Data security early warning method, application method and system based on multi-dimensional time series

Abstract

The invention provides a data security early warning method, application method and system based on a multi-dimensional time series, and the method comprises the steps: extracting the full-path historical access information of a historical access behavior based on an obtained database historical audit log and a terminal historical user log; performing vectorization processing on the full-path historical access information to obtain historical feature representation of the historical access behavior; inputting the historical feature representation into a long short-term memory network model for prediction to obtain a security access threshold of the access behavior; and based on the obtained current access behavior and the security access threshold, performing access volume early warning on access data in the current access behavior. According to the invention, the accuracy and flexibility of data security event early warning can be improved.

Description

Technical Field

[0001] The present invention relates to the field of network security, and in particular to a data security early warning method, application method and system based on multidimensional time series. Background Art

[0002] With the rapid development of digital information technology, data has become the core production factor of the digital economy, an important national asset and a basic strategic resource. As the value of data becomes more prominent, data security risks are increasing day by day. As data becomes increasingly important and widely used in enterprises and organizations, data security risks and attacks have become more diverse and complex. Compared with traditional network security threats, the challenges facing data security are no longer limited to attacks using technical means such as security vulnerabilities, malicious traffic, viruses and Trojans, but are more focused on business levels such as data permission abuse and illegal data use. Therefore, for these network behaviors that go deep into the business level, it becomes crucial to effectively combine business-level information to warn of data security incidents. Summary of the invention

[0003] In order to solve the problems of the prior art, the present invention proposes a data security early warning method, application method and system based on multidimensional time series, aiming to improve the accuracy and flexibility of data security event early warning.

[0004] The purpose of the present invention is achieved by adopting the following technical solutions:

[0005] In one aspect, the present invention provides a data security early warning method based on multidimensional time series, the method comprising:

[0006] Based on the acquired database historical audit logs and terminal historical user logs, extract the full path historical access information of historical access behaviors;

[0007] Vectorizing the full-path historical access information to obtain a historical feature representation of the historical access behavior;

[0008] Inputting the historical feature representation into a long short-term memory network model for prediction to obtain a safe access threshold of the access behavior;

[0009] Based on the acquired current access behavior and the security access threshold, an access volume warning is issued for the access data in the current access behavior.

[0010] Optionally, the step of inputting the historical feature representation into a long short-term memory network model for prediction to obtain a safe access threshold of the access behavior includes:

[0011] Using the input data format corresponding to the long short-term memory network model, the historical feature representation is format-converted to obtain data to be input;

[0012] Inputting the data to be input into the long short-term memory network model for feature prediction to obtain multiple feature vectors of access behavior; wherein the number of the multiple feature vectors is the same as the time step parameter of the long short-term memory network model;

[0013] A preset quantity statistical method is used to count the number of data appearing in the multiple feature vectors to obtain the security access threshold.

[0014] Optionally, extracting the full-path historical access information of the historical access behavior based on the acquired database historical audit logs and terminal historical user logs includes:

[0015] Extracting the access behavior path corresponding to the historical access behavior from the database historical audit log and the terminal historical user log based on time correlation and content correlation in turn;

[0016] Extracting historical interaction behavior information and historical data flow information from the access behavior path;

[0017] The historical interaction behavior information and the historical data flow information are spliced ​​to obtain the full-path historical access information.

[0018] Optionally, the vectorizing the full-path historical access information to obtain a historical feature representation of the historical access behavior includes:

[0019] Vectorizing the full-path historical access information to obtain feature information of the historical access behavior;

[0020] The characteristic information is truncated or padded with zeros using a preset characteristic vector length to obtain the historical characteristic representation.

[0021] Optionally, the performing access volume warning on the access data in the current access behavior based on the acquired current access behavior and the security access threshold includes:

[0022] Obtaining current access statistics corresponding to the access data in the current access behavior;

[0023] Based on the current access statistics and the security access threshold, an access volume warning is performed on the access data.

