Computer network security protection method and system
By receiving user access requests in the computer network security protection system, performing multi-factor authentication, virus detection and vulnerability analysis, combining abnormal behavior recognition models, network security protection strategies are generated, and problems of low detection efficiency and high false alarm rate in the existing technology are solved, and efficient network security protection is achieved.
Patent Information
- Application Number
- CN202411903337.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-23
- Publication Date
- 2025-03-28
- Estimated Expiration
- Not applicable · inactive patent
AI Technical Summary
When facing complex and changing network attacks, existing computer network security protection methods have low detection efficiency and high false alarm rate, which cannot effectively prevent network attacks and data leakage, especially in big data environments.
By receiving access requests from the target user, the multi-user authentication mechanism is activated, virus detection and vulnerability analysis is performed on the original backup data, network security protection policies are generated, user network interaction indicators are dynamically adjusted, abnormal behavior recognition models are established, and virus detection results, vulnerability repair policies and user access security levels are comprehensively considered to generate network security protection policies.
It significantly improves the security of computer systems, can monitor and detect network threats in real time, quickly generate and execute security defense policies, effectively respond to various network attacks, ensure the security and integrity of data, and reduce data losses caused by network attacks or system failures.
Smart Images
Figure CN119728244A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of computer network security, and in particular to a computer network security protection method and system. Background Art
[0002] With the rapid development of information technology, computer networks have become an indispensable part. However, the risks of network attacks and data leakage have also increased, and network security issues have become increasingly prominent.
[0003] Existing security protection methods usually rely on traditional firewalls, intrusion detection systems and other means, but these methods often have problems when facing complex and changeable network attacks. Especially in the big data environment, traditional security protection methods have problems such as low detection efficiency and high false alarm rate, and cannot effectively prevent network attacks and data leakage.
[0004] Therefore, it is necessary to provide a computer network security protection method and system to solve the above technical problems. Summary of the invention
[0005] In order to solve the above technical problems, the present invention provides a computer network security protection method and system for solving the problems that existing security protection methods usually rely on traditional firewalls and intrusion detection systems, but these methods often have problems when facing complex and changeable network attacks. Especially in the big data environment, traditional security protection methods have the problems of low detection efficiency and high false alarm rate, and cannot effectively prevent network attacks and data leakage. The present invention provides a computer network security protection method, the protection method comprising: Receiving a target access request from a target user terminal, and starting a multiple user identity authentication mechanism to authenticate the target user terminal; If the identity authentication of the target user terminal is passed, the original backup data is determined according to the preset data backup strategy, a backup operation is performed to generate corresponding target backup data, and the target backup data is transmitted to the data backup storage device; Based on the network virus feature library, a network virus detection mechanism is started to identify network viruses on the original backup data, and a corresponding network virus detection result is generated; Performing a primary extraction process on the original backup data to generate corresponding network vulnerability features, performing a secondary sorting process on the network vulnerability features to determine a corresponding vulnerability repair sequence, and generating a corresponding network vulnerability repair strategy according to the vulnerability repair sequence; Determine and adjust the indicator weight of the user network interaction indicator corresponding to the original backup data, generate the corresponding update indicator weight, obtain the target user behavior data of the target user terminal and establish the corresponding abnormal behavior recognition model, and determine the user access security level corresponding to the target user terminal based on the update indicator weight and the abnormal behavior recognition model; Based on the network virus detection results, network vulnerability repair strategies and user access security levels, a corresponding network security protection strategy is generated.
[0006] Preferably, the receiving of the target access request from the target user terminal and starting a multiple user identity authentication mechanism to authenticate the target user terminal specifically includes: Receiving a target access request from the target user terminal and initiating the multiple user identity authentication mechanism; Collecting target fingerprint data of the target user terminal through a fingerprint sensor, and performing a comparison process on the target fingerprint data and preset fingerprint data; If the fingerprint verification of the target user terminal is passed, the facial image data of the target user terminal is obtained through the facial acquisition device, and the facial image data is compared with the preset facial data for a second time; If the face verification of the target user terminal is passed, the access password input by the target user terminal is obtained and compared with the preset storage password three times; If the password verification of the target user terminal passes, the identity verification of the target user terminal passes, and the target access request of the target user terminal is accepted; otherwise, the target access request of the target user terminal is rejected.
[0007] Preferably, the step of collecting the target fingerprint data of the target user terminal by means of a fingerprint sensor and performing a comparison process on the target fingerprint data and preset fingerprint data specifically includes: Collecting target fingerprint data of the target user terminal through the fingerprint sensor; The preset fingerprint data is obtained, and fingerprint features of the target fingerprint data and the preset fingerprint data are respectively extracted to generate corresponding target fingerprint features and preset fingerprint features, and the similarity between the target fingerprint features and the preset fingerprint features is calculated to complete a comparison process between the target fingerprint data and the preset fingerprint data. The corresponding calculation formula is as follows: In the formula, Indicates the similarity between the target fingerprint feature and the preset fingerprint feature; Indicates the total dimension corresponding to the target fingerprint feature and the preset fingerprint feature; Indicates the target fingerprint feature in The value of the dimension; Indicates that the preset fingerprint feature is The value on each dimension; ∑ represents the summation symbol; If the fingerprint verification of the target user terminal is passed, the facial image data of the target user terminal is obtained through a facial acquisition device, and the facial image data is compared with the preset facial data for a second time, which specifically includes: If the fingerprint verification of the target user terminal is passed, the facial image data of the target user terminal is obtained through the facial acquisition device; The preset facial data is obtained, facial features of the facial image data and the preset facial data are respectively extracted to generate corresponding facial image features and preset facial features, the similarity between the facial image features and the preset facial features is calculated, and a secondary comparison process of the facial image data and the preset facial data is completed. The corresponding calculation formula is as follows: In the formula, Indicates the similarity between facial image features and preset facial features; Represents facial image features; Indicates preset facial features; Represents the dot product of facial image features and preset facial features; Represents the length of facial image features; Indicates the length of the preset facial features.
