Network security information protection method based on AI learning
By building daily and authorized behavior models, identifying and grading abnormal behaviors, the problem of low efficiency of user behavior monitoring in the existing technology is solved, and accurate monitoring of user behavior and security guarantee of network information is achieved.
Patent Information
- Application Number
- CN202411964049.9
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-30
- Publication Date
- 2025-04-18
- Estimated Expiration
- Not applicable · inactive patent
AI Technical Summary
In the prior art, the monitoring efficiency of users' daily behavior and authorized behavior is low, and using the same monitoring logic will lead to an increase in processing burden and reduce monitoring efficiency.
Using AI-based learning-based network security information protection methods, we collect and analyze historical user behavior data from different departments, build daily normal behavior models and authorize normal behavior models, identify and classify abnormal behaviors, and implement corresponding restrictions.
It realizes accurate monitoring of users' daily behavior and authorized behavior, improves monitoring efficiency, reduces processing burden, and ensures the security of network information.
Smart Images
Figure CN119854350A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of network security technology, and in particular to a network security information protection method based on AI learning. Background Art
[0002] Currently, in network security, data access permission management during users' daily operations is an important link. Traditional technologies mainly rely on access control technology and security auditing methods to monitor and analyze user behavior; access control technology limits users' access to data information in the server by setting fixed access permissions and rules, while security auditing technology provides post-analysis by recording users' access logs, thereby ensuring the security of network information.
[0003] In the prior art, when users are working on a daily basis, they usually have the authority to access various basic data in the server. They may tamper with work records and frequently check the personal information of corporate employees. They may even illegally obtain undisclosed R&D technology or financial data when accessing core network data information with the authorization of their superiors. Therefore, in daily behavior and authorized behavior, users view different information and perform different operations. If the same monitoring logic is used for the two behaviors, it will lead to strict requirements for using authorized behaviors when monitoring daily behavior, while monitoring authorized behaviors will be accompanied by monitoring operations for daily behavior, which will greatly increase the processing burden and reduce monitoring efficiency. Summary of the invention
[0004] The purpose of the present invention is to provide a network security information protection method based on AI learning, so as to solve the problem that when monitoring the daily behavior and authorized behavior of users in the prior art, if the same monitoring logic is used, two monitoring behaviors will be executed simultaneously each time the monitoring system runs, while the user only has one behavior at the same time, thus resulting in low monitoring efficiency.
[0005] To achieve the above object, the present invention provides a network security information protection method based on AI learning, comprising the following steps:
[0006] Collect historical user behavior data from different departments, including daily data and authorized data;
[0007] Based on the historical daily data and the authorized data, outputting clustering results through a daily normal behavior model and an authorized normal behavior model;
[0008] Collect existing user behavior data and compare it with the clustering results. If there is a mismatch, it is determined that abnormal behavior exists;
[0009] The abnormal behaviors are classified into different levels, and corresponding restrictions are made according to different levels.
[0010] Among them, in the step of using a clustering algorithm to group the collected user daily data and authorization data and identify the behavioral characteristics of different user groups:
[0011] The clustering algorithm is a combination of the K-Means clustering algorithm and the DBSCAN clustering algorithm to complete the grouping task of user daily data and authorized data.
[0012] Among them, in the step of collecting historical user behavior data of different departments, the user behavior data includes daily data and authorization data:
[0013] Acquire daily data of users, including mouse movement data, website browsing data, application usage data and user department data;
[0014] Monitor the operation interface of authorized users in real time, and obtain authorization data and authorization level from the authorization records and access logs of the server, wherein the authorization data includes information viewing data, access frequency data, authorization level data and information transmission data;
[0015] Perform network security protection on the server.
[0016] Wherein, in the step of outputting clustering results through the daily normal behavior model and the authorized normal behavior model based on the historical daily data and the authorized data:
[0017] Remove abnormal behaviors in the daily data and the authorized data, and retain normal operation data of daily users and authorized users. The abnormal behaviors include screenshots, frequent clicks, and data tampering.