[0024] Optionally, the obtaining current access statistics corresponding to the access data in the current access behavior includes:

[0025] Extracting the full path current access information of the current access behavior based on the current audit log of the database and the current user log of the terminal;

[0026] Performing vectorization processing on the current access information of the entire path to obtain a current feature representation of the current access behavior;

[0027] Statistics are collected on the access data in the current feature representation to obtain current access statistics corresponding to the access data.

[0028] Optionally, the security access threshold includes: an access threshold to be compared of the access data, and the access volume warning for the access data based on the current access statistics and the security access threshold includes:

[0029] Determine the difference between the current access statistic and the access threshold to be compared;

[0030] If the difference is greater than a preset threshold, an access volume warning is issued for the access data.

[0031] Correspondingly, the present invention provides a data security early warning system based on multidimensional time series, the system comprising:

[0032] A first extraction module is used to extract the full path historical access information of the historical access behavior based on the acquired database historical audit log and terminal historical user log;

[0033] A first vectorization module, configured to perform vectorization processing on the full-path historical access information to obtain a historical feature representation of the historical access behavior;

[0034] A first prediction module is used to input the historical feature representation into a long short-term memory network model for prediction to obtain a safe access threshold of the access behavior;

[0035] The first warning module is used to issue an access volume warning to the access data in the current access behavior based on the acquired current access behavior and the security access threshold.

[0036] Optionally, the first prediction module includes:

[0037] A conversion unit, configured to convert the format of the historical feature representation using an input data format corresponding to the long short-term memory network model to obtain data to be input;

[0038] A prediction unit, used for inputting the data to be input into the long short-term memory network model for feature prediction to obtain a plurality of feature vectors of the access behavior; wherein the number of the plurality of feature vectors is the same as the time step parameter of the long short-term memory network model;

[0039] The statistical unit is used to use a preset quantitative statistical method to count the number of data appearing in the multiple feature vectors to obtain the security access threshold.

[0040] Optionally, the first extraction module includes:

[0041] A first extraction unit is used to extract the access behavior path corresponding to the historical access behavior from the database historical audit log and the terminal historical user log based on time correlation and content correlation in sequence;

[0042] A second extraction unit, configured to extract historical interaction behavior information and historical data flow information from the access behavior path;

[0043] The splicing unit is used to splice the historical interaction behavior information and the historical data flow information to obtain the full-path historical access information.

[0044] Optionally, the first vectorization module includes:

[0045] A vectorization unit, used for performing vectorization processing on the full-path historical access information to obtain feature information of the historical access behavior;

[0046] The adjustment unit is used to use a preset feature vector length to perform a truncation operation or a zero-filling operation on the feature information to obtain the historical feature representation.

[0047] Optionally, the first early warning module includes:

[0048] An acquisition unit, configured to acquire current access statistics corresponding to the access data in the current access behavior;

[0049] The early warning unit is used to issue an access volume early warning to the access data based on the current access statistics and the security access threshold.

[0050] Optionally, the acquisition unit is specifically used to extract the full path current access information of the current access behavior based on the current audit log of the database and the current user log of the terminal;

[0051] Performing vectorization processing on the current access information of the entire path to obtain a current feature representation of the current access behavior;

[0052] Statistics are collected on the access data in the current feature representation to obtain current access statistics corresponding to the access data.

[0053] Optionally, the security access threshold includes: an access threshold to be compared of the access data,

[0054] The early warning unit is specifically used to determine the difference between the current access statistic and the access threshold to be compared;

[0055] If the difference is greater than a preset threshold, an access volume warning is issued for the access data.

[0056] On the other hand, the present invention also provides an application method of the data security early warning method based on a multidimensional time series in a power grid system. The data security early warning method based on a multidimensional time series is to use the data security early warning method based on a multidimensional time series described above. The application method of the data security early warning method based on a multidimensional time series in a power grid system includes:

[0057] The acquired database historical audit log is the power grid database historical audit log;

[0058] The terminal historical user log obtained is the power grid terminal historical user log;

[0059] Extracting full-path access information of historical grid access behaviors according to the historical audit log of the grid database and the historical user log of the grid terminal;

[0060] Vectorizing the full-path access information to obtain a power grid historical feature representation of the historical power grid access behavior;

[0061] Inputting the power grid historical feature representation into the long short-term memory network model for prediction to obtain the access threshold of the power grid access behavior;

[0062] Based on the acquired current grid access behavior and the access threshold, an access volume warning is performed on the grid access data in the current grid access behavior.