[0008] Preferably, the starting of a network virus detection mechanism to identify network viruses on the original backup data based on a network virus feature library to generate corresponding network virus detection results specifically includes: Performing a parsing operation on the original backup data to generate a corresponding original backup data packet; Based on the network virus feature library, the network virus detection mechanism is started to identify the network virus of the original backup data packet, and the corresponding network virus detection result is generated; When a network virus is identified in the original backup data packet, a clearing operation is performed on the network virus, and the virus name and infection location corresponding to the network virus are recorded and stored.
[0009] Preferably, the extracting process is performed once on the original backup data to generate corresponding network vulnerability features, and the network vulnerability features are sorted twice to determine corresponding vulnerability repair sequences, and the corresponding network vulnerability repair strategies are generated according to the vulnerability repair sequences, specifically including: Performing feature screening and extraction on the original backup data to generate corresponding network vulnerability features; Feature classification is performed on the network vulnerability features, and based on the feature classification results, the network vulnerability features are sorted from greatest to least according to the threat levels of the network vulnerability features, to determine a vulnerability repair sequence corresponding to the network vulnerability features; Generate the corresponding network vulnerability repair strategy according to the vulnerability repair sequence, and perform corresponding vulnerability repair operations.
[0010] Preferably, the feature screening and extraction of the original backup data to generate the corresponding network vulnerability features specifically includes: The original backup data includes sub-original backup data, and each of the sub-original backup data includes Individual original backup features; The mean value corresponding to the sub-original backup data is calculated as follows: In the formula, Represents the mean value of the sub-original backup data; Indicates the number of sub-original backup data in the original backup data; Indicates the number of The original backup data of each sub-item; ∑ represents the summation symbol; The original backup data is centrally processed as follows: In the formula, Represents the original backup data after centralized processing; Indicates the original backup data; Indicates the mean value corresponding to the sub-original backup data; The covariance matrix corresponding to the original backup data is calculated as follows: In the formula, Represents the covariance matrix corresponding to the original backup data; Indicates the number of sub-original backup data in the original backup data; Represents the transposition of the original backup data after centralized processing; Represents the original backup data after centralized processing; Perform eigenvalue decomposition on the covariance matrix corresponding to the original backup data to obtain the eigenvalue , and the corresponding eigenvector ; Before selection The eigenvectors corresponding to the eigenvalues are used as principal components to generate the projection matrix corresponding to the original backup data. , and project the original backup data to the front The corresponding network vulnerability features are generated in the subspace composed of feature vectors. The corresponding calculation formula is as follows: In the formula, Indicates network vulnerability characteristics; Represents the original backup data after centralized processing; Represents the projection matrix corresponding to the original backup data.
[0011] Preferably, the feature classification of the network vulnerability features, and sorting the network vulnerability features from large to small according to the threat levels of the network vulnerability features based on the feature classification results, and determining the vulnerability repair sequence corresponding to the network vulnerability features specifically includes: When classifying the network vulnerability features, the corresponding optimization problem is as follows: In the formula, Indicates The weight vector of the support vector machine is used to determine the direction of the classification hyperplane; Indicates The bias term of the support vector machine is used to determine the distance between the classification hyperplane and the origin; Indicates The network vulnerability characteristics are Slack variables when linearly inseparable in a support vector machine; represents the regularization parameter, which is used to control the trade-off between classification interval and classification error; Indicates the total number of network vulnerability features; Indicates the minimum value operation; ∑ indicates the summation symbol; The constraints corresponding to the optimization problem are: In the formula, Indicates Feature category labels corresponding to network vulnerability features; Indicates Network vulnerability characteristics; Indicates The weight vector of the support vector machine is used to determine the direction of the classification hyperplane; Indicates The bias term of the support vector machine is used to determine the distance between the classification hyperplane and the origin; Indicates The network vulnerability characteristics are Slack variables when linearly inseparable in a support vector machine; Indicates the total number of network vulnerability features; Based on the feature classification results of the network vulnerability features, the network vulnerability features are sorted from large to small according to the threat levels of the network vulnerability features, and a vulnerability repair sequence corresponding to the network vulnerability features is determined.
[0012] Preferably, the determining and adjusting the indicator weight of the user network interaction indicator corresponding to the original backup data, generating the corresponding update indicator weight, obtaining the target user behavior data of the target user terminal and establishing the corresponding abnormal behavior recognition model, and determining the user access security level corresponding to the target user terminal based on the update indicator weight and the abnormal behavior recognition model, specifically includes: Determine and adjust the index weight of the user network interaction index corresponding to the original backup data, and generate the corresponding update index weight. The calculation formula of the update index weight is as follows: In the formula, Indicates Update indicator weights; represents the indicator weight adjustment function; Indicates the original backup data; Indicates The weight of each indicator; The target user behavior data of the target user terminal is obtained and a corresponding abnormal behavior recognition model is established to identify and predict the abnormal behavior probability of the target user terminal. The corresponding calculation formula is as follows: In the formula, Indicates the probability of abnormal behavior of the target user end; Indicates the target user behavior data of the target user end; represents the number of Gaussian components; Indicates The mixing coefficient of the Gaussian components; Indicates The probability density of Gaussian components; ∑ represents the summation symbol; The user access security level corresponding to the target user terminal is determined based on the update index weight and the abnormal behavior recognition model. The corresponding calculation formula is as follows: In the formula, Indicates the user access security level corresponding to the target user end; Indicates the number of updated indicator weights; Indicates Update indicator weights; represents the probability of abnormal behavior of the target user end; ∑ represents the summation symbol.
