Secure communication method, system and device based on big data and medium

Abstract

The invention provides a secure communication method, system and device based on big data and a medium, and belongs to the technical field of communication security, the method comprises the following steps: identifying a request terminal and a target terminal in response to a communication request of a user, and establishing a secure transmission channel for the request terminal and the target terminal; requesting the terminal to carry out encrypted communication with the target terminal based on the secure transmission channel, establishing a communication record after the communication is finished, desensitizing the communication record, and storing the desensitized communication record in a database; and performing big data analysis on the desensitized communication records, identifying high and low peak periods of communication to optimize network resources, and identifying and intercepting abnormal request terminals with attack behaviors. According to the method, data leakage and tampering are prevented through a secure channel, encrypted communication and desensitization storage, privacy is protected by adopting a differential privacy algorithm, resources are optimized through big data analysis, abnormity is detected through an isolated forest model, and finally secure communication is realized.

Description

Technical Field

[0001] The present invention belongs to the field of communication security technology, and specifically relates to a secure communication method, system, equipment and medium based on big data. Background Art

[0002] With the development of information technology, big data has become an important part of modern communications. In the context of big data, secure communication has become the key to ensuring the security of information transmission and privacy protection. Traditional communication methods often have problems such as insecure data transmission, high risk of privacy leakage, and unreasonable allocation of network resources when facing big data environments.

[0003] Specifically, firstly, traditional communication methods often use simple encryption protocols, which are difficult to ensure the secure transmission of data when facing complex attack methods in the big data environment. Secondly, in the big data environment, users' communication records contain a large amount of personal information and privacy data. Once leaked, it will pose a serious threat to the privacy of users. Existing communication systems often lack effective privacy protection mechanisms, making it easy for criminals to obtain and use users' communication records. Thirdly, traditional communication systems often use static or fixed methods to allocate network resources, and cannot be dynamically adjusted according to communication needs. This method may lead to resource shortages during peak network communication periods, resulting in reduced user communication quality, while idle resources during off-peak periods are wasted.

[0004] In summary, traditional data communication methods have problems such as insufficient communication security, weak privacy protection and unreasonable allocation of network resources. Summary of the invention

[0005] In a first aspect, an embodiment of the present application provides a secure communication method based on big data, comprising the following steps: S1 responds to the user's communication request to identify the requesting terminal and the target terminal, and establishes a secure transmission channel for the requesting terminal and the target terminal; S2. Based on the secure transmission channel, the request terminal performs encrypted communication with the target terminal, and after the communication is completed, a communication record is established, and then the communication record is desensitized and saved in the database; S3. Perform big data analysis on the communication records after desensitization, identify the peak and off-peak periods of communication to optimize network resources, and identify abnormal request terminals with attack behaviors and intercept them.

[0006] Furthermore, the specific steps of step S1 are as follows: S11. The communication server responds to the communication request and identifies the requesting terminal user, the target terminal user, and the encryption protocol used by the requesting terminal user according to the user identifier; S12. The communication server initiates communication with the target terminal user, and after the communication response, the protocol used by the requesting terminal user to encrypt is sent to the target terminal user; S13. The communication server establishes a secure transmission channel based on the encryption protocol used by the requesting end user and the target end user; S14. The requesting terminal user and the target terminal user use a key exchange algorithm to exchange keys in a secure transmission channel to obtain a shared key.

[0007] Furthermore, the specific steps of step S14 are as follows: S141. Request the terminal user to use the Diffie-Hellman key exchange algorithm to generate a first key pair, including a first public key and a first private key, and send the first public key to the target terminal user through a secure transmission channel; S142. The target terminal user generates a second key pair using the Diffie-Hellman key exchange algorithm, including a second public key and a second private key, and sends the second public key to the requesting terminal user via a secure transmission channel; S143. The requesting terminal user and the target terminal user both calculate a shared key based on the Diffie-Hellman key exchange algorithm using the other party's public key and their own private key, and the two shared keys are the same.

[0008] Furthermore, the specific steps of step S2 are as follows: S21. Request the terminal user to encrypt the data using the shared key and send it to the other party; S22. The target terminal user receives the data sent by the requesting terminal user and decrypts it using the shared key; S23. The communication server detects that the communication is interrupted or the communication ends, and establishes a communication record for each user; the communication record includes a request to send a message record and a response to receive a message record; the request to send a message record includes the requesting terminal user identification and identity information, the target terminal user identification, the communication start time starting point and the communication end time point; the response to receive a message record includes the target terminal user identification and identity information, the requesting terminal user identification, the communication start time starting point and the communication end time point; S24. The communication server saves the original communication records in the first storage area of ​​the database, desensitizes the user identification and identity information in the original communication records, and then saves them in the second storage area of ​​the database, and regularly clears the original communication records in the first storage area of ​​the database that exceed the set storage time.

