Network security protection method, device, equipment, medium and product

Abstract

The invention provides a network security protection method, device and equipment, a medium and a product, relates to the field of networks, and aims to realize efficient and practical network security protection. The method comprises the steps of collecting user historical data; filtering the historical data of the user by using a network security blacklist information base to obtain occurrence time of a network security event and network security event information; constructing a network security linear regression model based on the occurrence time of the network security event and the network security event information; based on the Poisson distribution model, the occurrence time of the network security events and the network security event information, and based on the number of the network security events occurring in each unit time and the average number of the network security events occurring in the unit time, determining a probability density value of the network security events occurring in the unit time; and based on the probability density value of the occurrence of the network security event in the unit time and the network security linear regression model, predicting the probability of the occurrence of the network security event in the next time period.

Description

Technical Field

[0001] The embodiments of the present invention relate to the network field, and in particular to a network security protection method, device, equipment, medium and product. Background Art

[0002] With the continuous development of Internet technology and its full integration into people's lives, misleading information about telephones, text messages and network security continues to increase, incidents affecting network security continue to run at a high level, and attackers' misleading methods are changing with each passing day and emerging in an endless stream, resulting in increasingly high-tech misleading technology, and a comprehensive escalation in the confrontation between misleading and anti-misleading. The situation of anti-misleading in telecommunications remains severe.

[0003] With the development of the times, the network environment has become more and more complex. Misleading websites, misleading calls, virus attacks and other bad information are rampant. Teenagers have poor self-control ability and the elderly have a relatively weak awareness of anti-misleading, making them easy targets of attackers. Therefore, the present invention urgently needs an efficient and practical network security protection method to protect the property safety of users. Summary of the invention

[0004] The embodiments of the present invention provide a network security protection method, apparatus, device, medium and product, which predict the probability of network security incidents occurring in the next time period by using a network security linear regression model and a Poisson distribution model constructed through user historical data, thereby achieving efficient and practical network security protection.

[0005] A first aspect of an embodiment of the present invention provides a network security protection method, the method comprising:

[0006] Collecting user historical data, wherein the user historical data includes network usage data of the user account within a historical time period;

[0007] Using the network security blacklist information database, filtering the user historical data to obtain the occurrence time and network security event information of the network security event;

[0008] Based on the occurrence time of the network security event and the network security event information, a network security linear regression model is constructed, wherein the network security linear regression model characterizes the linear relationship between the occurrence time of the network security event and the number of network security events;

[0009] Based on a Poisson distribution model, the historical time period is divided according to unit time, and based on the occurrence time of the network security event and the network security event information, the number of network security events occurring per unit time is counted to determine the average number of network security events occurring per unit time;

[0010] Determine a probability density value of a network security incident occurring within a unit time based on the number of network security incidents occurring per unit time and the average number of network security incidents occurring within a unit time;

[0011] Based on the probability density value of the network security incident occurring within a unit time and the network security linear regression model, the probability of the network security incident occurring within the next time period is predicted.

[0012] A second aspect of an embodiment of the present invention provides a network security protection device, the device comprising:

[0013] A data collection module is used to collect user historical data, wherein the user historical data includes network usage data of the user account within a historical time period;

[0014] A data filtering module, used to filter the user's historical data using a network security blacklist information base to obtain the occurrence time of a network security event and network security event information;

[0015] A regression model building module, used to build a network security linear regression model based on the occurrence time of the network security event and the network security event information, wherein the network security linear regression model characterizes the linear relationship between the occurrence time of the network security event and the number of network security events;

[0016] A time segmentation module, configured to segment the historical time period according to unit time based on a Poisson distribution model, and to count the number of network security events occurring per unit time based on the occurrence time of the network security event and the network security event information, so as to determine the average number of network security events occurring per unit time;

[0017] A probability density determination module, configured to determine a probability density value of a network security event occurring within a unit time based on the number of network security events occurring within each unit time and the average number of network security events occurring within the unit time;

[0018] The probability prediction module is used to predict the probability of a network security event occurring in the next time period based on the probability density value of the network security event occurring in the unit time and the network security linear regression model.

[0019] A third aspect of an embodiment of the present invention provides an electronic device, comprising: a memory, a processor, and a computer program stored in the memory and running on the processor, wherein when the computer program is executed by the processor, the network security protection method as in the first aspect of the embodiment of the present invention is implemented.

