Computer data security protection system based on computer network

Abstract

The invention discloses a computer data security protection system based on a computer network. The system comprises a flow monitoring module; the capture module captures network flow data in real time; the threat intelligence integration module is responsible for collecting and analyzing threat intelligence information from multiple sources; the user behavior analysis module is responsible for monitoring and analyzing network behaviors of users; according to the invention, through real-time capturing and monitoring of network flow data by the flow monitoring module and targeted detection of the abnormity detection module by using a preset algorithm and a rule, the system can more accurately identify abnormal behaviors in a network, and the abnormal behaviors in the network can be more accurately analyzed and mined. And the situations of missing report and false report are reduced. And the threat intelligence integration module and the user behavior analysis module further enhance the insight of the system to network threats and user behaviors, so that the system can respond more quickly when facing a complex network environment.

Description

Technical Field

[0001] The present invention relates to the technical field of network data protection, and in particular to a computer data security protection system based on a computer network. Background Art

[0002] In the information age, data has become an important asset for enterprises, governments and individuals. The leakage, tampering or destruction of data may lead to serious economic losses, legal risks and reputation damage. Therefore, protecting data security has become a focus of common concern in all sectors of society. Data security protection systems are widely used in many fields such as government, enterprises, banks, e-commerce, and healthcare. For example, in government R&D, design, manufacturing and other industries, data security protection systems can protect various sensitive data documents of governments and enterprises; in the banking industry, data security protection systems can protect the security of bank databases and prevent hacker intrusions and information leaks; in the field of e-commerce, data security protection systems can protect user personal information, transaction records and payment information stored on e-commerce platforms.

[0003] After searching, the invention patent with Chinese patent number CN117978421 B discloses an Internet-based computer network data security intelligent protection system, which involves the field of network data protection technology and solves the technical problem that the prior art cannot perform active risk warning and passive risk warning on the computer operation process. Specifically, the equipment analysis and protection unit performs equipment analysis on the computer network data, generates equipment operation protection signal or equipment operation safety signal according to the equipment analysis protection coefficient comparison, and sends it to the cloud protection platform; the active risk warning unit performs active risk warning on the computer operation process to determine whether there is network intrusion during the computer operation process, and the passive risk warning unit performs passive risk warning during the computer network operation period to determine whether there is passive authorization operation risk in the computer network data during the computer operation process; after completing the protection analysis, the security performance evaluation unit performs security performance evaluation on the computer network data. Compared with the prior art, the invention patent with Chinese patent number CN117978421 B solves the problem that the computer network data protection stage in the prior art cannot perform security detection on the computer operation equipment, so that the influence of the operation equipment on the data cannot be eliminated, and the active risk warning and passive risk warning cannot be performed on the computer operation process, resulting in reduced efficiency of computer network data security protection.

[0004] However, in the actual use of the above invention, although the system can perform active and passive risk warnings, the accuracy and response speed of real-time monitoring may be limited when facing a complex network environment, especially when the network traffic is large or abnormal activities are frequent, which may lead to missed reports or false reports. Therefore, a computer data security protection system based on a computer network is proposed. Summary of the invention

[0005] The purpose of the present invention is to solve the problem that although the system in the prior art can perform active and passive risk warnings, the accuracy and response speed of real-time monitoring may be limited when facing a complex network environment, especially when the network traffic is large or abnormal activities are frequent, which may lead to missed reports or false reports. A computer data security protection system based on computer networks is proposed to solve the problem.

[0006] In order to achieve the above object, the present invention adopts the following technical solutions:

[0007] A computer data security protection system based on a computer network, comprising:

[0008] Traffic monitoring module; responsible for capturing network traffic data in real time;

[0009] Threat intelligence integration module: responsible for collecting and analyzing threat intelligence information from multiple sources;

[0010] User behavior analysis module: responsible for monitoring and analyzing users' network behavior;

[0011] Data analysis and mining module: responsible for in-depth analysis and mining of data;

[0012] Anomaly detection module: responsible for detecting abnormal behaviors using preset algorithms and rules;

[0013] Incident response module: responsible for taking corresponding protective measures according to the preset response strategy;

[0014] Policy management module: responsible for integrating the information and data provided by each module and adjusting network security policies;