[0009] Furthermore, the specific steps of step S24 are as follows: S241. The communication server creates a first storage area and a second storage area in the database; S242. The communication server saves the original communication record to the first storage area, and detects whether there is an original communication record in the first storage area that exceeds the set storage time; If yes, go to step S243; If not, proceed to step S244; S243. Clean up the original communication records that have exceeded the set storage period; S244. The communication server desensitizes the set digits in the user identifier and the set bytes in the identity information in the original communication record using a differential privacy algorithm to obtain the desensitized user identifier and identity information; S245. The desensitized communication records are saved in the second storage area, and an association identification table of the original communication records and the desensitized communication records is established; S246. Save the association identification table to the first storage area, encrypt the original communication records and the association identification table in the first storage area, and set the access permission to be accessible only to administrator users.

[0010] Furthermore, the specific steps of step S3 are as follows: S31. The communication server responds to the data analysis user's big data analysis request and verifies the data analysis user's identity authority; If the verification is successful, proceed to step S32; If the verification fails, the data analysis user is prohibited from obtaining the communication records in the second storage area, and the process ends; S32. The communication server obtains the communication records of each user and performs timestamp standardization, calculates the communication duration and communication frequency, and completes preprocessing; S33. The communication server groups the communication records into time periods according to the time dimension, calculates the communication volume in each time period, and then uses the K-means clustering algorithm to cluster the communication volume to identify the peak and low peak periods of communication; S34. The communication server sends a reminder to the data analysis user to increase bandwidth and optimize the communication server performance during peak hours; S35. Obtain historical desensitized communication records in advance and mark abnormal communications, select the statistics of communication duration, communication frequency and user identification of both parties in communication as data features, train the isolation forest model, and then input the desensitized communication records obtained in real time into the trained isolation forest model to calculate the abnormal score, and determine it as abnormal communication when the abnormal score exceeds the set threshold; S36. The communication server sends a communication interception reminder from the requesting terminal user corresponding to the abnormal communication to the target terminal user and the data analysis user.

[0011] Furthermore, the specific steps of step S33 are as follows: S331. The communication server divides each communication record into time periods according to hours and calculates the communication volume in each time period; the communication volume includes the number of communications and the duration of communications; S332. Count all communication records for each time period and calculate the total amount of communication as a data point; S333. Randomly select K traffic data points as the initial centroid; S334. Calculate the distance from each data point to all centroids, and assign each data point to the nearest centroid; S335. Update the position of the centroid to the average value of all data points assigned to the centroid; S336. Determine whether the position of the centroid of this iteration is the same as the position of the centroid of the previous iteration; If yes, go to step S338; If not, proceed to step S337; S337. Determine whether the number of iterations is completed; If yes, go to step S338; If not, proceed to the next iteration and return to step S334; S338. According to the clustering result, the time period when the communication volume is greater than the first ratio threshold is regarded as the peak period, and the time period when the communication volume is less than the second ratio threshold is regarded as the off-peak period; The specific steps of step S35 are as follows: S351. Obtain the historical desensitized communication records, select the communication duration, communication frequency and the user identifications of both parties after desensitization as features, and convert the communication records into feature vectors; S352. Use the communication records after feature conversion as training data for the isolation forest model, and set the number of tree parameters and the maximum depth parameter of each tree of the isolation forest model; S353. Use training data to train the isolation forest model: S354. Obtain the real-time desensitized communication records and convert them into feature vectors, and then input them into the trained isolation forest model to calculate the anomaly score; S355. Determine whether the abnormal score exceeds the set threshold; If yes, go to step S356; If not, proceed to step S36; S356. Determine the currently input communication record as abnormal communication, and apply to the system administrator to query the abnormal communication subject; S357. The system administrator user decrypts the association identification table and the original communication record in the first access area, searches the association identification table for the abnormal communication subject first, then searches the original communication record, determines the user identification and identity information of the abnormal communication subject and returns them.

[0012] In a second aspect, an embodiment of the present application further provides a secure communication system based on big data, including: A secure transmission channel establishment module, used to identify a requesting terminal and a target terminal in response to a user's communication request, and to establish a secure transmission channel for the requesting terminal and the target terminal; The record desensitization and storage module is used to request the terminal to perform encrypted communication with the target terminal based on the secure transmission channel, and to establish a communication record after the communication is completed, and then save the communication record to the database after desensitization processing; The secure communication module is used to perform big data analysis on communication records after desensitization, identify peak and off-peak communication periods to optimize network resources, and identify abnormal request terminals with attack behaviors and intercept them.