[0020] A fourth aspect of an embodiment of the present invention provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the network security protection method of the first aspect of the embodiment of the present invention is implemented.

[0021] A fifth aspect of an embodiment of the present invention provides a computer program product, including a computer program / instruction, which, when executed by a processor, implements the network security protection method of the first aspect of the embodiment of the present invention.

[0022] In the network security protection method provided by the embodiment of the present invention, the occurrence time of network security events and network security event information are screened out from the collected user historical data. While building a network security linear regression model based on the occurrence time of network security events and network security event information, the probability density value of network security events occurring within a unit time of a historical time period is determined based on the occurrence time of network security events and network security event information through a Poisson distribution model. Finally, based on the probability density value of network security events occurring within a unit time of a historical time period and the network security linear regression model, the probability of network security events occurring within the next time period is predicted. In this way, this embodiment uses comprehensive simulation and prediction of the network security linear regression model and the Poisson distribution model to make the predicted probability more accurate and achieve efficient and practical network security protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments of the present invention will be briefly introduced below. Obviously, the accompanying drawings in the following description are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative labor.

[0024] Figure 1 is a flow chart of a network security protection method shown in one embodiment of the present invention;

[0025] Figure 2 It is a schematic diagram of constructing a network security linear regression model proposed in one embodiment of the present invention;

[0026] Figure 3 It is a schematic diagram of a Poisson distribution calculation process shown in one embodiment of the present invention;

[0027] Figure 4 is a structural block diagram of a network security protection device provided by an embodiment of the present invention;

[0028] Figure 5 It is a schematic diagram of an electronic device shown in an embodiment of the present invention. DETAILED DESCRIPTION

[0029] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0030] refer to Figure 1 , Figure 1 FIG. 1 is a flow chart of a network security protection method according to an embodiment of the present invention. Figure 1 As shown, the network security protection method of this embodiment may include the following steps:

[0031] Step S11: Collecting user historical data, wherein the user historical data includes network usage data of the user account within a historical time period.

[0032] In this embodiment, user historical data may be collected, and the user historical data may include at least: network usage data of the user account in a historical time period. The historical time period is a period of the past cycle, such as the past day, the past year, the past six months, the past three months, etc. This embodiment does not limit the specific value of the historical time period.

[0033] In an optional example, the user accounts corresponding to the user history data are all user accounts, that is, all user accounts that use network communications (such as phone calls, Internet access, text messages, etc.). In another optional example, the user accounts corresponding to the user history data may be user accounts corresponding to user groups that are easily misled, such as user accounts corresponding to a certain elderly phone package, without limitation.

[0034] In an optional example, the network usage data may include: call data and / or Internet access data. The call data includes at least any one of the following: call duration, call recipient, and keywords of the call content; the Internet access data includes at least any one of the following: traffic volume, website category, and access duration.

[0035] Step S12: Use the network security blacklist information database to filter the user history data to obtain the occurrence time of the network security event and the network security event information.

[0036] In this embodiment, a network security blacklist information database is established in advance. For example, the network security blacklist information database can be constructed based on at least relevant data of the data center of the network information security center and network security related departments. The network security blacklist information database includes relevant information that causes network security incidents. For example, the network security blacklist information database includes at least any one of the following: malicious URL addresses, misleading phone numbers, malicious misleading bank account numbers, social account information commonly used by misleaders, specific misleading-related IP address ranges, and known misleading software feature codes.

[0037] This embodiment can use the network security blacklist information library to filter the collected user historical data to obtain the occurrence time and network security event information of the network security events in the user historical data. Wherein, the network security event is an event that affects network security, for example, the network security event may include: misleading events (such as answering / dialing misleading calls), network attack events (such as visiting misleading websites); network security event information is related information of network security events, for example, the network security event information may at least include the number of network security events, and the number of network security events represents the number of network security events that have occurred.

[0038] Step S13: Based on the occurrence time of the network security event and the network security event information, a network security linear regression model is constructed, wherein the network security linear regression model characterizes the linear relationship between the occurrence time of the network security event and the number of network security events.

[0039] In this embodiment, a linear regression model can be constructed based on the obtained occurrence time of the network security event and the network security event information to obtain a network security linear regression model. The network security linear regression model characterizes the linear relationship between the occurrence time of the network security event and the number of network security events. For example, in the network security linear regression model, the occurrence time t of the network security event is the independent variable, and the number n of the network security events is the dependent variable.