[0015] The traffic monitoring module is responsible for capturing and monitoring network traffic in real time by deploying network traffic monitoring tools (such as Wi reshark, NetF l ow). The traffic monitoring module transmits the captured network traffic data to the anomaly detection module and the data analysis and mining module. The threat intelligence integration module is responsible for collecting and integrating external threat intelligence. The threat intelligence integration module transmits the collected threat intelligence to the anomaly detection module. The user behavior analysis module is responsible for analyzing the user's behavior in the network by collecting user activity logs, such as login time and access resources, and then using the support vector machine algorithm to establish a user behavior baseline model, and then compare the user's real-time behavior with the model to identify normal and abnormal activities. The user behavior analysis module transmits the user behavior analysis results to the anomaly detection module. The data analysis and mining module is responsible for statistical analysis and machine learning algorithms on the data transmitted by the traffic monitoring module. The data is deeply analyzed to identify potential security threats. The data analysis and mining module transmits the analysis results to the policy management module and the anomaly detection module. The anomaly detection module is responsible for detecting abnormal behavior of the data transmitted by the traffic monitoring module, and performing targeted detection based on the intelligence of the threat intelligence integration module and the results of the user behavior analysis module. The anomaly detection module transmits the detected abnormal behavior information to the event response module and the policy management module. The event response module is responsible for receiving the abnormal behavior information from the anomaly detection module and triggering the response mechanism. The event response module transmits the response result to the policy management module. The policy management module is responsible for dynamically adjusting the security policy according to the analysis and detection results of each module to cope with the ever-changing network environment and threats.

[0016] The above technical solution further includes:

[0017] Preferably, the traffic monitoring module includes a data acquisition unit, a traffic parsing unit, a traffic filtering unit, a traffic statistics unit, an anomaly representation unit and a data transmission unit. The data acquisition unit is responsible for capturing network traffic data in real time, including header information and load of data packets. The traffic parsing unit is responsible for parsing the captured data and extracting important information, such as source IP, destination IP, protocol type, and data packet size. The traffic filtering unit is responsible for filtering irrelevant traffic, reducing the amount of data, and improving monitoring efficiency. The traffic statistics unit is responsible for performing statistical analysis on the traffic, generating real-time traffic reports and charts, and displaying traffic change trends. The anomaly representation unit is responsible for detecting abnormal activities in the traffic in real time and marking suspicious traffic. The data transmission unit is responsible for transmitting the monitored network traffic data to the anomaly detection module and the data analysis and mining module in real time.

[0018] Preferably, the threat intelligence integration module includes an intelligence collection unit, a data cleaning and classification unit, an intelligence integration unit, an intelligence scoring unit and a data transmission unit. The intelligence collection unit is responsible for automatically collecting relevant threat intelligence from various external sources, such as threat intelligence platforms, open resources, social media, etc. The data cleaning and classification unit is responsible for cleaning the collected threat intelligence, removing redundant information and irrelevant data to improve the accuracy and reliability of the intelligence, and classifying the cleaned threat intelligence, such as malware, network attacks, vulnerability information, etc. The intelligence integration unit is responsible for integrating threat intelligence from various external sources to form a comprehensive threat view and eliminate duplicate information. The intelligence scoring unit is responsible for scoring threat intelligence and giving priority to high-risk intelligence. The data transmission unit is responsible for transmitting the integrated threat intelligence to the anomaly detection module in real time to facilitate real-time monitoring and analysis.

[0019] Preferably, the user behavior analysis module includes a data collection unit, a behavior modeling unit, a behavior analysis unit, a risk assessment unit and an integration and transmission unit. The data collection unit is responsible for collecting user behavior data, including login information, access records, operation logs, etc. The behavior modeling unit is responsible for establishing a user behavior model based on historical data and defining a normal behavior pattern. The behavior analysis unit is responsible for identifying user behavior characteristics and detecting deviations from normal patterns. The risk assessment unit is responsible for assessing the risk level of user behavior and determining whether it constitutes a security threat. The integration and transmission unit is responsible for transmitting the analysis results and risk assessment to the anomaly detection module.