[0013] A computer network security protection system, the protection system comprising: An identity authentication module, used for receiving a target access request from a target user terminal and starting a multiple user identity authentication mechanism to authenticate the target user terminal; A data backup module, for determining the original backup data according to a preset data backup strategy and performing a backup operation to generate corresponding target backup data if the identity authentication of the target user terminal is passed, and transmitting the target backup data to a data backup storage device; A virus detection module, used to start a network virus detection mechanism to identify network viruses on the original backup data based on a network virus feature library, and generate corresponding network virus detection results; A vulnerability repair module is used to perform a primary extraction process on the original backup data to generate corresponding network vulnerability features, perform a secondary sorting process on the network vulnerability features to determine a corresponding vulnerability repair sequence, and generate a corresponding network vulnerability repair strategy according to the vulnerability repair sequence; An access security module, used to determine and adjust the index weight of the user network interaction index corresponding to the original backup data, generate a corresponding update index weight, obtain the target user behavior data of the target user terminal and establish a corresponding abnormal behavior recognition model, and determine the user access security level corresponding to the target user terminal based on the update index weight and the abnormal behavior recognition model; The security protection module is used to generate a corresponding network security protection strategy based on the network virus detection results, network vulnerability repair strategy and user access security level.
[0014] Compared with the related art, the computer network security protection method and system provided by the present invention have the following beneficial effects: The present invention receives a target access request from a target user terminal, starts a multi-user identity authentication mechanism to authenticate the target user terminal; if the identity authentication of the target user terminal is passed, the original backup data is determined according to a preset data backup strategy, and a backup operation is performed to generate corresponding target backup data, and the target backup data is transmitted to a data backup storage device; based on a network virus feature library, a network virus detection mechanism is started to identify network viruses on the original backup data, and a corresponding network virus detection result is generated; an extraction process is performed on the original backup data to generate corresponding network vulnerability features, and a secondary sorting process is performed on the network vulnerability features to determine a corresponding vulnerability repair sequence, and a corresponding network vulnerability repair strategy is generated according to the vulnerability repair sequence; an indicator weight of a user network interaction indicator corresponding to the original backup data is determined and adjusted, and a corresponding update indicator weight is generated, the target user behavior data of the target user terminal is obtained and a corresponding abnormal behavior recognition model is established, and the user access security level corresponding to the target user terminal is determined based on the update indicator weight and the abnormal behavior recognition model; based on the network virus detection result, the network vulnerability repair strategy and the user access security level, a corresponding network security protection strategy is generated. The present invention can significantly improve the security of computer systems through measures such as multiple identity authentication, data backup, network virus detection, vulnerability detection and repair, security level determination, and protection strategy formulation; and the system of the present invention can monitor and detect network threats in real time, and quickly generate and execute corresponding security defense strategies, thereby effectively responding to various network attacks; the present invention can ensure the security and integrity of data through data backup and recovery mechanisms, and reduce data losses caused by network attacks or system failures; the system of the present invention provides an intuitive and easy-to-use interface and operation method, allowing users to easily manage and configure network security settings. BRIEF DESCRIPTION OF THE DRAWINGS
[0015] Figure 1 A flowchart of a computer network security protection method of the present invention; Figure 2 A flowchart of a multi-user identity authentication mechanism of the present invention; Figure 3 The present invention is a system block diagram of a computer network security protection system. DETAILED DESCRIPTION
[0016] The present invention will be further described below in conjunction with the accompanying drawings and implementation modes.
[0017] Embodiment 1 like Figure 1 A computer network security protection method is shown, the protection method comprising: S1, receiving a target access request from a target user terminal, and starting a multiple user identity authentication mechanism to authenticate the target user terminal; S2, if the identity authentication of the target user terminal is passed, determining the original backup data according to the preset data backup strategy and performing a backup operation to generate corresponding target backup data, and transmitting the target backup data to the data backup storage device; S3, based on the network virus feature library, starting the network virus detection mechanism to identify the network virus on the original backup data, and generating a corresponding network virus detection result; S4, performing a primary extraction process on the original backup data to generate corresponding network vulnerability features, performing a secondary sorting process on the network vulnerability features to determine a corresponding vulnerability repair sequence, and generating a corresponding network vulnerability repair strategy according to the vulnerability repair sequence; S5, determining and adjusting the indicator weight of the user network interaction indicator corresponding to the original backup data, generating a corresponding update indicator weight, obtaining the target user behavior data of the target user terminal and establishing a corresponding abnormal behavior recognition model, and determining the user access security level corresponding to the target user terminal based on the update indicator weight and the abnormal behavior recognition model; S6, generating a corresponding network security protection strategy based on the network virus detection result, network vulnerability repair strategy and user access security level.
[0018] Among them, first of all, it can receive access requests from the target user end and immediately trigger multiple user identity authentication mechanisms, and comprehensively use various technical means such as biometric recognition, password verification and dynamic tokens to enhance the accuracy and security of identity recognition of the target user end.
[0019] Once the identity authentication of the target user is passed, the key original data can be intelligently identified and selected for backup according to the pre-set data backup strategy. By analyzing factors such as data sensitivity and update frequency, accurate target backup data can be generated and securely transmitted to the data backup storage device to ensure data redundancy and recovery capabilities.