[0040] like Figure 2 As shown, Figure 2 FIG. 1 is a schematic diagram of constructing a network security linear regression model proposed in one embodiment of the present invention. Figure 2 In the network security linear regression model, we can analyze the collected user historical data (such as call records and Internet access data) according to the network security blacklist information database, take the occurrence time of network security events as the independent variable, and the number of network security events as the dependent variable, and build a network security linear regression model.

[0041] Step S14: Based on the Poisson distribution model, the historical time period is divided according to unit time, and based on the occurrence time of the network security event and the network security event information, the number of network security events occurring per unit time is counted to determine the average number of network security events occurring per unit time.

[0042] In this embodiment, the historical time period can be divided according to unit time based on the Poisson distribution model, and based on the occurrence time of the network security incidents and the network security incident information, the number of network security incidents occurring per unit time can be counted, and the average number of network security incidents occurring per unit time can be determined.

[0043] For example, the unit time may refer to one minute, a quarter of an hour, one hour, etc., without limitation. Taking every minute as an example, the historical time period may be segmented into one minute unit time based on the Poisson distribution model, and the number of network security events occurring in each minute may be obtained by counting (for example, the number of network security events occurring in the first minute, the number of network security events occurring in the second minute, the number of network security events occurring in the third minute, and so on), and then based on the number of network security events occurring in each minute, the average number of network security events occurring in one minute may be obtained (for example, the average number of network security events occurring in one minute may be obtained based on the number of network security events occurring in the first minute, the number of network security events occurring in the second minute, the number of network security events occurring in the third minute, and so on).

[0044] It should be noted that this embodiment does not limit the execution order between step S13 and step S14. For example, step S13 and step S14 may be executed simultaneously, step S13 may be executed first and then step S14, or step S14 may be executed first and then step S13.

[0045] Step S15: Based on the number of network security events occurring per unit time and the average number of network security events occurring per unit time, determine a probability density value of network security events occurring per unit time.

[0046] In this embodiment, based on the Poisson distribution model, the probability density value of network security incidents occurring in unit time can be calculated according to the obtained number of network security incidents occurring per unit time and the average number of network security incidents occurring in unit time.

[0047] like Figure 3 As shown, Figure 3 FIG. 1 is a schematic diagram of a Poisson distribution calculation process according to an embodiment of the present invention. Figure 3In the process, user historical data (including call records and Internet traffic) within the past year can be collected, and divided into time units of minutes, filtered and integrated into a big data model of user behavior; then based on the big data model and the network security blacklist information database, the user historical data is matched with the network security blacklist information database, and the call records and Internet records that are network security incidents are filtered out to generate a network security behavior time distribution model. Finally, based on the network security behavior time distribution model and the Poisson distribution model, the Poisson distribution probability is obtained, that is, the probability density value of network security incidents occurring in unit time.

[0048] Among them, the network security behavior time distribution model is mainly used to calculate the Poisson distribution probability based on the time series data of network security events in the past cycle. It can also analyze the periodicity of the occurrence time of network security events, such as the high frequency of network security events in certain time periods (such as the beginning of the month, weekend nights, etc.); it can also identify the concentration trend of the occurrence time of network security events and determine the time range of high incidence of network security events, so as to help relevant departments strengthen monitoring and prevention measures in these high-risk periods, reasonably allocate network security protection resources, optimize network security protection strategies, and improve the overall network security protection efficiency.

[0049] Step S16: Based on the probability density value of the network security incident occurring within a unit time and the network security linear regression model, the probability of the network security incident occurring within the next time period is predicted.

[0050] In this embodiment, after obtaining the probability density value of network security incidents occurring within unit time output by the Poisson distribution model, the probability of network security incidents occurring within unit time can be predicted based on the probability density value of network security incidents occurring within unit time and the constructed network security linear regression model.

[0051] In this embodiment, the occurrence time of network security events and network security event information are screened out from the collected user historical data. While building a network security linear regression model based on the occurrence time of network security events and network security event information, the probability density value of network security events occurring within a unit time of the historical time period is determined based on the occurrence time of network security events and network security event information through a Poisson distribution model. Finally, based on the probability density value of network security events occurring within a unit time of the historical time period and the network security linear regression model, the probability of network security events occurring within the next time period is predicted. In this way, this embodiment uses comprehensive simulation and prediction of the network security linear regression model and the Poisson distribution model to make the predicted probability more accurate and achieve efficient and practical network security protection.