[0020] Preferably, the specific steps of the behavior modeling unit to establish the user behavior model are:

[0021] Data collection: Collect users' historical behavior data, including login records, visited websites, file operations, system calls, etc., and ensure the integrity and accuracy of the data;

[0022] Feature extraction: extract key features from raw data, such as access frequency, access time, access resource type, operation mode, etc.;

[0023] Behavior classification: classify the extracted features to identify different types of user behaviors, such as normal behavior, abnormal behavior, etc.

[0024] Model selection and training: Select a neural network model, train the selected model using annotated historical data, adjust model parameters to improve accuracy, and use cross-validation methods to evaluate model performance to ensure the generalization ability of the model;

[0025] Model validation: Test the model on an independent validation set to evaluate its accuracy, recall and other indicators in identifying normal and abnormal behaviors, and adjust and optimize the model based on the validation results;

[0026] Model deployment: Deploy the trained model into a real-time environment to conduct real-time user behavior monitoring.

[0027] Preferably, the anomaly detection module performs abnormal behavior detection by using a K-means clustering algorithm, and the specific steps of the K-means clustering algorithm are:

[0028] Data collection and preprocessing: Obtain network traffic data from the traffic monitoring module to form an original data set, remove duplicate values ​​and process missing values ​​to obtain a cleaned data set;

[0029] Feature extraction: extract features from the cleaned data;

[0030] Initialize cluster centers: randomly select k objects as initial cluster centers;

[0031] Object assignment and cluster formation: Calculate the distance from each object to the k initial cluster centers, and assign the object to the cluster that is most similar to it based on the distance. The distance calculation usually uses the Euclidean distance, and the formula is:

[0032]

[0033] Among them, x i and x j Represents two n-dimensional data objects;

[0034] Cluster center update: recalculate the center of each cluster, that is, calculate the mean of the attribute values ​​of all objects in each cluster as the new cluster center. The calculation formula of the cluster center is:

[0035]

[0036] Among them, m i is the center of the ith cluster, n i is the number of objects in the ith cluster, C i is the object set of the i-th cluster;

[0037] Iteration and convergence: Repeat the above steps until the convergence of the objective function or the preset maximum number of iterations is reached;

[0038] Anomaly detection: Calculate the distance from each data point to its nearest cluster center and determine whether the distance exceeds a set threshold to identify abnormal behavior.

[0039] Preferably, the specific steps of the event response module taking corresponding protective measures include:

[0040] Receive abnormal behavior information: obtain abnormal behavior information from the anomaly detection module and generate an abnormal behavior list;

[0041] Abnormal behavior assessment: Evaluate each abnormal behavior received and calculate its risk level. The assessment criteria include impact degree and probability of occurrence.

[0042] Risk threshold judgment: Set a risk threshold and determine whether each abnormal behavior exceeds the threshold;

[0043] Strategy selection: Select an appropriate response strategy based on the type of abnormal behavior and its risk level;

[0044] Execute response strategy: Execute the selected response strategy and record the results of the response measures, including execution status (success / failure) and timestamp, for subsequent analysis.

[0045] Preferably, the policy management module needs to evaluate the effectiveness of the policy after the policy is implemented, and the policy effectiveness evaluation formula is:

[0046]

[0047] Where s represents the strategy, E(s) represents the effectiveness score of strategy s, and R before represents the risk score before the strategy is implemented, R after Represents the risk score after the policy is implemented.

[0048] The present invention has the following beneficial effects:

[0049] 1. In the present invention, through the real-time capture and monitoring of network traffic data by the traffic monitoring module, and the targeted detection by the anomaly detection module using preset algorithms and rules, the system can more accurately identify abnormal behaviors in the network and reduce missed reports and false positives. The threat intelligence integration module and the user behavior analysis module further enhance the system's insight into network threats and user behaviors, allowing the system to respond more quickly when facing complex network environments.