[0013] In a third aspect, an embodiment of the present application further provides an electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein when the processor executes the program, the steps of the secure communication method based on big data as described in the first aspect are implemented.

[0014] In a fourth aspect, an embodiment of the present application further provides a storage medium on which a computer program is stored, and when the computer program is executed by a processor, the steps of the secure communication method based on big data as described in the first aspect are implemented.

[0015] It can be seen from the above technical solutions that the present invention has the following advantages: In the big data-based secure communication method, system, device and medium provided by the present application, the security of the communication process is ensured and data leakage and tampering are prevented by establishing a secure transmission channel, implementing encrypted communication and desensitizing and storing communication records; the communication records are desensitized by a differential privacy algorithm to protect user privacy and provide communication records that can be used for subsequent analysis; through big data analysis, the peak and off-peak periods of communication are identified, network resources are optimized, and the efficiency of the communication system is improved; the isolation forest model algorithm is used to identify abnormal communications, timely discover and deal with potential threats, and enhance the security of the communication system.

[0016] In addition, the present application is applicable to various scenarios requiring secure communication and has broad application prospects. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solution of the present invention, the accompanying drawings required for use in the description will be briefly introduced below. Obviously, the accompanying drawings in the following description are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0018] Figure 1 The figure is a flow chart of an embodiment of the big data-based secure communication method of the present invention.

[0019] Figure 2 The figure is a flow chart of another embodiment of the big data-based secure communication method of the present invention.

[0020] Figure 3 It is a schematic diagram of the big data-based secure communication system of the present invention. DETAILED DESCRIPTION

[0021] In the specific steps of the big data-based secure communication method described in detail below, various embodiments of the present disclosure will be described more comprehensively. The present disclosure may have various embodiments, and adjustments and changes may be made therein. However, it should be understood that there is no intention to limit the various embodiments of the present disclosure to the specific embodiments disclosed herein, but the present disclosure should be understood to cover all adjustments, equivalents and / or alternatives that fall within the spirit and scope of the various embodiments of the present disclosure.

[0022] For example, with the rapid development of information technology, big data has become an indispensable part of modern communications. Under the wave of big data, ensuring the security and privacy protection of information transmission has become the top priority of secure communications. However, traditional communication methods have exposed a series of problems when dealing with big data environments.

[0023] First, these traditional methods often rely on simple encryption protocols, which are powerless in the face of complex attack methods in the big data environment and cannot effectively ensure the secure transmission of data. Secondly, in the big data environment, users' communication records contain a large amount of personal information and privacy data. Once these records are leaked, they will pose a huge threat to users' privacy. Unfortunately, existing communication systems often lack a sound privacy protection mechanism, making users' communication records like exposed treasures, which are easily stolen and used by criminals. Finally, traditional communication systems have obvious deficiencies in resource allocation. They often adopt static or fixed allocation methods and cannot be flexibly adjusted according to actual communication needs. This rigid resource allocation method may lead to serious resource shortages during peak network communication periods, affecting the communication quality of users; and during off-peak periods, resources are not fully utilized, resulting in resource waste.

[0024] In summary, traditional communication methods can no longer meet the needs of secure communication in a big data environment.

[0025] In response to the above problems, this embodiment provides a secure communication method based on big data, which ensures communication security through a secure transmission channel, protects user privacy through desensitization processing, optimizes network resources and identifies abnormal behaviors through big data analysis, and realizes secure, efficient and intelligent communication management.

[0026] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0027] See also Figure 1 FIG. 1 is a flow chart of a secure communication method based on big data in a specific embodiment, wherein the method includes: S1 responds to the user's communication request to identify the requesting terminal and the target terminal, and establishes a secure transmission channel for the requesting terminal and the target terminal; It should be noted that by identifying the requesting terminal and the target terminal and establishing a secure transmission channel, the security of data transmission between the communicating parties is ensured; S2. Based on the secure transmission channel, the request terminal performs encrypted communication with the target terminal, and after the communication is completed, a communication record is established, and then the communication record is desensitized and saved in the database; It should be noted that the privacy of the communication content is protected through encrypted communication and desensitization, while the communication records are retained for subsequent analysis; S3. Perform big data analysis on the communication records after desensitization, identify the peak and low peak periods of communication to optimize network resources, and identify abnormal request terminals with attack behaviors and intercept them; It should be noted that through big data analysis, network resource allocation is optimized, communication efficiency is improved, and potential attack behaviors can be identified and intercepted in a timely manner, thereby enhancing the security of the system.