[0052] In combination with the above embodiments, in one implementation, the present invention also provides a network security protection method. Specifically, in this embodiment, the above step S15 may include step S21:

[0053] Step S21: According to the Poisson distribution formula, based on the number of network security events occurring per unit time and the average number of network security events occurring per unit time, a probability density value P of network security events occurring per unit time is obtained.

[0054] In this embodiment, the Poisson distribution model can be used to calculate the probability density value P of network security incidents occurring in unit time based on the number of network security incidents occurring per unit time and the average number of network security incidents occurring in unit time according to the Poisson distribution formula.

[0055] The Poisson distribution formula of this embodiment includes:

[0056] Among them, k represents the number of network security incidents occurring per unit time, λ represents the average number of network security incidents occurring per unit time, and e is the base of the natural logarithm, such as:

[0057]

[0058] In combination with the above embodiments, in one implementation, the present invention further provides a network security protection method. Specifically, in this embodiment, the above step S16 may further include:

[0059] The probability density value of network security incidents occurring in unit time is introduced as an important characteristic variable into the network security linear regression model. In the network security linear regression model, the variable relationship established based on user historical data is combined with the multivariate linear regression algorithm to calculate the probability of network security incidents occurring in the next time period. Among them, the variable relationship of the network security linear regression model is: the linear relationship between the occurrence time of network security incidents and the number of network security incidents.

[0060] The network security linear regression model can obtain the transformation relationship between the probability density value of network security incidents occurring in unit time and the number of network security incidents based on the input probability density value of network security incidents occurring in unit time and user historical data, and then based on the transformation relationship, and the linear relationship between the occurrence time of network security incidents and the number of network security incidents, finally output the predicted probability of network security incidents occurring in the next time period. For example, specifically, it can be the predicted probability of network security incidents occurring in unit time in the next time period.

[0061] In combination with the above embodiments, in one implementation, an embodiment of the present invention further provides a network security protection method. Specifically, in addition to the above steps, the method may also include steps S31 to S32:

[0062] Step S31: Determine whether the probability of a network security incident occurring within the next time period exceeds a security threshold.

[0063] In this embodiment, a security threshold is set in advance, and it can be determined whether the predicted probability of a network security incident occurring in the next time period exceeds the security threshold.

[0064] Step S32: When the probability of a network security incident occurring in the next time period exceeds the security threshold, an early warning is issued to the target user account.

[0065] In this embodiment, when it is determined that the probability of a network security incident occurring in the next time period exceeds a set security threshold, it is necessary to issue an early warning to the target user account, wherein the target user account is the user account that needs an early warning.

[0066] In an optional embodiment, the security threshold can be determined based on the historical probability of network security incidents provided by the data center of the network information security center and the network security related department. Further, the security threshold can be the average value of the historical probability of network security incidents provided by the data center of the network information security center and the network security related department. For example, the actual probability data of network security incidents encountered by all users in the past period of time (for example, the past year) are collected, these actual probability data are summed, and then divided by the total number of these actual probability data, and the result obtained is the average value of the historical probability of network security incidents.

[0067] In one embodiment, the methods of issuing warnings include, but are not limited to: SMS notifications, official APP push notifications from operators, voice phone prompts, and other channels.

[0068] In combination with the above embodiments, in another implementation, the present invention also provides a network security protection method. Specifically, in this embodiment, in addition to the above steps, steps S41 to S44 may also be included:

[0069] Step S41: Obtain user account information, wherein the user account information includes at least one of the following: user account type and user package information.

[0070] In this embodiment, user account information may be obtained, and the user account information includes at least one of the following: user account type and user package information.

[0071] Step S42: Determine a first user account based on the user account information, where the first user account includes: a youth user account and / or an elderly user account.

[0072] In this embodiment, a first user account can be determined based on the acquired user account information. The first user account is a user account that is easily misled to cause a network security incident. The first user account includes: a youth user account and / or an elderly user account.

[0073] Step S43: Based on the first user account, determine a second user account corresponding to the first user account, the second user account including: a parent user account corresponding to the youth user account and / or a child user account corresponding to the elderly user account.

[0074] In this embodiment, based on the first user account, a second user account corresponding to the first user account can be determined, wherein the second user account is a supervisory user account corresponding to the first user account, and the second user account includes: a parent user account corresponding to the youth user account and / or a child user account corresponding to the elderly user account.

[0075] Step S44: Determine the first user account and / or the second user account as the target user account.