[0018] Based on the normal operation data of daily users and the user department data, each user is classified to obtain department classification data;
[0019] Using the K-Means clustering algorithm, a daily normal behavior model is constructed based on the department classification data, and at the same time, the normal operation data of authorized users is processed to identify access modes of different permission levels and construct an authorized normal behavior model;
[0020] Continuously collect real-time data of users, analyze newly collected user behavior data, and update the daily normal behavior model and the authorized normal behavior model in real time.
[0021] Among them, in the step of collecting existing user behavior data and comparing it with the clustering result, if there is a mismatch, determining that abnormal behavior exists:
[0022] Establishing an authorization key, and sending the authorization key to a designated authorized user;
[0023] By identifying the authorization key, the user is identified as a regular user or an authorized user when entering the information system;
[0024] Based on user categories, corresponding data is collected in real time, and the clustering results of the corresponding models are used for comparison.
[0025] Among them, in the step of using the K-Means clustering algorithm to build a daily normal behavior model based on the department classification data, processing the normal operation data of the authorized user, identifying the access modes of different permission levels, and building the authorized normal behavior model:
[0026] Arrange the normal operation data of the daily data and the authorized data into data sets respectively;
[0027] Set daily initialization centroid and authorized initialization centroid based on the data set;
[0028] Based on the daily initialization centroid and the authorized initialization centroid, daily data points are allocated to clusters and authorized data points are allocated to clusters to obtain normal behavior clustering results, and the daily normal behavior model and the authorized normal behavior model are obtained respectively.
[0029] Among them, in the step of collecting corresponding data in real time based on user categories and using the clustering results of the corresponding model for comparison:
[0030] The user identifies the account key when logging into the system;
[0031] After determining the daily user, comparing the clustering result obtained based on the daily data of the existing user with the daily normal behavior model to obtain a first difference quantity;
[0032] After the authorized user is determined, a second difference quantity is obtained based on a comparison between the existing user authorization data and the authorized normal behavior model.
[0033] Among them, in the step of grading the abnormal behavior and making corresponding restrictions according to different grades:
[0034] Set preset values and classify the difference quantities into primary, secondary and tertiary levels according to the preset values;
[0035] When the first difference number or the second difference number reaches level one, the user operation interface is immediately monitored and recorded through the background to record abnormal data;
[0036] When the number of first or second differences reaches level 2, a pop-up window will be displayed to remind the user of the possible risks of their operation, and the user account will be temporarily restricted. At the same time, the management will be automatically notified and abnormal data will be provided;
[0037] When the first difference number or the second difference number reaches level three, the accessed information is encrypted and protected with garbled code, and the user is prohibited from continuing to access it. An alarm signal is issued to notify relevant personnel to go and inquire.
[0038] Among them, in the step of performing network security protection on the server:
[0039] Set up exclusive access VPN, using it by entering the authorization key;
[0040] Monitor and limit the amount of access to the server;
[0041] Establish a firewall to provide real-time protection for the network.
[0042] The network security information protection method based on AI learning of the present invention collects historical user behavior data of different departments, wherein the user behavior data includes daily data and authorized data, and the daily behavior and authorized behavior of the user are recorded respectively through the daily data and the authorized data, so as to build models separately later; based on the historical daily data and the authorized data, clustering results are output through the daily normal behavior model and the authorized normal behavior model, and the daily clustering results and the authorized clustering results are output, so as to be compared with the existing data of the new mobile phone, so as to judge the daily behavior and the authorized behavior respectively; the abnormal behavior is graded, and corresponding restrictions are made according to different grades;
[0043] Therefore, by comparing the existing collected user data with the daily normal behavior model and the authorized normal behavior model, it can not only accurately determine whether the user has abnormal behavior that threatens network information security, but also make sure that authorized behavior and daily behavior do not use the same monitoring method, greatly improving monitoring efficiency. BRIEF DESCRIPTION OF THE DRAWINGS
[0044] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art are briefly introduced below.