[0050] 2. In the present invention, the data analysis and mining module uses statistical analysis and machine learning algorithms to conduct in-depth analysis of traffic data, which improves the system's processing capability and accuracy of network traffic data, especially when the network traffic is large, and can more effectively identify potential threats. The anomaly detection module not only relies on traffic data, but also combines threat intelligence and user behavior analysis results, so that the system can more accurately determine the nature and source of abnormal behavior when facing frequent abnormal activities. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Figure 1This is a system architecture diagram of a computer data security protection system based on a computer network proposed by the present invention. DETAILED DESCRIPTION

[0052] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0053] like Figure 1 As shown, a computer data security protection system based on a computer network includes:

[0054] Traffic monitoring module; responsible for capturing network traffic data in real time;

[0055] Threat intelligence integration module: responsible for collecting and analyzing threat intelligence information from multiple sources;

[0056] User behavior analysis module: responsible for monitoring and analyzing users' network behavior;

[0057] Data analysis and mining module: responsible for in-depth analysis and mining of data;

[0058] Anomaly detection module: responsible for detecting abnormal behaviors using preset algorithms and rules;

[0059] Incident response module: responsible for taking corresponding protective measures according to the preset response strategy;

[0060] Policy management module: responsible for integrating the information and data provided by each module and adjusting network security policies;

[0061] The traffic monitoring module is responsible for capturing and monitoring network traffic in real time by deploying network traffic monitoring tools. The traffic monitoring module transmits the captured network traffic data to the anomaly detection module and the data analysis and mining module. The threat intelligence integration module is responsible for collecting and integrating external threat intelligence. The threat intelligence integration module transmits the collected threat intelligence to the anomaly detection module. The user behavior analysis module is responsible for analyzing the user's behavior in the network and identifying normal and abnormal activities. The user behavior analysis module transmits the user behavior analysis results to the anomaly detection module. The data analysis and mining module is responsible for statistical analysis and machine learning algorithms to perform in-depth analysis on the data transmitted by the traffic monitoring module. The data analysis and mining module transmits the analysis results to the policy management module and the anomaly detection module. The anomaly detection module is responsible for abnormal behavior detection of the data transmitted by the traffic monitoring module, and performs targeted detection based on the intelligence of the threat intelligence integration module and the results of the user behavior analysis module. The anomaly detection module transmits the detected abnormal behavior information to the event response module and the policy management module. The event response module is responsible for receiving abnormal behavior information from the anomaly detection module and triggering the response mechanism. The event response module transmits the response results to the policy management module. The policy management module is responsible for dynamically adjusting the security policy based on the analysis and detection results of each module.

[0062] In one embodiment, the traffic monitoring module includes a data acquisition unit, a traffic parsing unit, a traffic filtering unit, a traffic statistics unit, an anomaly representation unit and a data transmission unit. The data acquisition unit is responsible for capturing network traffic data in real time, the traffic parsing unit is responsible for parsing the captured data and extracting important information, the traffic filtering unit is responsible for filtering irrelevant traffic, the traffic statistics unit is responsible for performing statistical analysis on the traffic, the anomaly representation unit is responsible for detecting abnormal activities in the traffic in real time and marking suspicious traffic, and the data transmission unit is responsible for transmitting the monitored network traffic data to the anomaly detection module and the data analysis and mining module in real time.

[0063] In the embodiment of the present invention, the flow filtering rate calculation in the flow filtering unit can be expressed as:

[0064]

[0065] Where F represents the filtration rate, N f Indicates the amount of traffic being filtered, and N indicates the total amount of traffic;

[0066] The formula for calculating the total traffic volume in the traffic statistics unit can be expressed as:

[0067]

[0068] Where T represents the total flow, D i It represents the flow data in each time period, and n represents the number of time periods.

[0069] In one embodiment, the threat intelligence integration module includes an intelligence collection unit, a data cleaning and classification unit, an intelligence integration unit, an intelligence scoring unit and a data transmission unit. The intelligence collection unit is responsible for automatically collecting relevant threat intelligence from various external sources, the data cleaning and classification unit is responsible for cleaning the collected threat intelligence and classifying the cleaned threat intelligence, the intelligence integration unit is responsible for integrating threat intelligence from various external sources, the intelligence scoring unit is responsible for scoring the threat intelligence, and the data transmission unit is responsible for transmitting the integrated threat intelligence to the anomaly detection module in real time.

[0070] In the embodiment of the present invention, the intelligence collection unit can automatically collect relevant threat intelligence from network logs, social media, open intelligence sources, etc. to ensure that comprehensive and timely threat information can be obtained. The calculation formula can be expressed as:

[0071]

[0072] Among them, I c Indicates the total amount of threat intelligence collected, S j represents the intelligence data from the jth external source, and m represents the number of external sources.

