Computer information security processing method and system based on big data

Abstract

The invention relates to the technical field of computer information processing, and particularly discloses a computer information security processing method and system based on big data, comprising threat detection and analysis, real-time monitoring, quantum encryption, quantum transmission, reaction and response. According to the method, the system state and the network activity are monitored in real time by using a big data analysis technology, malicious activities are detected and coped with in time, abnormal behaviors and potential threats are identified, an attacker can be detected when stealing a key or information by using the core principle of quantum cryptography based on irreversibility of quantum mechanics and interference characteristics of measurement, and the security of the attacker is improved. Once someone tries to eavesdrop communication, the quantum state collapses, so that abnormity can be quickly detected, response is quick, and the high security can provide more reliable protection for communication and data transmission.

Description

Technical Field

[0001] The present invention belongs to the technical field of computer information processing, and specifically relates to a computer information security processing method and system based on big data. Background Art

[0002] The Internet is an open system for the public. At the beginning of its design, the security of information transmitted on the network was not fully considered. With the rapid development of network technology, the network security issues caused by it have become increasingly serious. How to protect the information transmitted on the network, that is, the security of network transmission data, has become more and more important. At present, with the B / S architecture mode network application becoming the mainstream development direction, encryption technology is an important means to ensure the security of transmission data. Before data is transmitted on the network, it needs to be encrypted. After the ciphertext reaches the destination, it needs to be decrypted for program use. At present, the DES algorithm is a typical symmetric encryption algorithm with low computational cost and fast encryption speed, but low security and the risk of being easily cracked by brute force; the RSA algorithm is a typical asymmetric encryption algorithm with high security, but high computational cost and slow encryption speed.

[0003] The above algorithm has limitations when used for computer communication and needs to be improved urgently to ensure computer information security. Summary of the invention

[0004] The purpose of the present invention is to provide a computer information security processing method and system based on big data to solve the problems raised in the above background technology.

[0005] To achieve the above object, the present invention provides the following technical solutions:

[0006] A computer information security processing method and system based on big data, comprising:

[0007] Threat detection and analysis: Using big data analysis technology, abnormal behaviors and potential threats can be identified from massive amounts of network traffic and log data. Based on behavioral analysis methods, unknown threats and attack patterns can be discovered.

[0008] Real-time monitoring: Use big data technology to monitor system status and network activities in real time, and detect and respond to malicious activities in a timely manner;

[0009] Quantum encryption: For data that needs to be encrypted, the encryption principle in quantum cryptography is used for encryption, and quantum key distribution is used to detect eavesdropping and interference, providing a secure communication method;

[0010] Quantum transmission: Using the principle of quantum communication, encrypted data is transmitted to the target location. The characteristics of quantum entanglement are used to ensure the security of the communication process. Once someone tries to eavesdrop on the communication, the quantum state will collapse, so that the anomaly can be quickly detected.

[0011] Reaction and response: When abnormal behavior is detected, the system takes appropriate reaction measures based on the severity and type of the analysis results, such as disconnecting, blocking IP, and locking accounts.

[0012] Preferably, the big data analysis technology specifically includes:

[0013] Data collection and processing: collect big data related to the problem, including databases, tabular data, text, images, and audio data, remove noise, missing values, and outliers from the data, and transform and normalize the data for subsequent analysis;

[0014] Exploratory data analysis: analyzing the statistical characteristics, distribution, and correlation of data to gain a preliminary understanding of the data;

[0015] Model selection and training: Select a machine learning model, train the model using part of the data, and adjust the model parameters to make it better fit the data;

[0016] Model evaluation: Use another part of the data to evaluate the model performance. Common evaluation indicators include accuracy, precision, recall, and F1 score. Explain the model's prediction results and understand the model's contribution to the problem.

[0017] Result visualization: Use charts and images to visualize the analysis results to better communicate the analysis results.

[0018] Preferably, the behavior analysis is as follows:

[0019] Data preprocessing: Clean and preprocess user login data to handle missing values ​​and outliers;

[0020] Feature engineering: Extract features from login data, such as login time interval, login location changes, and commonly used devices. The feature formula is as follows:

[0021] Login time interval: login_time_interval = time_since_last_login

[0022] Login location changes:

[0023] location_change=count_distinct(locations) / total_logins

[0024] Frequent devices: frequent_device = device_frequency / total_logins

[0025] Establish a behavioral baseline: For each user, calculate the baseline of their normal behavior, that is, the typical behavioral characteristics over a period of time;

[0026] Anomaly detection model training: The model is trained using the Isolation Forest Anomaly Score algorithm to identify abnormal behaviors that do not match the behavioral baseline. The specific formula is as follows:

[0027]

[0028] Among them, E(h(x)) is the external path length, c(n) is the expected external path length, n is the total number of samples, and its anomaly score reflects the degree of sample outlier.