[0045] Figure 1 It is a flowchart of the steps of the network security information protection method based on AI learning of the present invention.
[0046] Figure 2 It is a flow chart of the steps of collecting historical user behavior data of different departments according to the present invention, wherein the user behavior data includes daily data and authorization data.
[0047] Figure 3 It is a flowchart of the steps of outputting clustering results through a daily normal behavior model and an authorized normal behavior model based on the historical daily data and the authorized data of the present invention.
[0048] Figure 4 The present invention adopts K-Means clustering algorithm to build a daily normal behavior model based on the department classification data, and at the same time processes the normal operation data of authorized users, identifies access modes of different authority levels, and builds a step flow chart of the authorized normal behavior model.
[0049] Figure 5 It is a flowchart of the steps of collecting existing user behavior data and comparing it with the clustering result, and determining the presence of abnormal behavior if there is a mismatch.
[0050] Figure 6 It is a flowchart of the steps of collecting corresponding data in real time based on user categories and comparing the clustering results of the corresponding model.
[0051] Figure 7 It is a flowchart of the steps of grading the abnormal behaviors and making corresponding restrictions according to different grades of the present invention.
[0052] Figure 8 It is a flow chart of the steps of performing network security protection on the server according to the present invention. DETAILED DESCRIPTION
[0053] Embodiments of the present invention are described in detail below. Examples of the embodiments are shown in the accompanying drawings. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present invention, but should not be construed as limiting the present invention.
[0054] See also Figures 1 to 8 The present invention provides a network security information protection method based on AI learning, comprising:
[0055] S101: Collecting historical user behavior data of different departments, wherein the user behavior data includes daily data and authorization data;
[0056] The specific steps include:
[0057] S201: Acquire daily data of the user, wherein the daily data includes mouse movement data, website browsing data, application usage data and user department data;
[0058] Data can be obtained through the website logged in by the user, the server and database visited by the user, and the monitoring of the user screen interface (including but not limited to); through mouse movement data, website browsing data, application usage data and user department data (including but not limited to), by collecting the user's mouse movement data, it can be used to analyze whether the mouse movement speed is normal. If it exceeds the normal clicking speed, it means that the user may have used a clicker or modifier, and there is a situation of automatically checking network information. Clickers or modifiers are usually prone to carry viruses, causing network information leakage; website browsing data can mainly understand whether the information browsed by the user is related to the company's content, and can query whether the user has downloaded virus software or software unrelated to work on the website; user department data can be scanned and recorded when the user logs into the system, so as to determine the department to which the user belongs.
[0059] S202: monitoring the operation interface of the authorized user in real time, and obtaining authorization data and authorization level from the authorization record and access log of the server, wherein the authorization data includes information viewing data, access frequency data, authorization level data and information transmission data;
[0060] The authorized data includes but is not limited to information viewing data, access frequency data, authorization level data and information transmission data; authorized users may have access to the core information of the enterprise, such as undisclosed technologies, software underlying codes and financial data, after being authorized by the management account. By monitoring the viewing frequency, number of views and viewing time of these core information by authorized users, the security of core data can be indirectly protected. Cameras can also be placed outside the device viewed by the user to monitor user behavior and avoid sneak shots using external devices.
[0061] S203: Perform network security protection on the server.
[0062] The specific steps include:
[0063] S801: Setting up a dedicated access VPN, using it by inputting the authorization key;
[0064] Before accessing the server or transmitting network data, authorized users need to use the authorization key to activate the VPN to view core data, thereby ensuring the security of network data for remote access.
[0065] S802: Monitor and limit the access volume to the server;
[0066] Limiting the amount of network access can prevent a large number of users from accessing the network at the same time, causing network congestion. It can also prevent network paralysis caused by malicious access by criminals using a large number of virtual users, thereby improving network security.