[0073] The data cleaning and classification unit removes redundant, repeated or irrelevant information to ensure the accuracy and reliability of the data. Subsequently, the cleaned threat intelligence will be classified for subsequent processing. The intelligence integration unit is responsible for integrating threat intelligence from different external sources to provide a comprehensive threat view. This unit will merge intelligence on the same topic to form more valuable information. The specific formula is as follows:

[0074]

[0075] Among them, I t Represents the integrated threat intelligence, I k represents the cleansed threat intelligence from the kth source, and p is the number of integrated sources.

[0076] The intelligence scoring unit scores the integrated threat intelligence to assess its potential threat level and relevance. The scoring criteria are based on factors such as the severity of the threat and the credibility of the source. The specific formula for intelligence scoring is:

[0077]

[0078] Among them, S represents the intelligence score, W s Represents the weight value of threat intelligence, W t Indicates the total weight of all threat intelligence.

[0079] In one embodiment, the user behavior analysis module includes a data collection unit, a behavior modeling unit, a behavior analysis unit, a risk assessment unit, and an integration and transmission unit. The data collection unit is responsible for collecting user behavior data, the behavior modeling unit is responsible for establishing a user behavior model based on historical data and defining a normal behavior pattern, the behavior analysis unit is responsible for identifying user behavior characteristics and detecting deviations from normal patterns, the risk assessment unit is responsible for assessing the risk level of user behavior, and the integration and transmission unit is responsible for transmitting the analysis results and risk assessment to the anomaly detection module.

[0080] In the embodiment of the present invention, the data collection unit is responsible for collecting user behavior data from various channels. For example, the user's operation log in the application, browsing history, social media interaction, etc. This unit ensures the diversity and comprehensiveness of the data for subsequent analysis. The risk assessment unit assesses the risk level of the user's behavior based on the detected deviation. The assessment of the risk level includes aspects such as the severity and frequency of the deviation and its potential threat to system security.

[0081] In one embodiment, the specific steps of the behavior modeling unit to establish the user behavior model are:

[0082] Data collection: Collect users' historical behavior data and ensure the integrity and accuracy of the data;

[0083] Feature extraction: extract key features from raw data;

[0084] Behavior classification: classify the extracted features and identify different types of user behaviors;

[0085] Model selection and training: Select a neural network model, train the selected model using annotated historical data, adjust model parameters to improve accuracy, and use cross-validation methods to evaluate model performance to ensure the generalization ability of the model;

[0086] Model validation: Test the model on an independent validation set and adjust and optimize the model based on the validation results;

[0087] Model deployment: Deploy the trained model into a real-time environment to conduct real-time user behavior monitoring.

[0088] In one embodiment, the anomaly detection module performs abnormal behavior detection by using a K-means clustering algorithm. The specific steps of the K-means clustering algorithm are:

[0089] Data collection and preprocessing: Obtain network traffic data from the traffic monitoring module to form an original data set, remove duplicate values ​​and process missing values ​​to obtain a cleaned data set;

[0090] Feature extraction: extract features from the cleaned data;

[0091] Initialize cluster centers: randomly select k objects as initial cluster centers;

[0092] Object assignment and cluster formation: Calculate the distance from each object to the k initial cluster centers, and assign the object to the cluster that is most similar to it based on the distance. The distance calculation usually uses the Euclidean distance, and the formula is:

[0093]

[0094] Among them, x i and x j Represents two n-dimensional data objects;

[0095] Cluster center update: recalculate the center of each cluster, that is, calculate the mean of the attribute values ​​of all objects in each cluster as the new cluster center. The calculation formula of the cluster center is:

[0096]

[0097] Among them, m i is the center of the ith cluster, n i is the number of objects in the ith cluster, C i is the object set of the i-th cluster;

[0098] Iteration and convergence: Repeat the above steps until the convergence of the objective function or the preset maximum number of iterations is reached;

[0099] Anomaly detection: Calculate the distance from each data point to its nearest cluster center and determine whether the distance exceeds a set threshold to identify abnormal behavior.

