and finds the following matches:

[0120] IP address: match (1 point);

[0121] Port number: mismatch (0 points);

[0122] Protocol type: Match (1 point);

[0123] Packet size: mismatch (0 points);

[0124] Transmission rate: Match (1 point);

[0125] Number of matched feature points: m = 3 Total number of feature points: n = 5 Matching ratio: m / n = 3 / 5 = 0.6;

[0126] Risk value = 100*(1-0.6) = 40;

[0127] Among them, in the risk level, risk values ​​70-100 are dangerous data, risk values ​​10-69 are suspicious data, and risk values ​​0-9 are safe data;

[0128] When the risk value falls into the adjacent numerical range of risk levels, the upgrade system is adopted to increase the risk level by one level;

[0129] The risk value of the data packet is 40, so the data packet is converted into suspicious data by the processing unit;

[0130] After the comparison result classification, the early warning unit matches the data packet converted into dangerous data with the risk database unit of the data model module to generate a corresponding emergency treatment plan;

[0131] The mapping unit processes the data packets converted into suspicious data, extracts the marked feature points in the corresponding data packets to obtain feature packets, and fills the missing parts in the feature packets with big data features based on the feature data units in the data model module to generate a converted data packet set, and finally the mapping unit transmits the converted data packet set to the processing unit;

[0132] The processing unit transmits the converted data packet set bidirectionally, and a user using the corresponding connection port selects any filled feature packet in the converted data packet set to convert it into a corresponding data packet, and then the system performs subsequent processing based on the selected data packet;

[0133] The data analysis module generates a flow curve within a preset period based on the big data of historical flow, and generates the expected update time of each independent part based on the time point and duration in the flow curve;

[0134] The flow curve includes peaks and valleys. Through time series analysis, the periodic characteristics of the flow are identified, which facilitates the drawing of the flow curve. In this embodiment, it is divided into high flow period, normal flow period and low flow period;

[0135] After the expected time is reached, the real-time data flow is compared with the flow curve. If the real-time data flow matches the flow curve, the corresponding independent parts in the risk data model and the feature data model are updated;

[0136] If the real-time data flow does not match the flow curve, the independent part will be selectively updated, and the staff will judge and execute whether to update it;

[0137] In the risk data model:

[0138] During high traffic periods, update the risk model parts for traffic anomalies and security threats, such as traffic anomaly detection model and DDoS attack detection model;

[0139] During normal traffic periods, common risk model parts, such as regular malware and vulnerability scans, are routinely updated;

[0140] Perform comprehensive model updates during low traffic periods to revise and optimize all risk models, especially those that require a lot of calculations;

[0141] In the feature data model:

[0142] During high traffic periods, priority is given to updating dynamic features related to traffic, such as traffic packet size and frequency, to ensure real-time detection and matching;

[0143] During normal traffic periods, static features such as network equipment and user behavior are updated;

[0144] During low traffic periods, all relevant network features are updated at scale, optimizing all model components.

[0145] Example 2

[0146] A computer network security control system based on big data, comprising a data model module, a data input module and a data analysis module;

[0147] The data model module includes a risk database unit and a feature data unit, the risk database unit is established based on network attacks or network risks in big data, including a risk data model, and the feature data unit is established based on big data features of the corresponding computer network, including a feature data model;

[0148] The data model module divides the risk data model and the feature data model into multiple independent parts according to different dimensions, including time, function, and feature type, and calculates the size of different independent parts;

[0149] When the data input module is connected to the corresponding computer network through the connection port and transmits the data, the data input module identifies and marks the characteristics of the input data to facilitate subsequent processing. The data input module includes: a flow collection unit and a parsing unit;

[0150] The flow collection unit is used to capture data packets passing through the corresponding connection port and transmit them to the analysis unit;

[0151] The parsing unit has a built-in feature matching model, which is formulated based on the feature data unit. After receiving a data packet, the parsing unit compares the data packet with the feature matching model, and identifies and marks feature points in the data packet that meet the feature matching model.