[0020] Furthermore, the built-in network virus feature library can be used to start the network virus detection mechanism to perform a deep scan on the original backup data to identify and mark any potential virus threats and generate corresponding network virus detection results. At the same time, the network vulnerability features in the original backup data can be extracted and optimized through the secondary sorting algorithm to generate an efficient vulnerability repair sequence. Based on this sequence, a customized network vulnerability repair strategy can be automatically generated to repair known security weaknesses in a timely manner.
[0021] In addition, by dynamically adjusting the weights of user network interaction indicators, an updated indicator weight system can be generated, and user behavior data from the target user end can be collected to build an abnormal behavior identification model. Combined with the updated indicator weights, the security level of user access can be accurately assessed, and potential abnormal behaviors can be discovered and warned in a timely manner.
[0022] Ultimately, we can integrate multi-dimensional information such as network virus detection results, network vulnerability repair strategies, and user access security levels to automatically generate a comprehensive and targeted network security protection strategy, providing all-round, multi-level security protection for computer systems.
[0023] In the specific implementation process, Figure 2 As shown, the receiving of the target access request of the target user terminal and starting the multiple user identity authentication mechanism to authenticate the target user terminal specifically includes: Receiving a target access request from the target user terminal and initiating the multiple user identity authentication mechanism; Collecting target fingerprint data of the target user terminal through a fingerprint sensor, and performing a comparison process on the target fingerprint data and preset fingerprint data; If the fingerprint verification of the target user terminal is passed, the facial image data of the target user terminal is obtained through the facial acquisition device, and the facial image data is compared with the preset facial data for a second time; If the face verification of the target user terminal is passed, the access password input by the target user terminal is obtained and compared with the preset storage password three times; If the password verification of the target user terminal passes, the identity verification of the target user terminal passes, and the target access request of the target user terminal is accepted; otherwise, the target access request of the target user terminal is rejected.
[0024] It is understandable that first, a target access request from a target user terminal may be received, and then a multi-user identity authentication mechanism may be activated to perform a comprehensive identity authentication process on the target user terminal.
[0025] Specifically, the target access request from the target user can be captured and processed first, and the multi-user identity authentication mechanism can be immediately started. Based on fingerprint verification technology, the fingerprint feature data of the target user, i.e. the target fingerprint data, can be accurately collected through a high-precision fingerprint sensor. Subsequently, these target fingerprint data can be compared with the preset fingerprint data pre-stored in the fingerprint database.
[0026] If the target user's fingerprint verification is successful, facial recognition technology can be further enabled. By configuring a high-resolution facial acquisition device, the target user's facial image data can be accurately captured, and then these facial image data can be compared with the data in the preset facial database for a second time to further verify the authenticity of the user's identity.
[0027] If the facial verification is successful, the target user may be prompted to enter an access password, and the received access password may be compared three times with the password pre-stored in the security password library.
[0028] Therefore, only when the target user successfully passes all three layers of verification, namely fingerprint verification, face verification and password verification, can it be determined that its identity verification is passed. At this time, the target access request proposed by the target user can be accepted and processed. On the contrary, if the target user fails to pass any layer of verification, its target access request will be immediately rejected to ensure system security.
[0029] The step of collecting the target fingerprint data of the target user terminal by using the fingerprint sensor and performing a comparison process on the target fingerprint data and the preset fingerprint data specifically includes: Collecting target fingerprint data of the target user terminal through the fingerprint sensor; The preset fingerprint data is obtained, and fingerprint features of the target fingerprint data and the preset fingerprint data are respectively extracted to generate corresponding target fingerprint features and preset fingerprint features, and the similarity between the target fingerprint features and the preset fingerprint features is calculated to complete a comparison process between the target fingerprint data and the preset fingerprint data. The corresponding calculation formula is as follows: In the formula, Indicates the similarity between the target fingerprint feature and the preset fingerprint feature; Indicates the total dimension corresponding to the target fingerprint feature and the preset fingerprint feature; Indicates the target fingerprint feature in The value of the dimension; Indicates that the preset fingerprint feature is The value on each dimension; ∑ represents the summation symbol; If the fingerprint verification of the target user terminal is passed, the facial image data of the target user terminal is obtained through a facial acquisition device, and the facial image data is compared with the preset facial data for a second time, which specifically includes: If the fingerprint verification of the target user terminal is passed, the facial image data of the target user terminal is obtained through the facial acquisition device; The preset facial data is obtained, facial features of the facial image data and the preset facial data are respectively extracted to generate corresponding facial image features and preset facial features, the similarity between the facial image features and the preset facial features is calculated, and a secondary comparison process of the facial image data and the preset facial data is completed. The corresponding calculation formula is as follows: In the formula, Indicates the similarity between facial image features and preset facial features; Represents facial image features; Indicates preset facial features; Represents the dot product of facial image features and preset facial features; Represents the length of facial image features; Indicates the length of the preset facial features.
[0030] It should be noted that, first, the fingerprint sensor can be used to accurately capture the fingerprint information of the target user terminal to form the target fingerprint data. Then, the preset fingerprint data can be extracted from the database, and the fingerprint features can be extracted from the target fingerprint data and the preset fingerprint data respectively using the feature extraction algorithm to generate the corresponding target fingerprint features and preset fingerprint features. Subsequently, the similarity between the target fingerprint features and the preset fingerprint features in various dimensions can be calculated to complete a comparison process.