[0028] This embodiment achieves security, privacy protection and resource optimization of the communication process through the establishment of a secure transmission channel, the implementation of encrypted communication, the desensitizing storage of communication records and the application of big data analysis, thereby improving the overall security and efficiency of the communication system and reducing the risks in the communication process.

[0029] Further, as a refinement and extension of the specific implementation of the above embodiment, in order to fully illustrate the specific implementation process of this embodiment, another secure communication method based on big data is provided, such as Figure 2 As shown, the method includes: S1. Respond to the user's communication request to identify the requesting terminal and the target terminal, and establish a secure transmission channel for the requesting terminal and the target terminal; the specific steps of step S1 are as follows: S11. The communication server responds to the communication request and identifies the requesting terminal user, the target terminal user, and the encryption protocol used by the requesting terminal user according to the user identifier; S12. The communication server initiates communication with the target terminal user, and after the communication response, the protocol used by the requesting terminal user to encrypt is sent to the target terminal user; S13. The communication server establishes a secure transmission channel based on the encryption protocol used by the requesting end user and the target end user; S14. The requesting end user and the target end user use a key exchange algorithm to exchange keys in a secure transmission channel to obtain a shared key; It should be noted that the secure transmission channel construction process through the identification and negotiation of encryption protocols ensures that both parties can use appropriate encryption protocols for communication, improves the security of the communication process, and prevents data leakage and tampering during transmission; S2. Based on the secure transmission channel, the request terminal performs encrypted communication with the target terminal, and establishes a communication record after the communication is completed, and then saves the communication record to the database after desensitization processing; the specific steps of step S2 are as follows: S21. Request the terminal user to encrypt the data using the shared key and send it to the target terminal user; S22. The target terminal user receives the data sent by the requesting terminal user and decrypts it using the shared key; For example, taking a phone call as an example, although the requesting terminal user is the requesting end, after the call is connected, the communication between the two parties is two-way. The requesting terminal user will send data to the target terminal user, and the target terminal user will also send data to the requesting terminal user; Therefore, the target terminal user will also use the shared key to encrypt the data and send it to the requesting terminal user, and the requesting terminal user will use the shared key to decrypt the data after receiving it. S23. The communication server detects that the communication is interrupted or the communication ends, and establishes a communication record for each user; the communication record includes a request to send a message record and a response to receive a message record; the request to send a message record includes the requesting terminal user identification and identity information, the target terminal user identification, the communication start time starting point and the communication end time point; the response to receive a message record includes the target terminal user identification and identity information, the requesting terminal user identification, the communication start time starting point and the communication end time point; S24. The communication server stores the original communication records in the first storage area of ​​the database, desensitizes the user identification and identity information in the original communication records, and stores them in the second storage area of ​​the database, and regularly cleans up the original communication records that exceed the set storage period in the first storage area of ​​the database; It should be noted that the key exchange algorithm improves the security of key exchange between the communicating parties, enhances the encryption of the communication process, and ensures the confidentiality of the communication content; S3. Perform big data analysis on the communication records after desensitization, identify the peak and low peak periods of communication to optimize network resources, and identify abnormal request terminals with attack behaviors and intercept them; the specific steps of step S3 are as follows: S31. The communication server responds to the data analysis user's big data analysis request and verifies the data analysis user's identity authority; If the verification is successful, proceed to step S32; If the verification fails, the data analysis user is prohibited from obtaining the communication records in the second storage area, and the process ends; S32. The communication server obtains the communication records of each user and performs timestamp standardization, calculates the communication duration and communication frequency, and completes preprocessing; S33. The communication server groups the communication records into time periods according to the time dimension, calculates the communication volume in each time period, and then uses the K-means clustering algorithm to cluster the communication volume to identify the peak and low peak periods of communication; S34. The communication server sends a reminder to the data analysis user to increase bandwidth and optimize the communication server performance during peak hours; S35. Obtain historical desensitized communication records in advance and mark abnormal communications, select the statistics of communication duration, communication frequency and user identification of both parties in communication as data features, train the isolation forest model, and then input the desensitized communication records obtained in real time into the trained isolation forest model to calculate the abnormal score, and determine it as abnormal communication when the abnormal score exceeds the set threshold; S36. The communication server sends a communication interception reminder to the target terminal user and the data analysis user by the requesting terminal user corresponding to the abnormal communication; For example, taking the identification of similar harassing calls as an example, the request terminal user sends a communication interception reminder to the data analysis user, so that the request is intercepted as a whole on the server side so that the request cannot reach the target terminal user, or it can be intercepted at the target terminal user; It should be noted that through big data analysis, network resources can be optimized and abnormal communications can be identified, the efficiency and security of the communication system can be improved, and potential threats can be discovered and dealt with in a timely manner.