[0152] The method for establishing the feature matching model comprises the following steps:

[0153] Step 1: Define feature data units;

[0154] The feature data unit is established based on the corresponding computer network features captured in the big data, including:

[0155] a: Traffic characteristics;

[0156] Traffic magnitude: number of data packets, total bandwidth consumption of traffic, and time distribution of traffic;

[0157] Traffic direction: whether traffic is sent from the source to the destination or in the reverse direction;

[0158] Time distribution of traffic: the periodicity and volatility of network traffic, and whether there is burst traffic;

[0159] Packet size: the size of each packet, the average size, the maximum and minimum packet size;

[0160] b. Protocol characteristics, including protocol type, protocol field characteristics and port characteristics;

[0161] Protocol types include the usage frequency and behavior of TCP, UDP, I CMP, HTTP, DNS and other protocols;

[0162] The protocol field features include TCP connection flags, such as SYN, ACK, and FIN, and HTTP request methods, such as GET and POST;

[0163] Port features include the distribution of source and destination ports, and whether there is abnormal port usage;

[0164] c. Behavioral characteristics, including connection duration, connection frequency, and packet interval;

[0165] Connection duration is the length of time the network connection is connected, and whether the connection conforms to regular opening and closing times;

[0166] Connection frequency is: the number of connections per source / destination IP, and the fluctuation of connection frequency;

[0167] The packet interval is the time interval between adjacent packets, and whether there is an abnormal time interval;

[0168] d. Network behavior, including network communication patterns, traffic fluctuations, and protocol usage patterns;

[0169] Step 2: Extract the original data of the corresponding computer network from the big data, obtain the key features after processing, and organize the key features of the computer network into structured feature data units;

[0170] The processing of computer network raw data includes data cleaning, data standardization and discretization;

[0171] Data cleaning is used to remove duplicate data from the original data, process missing values, and remove noise;

[0172] Data standardization is used to standardize the features of the cleaned raw data to eliminate dimensional differences;

[0173] Discretization is used to convert the continuous features of the original data into discrete features;

[0174] Step 3: Select the required key features, form a feature matching model, and use historical data for training;

[0175] During training, prepare training data with labeled features to match with the feature matching model, and use the cross-validation method to optimize the feature matching model;

[0176] The data analysis module is used to receive the data packets processed by the parsing unit, and the data analysis module includes a comparison unit, a processing unit, an early warning unit and a mapping unit;

[0177] The comparison unit retrieves the risk data model and the feature data model from the data model module, and after receiving the data packet, dynamically compares the data packet with the risk data model and the feature data model. The comparison unit dynamically uses the risk data model and the feature data model for comparison based on the number and type of the data packet, and obtains the comparison result, thereby reducing the system load while improving work efficiency;

[0178] The comparison unit is preset with a risk level, and when the comparison unit compares the data packet through the characteristic data model, a corresponding risk value is generated based on the number of characteristic points of the data packet matching the characteristic data model;

[0179] The risk value is inversely proportional to the number of feature points that match the data packet, that is, the more feature points the data packet matches with the feature data model, the lower the corresponding risk value, indicating that the characteristics of the data packet are more consistent with the normal communication mode of the computer network, and therefore the risk is lower;

[0180] The fewer the number of feature points that match the data packet and the feature data model, the higher the corresponding risk value, indicating that there may be anomalies and the risk is high;

[0181] The comparison unit adopts a dynamic comparison mechanism for the data packets. In the same time period, if the number of input data packets exceeds a preset number threshold, the comparison unit changes the recognition range of the data packets.