[0031] If the fingerprint verification of the target user terminal is passed, the facial recognition process can be started, and the facial image data of the target user terminal can be captured by the facial acquisition device. Subsequently, the preset facial data can be obtained, and facial features can be extracted from the facial image data and the preset facial data respectively to generate corresponding facial image features and preset facial features. Finally, the similarity between the facial image features and the preset facial features can be calculated to complete the secondary comparison process.
[0032] The method of starting a network virus detection mechanism to identify network viruses on the original backup data based on the network virus feature library and generating corresponding network virus detection results specifically includes: Performing a parsing operation on the original backup data to generate a corresponding original backup data packet; Based on the network virus feature library, the network virus detection mechanism is started to identify the network virus of the original backup data packet, and the corresponding network virus detection result is generated; When a network virus is identified in the original backup data packet, a clearing operation is performed on the network virus, and the virus name and infection location corresponding to the network virus are recorded and stored.
[0033] Among them, based on a comprehensive network virus feature library, the original backup data can be deeply identified and analyzed through a network virus detection mechanism.
[0034] Specifically, the original backup data can be parsed to generate a series of structured original backup data packets. Then, according to the virus features in the network virus feature library, an efficient network virus detection mechanism can be started to compare and identify these data packets one by one to generate accurate network virus detection results.
[0035] If a network virus is identified in the original backup data package during this process, the virus removal operation will be performed immediately to ensure the security and purity of the data. At the same time, the specific information of these network viruses, including the virus name and the specific location of the infection, can be recorded and safely stored in detail.
[0036] The extracting process of the original backup data to generate corresponding network vulnerability features, performing secondary sorting process on the network vulnerability features to determine corresponding vulnerability repair sequences, and generating corresponding network vulnerability repair strategies according to the vulnerability repair sequences specifically include: Performing feature screening and extraction on the original backup data to generate corresponding network vulnerability features; Feature classification is performed on the network vulnerability features, and based on the feature classification results, the network vulnerability features are sorted from greatest to least according to the threat levels of the network vulnerability features, to determine a vulnerability repair sequence corresponding to the network vulnerability features; Generate the corresponding network vulnerability repair strategy according to the vulnerability repair sequence, and perform corresponding vulnerability repair operations.
[0037] It is understandable that the original backup data can be processed by precise feature screening and extraction to generate corresponding network vulnerability features. Through secondary sorting, the network vulnerability features can be classified. Based on the classification results, according to the threat level of the network vulnerability features, the vulnerability repair sequence can be determined by using the high to low sorting principle. Based on the vulnerability repair sequence, a highly targeted network vulnerability repair strategy can be generated.
[0038] The feature screening and extraction of the original backup data to generate the corresponding network vulnerability features specifically includes: The original backup data includes sub-original backup data, and each of the sub-original backup data includes Individual original backup features; The mean value corresponding to the sub-original backup data is calculated as follows: In the formula, Represents the mean value of the sub-original backup data; Indicates the number of sub-original backup data in the original backup data; Indicates the number of The original backup data of each sub-item; ∑ represents the summation symbol; The original backup data is centrally processed as follows: In the formula, Represents the original backup data after centralized processing; Indicates the original backup data; Indicates the mean value corresponding to the sub-original backup data; The covariance matrix corresponding to the original backup data is calculated as follows: In the formula, Represents the covariance matrix corresponding to the original backup data; Indicates the number of sub-original backup data in the original backup data; Represents the transposition of the original backup data after centralized processing; Represents the original backup data after centralized processing; Perform eigenvalue decomposition on the covariance matrix corresponding to the original backup data to obtain the eigenvalue , and the corresponding eigenvector ; Before selection The eigenvectors corresponding to the eigenvalues are used as principal components to generate the projection matrix corresponding to the original backup data. , and project the original backup data to the front The corresponding network vulnerability features are generated in the subspace composed of feature vectors. The corresponding calculation formula is as follows: In the formula, Indicates network vulnerability characteristics; Represents the original backup data after centralized processing; Represents the projection matrix corresponding to the original backup data.
[0039] The feature classification of the network vulnerability features, and sorting the network vulnerability features from large to small according to the threat levels of the network vulnerability features based on the feature classification results, and determining the vulnerability repair sequence corresponding to the network vulnerability features, specifically includes: When classifying the network vulnerability features, the corresponding optimization problem is as follows: In the formula, Indicates The weight vector of the support vector machine is used to determine the direction of the classification hyperplane; Indicates The bias term of the support vector machine is used to determine the distance between the classification hyperplane and the origin; Indicates The network vulnerability characteristics are Slack variables when linearly inseparable in a support vector machine; represents the regularization parameter, which is used to control the trade-off between classification interval and classification error; Indicates the total number of network vulnerability features; Indicates the minimum value operation; ∑ indicates the summation symbol; The constraints corresponding to the optimization problem are: In the formula, Indicates Feature category labels corresponding to network vulnerability features; Indicates Network vulnerability characteristics; Indicates The weight vector of the support vector machine is used to determine the direction of the classification hyperplane; Indicates The bias term of the support vector machine is used to determine the distance between the classification hyperplane and the origin; Indicates The network vulnerability characteristics are Slack variables when linearly inseparable in a support vector machine; Indicates the total number of network vulnerability features; Based on the feature classification results of the network vulnerability features, the network vulnerability features are sorted from large to small according to the threat levels of the network vulnerability features, and a vulnerability repair sequence corresponding to the network vulnerability features is determined.
[0040] After determining the characteristic classification of network vulnerability features, they can be ranked from high to low according to the threat level of the network vulnerability features. And the assessment of the threat level may be based on multiple dimensions such as the potential impact of the vulnerability, difficulty of exploitation, and prevalence.