[0030] In an embodiment of the present invention, based on step S14, a possible embodiment is given below to illustrate its specific implementation scheme in a non-limiting manner.

[0031] The specific steps of step S14 are as follows: S141. Request the terminal user to generate a first key pair using the Diffie-Hellman key exchange algorithm, including a first public key and a first private key, and send the first public key to the target terminal user through a secure transmission channel; S142. The target terminal user generates a second key pair using the Diffie-Hellman key exchange algorithm, including a second public key and a second private key, and sends the second public key to the requesting terminal user via a secure transmission channel; S143. The requesting terminal user and the target terminal user both calculate a shared key based on the Diffie-Hellman key exchange algorithm using the other party's public key and their own private key, and the two shared keys are the same.

[0032] Specifically, the communication server sends the encryption protocol of the requesting terminal user to the target terminal user and also sends the public prime number p and primitive element g required for Diffie-Hellman key exchange; The terminal user is requested to generate the first private key a, and the first public key A is calculated according to the following formula, and the first public key A is sent to the target terminal user: A = g^a mod p; The target terminal user generates a second private key b, calculates a second public key B according to the following formula, and sends the second public key B to the requesting terminal user: B = g^bmod p; Request the terminal user to use the first private key a and the received second public key B to calculate the first shared key K1: K1 = a^B mod p; The target terminal user uses the second private key b and the received first public key A to calculate the first shared key K2: K2 = b^A mod p; Based on the Diffie-Hellman key exchange algorithm, we know that K1=K2=K; Where K is the shared key.

[0033] In an embodiment of the present invention, based on step S24, a possible embodiment is given below to illustrate its specific implementation in a non-limiting manner.

[0034] The specific steps of step S24 are as follows: S241. The communication server creates a first storage area and a second storage area in the database; S242. The communication server saves the original communication record to the first storage area, and detects whether there is an original communication record in the first storage area that exceeds the set storage time; If yes, go to step S243; If not, proceed to step S244; S243. Clean up the original communication records that have exceeded the set storage period; S244. The communication server desensitizes the set digits in the user identifier and the set bytes in the identity information in the original communication record using a differential privacy algorithm to obtain the desensitized user identifier and identity information; S245. The desensitized communication records are saved in the second storage area, and an association identification table of the original communication records and the desensitized communication records is established; S246. The association identification table is saved in the first storage area, and the original communication records and the association identification table are encrypted in the first storage area, and the access rights are set to be accessible only to administrator users; It should be noted that the communication records are desensitized through the differential privacy algorithm to further protect user privacy; the secure storage and management of communication records are ensured by setting access rights and encryption measures.

[0035] In an embodiment of the present invention, based on step S33 and step S35, a possible embodiment is given below to illustrate its specific implementation scheme in a non-limiting manner.

[0036] The specific steps of step S33 are as follows: S331. The communication server divides each communication record into time periods according to hours and calculates the communication volume in each time period; the communication volume includes the number of communications and the duration of communications; S332. Count all communication records for each time period and calculate the total amount of communication as a data point; S333. Randomly select K traffic data points as the initial centroid; S334. Calculate the distance from each data point to all centroids, and assign each data point to the nearest centroid; S335. Update the position of the centroid to the average value of all data points assigned to the centroid by the following formula;

[0037] in, is the ith centroid, is the set of data points assigned to this centroid; S336. Determine whether the position of the centroid of this iteration is the same as the position of the centroid of the previous iteration; If yes, go to step S338; If not, proceed to step S337; S337. Determine whether the number of iterations is completed; If yes, go to step S338; If not, proceed to the next iteration and return to step S334; S338. According to the clustering result, the time period when the communication volume is greater than the first ratio threshold is regarded as the peak period, and the time period when the communication volume is less than the second ratio threshold is regarded as the off-peak period; The specific steps of step S35 are as follows: S351. Obtain the historical desensitized communication records, select the communication duration, communication frequency and the user identifications of both parties after desensitization as features, and convert the communication records into feature vectors; S352. Use the communication records after feature conversion as training data for the isolation forest model, and set the number of tree parameters and the maximum depth parameter of each tree of the isolation forest model; S353. Use the training data to train the isolation forest model in the following way: from sklearn.ensemble import IsolationForest import numpy as np # Let X be the feature matrix of historical communication records X = np.array([ [duration_1, frequency_1, user_id_1_hashed, user_id_2_hashed], ... ]) # Train Isolation Forest Model iso_forest = IsolationForest(n_estimators=100, max_samples='auto',contamination=0.01, random_state=42) iso_forest.fit(X[:, :-2])#Use communication duration and frequency for training; S354. Obtain the real-time desensitized communication records and convert them into feature vectors, and then input them into the trained isolation forest model to calculate the anomaly score; S355. Determine whether the abnormal score exceeds the set threshold; If yes, go to step S356; If not, proceed to step S36; S356. Determine the currently input communication record as abnormal communication, and apply to the system administrator to query the abnormal communication subject; S357. The system administrator user decrypts the association identification table and the original communication record in the first access area, searches the association identification table for the abnormal communication subject, and then searches the original communication record to determine the user identification and identity information of the abnormal communication subject and returns; It should be noted that by clustering the communication volume and identifying abnormal communications, the accuracy of network resource optimization and the accuracy of abnormal communication identification are improved, providing strong support for the optimization and security management of the communication system.