[0067] S803: Establish a firewall to provide real-time protection for the network.
[0068] By establishing a firewall, unauthorized users can be intercepted, preventing unknown users and network attacks from posing threats to the network system. Network viruses can also be detected and killed, further improving network security.
[0069] S102: Based on the historical daily data and the authorization data, output a clustering result through a daily normal behavior model and an authorized normal behavior model;
[0070] The specific steps include:
[0071] S301: Remove abnormal behaviors in the daily data and the authorized data, and retain normal operation data of daily users and authorized users. The abnormal behaviors include screenshots, frequent clicks, and data tampering.
[0072] After all historical data is collected, the abnormal behavior data is removed and the normal operation data is retained to generate a normal behavior model so that the existing data can be collected later for comparison with the normal operation data.
[0073] S302: Classifying each user based on the normal operation data of the daily user and the user department data to obtain department classification data;
[0074] According to the user's department information, the user is classified into multiple departments, and then the normal operation data unique to each department can be constructed. The unique data can be used for subsequent model comparison to improve the comparison efficiency and accuracy.
[0075] S303: Using the K-Means clustering algorithm, a daily normal behavior model is constructed based on the department classification data, and at the same time, the normal operation data of the authorized user is processed to identify access modes of different permission levels and construct an authorized normal behavior model;
[0076] The specific steps include:
[0077] S401: Arrange the normal operation data of the daily data and the authorized data into data sets respectively;
[0078] By arranging the data set, the data can be cleaned and preprocessed to remove outliers, fill missing values, etc., thereby ensuring the quality and consistency of the data. This helps to improve the accuracy of the K-Means clustering algorithm and avoid clustering result deviations caused by data problems.
[0079] S402: setting the daily initialization centroid and the authorized initialization centroid respectively based on the data set;
[0080] The daily initialization centroid can be closer to the distribution characteristics of daily data, so that it can converge to a stable cluster center more quickly during the clustering process; the authorized initialization centroid is initialized according to the characteristics of the authorized data, which helps the algorithm find a reasonable clustering structure more quickly when processing specific tasks; it can reduce the number of iterations of the K-Means algorithm, thereby improving clustering efficiency; this is because the closer the initial centroid is to the actual cluster center, the easier it is for the algorithm to converge to the global optimal solution during the iteration process.
[0081] S403: Allocate daily data points to clusters and authorized data points to clusters based on the daily initialization centroid and the authorized initialization centroid to obtain normal behavior clustering results, and obtain the daily normal behavior model and the authorized normal behavior model respectively.
[0082] During the clustering process, the algorithm will look for similarities between data points and assign similar data points to the same cluster. By assigning daily data and authorized data to different clusters, we can clearly see the grouping of the data and identify different data subsets. The K-Means clustering algorithm can assign data points to K clusters, so that data points within the same cluster have a high degree of similarity, while data points between different clusters have a low degree of similarity. For daily data and authorized data, clustering analysis can identify users' daily and authorized behavior habits and patterns, which helps companies or individuals better understand their own behavioral characteristics and optimize or adjust their behavior.
[0083] S304: Continuously collect real-time data of users, analyze newly collected user behavior data, and update the daily normal behavior model and the authorized normal behavior model in real time.
[0084] By continuously collecting the latest user data, the daily normal behavior model and the authorized normal behavior model, it is possible to avoid inaccurate clustering results of the model caused by changes in users and replacement of information.
[0085] S103: Collect existing user behavior data and compare it with the clustering result. If there is a mismatch, it is determined that abnormal behavior exists;
[0086] The specific steps include:
[0087] S501: Establishing an authorization key, and sending the authorization key to a designated authorized user;
[0088] S502: By identifying the authorization key, the user is judged as a regular user or an authorized user when entering the information system;
[0089] When a user logs into the company's information query system or the company's website, the system will proactively ask whether it is necessary to fill in the authorization key, and then directly determine whether it is an authorized user. After filling in the authorization key, the core data can be queried. At the same time, the authorization keys can also be graded, and users of different grades can view core data of different levels.