[0041] Finally, based on the sorting results, the vulnerability repair sequence corresponding to the network vulnerability characteristics can be determined, thereby ensuring that repair resources are allocated first to urgent and important vulnerabilities, effectively improving the overall security of the network system.
[0042] The determining and adjusting the indicator weight of the user network interaction indicator corresponding to the original backup data, generating the corresponding update indicator weight, obtaining the target user behavior data of the target user terminal and establishing the corresponding abnormal behavior recognition model, and determining the user access security level corresponding to the target user terminal based on the update indicator weight and the abnormal behavior recognition model specifically includes: Determine and adjust the index weight of the user network interaction index corresponding to the original backup data, and generate the corresponding update index weight. The calculation formula of the update index weight is as follows: In the formula, Indicates Update indicator weights; represents the indicator weight adjustment function; Indicates the original backup data; Indicates The weight of each indicator; The target user behavior data of the target user terminal is obtained and a corresponding abnormal behavior recognition model is established to identify and predict the abnormal behavior probability of the target user terminal. The corresponding calculation formula is as follows: In the formula, Indicates the probability of abnormal behavior of the target user end; Indicates the target user behavior data of the target user end; represents the number of Gaussian components; Indicates The mixing coefficient of the Gaussian components; Indicates The probability density of Gaussian components; ∑ represents the summation symbol; The user access security level corresponding to the target user terminal is determined based on the update index weight and the abnormal behavior recognition model. The corresponding calculation formula is as follows: In the formula, Indicates the user access security level corresponding to the target user end; Indicates the number of updated indicator weights; Indicates Update indicator weights; represents the probability of abnormal behavior of the target user end; ∑ represents the summation symbol.
[0043] In practical applications, the indicator weights of the user network interaction indicators can be adjusted to generate corresponding updated indicator weights. Subsequently, the target user behavior data of the target user end can be collected, and an abnormal behavior recognition model can be built based on these data to identify and predict the probability of abnormal behavior on the target user end.
[0044] Finally, the updated indicator weights and abnormal behavior identification model can be combined to determine the user access security level of the target user end, so that the user access security level can be accurately evaluated by comprehensively considering multiple dimensions of user network interaction and the possibility of abnormal behavior.
[0045] Embodiment 2 like Figure 3 As shown, a computer network security protection system, the protection system comprises: An identity authentication module, used for receiving a target access request from a target user terminal and starting a multiple user identity authentication mechanism to authenticate the target user terminal; A data backup module, for determining the original backup data according to a preset data backup strategy and performing a backup operation to generate corresponding target backup data if the identity authentication of the target user terminal is passed, and transmitting the target backup data to a data backup storage device; A virus detection module, used to start a network virus detection mechanism to identify network viruses on the original backup data based on a network virus feature library, and generate corresponding network virus detection results; A vulnerability repair module is used to perform a primary extraction process on the original backup data to generate corresponding network vulnerability features, perform a secondary sorting process on the network vulnerability features to determine a corresponding vulnerability repair sequence, and generate a corresponding network vulnerability repair strategy according to the vulnerability repair sequence; An access security module, used to determine and adjust the index weight of the user network interaction index corresponding to the original backup data, generate a corresponding update index weight, obtain the target user behavior data of the target user terminal and establish a corresponding abnormal behavior recognition model, and determine the user access security level corresponding to the target user terminal based on the update index weight and the abnormal behavior recognition model; The security protection module is used to generate a corresponding network security protection strategy based on the network virus detection results, network vulnerability repair strategy and user access security level.
[0046] Through the introduction of the above embodiments, the present invention uses a computer network security protection method and system to receive a target access request from a target user terminal and start a multi-user identity authentication mechanism to authenticate the target user terminal; if the identity authentication of the target user terminal is passed, the original backup data is determined according to a preset data backup strategy and a backup operation is performed to generate corresponding target backup data, and the target backup data is transmitted to a data backup storage device; based on a network virus feature library, a network virus detection mechanism is started to identify network viruses on the original backup data and generate corresponding network virus detection results; an extraction process is performed on the original backup data to generate corresponding network vulnerability features, and a secondary sorting process is performed on the network vulnerability features to determine a corresponding vulnerability repair sequence, and a corresponding network vulnerability repair strategy is generated according to the vulnerability repair sequence; the indicator weight of the user network interaction indicator corresponding to the original backup data is determined and adjusted, and a corresponding update indicator weight is generated to obtain the target The target user behavior data of the user end is collected and a corresponding abnormal behavior recognition model is established. The user access security level corresponding to the target user end is determined based on the updated indicator weight and the abnormal behavior recognition model; based on the network virus detection results, the network vulnerability repair strategy and the user access security level, the corresponding network security protection strategy is generated, so that the security of the computer system can be significantly improved through multiple identity authentication, data backup, network virus detection, vulnerability detection and repair, security level determination and protection strategy formulation. The system of the present invention can monitor and detect network threats in real time, and quickly generate and execute corresponding security defense strategies, thereby effectively responding to various network attacks; the present invention can ensure the security and integrity of data through data backup and recovery mechanisms, and reduce data losses caused by network attacks or system failures; the system of the present invention provides an intuitive and easy-to-use interface and operation method, allowing users to easily manage and configure network security settings.
[0047] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.