[0038] It should be understood that the order of execution of the steps in the above embodiment does not necessarily mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present invention.

[0039] like Figure 3 As shown, the following is an embodiment of the big data-based secure communication system provided by the embodiment of the present disclosure. The system and the big data-based secure communication method of the above-mentioned embodiments belong to the same inventive concept. For details not described in detail in the embodiment of the big data-based secure communication system, please refer to the above-mentioned big data-based secure communication method embodiment.

[0040] The system includes: A secure transmission channel establishment module, used to identify a requesting terminal and a target terminal in response to a user's communication request, and to establish a secure transmission channel for the requesting terminal and the target terminal; The record desensitization and storage module is used to request the terminal to perform encrypted communication with the target terminal based on the secure transmission channel, and to establish a communication record after the communication is completed, and then save the communication record to the database after desensitization processing; The secure communication module is used to perform big data analysis on communication records after desensitization, identify peak and off-peak communication periods to optimize network resources, and identify abnormal request terminals with attack behaviors and intercept them.

[0041] This embodiment realizes secure transmission, record desensitization storage and big data analysis functions through modular design, improves the overall security and efficiency of the communication system, and reduces the complexity and maintenance cost of the system.

[0042] The secure communication method based on big data provided in the embodiment of the present application can be applied to electronic devices. It can be understood by those skilled in the art that the electronic device structure involved in the embodiment of the present invention does not constitute a limitation on the electronic device, and the electronic device may include more or less components than shown, or combine certain components, or arrange different components. In an embodiment of the present invention, the electronic device includes but is not limited to a laptop computer, a desktop computer, a workbench, a personal digital assistant, a server, a blade server, a mainframe computer, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the embodiments of the present application described and / or required herein.

[0043] The electronic device may include a processor, an external memory interface, an internal memory, a universal serial bus (USB) interface, a charging management module, a power management module, a battery, a wireless communication module, an audio module, a speaker, a microphone, a sensor module, buttons, a camera, a display, and a SIM card interface, etc.

[0044] It is to be understood that the structure illustrated in the embodiments of the present application does not constitute a specific limitation on the electronic device. In other embodiments of the present application, the electronic device may include more or fewer components than shown in the figure, or combine certain components, or split certain components, or arrange the components differently. The components shown in the figure may be implemented in hardware, software, or a combination of software and hardware.

[0045] The processor may include one or more processing units, for example, the processor may include a central processing unit (CPU), an application processor (AP), a modem processor, a graphics processing unit (GPU), an image signal processor (ISP), a controller, a memory, a video codec, a digital signal processor (DSP), a baseband processor, and / or a neural-network processing unit (NPU), etc. Among them, different processing units may be independent devices or integrated into one or more processors.

[0046] The processor can be the nerve center and command center of the electronic device. The controller can generate an operation control signal according to the instruction operation code and timing signal to complete the control of fetching and executing instructions.

[0047] A memory may also be provided in the processor for storing instructions and data. In some embodiments, the memory in the processor is a cache memory. The memory may store instructions or data that the processor has just used or is cyclically used. If the processor needs to use the instruction or data again, it may be directly called from the memory. This avoids repeated access, reduces the waiting time of the processor, and thus improves system efficiency.

[0048] The above-mentioned electronic device implements the big data-based secure communication method of the present application, which responds to the user's communication request to identify the requesting terminal and the target terminal, and establishes a secure transmission channel for the requesting terminal and the target terminal; based on the secure transmission channel, the requesting terminal and the target terminal perform encrypted communication, and establish a communication record after the communication is completed, and save the communication record to the database after desensitizing processing; perform big data analysis on the desensitized communication records, identify the peak and off-peak periods of communication to optimize network resources, and identify abnormal requesting terminals with attack behaviors and intercept them. The technical solution achieves the effective effect of improving the security of the communication process, realizing privacy protection of the communication process, optimizing the resources in the chassis during the communication process, and detecting anomalies.