[0090] S503: Based on the user category, corresponding data is collected in real time, and the clustering results of the corresponding model are used for comparison.
[0091] The specific steps include:
[0092] S601: When a user logs into the system, a key is identified for the account;
[0093] S602: After determining the daily user, compare the clustering result obtained based on the daily data of the existing user with the daily normal behavior model to obtain a first difference quantity;
[0094] Each item of the existing user's daily data and the data of the clustering result obtained by the daily normal behavior model form a group; after comparison, the same group of results are removed, and the different groups of data are retained to obtain the difference quantity.
[0095] S603: After the authorized user is determined, a second difference quantity is obtained based on the comparison between the existing user authorization data and the authorized normal behavior model.
[0096] Each item of the existing user authorization data and the data of the clustering result obtained by the authorization normal behavior model form a group; after comparison, the same group of results are removed, and the different groups of data are retained to obtain the number of differences.
[0097] S104: Classify the abnormal behaviors and impose corresponding restrictions according to different levels.
[0098] The specific steps include:
[0099] S701: Setting a preset value, and classifying the difference quantity into primary, secondary and tertiary levels according to the preset value;
[0100] After the difference levels are graded, different difference levels represent the severity of the abnormal state. The more serious the situation, the stricter the corresponding measures.
[0101] S702: When the first difference number or the second difference number reaches level one, the user operation interface is immediately monitored and recorded through the background to record abnormal data;
[0102] At this time, it reaches level one, indicating that the user has abnormal behavior, but this behavior is not enough to determine whether the user has endangered network information security. There are only basic abnormal behaviors such as clicking the mouse too quickly, browsing information repeatedly, and clicking on information frequently. Therefore, only record it and follow up monitoring.
[0103] S703: When the number of first differences or the number of second differences reaches level 2, a pop-up window is displayed to remind the user to pay attention to the possible risks of their operation, and the user account is temporarily restricted at the same time. At the same time, the management is automatically notified and abnormal data is provided;
[0104] When it reaches level two, it means that when the user is browsing important data information, it is detected that a chat box with people outside the company is opened in the system, or there is a situation where the microphone detects that the user is communicating with irrelevant people by phone, or there is a situation where the user illegally uses unsafe software such as clickers or modifiers. Although these operations are not active leaks by users, they can easily cause passive loss of corporate data, and the risk is greater than at level one.
[0105] S704: When the first difference number or the second difference number reaches level three, the accessed information is encrypted with garbled characters for protection, and the user is prohibited from continuing to access it. An alarm signal is issued to notify relevant personnel to go and make inquiries.
[0106] When it reaches level three, it means that the user has taken screenshots, recorded the screen, or taken external photos of core data, or it is detected that the user has copied part of the data and sent it to the external network through the chat software. Therefore, before other core data is completely leaked, the user needs to be urgently banned and all data needs to be garbled to prevent leakage.
[0107] In the step of performing network security protection on the server:
[0108] Set up exclusive access VPN, using it by entering the authorization key;
[0109] Monitor and limit the amount of access to the server;
[0110] Establish a firewall to provide real-time protection for the network.
[0111] What is disclosed above is only one or more preferred embodiments of the present application, and cannot be used to limit the scope of rights of the present application. Ordinary technicians in this field can understand that all or part of the processes of implementing the above embodiments and equivalent changes made according to the claims of the present application are still within the scope covered by the present application.
Claims
1. A network security information protection method based on AI learning, characterized in that: The steps include: Collect historical user behavior data from different departments, including daily data and authorized data; Based on the historical daily data and the authorized data, outputting clustering results through a daily normal behavior model and an authorized normal behavior model; Collect existing user behavior data and compare it with the clustering results. If there is a mismatch, it is determined that abnormal behavior exists; The abnormal behaviors are classified into different levels, and corresponding restrictions are made according to different levels.