[0182] When the number of data packets is large, the comparison unit dynamically adjusts the recognition range based on the pressure of the current network traffic to optimize the allocation of resources;

[0183] When there are a large number of data packets, the comparison unit reduces the number of feature points checked for each data packet to reduce the system burden;

[0184] When the comparison unit is under low load, it checks more feature points and performs a comprehensive analysis;

[0185] When the comparison unit is highly loaded, it narrows the recognition range and only checks key features, or reduces the analysis of some redundant feature points;

[0186] The comparison unit assigns different weights to each feature point within the recognition range based on different recognition ranges;

[0187] When calculating the risk value of a feature point, its contribution to the final detection result is dynamically calculated based on the weight of the feature point;

[0188] After the recognition range is changed, the comparison unit dynamically adjusts the correlation between each feature point in each recognition range according to the correlation between each feature point in the changed recognition range. The dynamic adjustment step includes:

[0189] S1, calculate the recognition range coefficient α;

[0190] At low traffic, i.e. when the number of packets is small, the recognition range of the comparison unit is large, αF = 1;

[0191] At high traffic, i.e. when the number of packets is large, the recognition range of the comparison unit is reduced, αF < 1;

[0192] It is expressed by the formula: calculate;

[0193] Among them, γ is the adjustment coefficient, which is used to control the influence of traffic on weight;

[0194] F is the current flow rate, which is associated with the number of packets;

[0195] F t is the flow threshold, used to determine whether the flow is high flow;

[0196] When F>F t When the flow rate is large, the recognition range is reduced;

[0197] When F≤F t When the flow rate is small, the recognition range is large;

[0198] S2, dynamically adjust the recognition range and feature point weights;

[0199] The weight ω of each feature point within the recognition range i Adjust based on the correlation and recognition range between each feature point;

[0200] The formula used is

[0201] Among them, ω i ′ is the weight of feature point i after adjustment in the new recognition range;

[0202] ω i is the initial weight of feature point i;

[0203] αF is the flow coefficient, which indicates the effect of flow on the identification range;

[0204] p ij is the correlation coefficient between feature point i and feature point j;

[0205] ω j is the initial or adjusted weight of feature point j;

[0206] R is the collection of feature points within the current recognition range;

[0207] S3. When the recognition range is reduced, the comparison unit preferentially selects feature points with strong correlation for processing, increases the weight of these feature points, and reduces the weight of other less relevant feature points;

[0208] S4, calculating a matching score;

[0209] After adjusting the weights, the comparison unit calculates the matching score between the data packet and the feature point. The matching score of each feature point is determined by its weight and whether it matches;

[0210] Whether the data packet matches the feature point i is determined by the formula: express;

[0211] S is the matching score of the data packet;

[0212] M i Is the representation of whether feature point i matches, where 1 means match and 0 means no match;

[0213] ω i ′ is the adjusted weight of feature point i within the current recognition range;

[0214] Finally, the risk value R of the data packet is calculated by the formula: get;

[0215] S max It is the maximum comprehensive weight of all feature points, indicating the score when it is completely matched;

[0216] Therefore, according to the change of traffic, the comparison unit dynamically adjusts the recognition range and redistributes the weights according to the correlation between feature points in the new recognition range;

[0217] When the flow rate is high, the recognition range is reduced, and the weight of the feature points will be dynamically adjusted according to their importance, ensuring that the system can still work efficiently when processing large flow data, improving the system's adaptability and processing efficiency, avoiding unnecessary processing of all feature points under high flow conditions, and thus reducing resource consumption;

[0218] The correlation coefficient p between feature point i and feature point j ij The calculation steps include the following methods:

[0219] Q1. Collect the values ​​of feature points i and j in all data packets. In this embodiment, N data packets are provided.