[0048] Those skilled in the art can understand that all or part of the steps in the various methods of the above embodiments can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable storage medium, and the storage medium includes a read-only memory (ROM), a random access memory (RAM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), a one-time programmable read-only memory (OTPROM), an electronically erasable rewritable read-only memory (EEPROM), a compact disc (CD-ROM) or other optical disc storage, magnetic disk storage, magnetic tape storage, or any other computer-readable medium that can be used to carry or store data.
[0049] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.
Claims
1. A computer network security protection method, characterized in that: The protection method includes: Receiving a target access request from a target user terminal, and starting a multiple user identity authentication mechanism to authenticate the target user terminal; If the identity authentication of the target user terminal is passed, the original backup data is determined according to the preset data backup strategy, a backup operation is performed to generate corresponding target backup data, and the target backup data is transmitted to the data backup storage device; Based on the network virus feature library, a network virus detection mechanism is started to identify network viruses on the original backup data, and a corresponding network virus detection result is generated; Performing a primary extraction process on the original backup data to generate corresponding network vulnerability features, performing a secondary sorting process on the network vulnerability features to determine a corresponding vulnerability repair sequence, and generating a corresponding network vulnerability repair strategy according to the vulnerability repair sequence; Determine and adjust the indicator weight of the user network interaction indicator corresponding to the original backup data, generate the corresponding update indicator weight, obtain the target user behavior data of the target user terminal and establish the corresponding abnormal behavior recognition model, and determine the user access security level corresponding to the target user terminal based on the update indicator weight and the abnormal behavior recognition model; Based on the network virus detection results, network vulnerability repair strategies and user access security levels, a corresponding network security protection strategy is generated.
2. A computer network security protection method according to claim 1, characterized in that: The receiving a target access request from a target user terminal and starting a multiple user identity authentication mechanism to authenticate the target user terminal specifically includes: Receiving a target access request from the target user terminal and initiating the multiple user identity authentication mechanism; Collecting target fingerprint data of the target user terminal through a fingerprint sensor, and performing a comparison process on the target fingerprint data and preset fingerprint data; If the fingerprint verification of the target user terminal is passed, the facial image data of the target user terminal is obtained through the facial acquisition device, and the facial image data is compared with the preset facial data for a second time; If the face verification of the target user terminal is passed, the access password input by the target user terminal is obtained and compared with the preset storage password three times; If the password verification of the target user terminal passes, the identity verification of the target user terminal passes, and the target access request of the target user terminal is accepted; otherwise, the target access request of the target user terminal is rejected.
3. A computer network security protection method according to claim 2, characterized in that: The step of collecting the target fingerprint data of the target user terminal by using the fingerprint sensor and performing a comparison process on the target fingerprint data and the preset fingerprint data specifically includes: Collecting target fingerprint data of the target user terminal through the fingerprint sensor; The preset fingerprint data is obtained, and fingerprint features of the target fingerprint data and the preset fingerprint data are respectively extracted to generate corresponding target fingerprint features and preset fingerprint features, and the similarity between the target fingerprint features and the preset fingerprint features is calculated to complete a comparison process between the target fingerprint data and the preset fingerprint data. The corresponding calculation formula is as follows: In the formula, Indicates the similarity between the target fingerprint feature and the preset fingerprint feature; Indicates the total dimension corresponding to the target fingerprint feature and the preset fingerprint feature; Indicates the target fingerprint feature in The value of the dimension; Indicates that the preset fingerprint feature is The value on each dimension; ∑ represents the summation symbol; If the fingerprint verification of the target user terminal is passed, the facial image data of the target user terminal is obtained through a facial acquisition device, and the facial image data is compared with the preset facial data for a second time, which specifically includes: If the fingerprint verification of the target user terminal is passed, the facial image data of the target user terminal is obtained through the facial acquisition device; The preset facial data is obtained, facial features of the facial image data and the preset facial data are respectively extracted to generate corresponding facial image features and preset facial features, the similarity between the facial image features and the preset facial features is calculated, and a secondary comparison process of the facial image data and the preset facial data is completed. The corresponding calculation formula is as follows: In the formula, Indicates the similarity between facial image features and preset facial features; Represents facial image features; Indicates preset facial features; Represents the dot product of facial image features and preset facial features; Represents the length of facial image features; Indicates the length of the preset facial features.
4. A computer network security protection method according to claim 1, characterized in that: The method of starting a network virus detection mechanism to identify network viruses on the original backup data based on the network virus feature library and generating corresponding network virus detection results specifically includes: Performing a parsing operation on the original backup data to generate a corresponding original backup data packet; Based on the network virus feature library, the network virus detection mechanism is started to identify the network virus of the original backup data packet, and the corresponding network virus detection result is generated; When a network virus is identified in the original backup data packet, a clearing operation is performed on the network virus, and the virus name and infection location corresponding to the network virus are recorded and stored.
5. A computer network security protection method according to claim 1, characterized in that: The extracting process of the original backup data to generate corresponding network vulnerability features, performing secondary sorting process on the network vulnerability features to determine corresponding vulnerability repair sequences, and generating corresponding network vulnerability repair strategies according to the vulnerability repair sequences specifically include: Performing feature screening and extraction on the original backup data to generate corresponding network vulnerability features; Feature classification is performed on the network vulnerability features, and based on the feature classification results, the network vulnerability features are sorted from greatest to least according to the threat levels of the network vulnerability features, to determine a vulnerability repair sequence corresponding to the network vulnerability features; Generate the corresponding network vulnerability repair strategy according to the vulnerability repair sequence, and execute the corresponding vulnerability repair operation.