2. The network security information protection method based on AI learning according to claim 1, characterized in that: In the step of collecting historical user behavior data of different departments, wherein the user behavior data includes daily data and authorization data: Acquire daily data of users, including mouse movement data, website browsing data, application usage data and user department data; Monitor the operation interface of authorized users in real time, and obtain authorization data and authorization level from the authorization records and access logs of the server, wherein the authorization data includes information viewing data, access frequency data, authorization level data and information transmission data; Perform network security protection on the server.
3. The network security information protection method based on AI learning as claimed in claim 2, characterized in that: In the step of outputting clustering results through the daily normal behavior model and the authorized normal behavior model based on the historical daily data and the authorized data: Remove abnormal behaviors in the daily data and the authorized data, and retain normal operation data of daily users and authorized users. The abnormal behaviors include screenshots, frequent clicks, and data tampering. Based on the normal operation data of daily users and the user department data, each user is classified to obtain department classification data; Using the K-Means clustering algorithm, a daily normal behavior model is constructed based on the department classification data, and at the same time, the normal operation data of authorized users is processed to identify access modes of different permission levels and construct an authorized normal behavior model; Continuously collect real-time data of users, analyze newly collected user behavior data, and update the daily normal behavior model and the authorized normal behavior model in real time.
4. The network security information protection method based on AI learning as claimed in claim 3, characterized in that: In the step of collecting existing user behavior data and comparing it with the clustering result, and determining that abnormal behavior exists if there is a mismatch: Establishing an authorization key, and sending the authorization key to a designated authorized user; By identifying the authorization key, the user is identified as a regular user or an authorized user when entering the information system; Based on user categories, corresponding data is collected in real time, and the clustering results of the corresponding models are used for comparison.
5. The network security information protection method based on AI learning as claimed in claim 4, characterized in that: In the step of using the K-Means clustering algorithm to construct a daily normal behavior model based on the department classification data, processing the normal operation data of the authorized user, identifying access modes of different permission levels, and constructing the authorized normal behavior model: Arrange the normal operation data of the daily data and the authorized data into data sets respectively; Set daily initialization centroid and authorized initialization centroid based on the data set; Based on the daily initialization centroid and the authorized initialization centroid, daily data points are allocated to clusters and authorized data points are allocated to clusters to obtain normal behavior clustering results, and the daily normal behavior model and the authorized normal behavior model are obtained respectively.
6. The network security information protection method based on AI learning according to claim 5, characterized in that: In the step of collecting corresponding data in real time based on user categories and comparing with the clustering results of the corresponding model: The user identifies the account key when logging into the system; After determining the daily user, comparing the clustering result obtained based on the daily data of the existing user with the daily normal behavior model to obtain a first difference quantity; After the authorized user is determined, a second difference quantity is obtained based on a comparison between the existing user authorization data and the authorized normal behavior model.
7. The network security information protection method based on AI learning according to claim 6, characterized in that: In the step of grading the abnormal behaviors and making corresponding restrictions according to different grades: Set preset values and classify the difference quantities into primary, secondary and tertiary levels according to the preset values; When the first difference number or the second difference number reaches level one, the user operation interface is immediately monitored and recorded through the background to record abnormal data; When the number of first or second differences reaches level 2, a pop-up window will be displayed to remind the user of the possible risks of their operation, and the user account will be temporarily restricted. At the same time, the management will be automatically notified and abnormal data will be provided; When the first difference number or the second difference number reaches level three, the accessed information is encrypted and protected with garbled code, and the user is prohibited from continuing to access it. An alarm signal is issued to notify relevant personnel to go and inquire.
8. The network security information protection method based on AI learning as claimed in claim 7, characterized in that: In the step of performing network security protection on the server: Set up exclusive access VPN, using it by entering the authorization key; Monitor and limit the amount of access to the server; Establish a firewall to provide real-time protection for the network.