[0029] Preferably, accuracy: accuracy = (TP + TN) / (TP + TN + FP + FN)

[0030] Precision: precision = TP / (TP+FP)

[0031] Recall rate: recall = TP / (TP+FN)

[0032] F1 score: F1_score=2*(precision*recall) / (precision+recall).

[0033] Preferably, the quantum key distribution is specifically as follows:

[0034] Key generation: Alice (sender) and Bob (receiver) use a set of quantum bits (usually photons) to generate a shared key;

[0035] Quantum bit transmission: Alice encodes a bit sequence using the polarization state of light and sends these qubits to Bob through a quantum channel;

[0036] Quantum bit reception: After receiving the quantum bits sent by Alice, Bob performs quantum measurement on each bit and obtains the measurement result;

[0037] Quantum entanglement: Two or more quantum bits are entangled, so that the state of one bit is affected by the state of another bit, specifically:

[0038] In quantum communication, Alice (sender) and Bob (receiver) can create a pair of qubits represented as:

[0039] That is, the two quantum bits are in an entangled state. No matter how the state of one bit changes, the other bit will change accordingly.

[0040] Public information exchange: Alice and Bob will show the correct encoding of the bits in the measurement results and use the bits for subsequent key generation;

[0041] Error detection and random perturbations: Since qubit transmissions are subject to noise and interference, there is a probability of errors; Alice and Bob perform error detection and introduce random perturbations to protect the key.

[0042] Preferably, the polarization state of the light is represented as quantum bits |0> and |1> or a linear combination (α|0>+β|1>), and the quantum bits collapse to the ground state |0> or the excited state |1> when measured, and the probability of the measurement result is determined by the Born rule.

[0043] A computer information security processing system based on big data, characterized in that: the system includes a computer, a processor and a memory, the memory stores a computer program, and the processor is configured to execute the above-mentioned computer information security processing method based on big data through the computer program.

[0044] Compared with the prior art, the present invention has the following beneficial effects:

[0045] The present invention uses big data analysis technology to monitor system status and network activities in real time, detect and respond to malicious activities in a timely manner, identify abnormal behavior and potential threats, and use the core principles of quantum cryptography based on the irreversibility of quantum mechanics and the interference characteristics of measurement. This allows attackers to be detected when stealing keys or information. Once someone tries to eavesdrop on communications, the quantum state will collapse, so that anomalies can be detected quickly and responded to quickly. This high level of security can provide more reliable protection for communications and data transmission. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 The present invention is a flowchart of a computer information security processing method based on big data. DETAILED DESCRIPTION

[0047] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0048] Embodiment 1:

[0049] See also Figure 1 As shown, a computer information security processing method based on big data includes:

[0050] Threat detection and analysis: Using big data analysis technology, abnormal behaviors and potential threats can be identified from massive amounts of network traffic and log data. Based on behavioral analysis methods, unknown threats and attack patterns can be discovered.

[0051] Real-time monitoring: Use big data technology to monitor system status and network activities in real time, and detect and respond to malicious activities in a timely manner;

[0052] Quantum encryption: For data that needs to be encrypted, the encryption principle in quantum cryptography is used for encryption, and quantum key distribution is used to detect eavesdropping and interference, providing a secure communication method;

[0053] Quantum transmission: Using the principle of quantum communication, encrypted data is transmitted to the target location. The characteristics of quantum entanglement are used to ensure the security of the communication process. Once someone tries to eavesdrop on the communication, the quantum state will collapse, so that the anomaly can be quickly detected.

[0054] Reaction and response: When abnormal behavior is detected, the system takes appropriate reaction measures based on the severity and type of the analysis results, such as disconnecting, blocking IP, and locking accounts.

[0055] The big data analysis technology specifically includes:

[0056] Data collection and processing: collect big data related to the problem, including databases, tabular data, text, images, and audio data, remove noise, missing values, and outliers from the data, and transform and normalize the data for subsequent analysis;

[0057] Exploratory data analysis: analyzing the statistical characteristics, distribution, and correlation of data to gain a preliminary understanding of the data;

[0058] Model selection and training: Select a machine learning model, train the model using part of the data, and adjust the model parameters to make it better fit the data;

[0059] Model evaluation: Use another part of the data to evaluate the model performance. Common evaluation indicators include accuracy, precision, recall, and F1 score. Explain the model's prediction results and understand the model's contribution to the problem.