[0220] The corresponding eigenvalue sets are:

[0221] X i ={X i,1 ,X i,2 ,...,X i,N}, where X i,N is the value of feature point i in the kth data packet;

[0222] X j ={X j,1 ,X j,2 ,...,X j,N}, where X j,N is the value of feature point j in k data packets;

[0223] Q2, calculate the mean of feature point i and feature point j in all data packets respectively;

[0224] The mean of feature point i The formula is:

[0225] The mean of feature point j The formula is:

[0226] Q3, by calculating the covariance Cov(X i ,X j ), measures whether the values ​​of feature points i and j change together, and the formula used for covariance is:

[0227]

[0228] Q4, calculate the variance Var(X i ) and Var(X j ), the variance measures how the value of a single feature point fluctuates around its mean;

[0229] The formula used for feature point i is:

[0230] The formula used for feature point j is:

[0231] Q5, calculate the standard deviation of feature point i and feature point j, the standard deviation is the square root σ of feature point i in step Q4 i and the square root of the variance of feature point j, σ j , indicating the fluctuation range of the data;

[0232] The formula used for feature point i is:

[0233] The formula used for feature point j is:

[0234] Q6. Use the covariance and standard deviation of feature points i and j to calculate the correlation coefficient p ij , that is, the linear correlation degree between feature point i and feature point j, the formula used is:

[0235]

[0236] When p ij =1, feature point i and feature point j are completely positively correlated, and feature point i and feature point j increase or decrease together;

[0237] When p ij = -1, feature point i and feature point j are completely negatively correlated, and the increase or decrease relationship between feature point i and feature point j is opposite;

[0238] When p ij = 0, there is no linear correlation between feature point i and feature point j, and the two are independent of each other;

[0239] The processing unit classifies the comparison results and converts the corresponding data packets into one of safe data, suspicious data or dangerous data, and the processing unit transmits the data packets converted into safe data to the corresponding computer network for subsequent processing;

[0240] After the comparison result classification, the early warning unit matches the data packet converted into dangerous data with the risk database unit of the data model module to generate a corresponding emergency treatment plan;

[0241] The mapping unit processes the data packets converted into suspicious data, extracts the marked feature points in the corresponding data packets to obtain feature packets, and fills the missing parts in the feature packets with big data features based on the feature data units in the data model module to generate a converted data packet set, and finally the mapping unit transmits the converted data packet set to the processing unit.

[0242] The data analysis module generates a flow curve within a preset period based on the big data of historical flow, and generates the expected update time of each independent part based on the time point and duration in the flow curve;

[0243] The flow curve includes peaks and valleys. Through time series analysis, the periodic characteristics of the flow are identified, which facilitates the drawing of the flow curve. In this embodiment, it is divided into high flow period, normal flow period and low flow period;

[0244] The individual and independent parts are matched to the duration of different troughs of the flow curve based on their size;

[0245] After the expected time is reached, the real-time data flow is compared with the flow curve. If the real-time data flow matches the flow curve, the corresponding independent parts in the risk data model and the feature data model are updated;

[0246] If the real-time data flow does not match the flow curve, the independent part will be selectively updated, and the staff will judge and execute whether to update it.

[0247] The above description is only a preferred embodiment of the present invention and does not limit the present invention in any form. Although the present invention has been disclosed as a preferred embodiment as above, it is not used to limit the present invention. Any technical personnel in this field can make some changes or modify the technical contents disclosed above into equivalent embodiments without departing from the scope of the technical solution of the present invention. However, any simple modification, equivalent change and modification made to the above embodiments according to the technical essence of the present invention without departing from the content of the technical solution of the present invention still fall within the scope of the technical solution of the present invention.

Claims

1. A computer network security control system based on big data, characterized in that: include: Data model module, including risk data model and feature data model; Data input module, including: flow collection unit, analysis unit; The flow collection unit is used to capture data packets passing through the corresponding connection port in real time and transmit them to the analysis unit; The parsing unit has a built-in feature matching model, which is formulated based on the feature data unit. After receiving a data packet, the parsing unit compares the data packet with the feature matching model, and identifies and marks feature points in the data packet that meet the feature matching model. Data analysis module, including comparison unit, processing unit, early warning unit and mapping unit; The comparison unit retrieves the risk data model and the feature data model from the data model module, and after receiving the data packet, dynamically compares the data packet with the risk data model and the feature data model, and obtains a comparison result; The processing unit classifies the comparison results and converts the corresponding data packets into one of safe data, suspicious data or dangerous data; The early warning unit matches the data packets converted into dangerous data with the risk database unit of the data model module to generate a corresponding emergency treatment plan; The mapping unit processes the data packets converted into suspicious data, extracts the marked feature points in the corresponding data packets to obtain feature packets, and fills the missing parts in the feature packets with big data features based on the feature data units in the data model module to generate a converted data packet set, and finally transmits the converted data packet set to the processing unit.