6. A computer network security protection method according to claim 5, characterized in that: The feature screening and extraction of the original backup data to generate the corresponding network vulnerability features specifically includes: The original backup data includes sub-original backup data, and each of the sub-original backup data includes Individual original backup features; The mean value corresponding to the sub-original backup data is calculated as follows: In the formula, Represents the mean value of the sub-original backup data; Indicates the number of sub-original backup data in the original backup data; Indicates the number of The original backup data of each sub-item; ∑ represents the summation symbol; The original backup data is centrally processed as follows: In the formula, Represents the original backup data after centralized processing; Indicates the original backup data; Indicates the mean value corresponding to the sub-original backup data; The covariance matrix corresponding to the original backup data is calculated as follows: In the formula, Represents the covariance matrix corresponding to the original backup data; Indicates the number of sub-original backup data in the original backup data; Represents the transposition of the original backup data after centralized processing; Represents the original backup data after centralized processing; Perform eigenvalue decomposition on the covariance matrix corresponding to the original backup data to obtain the eigenvalue , and the corresponding eigenvector ; Before selection The eigenvectors corresponding to the eigenvalues are used as principal components to generate the projection matrix corresponding to the original backup data. , and project the original backup data to the front The corresponding network vulnerability features are generated in the subspace composed of feature vectors. The corresponding calculation formula is as follows: In the formula, Indicates network vulnerability characteristics; Represents the original backup data after centralized processing; Represents the projection matrix corresponding to the original backup data.
7. A computer network security protection method according to claim 5, characterized in that: The feature classification of the network vulnerability features, and sorting the network vulnerability features from large to small according to the threat levels of the network vulnerability features based on the feature classification results, and determining the vulnerability repair sequence corresponding to the network vulnerability features, specifically includes: When classifying the network vulnerability features, the corresponding optimization problem is as follows: In the formula, Indicates The weight vector of the support vector machine is used to determine the direction of the classification hyperplane; Indicates The bias term of the support vector machine is used to determine the distance between the classification hyperplane and the origin; Indicates The network vulnerability characteristics are Slack variables when linearly inseparable in a support vector machine; represents the regularization parameter, which is used to control the trade-off between classification interval and classification error; Indicates the total number of network vulnerability features; Indicates the minimum value operation; ∑ indicates the summation symbol; The constraints corresponding to the optimization problem are: In the formula, Indicates Feature category labels corresponding to network vulnerability features; Indicates Network vulnerability characteristics; Indicates The weight vector of the support vector machine is used to determine the direction of the classification hyperplane; Indicates The bias term of the support vector machine is used to determine the distance between the classification hyperplane and the origin; Indicates The network vulnerability characteristics are Slack variables when linearly inseparable in a support vector machine; Indicates the total number of network vulnerability features; Based on the feature classification results of the network vulnerability features, the network vulnerability features are sorted from large to small according to the threat levels of the network vulnerability features, and a vulnerability repair sequence corresponding to the network vulnerability features is determined.
8. A computer network security protection method according to claim 1, characterized in that: The determining and adjusting the indicator weight of the user network interaction indicator corresponding to the original backup data, generating the corresponding update indicator weight, obtaining the target user behavior data of the target user terminal and establishing the corresponding abnormal behavior recognition model, and determining the user access security level corresponding to the target user terminal based on the update indicator weight and the abnormal behavior recognition model specifically includes: Determine and adjust the index weight of the user network interaction index corresponding to the original backup data, and generate the corresponding update index weight. The calculation formula of the update index weight is as follows: In the formula, Indicates Update indicator weights; represents the indicator weight adjustment function; Indicates the original backup data; Indicates The weight of each indicator; The target user behavior data of the target user terminal is obtained and a corresponding abnormal behavior recognition model is established to identify and predict the abnormal behavior probability of the target user terminal. The corresponding calculation formula is as follows: In the formula, Indicates the probability of abnormal behavior of the target user end; Indicates the target user behavior data of the target user end; represents the number of Gaussian components; Indicates The mixing coefficient of the Gaussian components; Indicates The probability density of Gaussian components; ∑ represents the summation symbol; The user access security level corresponding to the target user terminal is determined based on the update index weight and the abnormal behavior recognition model. The corresponding calculation formula is as follows: In the formula, Indicates the user access security level corresponding to the target user end; Indicates the number of updated indicator weights; Indicates Update indicator weights; represents the probability of abnormal behavior of the target user end; ∑ represents the summation symbol.
9. A computer network security protection system, applied to a computer network security protection method according to any one of claims 1 to 8, the protection system comprising: An identity authentication module, used for receiving a target access request from a target user terminal and starting a multiple user identity authentication mechanism to authenticate the target user terminal; A data backup module, for determining the original backup data according to a preset data backup strategy and performing a backup operation to generate corresponding target backup data if the identity authentication of the target user terminal is passed, and transmitting the target backup data to a data backup storage device; A virus detection module, used to start a network virus detection mechanism to identify network viruses on the original backup data based on a network virus feature library, and generate corresponding network virus detection results; A vulnerability repair module is used to perform a primary extraction process on the original backup data to generate corresponding network vulnerability features, perform a secondary sorting process on the network vulnerability features to determine a corresponding vulnerability repair sequence, and generate a corresponding network vulnerability repair strategy according to the vulnerability repair sequence; An access security module, used to determine and adjust the index weight of the user network interaction index corresponding to the original backup data, generate a corresponding update index weight, obtain the target user behavior data of the target user terminal and establish a corresponding abnormal behavior recognition model, and determine the user access security level corresponding to the target user terminal based on the update index weight and the abnormal behavior recognition model; The security protection module is used to generate a corresponding network security protection strategy based on the network virus detection results, network vulnerability repair strategy and user access security level.