[0076] In this embodiment, the first user account and / or the second user account may be determined as a target user account for which an early warning is required.

[0077] The application scenario of this embodiment can be applied to the public users, and provide network security protection for users who subscribe to network security protection. It has good practicality, can give full play to the advantages of network security, can export network security protection capabilities to the outside world, and provide external services after further productization, such as misleading and attacking the elderly and teenagers to access the green Internet, supporting telecommunications anti-misleading and anti-attack, and early warning to notify children or parents to pay attention to protection, etc.

[0078] In combination with the above embodiments, in another implementation, the present invention also provides a network security protection method. In this embodiment, in addition to the above steps, it can also include steps S51 to S52:

[0079] Step S51: Determine the behavior risk level of the user account based at least on the historical risk level of the user account, the user account type, and the user's network behavior characteristics.

[0080] In this embodiment, a comprehensive judgment can be made based on factors such as the user's historical risk level, user account type (such as elderly users, teenage users, ordinary adult users, etc.), recent Internet access and call behavior characteristics (such as whether high-risk websites are frequently visited, whether there has been contact with suspected misleading numbers, etc.), etc., to screen out high-risk user accounts for accurate early warning, so as to improve the pertinence and effectiveness of the early warning and avoid unnecessary interference with low-risk users.

[0081] Specifically, the behavioral risk level of the user account may be determined based on at least the historical risk level of the user account, the user account type, and the user's network behavior characteristics (such as the behavior characteristics of surfing the Internet and / or making calls in a recent period of time).

[0082] Step S52: Determine the user account whose behavior risk level exceeds the level threshold as the target user account, and the level threshold is the highest level of behavior safety represented by the behavior risk level.

[0083] In this embodiment, the obtained behavior risk level of the user account is compared with the level threshold, and the user account whose behavior risk level exceeds the level threshold is determined as the target user account for early warning, wherein the level threshold of this embodiment is the highest level of behavior safety represented by the behavior risk level. If the behavior risk level exceeds the level threshold, the user account is characterized as a high-risk user account, which is very susceptible to misleading and network attacks.

[0084] In combination with the above embodiments, in one implementation, an embodiment of the present invention further provides a network security protection method. Specifically, in addition to the above steps, the method may also include steps S61 to S63:

[0085] Step S61: when the probability of a network security incident occurring in the next time period exceeds the security threshold, determining a target access address corresponding to a web page request initiated by a user in the next time period.

[0086] In this embodiment, when it is determined that the probability of a network security incident occurring within the next time period exceeds a security threshold, the target access address corresponding to the web page request initiated by the user received within the next time period can be determined before the device of the user account establishes a connection with the target access address.

[0087] Step S62: Determine whether the target access address is a website in the network security blacklist information database.

[0088] In this embodiment, the website included in the network security blacklist information library is a malicious website. At this time, it is determined whether the target access address matches the website in the network security blacklist information library, that is, whether it is a website in the network security blacklist information library.

[0089] Step S63: When the target access address is a website in the network security blacklist information database, intercept the web page request and stop connecting to the target access address.

[0090] In this embodiment, when the target access address is a URL in the network security blacklist information library, the target access address is determined to be a high-risk address. At this time, the web page request corresponding to the target access address is immediately intercepted, and the connection to the target access address is stopped to achieve real-time automatic interception, thereby meeting the real-time network security monitoring protection and early warning protection of the user network.

[0091] In summary, the embodiment of the present invention discloses a network security protection method based on Poisson distribution to protect network security incidents occurring in telecommunication networks. The method collects user historical data (such as historical call data and historical online traffic data) to construct relevant linear regression models and Poisson distribution models, which can judge misleading information in real time, and can also comprehensively simulate and calculate the probability of network security incidents occurring in the next unit time, and warn users in advance that there may be network attacks or misleadings in the future unit time, thereby protecting the property safety of users. The embodiment of the present invention analyzes user historical data in multiple dimensions, and uses linear and Poisson distribution comprehensive simulation prediction to make probability judgment more accurate.

[0092] It should be noted that, for the sake of simplicity, the method embodiments are described as a series of action combinations, but those skilled in the art should be aware that the embodiments of the present invention are not limited by the order of the actions described, because according to the embodiments of the present invention, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present invention.