[0049] The storage medium provided in the present application stores a program product that can implement a secure communication method based on big data.

[0050] Big data-based secure communication methods include: Responding to the user's communication request, identifying the requesting terminal and the target terminal, and establishing a secure transmission channel for the requesting terminal and the target terminal; The request terminal performs encrypted communication with the target terminal based on a secure transmission channel, and creates a communication record after the communication is completed. The communication record is desensitized and saved in a database; Conduct big data analysis on the communication records after desensitization, identify peak and off-peak communication periods to optimize network resources, and identify abnormal request terminals with attack behaviors and intercept them.

[0051] In some possible implementations, the big data-based secure communication method of the present disclosure may be implemented in the form of a program product, which includes a program code. When the program product is run on a terminal device, the program code is used to enable the terminal device to execute the steps described in the above “Exemplary Method” section of this specification according to various exemplary implementations of the present disclosure.

[0052] The storage medium of the present disclosure can adopt any combination of one or more readable media. The readable medium can be a readable signal medium or a readable storage medium. The readable storage medium can be, for example, but not limited to, a system, device or device of electricity, magnetism, light, electromagnetic, infrared, or semiconductor, or any combination of the above. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0053] The above description of the disclosed embodiments enables one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A secure communication method based on big data, characterized in that: The steps include: S1. Respond to the user's communication request to identify the requesting terminal and the target terminal, and establish a secure transmission channel for the requesting terminal and the target terminal; S2. Based on the secure transmission channel, the request terminal performs encrypted communication with the target terminal, and establishes a communication record after the communication is completed, and then saves the communication record to the database after desensitization processing; S3. Perform big data analysis on the communication records after desensitization, identify peak and off-peak communication periods to optimize network resources, and identify abnormal request terminals with attack behaviors and intercept them.

2. The secure communication method based on big data according to claim 1, characterized in that: The specific steps of step S1 are as follows: S11. The communication server responds to the communication request and identifies the requesting terminal user, the target terminal user, and the encryption protocol used by the requesting terminal user according to the user identifier; S12. The communication server initiates communication with the target terminal user, and after the communication response, the protocol used by the requesting terminal user to encrypt is sent to the target terminal user; S13. The communication server establishes a secure transmission channel based on the encryption protocol used by the requesting end user and the target end user; S14. The requesting terminal user and the target terminal user use a key exchange algorithm to exchange keys in a secure transmission channel to obtain a shared key.

3. The secure communication method based on big data according to claim 2, characterized in that: The specific steps of step S14 are as follows: S141. Request the terminal user to use the Diffie-Hellman key exchange algorithm to generate a first key pair, including a first public key and a first private key, and send the first public key to the target terminal user through a secure transmission channel; S142. The target terminal user generates a second key pair using the Diffie-Hellman key exchange algorithm, including a second public key and a second private key, and sends the second public key to the requesting terminal user via a secure transmission channel; S143. The requesting terminal user and the target terminal user both calculate a shared key based on the Diffie-Hellman key exchange algorithm using the other party's public key and their own private key, and the two shared keys are the same.

4. The secure communication method based on big data according to claim 2, characterized in that: The specific steps of step S2 are as follows: S21. Request the terminal user to encrypt the data using the shared key and send it to the target terminal user; S22. The target terminal user receives the data sent by the requesting terminal user and decrypts it using the shared key; S23. The communication server detects that the communication is interrupted or the communication ends, and establishes a communication record for each user; the communication record includes a request to send a message record and a response to receive a message record; the request to send a message record includes the requesting terminal user identification and identity information, the target terminal user identification, the communication start time starting point and the communication end time point; the response to receive a message record includes the target terminal user identification and identity information, the requesting terminal user identification, the communication start time starting point and the communication end time point; S24. The communication server saves the original communication records in the first storage area of ​​the database, desensitizes the user identification and identity information in the original communication records, and then saves them in the second storage area of ​​the database, and regularly clears the original communication records in the first storage area of ​​the database that exceed the set storage time.