[0100] In one embodiment, the specific steps of the event response module taking corresponding protective measures include:

[0101] Receive abnormal behavior information: obtain abnormal behavior information from the anomaly detection module and generate an abnormal behavior list;

[0102] Abnormal behavior assessment: Evaluate each abnormal behavior received and calculate its risk level;

[0103] Risk threshold judgment: Set a risk threshold and determine whether each abnormal behavior exceeds the threshold;

[0104] Strategy selection: Select an appropriate response strategy based on the type of abnormal behavior and its risk level;

[0105] Execute response strategy: Execute the selected response strategy and record the results of the response measures.

[0106] In an embodiment of the present invention, the event response module first receives abnormal behavior information from the anomaly detection module and forms a detailed abnormal behavior list. The list contains relevant features of each abnormal behavior, such as timestamp, user ID, behavior type, etc. Each abnormal behavior received will be evaluated. During the evaluation process, the module will calculate the risk level of each abnormal behavior, usually based on a comprehensive analysis of multiple factors such as the historical record of the behavior, the current environment and the behavior characteristics. After the evaluation is completed, the event response module will set a risk threshold to determine whether each abnormal behavior exceeds the threshold. The risk threshold can be adjusted according to the security policy and business requirements of the system. Based on the type of abnormal behavior and its risk level, the event response module will select an appropriate response strategy. This strategy selection process may involve multiple predefined response plans, such as alarm notification, automatic blocking, traffic restriction, etc.

[0107] In one embodiment, after the policy is implemented, the policy management module needs to evaluate the effectiveness of the policy. The policy effectiveness evaluation formula is:

[0108]

[0109] Among them, E(s) represents the effectiveness score of strategy s, R before represents the risk score before the strategy is implemented, R after Represents the risk score after the policy is implemented.

[0110] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A computer data security protection system based on a computer network, characterized in that: include: Traffic monitoring module; Responsible for capturing network traffic data in real time; Threat intelligence integration module: responsible for collecting and analyzing threat intelligence information from multiple sources; User behavior analysis module: responsible for monitoring and analyzing users' network behavior; Data analysis and mining module: responsible for in-depth analysis and mining of data; Anomaly detection module: responsible for detecting abnormal behaviors using preset algorithms and rules; Incident response module: responsible for taking corresponding protective measures according to the preset response strategy; Policy management module: responsible for integrating the information and data provided by each module and adjusting network security policies; The traffic monitoring module is responsible for capturing and monitoring network traffic in real time by deploying network traffic monitoring tools. The traffic monitoring module transmits the captured network traffic data to the anomaly detection module and the data analysis and mining module. The threat intelligence integration module is responsible for collecting and integrating external threat intelligence. The threat intelligence integration module transmits the collected threat intelligence to the anomaly detection module. The user behavior analysis module is responsible for analyzing the user's behavior in the network and identifying normal and abnormal activities. The user behavior analysis module transmits the user behavior analysis results to the anomaly detection module. The data analysis and mining module is responsible for statistical analysis and machine learning algorithms to perform in-depth analysis on the data transmitted by the traffic monitoring module The data analysis and mining module transmits the analysis results to the policy management module and the anomaly detection module. The anomaly detection module is responsible for detecting abnormal behavior of the data transmitted by the traffic monitoring module, and performing targeted detection based on the intelligence of the threat intelligence integration module and the results of the user behavior analysis module. The anomaly detection module transmits the detected abnormal behavior information to the event response module and the policy management module. The event response module is responsible for receiving the abnormal behavior information from the anomaly detection module and triggering the response mechanism. The event response module transmits the response result to the policy management module. The policy management module is responsible for dynamically adjusting the security policy according to the analysis and detection results of each module.

2. A computer data security protection system based on a computer network according to claim 1, characterized in that: The traffic monitoring module includes a data acquisition unit, a traffic parsing unit, a traffic filtering unit, a traffic statistics unit, an anomaly representation unit and a data transmission unit. The data acquisition unit is responsible for capturing network traffic data in real time, the traffic parsing unit is responsible for parsing the captured data and extracting important information, the traffic filtering unit is responsible for filtering irrelevant traffic, the traffic statistics unit is responsible for performing statistical analysis on the traffic, the anomaly representation unit is responsible for detecting abnormal activities in the traffic in real time and marking suspicious traffic, and the data transmission unit is responsible for transmitting the monitored network traffic data to the anomaly detection module and the data analysis and mining module in real time.