[0093] Based on the same inventive concept, an embodiment of the present invention provides a network security protection device. Figure 4 , Figure 4 FIG. 1 is a structural block diagram of a network security protection device provided by an embodiment of the present invention. Figure 4 As shown, the network security protection device includes:

[0094] A data collection module is used to collect user historical data, wherein the user historical data includes network usage data of the user account within a historical time period;

[0095] A data filtering module, used to filter the user's historical data using a network security blacklist information base to obtain the occurrence time of a network security event and network security event information;

[0096] A regression model building module, used to build a network security linear regression model based on the occurrence time of the network security event and the network security event information, wherein the network security linear regression model characterizes the linear relationship between the occurrence time of the network security event and the number of network security events;

[0097] A time segmentation module, configured to segment the historical time period according to unit time based on a Poisson distribution model, and to count the number of network security events occurring per unit time based on the occurrence time of the network security event and the network security event information, so as to determine the average number of network security events occurring per unit time;

[0098] A probability density determination module, configured to determine a probability density value of a network security event occurring within a unit time based on the number of network security events occurring within each unit time and the average number of network security events occurring within the unit time;

[0099] The probability prediction module is used to predict the probability of a network security event occurring in the next time period based on the probability density value of the network security event occurring in the unit time and the network security linear regression model.

[0100] Optionally, the probability density determination module includes:

[0101] A probability density determination submodule, configured to obtain a probability density value P of a network security event occurring within a unit time based on the number of network security events occurring within each unit time and the average number of network security events occurring within the unit time according to a Poisson distribution formula;

[0102] The Poisson distribution formula includes:

[0103] Among them, k represents the number of network security incidents occurring per unit time, λ represents the average number of network security incidents occurring per unit time, and e is the base of the natural logarithm.

[0104] Optionally, the device further comprises:

[0105] A first determination module, used to determine whether the probability of a network security incident occurring within the next time period exceeds a security threshold;

[0106] The early warning module is used to issue an early warning to the target user account when the probability of a network security incident occurring in the next time period exceeds the security threshold.

[0107] Optionally, the device further comprises:

[0108] A first acquisition module is used to acquire user account information, wherein the user account information includes at least one of the following: user account type and user package information;

[0109] A second determination module is used to determine a first user account according to the user account information, wherein the first user account includes: a youth user account and / or an elderly user account;

[0110] A third determination module is used to determine, based on the first user account, a second user account corresponding to the first user account, the second user account including: a parent user account corresponding to the youth user account and / or a child user account corresponding to the elderly user account;

[0111] The fourth determination module is used to determine the first user account and / or the second user account as the target user account.

[0112] Optionally, the device further comprises:

[0113] A level determination module, used to determine the behavior risk level of the user account based on at least the historical risk level of the user account, the user account type, and the user's network behavior characteristics;

[0114] A fifth determination module is configured to determine a user account whose behavior risk level exceeds a level threshold as the target user account, wherein the level threshold is a highest level of behavior safety represented by the behavior risk level.

[0115] Optionally, the device further comprises:

[0116] a sixth determination module, configured to determine, for a web page request initiated by a user within the next time period, a target access address corresponding to the web page request when the probability of a network security incident occurring within the next time period exceeds the security threshold;

[0117] A judgment module, used to judge whether the target access address is a website in the network security blacklist information database;

[0118] The interception module is used to intercept the web page request and stop connecting to the target access address when the target access address is a website in the network security blacklist information library.

[0119] Based on the same inventive concept, another embodiment of the present invention provides an electronic device, such as Figure 5 shown. Figure 5 The electronic device includes a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements the steps of the network security protection method described in any of the above embodiments of the present invention when executing the computer program.

[0120] Based on the same inventive concept, another embodiment of the present invention provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps in the network security protection method described in any of the above embodiments of the present invention are implemented.

[0121] Based on the same inventive concept, another embodiment of the present invention provides a computer program product, including a computer program / instruction, which, when executed by a processor, implements the steps of the network security protection method described in any of the above embodiments of the present invention.

[0122] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0123] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0124] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, devices, or computer program products. Therefore, embodiments of the present invention may take the form of complete hardware embodiments, complete software embodiments, or embodiments combining software and hardware. Furthermore, embodiments of the present invention may take the form of computer program products implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0125] The embodiments of the present invention are described with reference to the flowcharts and / or block diagrams of the methods, terminal devices (systems), and computer program products according to the embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0126] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0127] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable terminal device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0128] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present invention.

[0129] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the elements.