5. The secure communication method based on big data according to claim 4, characterized in that: The specific steps of step S24 are as follows: S241. The communication server creates a first storage area and a second storage area in the database; S242. The communication server saves the original communication record to the first storage area, and detects whether there is an original communication record in the first storage area that exceeds the set storage time; If yes, go to step S243; If not, proceed to step S244; S243. Clean up the original communication records that have exceeded the set storage period; S244. The communication server desensitizes the set digits in the user identifier and the set bytes in the identity information in the original communication record using a differential privacy algorithm to obtain the desensitized user identifier and identity information; S245. The desensitized communication records are saved in the second storage area, and an association identification table of the original communication records and the desensitized communication records is established; S246. Save the association identification table to the first storage area, encrypt the original communication records and the association identification table in the first storage area, and set the access permission to be accessible only to administrator users.

6. The secure communication method based on big data according to claim 4, characterized in that: The specific steps of step S3 are as follows: S31. The communication server responds to the data analysis user's big data analysis request and verifies the data analysis user's identity authority; If the verification is successful, proceed to step S32; If the verification fails, the data analysis user is prohibited from obtaining the communication records in the second storage area, and the process ends; S32. The communication server obtains the communication records of each user and performs timestamp standardization, calculates the communication duration and communication frequency, and completes preprocessing; S33. The communication server groups the communication records into time periods according to the time dimension, calculates the communication volume in each time period, and then uses the K-means clustering algorithm to cluster the communication volume to identify the peak and low peak periods of communication; S34. The communication server sends a reminder to the data analysis user to increase bandwidth and optimize the communication server performance during peak hours; S35. Obtain historical desensitized communication records in advance and mark abnormal communications, select the statistics of communication duration, communication frequency and user identification of both parties in communication as data features, train the isolation forest model, and then input the desensitized communication records obtained in real time into the trained isolation forest model to calculate the abnormal score, and determine it as abnormal communication when the abnormal score exceeds the set threshold; S36. The communication server sends a communication interception reminder from the requesting terminal user corresponding to the abnormal communication to the target terminal user and the data analysis user.

7. The secure communication method based on big data according to claim 4, characterized in that: The specific steps of step S33 are as follows: S331. The communication server divides each communication record into time periods according to hours and calculates the communication volume in each time period; the communication volume includes the number of communications and the duration of communications; S332. Count all communication records for each time period and calculate the total amount of communication as a data point; S333. Randomly select K traffic data points as the initial centroid; S334. Calculate the distance from each data point to all centroids, and assign each data point to the nearest centroid; S335. Update the position of the centroid to the average value of all data points assigned to the centroid; S336. Determine whether the position of the centroid of this iteration is the same as the position of the centroid of the previous iteration; If yes, go to step S338; If not, proceed to step S337; S337. Determine whether the number of iterations is completed; If yes, go to step S338; If not, proceed to the next iteration and return to step S334; S338. According to the clustering result, the time period when the communication volume is greater than the first ratio threshold is regarded as the peak period, and the time period when the communication volume is less than the second ratio threshold is regarded as the off-peak period; The specific steps of step S35 are as follows: S351. Obtain the historical desensitized communication records, select the communication duration, communication frequency and the user identifications of both parties after desensitization as features, and convert the communication records into feature vectors; S352. Use the communication records after feature conversion as training data for the isolation forest model, and set the number of tree parameters and the maximum depth parameter of each tree of the isolation forest model; S353. Train the isolation forest model using the training data; S354. Obtain the real-time desensitized communication records and convert them into feature vectors, and then input them into the trained isolation forest model to calculate the anomaly score; S355. Determine whether the abnormal score exceeds the set threshold; If yes, go to step S356; If not, proceed to step S36; S356. Determine the currently input communication record as abnormal communication, and apply to the system administrator to query the abnormal communication subject; S357. The system administrator user decrypts the association identification table and the original communication record in the first access area, searches the association identification table for the abnormal communication subject first, then searches the original communication record, determines the user identification and identity information of the abnormal communication subject and returns them.

8. A secure communication system based on big data, characterized in that: include: A secure transmission channel establishment module, used to identify a requesting terminal and a target terminal in response to a user's communication request, and to establish a secure transmission channel for the requesting terminal and the target terminal; The record desensitization and storage module is used to request the terminal to perform encrypted communication with the target terminal based on the secure transmission channel, and to establish a communication record after the communication is completed, and then save the communication record to the database after desensitization processing; The secure communication module is used to perform big data analysis on communication records after desensitization, identify peak and off-peak communication periods to optimize network resources, and identify abnormal request terminals with attack behaviors and intercept them.

9. An electronic device, characterized in that: The method comprises a memory, a processor and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the big data-based secure communication method as claimed in any one of claims 1 to 7 when executing the program.

10. A storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the big data-based secure communication method according to any one of claims 1 to 7 are implemented.

Images