2. A computer network security control system based on big data according to claim 1, characterized in that: The method for establishing the feature matching model comprises the following steps: Step 1: Define feature data units; Step 2: Extract the original data of the corresponding computer network from the big data, obtain the key features after processing, and organize the key features of the computer network into structured feature data units; Step 3: Select the required key features, form a feature matching model, and use historical data for training.

3. A computer network security control system based on big data according to claim 1, characterized in that: The comparison unit is preset with a risk level, and when the comparison unit compares the data packet through the characteristic data model, a corresponding risk value is generated based on the number of characteristic points of the data packet matching the characteristic data model; The risk value is inversely proportional to the number of feature points matched by the data packet.

4. A computer network security control system based on big data according to claim 3, characterized in that: The comparison unit adopts a dynamic comparison mechanism for the data packets. In the same time period, if the number of input data packets exceeds a preset number threshold, the comparison unit changes the recognition range of the data packets.

5. A computer network security control system based on big data according to claim 4, characterized in that: The comparison unit assigns different weights to each feature point within the recognition range based on different recognition ranges; When calculating the risk value of a feature point, its contribution to the final detection result is dynamically calculated based on the weight of the feature point.

6. A computer network security control system based on big data according to claim 5, characterized in that: After the recognition range is changed, the comparison unit dynamically adjusts the correlation between each feature point in each recognition range according to the correlation between each feature point in the changed recognition range. The dynamic adjustment step includes: S1, calculate the recognition range coefficient; S2, dynamically adjust the recognition range and feature point weights; The weight of each feature point within the recognition range is adjusted based on the correlation between the feature points and the recognition range; The formula used is Among them, ω i ′ is the weight of feature point i after adjustment in the new recognition range; ω i is the initial weight of feature point i; αF is the flow coefficient, which indicates the effect of flow on the identification range; p ij is the correlation coefficient between feature point i and feature point j; ω j is the initial or adjusted weight of feature point j; R is the collection of feature points within the current recognition range; S3, when the recognition range is reduced, the comparison unit preferentially selects the feature points with correlation for processing; S4, calculating a matching score; After adjusting the weights, the comparison unit calculates the matching score between the data packet and the feature point.

7. A computer network security control system based on big data according to claim 6, characterized in that: Correlation coefficient p ij The calculation steps include the following methods: Q1, collect the values ​​of feature points i and j in all data packets; Q2, calculate the mean of feature point i and feature point j in all data packets respectively; Q3. By calculating the covariance, measure whether the values ​​of feature points i and j change together; Q4, calculate the variance of feature point i and feature point j; Q5. Calculate the standard deviation of feature point i and feature point j; Q6. Use the covariance and standard deviation of feature points i and j to calculate the correlation coefficient p ij .

8. A computer network security control system based on big data according to claim 1, characterized in that: The data model module divides the risk data model and the feature data model into different dimensions and calculates the size of different independent parts; The data analysis module generates a flow curve within a preset period based on the big data of historical flow, and generates the expected update time of each independent part based on the peak value, trough and duration in the flow curve; After the expected time is reached, the real-time data flow is compared with the flow curve. If the real-time data flow matches the flow curve, the corresponding independent parts in the risk data model and the feature data model are updated; If the real-time data flow does not match the flow curve, the independent part is selectively updated.

Images