[0130] The network security protection method, device, equipment, medium and product provided by the present invention are introduced in detail above. The principle and implementation mode of the present invention are explained in detail by using specific examples. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. At the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation mode and application scope. In summary, the content of this specification should not be understood as limiting the present invention.

Claims

1. A network security protection method, characterized in that: The method comprises: Collecting user historical data, wherein the user historical data includes network usage data of the user account within a historical time period; Using the network security blacklist information database, filtering the user historical data to obtain the occurrence time and network security event information of the network security event; Based on the occurrence time of the network security event and the network security event information, a network security linear regression model is constructed, wherein the network security linear regression model characterizes the linear relationship between the occurrence time of the network security event and the number of network security events; Based on a Poisson distribution model, the historical time period is divided according to unit time, and based on the occurrence time of the network security event and the network security event information, the number of network security events occurring per unit time is counted to determine the average number of network security events occurring per unit time; Determine a probability density value of a network security incident occurring within a unit time based on the number of network security incidents occurring per unit time and the average number of network security incidents occurring within a unit time; Based on the probability density value of the network security incident occurring within a unit time and the network security linear regression model, the probability of the network security incident occurring within the next time period is predicted.

2. The network security protection method according to claim 1, characterized in that: Determining a probability density value of a network security event occurring within a unit time based on the number of network security events occurring within each unit time and the average number of network security events occurring within the unit time includes: According to the Poisson distribution formula, based on the number of network security events occurring per unit time and the average number of network security events occurring per unit time, a probability density value P of network security events occurring per unit time is obtained; The Poisson distribution formula includes: Among them, k represents the number of network security incidents occurring per unit time, λ represents the average number of network security incidents occurring per unit time, and e is the base of the natural logarithm.

3. The network security protection method according to claim 1 or 2, characterized in that: The method further comprises: Determining whether the probability of a network security incident occurring within the next time period exceeds a security threshold; When the probability of a network security incident occurring within the next time period exceeds the security threshold, an early warning is issued to the target user account.

4. The network security protection method according to claim 3, characterized in that: The method further comprises: Obtaining user account information, wherein the user account information includes at least one of the following: user account type and user package information; Determine a first user account according to the user account information, wherein the first user account includes: a youth user account and / or an elderly user account; Based on the first user account, determining a second user account corresponding to the first user account, the second user account including: a parent user account corresponding to the youth user account and / or a child user account corresponding to the elderly user account; The first user account and / or the second user account are determined as the target user account.

5. The network security protection method according to claim 3, characterized in that: The method further comprises: Determine the behavioral risk level of the user account based on at least the historical risk level of the user account, the user account type, and the user's network behavior characteristics; A user account whose behavior risk level exceeds a level threshold is determined as the target user account, and the level threshold is the highest level of behavior safety represented by the behavior risk level.

6. The network security protection method according to claim 3, characterized in that: The method further comprises: When the probability of a network security incident occurring within the next time period exceeds the security threshold, determining a target access address corresponding to a web page request initiated by a user within the next time period; Determine whether the target access address is a website in the network security blacklist information database; In the case where the target access address is a website in the network security blacklist information library, the web page request is intercepted and the connection to the target access address is stopped.

7. A network security protection device, characterized in that: The device comprises: A data collection module is used to collect user historical data, wherein the user historical data includes network usage data of the user account within a historical time period; A data filtering module, used to filter the user's historical data using a network security blacklist information base to obtain the occurrence time of a network security event and network security event information; A regression model building module, used to build a network security linear regression model based on the occurrence time of the network security event and the network security event information, wherein the network security linear regression model characterizes the linear relationship between the occurrence time of the network security event and the number of network security events; A time segmentation module, configured to segment the historical time period according to unit time based on a Poisson distribution model, and to count the number of network security events occurring per unit time based on the occurrence time of the network security event and the network security event information, so as to determine the average number of network security events occurring per unit time; A probability density determination module, configured to determine a probability density value of a network security event occurring within a unit time based on the number of network security events occurring within each unit time and the average number of network security events occurring within the unit time; The probability prediction module is used to predict the probability of a network security event occurring in the next time period based on the probability density value of the network security event occurring in the unit time and the network security linear regression model.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the computer program is executed by the processor, the network security protection method according to any one of claims 1 to 6 is implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the network security protection method according to any one of claims 1 to 6 is implemented.

10. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instruction is executed by a processor, the network security protection method described in any one of claims 1 to 6 is implemented.

Images