3. A computer data security protection system based on a computer network according to claim 1, characterized in that: The threat intelligence integration module includes an intelligence collection unit, a data cleaning and classification unit, an intelligence integration unit, an intelligence scoring unit and a data transmission unit. The intelligence collection unit is responsible for automatically collecting relevant threat intelligence from various external sources, the data cleaning and classification unit is responsible for cleaning the collected threat intelligence and classifying the cleaned threat intelligence, the intelligence integration unit is responsible for integrating threat intelligence from various external sources, the intelligence scoring unit is responsible for scoring threat intelligence, and the data transmission unit is responsible for transmitting the integrated threat intelligence to the anomaly detection module in real time.

4. A computer data security protection system based on a computer network according to claim 1, characterized in that: The user behavior analysis module includes a data collection unit, a behavior modeling unit, a behavior analysis unit, a risk assessment unit and an integration and transmission unit. The data collection unit is responsible for collecting user behavior data, the behavior modeling unit is responsible for establishing a user behavior model based on historical data and defining a normal behavior pattern, the behavior analysis unit is responsible for identifying user behavior characteristics and detecting deviations from normal patterns, the risk assessment unit is responsible for assessing the risk level of user behavior, and the integration and transmission unit is responsible for transmitting the analysis results and risk assessment to the anomaly detection module.

5. A computer data security protection system based on a computer network according to claim 4, characterized in that: The specific steps of the behavior modeling unit to establish the user behavior model are: Data collection: Collect users' historical behavior data and ensure the integrity and accuracy of the data; Feature extraction: extract key features from raw data; Behavior classification: classify the extracted features and identify different types of user behaviors; Model selection and training: Select a neural network model, train the selected model using annotated historical data, adjust model parameters to improve accuracy, and use cross-validation methods to evaluate model performance to ensure the generalization ability of the model; Model validation: Test the model on an independent validation set and adjust and optimize the model based on the validation results; Model deployment: Deploy the trained model into a real-time environment to conduct real-time user behavior monitoring.

6. A computer data security protection system based on a computer network according to claim 1, characterized in that: The anomaly detection module performs abnormal behavior detection through the K-means clustering algorithm. The specific steps of the K-means clustering algorithm are: Data collection and preprocessing: Obtain network traffic data from the traffic monitoring module to form an original data set, remove duplicate values ​​and process missing values ​​to obtain a cleaned data set; Feature extraction: extract features from the cleaned data; Initialize cluster centers: randomly select k objects as initial cluster centers; Object assignment and cluster formation: Calculate the distance from each object to the k initial cluster centers, and assign the object to the cluster that is most similar to it based on the distance. The distance calculation usually uses the Euclidean distance, and the formula is: Among them, x i and x j Represents two n-dimensional data objects; Cluster center update: recalculate the center of each cluster, that is, calculate the mean of the attribute values ​​of all objects in each cluster as the new cluster center. The calculation formula of the cluster center is: Among them, m i is the center of the ith cluster, n i is the number of objects in the ith cluster, C i is the object set of the i-th cluster; Iteration and convergence: Repeat the above steps until the convergence of the objective function or the preset maximum number of iterations is reached; Anomaly detection: Calculate the distance from each data point to its nearest cluster center and determine whether the distance exceeds a set threshold to identify abnormal behavior.

7. A computer data security protection system based on a computer network according to claim 1, characterized in that: The specific steps of the event response module taking corresponding protective measures include: Receive abnormal behavior information: obtain abnormal behavior information from the anomaly detection module and generate an abnormal behavior list; Abnormal behavior assessment: Evaluate each abnormal behavior received and calculate its risk level; Risk threshold judgment: Set a risk threshold and determine whether each abnormal behavior exceeds the threshold; Strategy selection: Select an appropriate response strategy based on the type of abnormal behavior and its risk level; Execute response strategy: Execute the selected response strategy and record the results of the response measures.

8. A computer data security protection system based on a computer network according to claim 1, characterized in that: After the policy is implemented, the policy management module needs to evaluate the effectiveness of the policy. The policy effectiveness evaluation formula is: Where s represents the strategy, E(s) represents the effectiveness score of strategy s, and R before represents the risk score before the strategy is implemented, R after Represents the risk score after the policy is implemented.

Images