[0060] Result visualization: Use charts and images to visualize the analysis results to better convey the analysis results. Big data analysis can help detect specific patterns of threat behavior, such as malware propagation, phishing, etc. The system can monitor network traffic, file transfers, and user interactions to discover abnormal patterns. If a large number of computers or devices exhibit similar abnormal behaviors at the same time, the system can infer possible malicious attacks and take timely measures to block or isolate them.

[0061] Specifically, the behavior analysis is as follows:

[0062] Data preprocessing: Clean and preprocess user login data to handle missing values ​​and outliers;

[0063] Feature engineering: Extract features from login data, such as login time interval, login location changes, and commonly used devices. The feature formula is as follows:

[0064] Login time interval: login_time_interval = time_since_last_login

[0065] Login location changes:

[0066] location_change=count_distinct(locations) / total_logins

[0067] Frequent devices: frequent_device = device_frequency / total_logins

[0068] Establish a behavioral baseline: For each user, calculate the baseline of their normal behavior, that is, the typical behavioral characteristics over a period of time;

[0069] Anomaly detection model training: The model is trained using the Isolation Forest Anomaly Score algorithm to identify abnormal behaviors that do not match the behavioral baseline. The specific formula is as follows:

[0070]

[0071] Among them, E(h(x)) is the external path length, c(n) is the expected external path length, n is the total number of samples, and its anomaly score reflects the degree of sample outlier; by collecting and analyzing the user's behavior in the computer system, the normal behavior pattern of each user can be established. Once the user's behavior does not match the normal pattern, the system can issue an alarm to indicate possible intrusion or unauthorized activities. For example, if an employee usually only accesses a specific application during working hours and suddenly accesses sensitive data late at night, the system can mark this behavior as abnormal and take corresponding measures.

[0072] Specifically, accuracy: accuracy = (TP + TN) / (TP + TN + FP + FN)

[0073] Precision: precision = TP / (TP+FP)

[0074] Recall rate: recall = TP / (TP+FN)

[0075] F1 score: F1_score=2*(precision*recall) / (precision+recall).

[0076] Specifically, the quantum key distribution is as follows:

[0077] Key generation: Alice (sender) and Bob (receiver) use a set of quantum bits (usually photons) to generate a shared key;

[0078] Quantum bit transmission: Alice encodes a bit sequence using the polarization state of light and sends these qubits to Bob through a quantum channel;

[0079] Quantum bit reception: After receiving the quantum bits sent by Alice, Bob performs quantum measurement on each bit and obtains the measurement result;

[0080] In quantum communication, Alice (sender) and Bob (receiver) can create a pair of qubits represented as:

[0081] That is, the two quantum bits are in an entangled state. No matter how the state of one bit changes, the other bit will change accordingly.

[0082] Public information exchange: Alice and Bob will show the correct encoding of the bits in the measurement results and use the bits for subsequent key generation;

[0083] Error detection and random perturbations: Since qubit transmissions are subject to noise and interference, there is a probability of errors; Alice and Bob perform error detection and introduce random perturbations to protect the key.

[0084] The polarization state of the light is represented as quantum bits |0> and |1> or a linear combination (α|0>+β|1>). When measured, the quantum bits collapse to the ground state |0> or the excited state |1>, and the probability of the measurement result is determined by the Born rule.

[0085] From the above, we can see that big data analysis technology can be used to monitor system status and network activities in real time, detect and respond to malicious activities in a timely manner, identify abnormal behavior and potential threats, and use the core principles of quantum cryptography based on the irreversibility of quantum mechanics and the interference characteristics of measurement. This allows attackers to be detected when stealing keys or information. Once someone tries to eavesdrop on communications, the quantum state will collapse, so that anomalies can be detected quickly and responded to quickly. This high level of security can provide more reliable protection for communications and data transmission.

[0086] A computer information security processing system based on big data, characterized in that: the system includes a computer, a processor and a memory, the memory stores a computer program, and the processor is configured to execute the computer program to implement the above-mentioned computer information security processing method based on big data. Its beneficial effects are the same as the technical effects of an embodiment of a computer information security processing method based on big data, and will not be repeated here.

[0087] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A computer information security processing method based on big data, characterized in that: include: Threat detection and analysis: Using big data analysis technology, abnormal behaviors and potential threats can be identified from massive amounts of network traffic and log data. Based on behavioral analysis methods, unknown threats and attack patterns can be discovered. Real-time monitoring: Use big data technology to monitor system status and network activities in real time, and detect and respond to malicious activities in a timely manner; Quantum encryption: For data that needs to be encrypted, the encryption principle in quantum cryptography is used for encryption, and quantum key distribution is used to detect eavesdropping and interference, providing a secure communication method; Quantum transmission: Using the principle of quantum communication, encrypted data is transmitted to the target location. The characteristics of quantum entanglement are used to ensure the security of the communication process. Once someone tries to eavesdrop on the communication, the quantum state will collapse, so that the anomaly can be quickly detected. Reaction and response: When abnormal behavior is detected, the system takes appropriate reaction measures based on the severity and type of the analysis results, such as disconnecting, blocking IP, and locking accounts.

2. The computer information security processing method based on big data according to claim 1 is characterized by: The big data analysis technology specifically includes: Data collection and processing: collect big data related to the problem, including databases, tabular data, text, images, and audio data, remove noise, missing values, and outliers from the data, and transform and normalize the data for subsequent analysis; Exploratory data analysis: analyzing the statistical characteristics, distribution, and correlation of data to gain a preliminary understanding of the data; Model selection and training: Select a machine learning model, train the model using part of the data, and adjust the model parameters to make it better fit the data; Model evaluation: Use another part of the data to evaluate the model performance. Common evaluation indicators include accuracy, precision, recall, and F1 score. Explain the model's prediction results and understand the model's contribution to the problem. Result visualization: Use charts and images to visualize the analysis results to better communicate the analysis results.

3. The computer information security processing method based on big data according to claim 2 is characterized in that: The behavior-based analysis is as follows: Data preprocessing: Clean and preprocess user login data to handle missing values ​​and outliers; Feature engineering: Extract features from login data, such as login time interval, login location changes, and commonly used devices. The feature formula is as follows: Login time interval: login_time_interval = time_since_last_login Login location changes: location_change=count_distinct(locations) / total_logins Frequent devices: frequent_device = device_frequency / total_logins Establish a behavioral baseline: For each user, calculate the baseline of their normal behavior, that is, the typical behavioral characteristics over a period of time; Anomaly detection model training: The model is trained using the Isolation Forest Anomaly Score algorithm to identify abnormal behaviors that do not match the behavioral baseline. The specific formula is as follows: Among them, E(h(x)) is the external path length, c(n) is the expected external path length, n is the total number of samples, and its anomaly score reflects the degree of sample outlier.

4. The computer information security processing method based on big data according to claim 2 is characterized in that: The accuracy rate is: a=(TP+TN) / (TP+TN+FP+FN) Precision: p = TP / (TP+FP) Recall: r = TP / (TP+FN) F1 score: F1 = 2*(p*r) / (p+r).

5. The computer information security processing method based on big data according to claim 1 is characterized in that: The quantum key distribution is specifically as follows: Key generation: Alice (sender) and Bob (receiver) use a set of quantum bits (usually photons) to generate a shared key; Quantum bit transmission: Alice encodes a bit sequence using the polarization state of light and sends these qubits to Bob through a quantum channel; Quantum bit reception: After receiving the quantum bits sent by Alice, Bob performs quantum measurement on each bit and obtains the measurement result; Quantum entanglement: Two or more quantum bits are entangled, so that the state of one bit is affected by the state of another bit, specifically: In quantum communication, Alice (sender) and Bob (receiver) can create a pair of qubits represented as: That is, the two quantum bits are in an entangled state. No matter how the state of one bit changes, the other bit will change accordingly. Public information exchange: Alice and Bob will show the correct encoding of the bits in the measurement results and use the bits for subsequent key generation; Error detection and random perturbations: Since quantum bit transmission is affected by noise and interference, there is a probability of errors; Alice and Bob perform error detection and introduce random perturbations to protect the key.

6. A computer information security processing method based on big data according to claim 5, characterized in that: The polarization state of the light is represented as quantum bits |0> and |1> or a linear combination (α|0>+β|1>). When measured, the quantum bits collapse to the ground state |0> or the excited state |1>, and the probability of the measurement result is determined by the Born rule.

7. A computer information security processing system based on big data, characterized in that: The system includes a computer, a processor and a memory, wherein a computer program is stored in the memory, and the processor is configured to execute a computer information security processing method based on big data according to any one of claims 1 to 6 through the computer program.

Images