[0063] Correspondingly, the present invention further provides an application system of a data security early warning method based on a multidimensional time series in a power grid system, wherein the data security early warning method based on a multidimensional time series utilizes the above-mentioned data security early warning method based on a multidimensional time series, and the application system of the data security early warning method based on a multidimensional time series in a power grid system includes:

[0064] The acquisition module is used to acquire the database historical audit log, which is the power grid database historical audit log; the terminal historical user log, which is the power grid terminal historical user log;

[0065] A second extraction module is used to extract the full path access information of the historical power grid access behavior according to the historical audit log of the power grid database and the historical user log of the power grid terminal;

[0066] A second vectorization module, configured to perform vectorization processing on the full path access information to obtain a power grid historical feature representation of the historical power grid access behavior;

[0067] A second prediction module is used to input the power grid historical feature representation into the long short-term memory network model for prediction to obtain an access threshold of the power grid access behavior;

[0068] The second warning module is used to issue an access volume warning to the grid access data in the current grid access behavior based on the acquired current grid access behavior and the access threshold.

[0069] In another aspect, the present invention further provides an electronic device, comprising: at least one processor and a memory; the memory and the processor are connected via a bus;

[0070] The memory is used to store one or more programs;

[0071] When the one or more programs are executed by the at least one processor, the data security early warning method based on the multidimensional time series as described in any one of the above items, or the application method of the data security early warning method based on the multidimensional time series as described in the above item in the power grid system is implemented.

[0072] The present invention also provides a readable storage medium having an execution program stored thereon. When the execution program is executed, it implements the data security early warning method based on a multidimensional time series as described in any one of the above items, or the application method of the data security early warning method based on a multidimensional time series as described in the above item in a power grid system.

[0073] Compared with the prior art, the present invention has the following beneficial effects:

[0074] The embodiment of the present invention provides a data security early warning method and system based on multi-dimensional time series, which extracts the features of historical access behaviors based on terminal historical user logs and database historical audit logs, and can effectively integrate information from different data sources, so as to simultaneously analyze user data content information and operation behavior information, and restore the complete information of the entire data interaction process to the greatest extent, thereby better performing event early warning to maintain network security. At the same time, through the long short-term memory network model (Long Short Term Memory, LSTM), that is, the multivariate time series prediction model, it is possible to effectively capture the long-term dependency between access behaviors in the recurrent neural network, and by processing multi-dimensional features, it is possible to more comprehensively utilize the correlation and influence between multiple feature variables, better capture the inherent laws and trends of access behavior feature information, and achieve high-precision data security event early warning.

[0075] The embodiment of the present invention also provides an application method and system of a data security early warning method based on a multidimensional time series in a power grid system, which extracts the features of the historical access behavior of the power grid based on the historical user logs of the power grid terminal and the historical audit logs of the power grid database, and can effectively integrate the information of different data sources in the power grid system, so that the user data content information and operation behavior information in the power grid system can be analyzed at the same time, and the complete information of the whole process of data interaction can be restored to the greatest extent, so as to better warn the relevant events in the power grid system to maintain the network security of the power grid system. At the same time, through the multivariate time series prediction model (LSTM model), the long-term dependency between access behaviors in the recurrent neural network can be effectively captured, and by processing multidimensional features, the correlation and influence between multiple feature variables can be more comprehensively utilized, and the inherent laws and trends of the access behavior feature information can be better captured, so as to realize the high-precision data security event early warning in the power grid system. In this way, the power grid system can timely discover and respond to security threats in the network to ensure the data security and the stability of the continuous operation of the business in the power grid system.

[0076] It should be understood that the above general description and the following detailed description are merely exemplary and explanatory, and are not intended to limit the technical solutions provided by the embodiments of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0077] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative work, among which:

[0078] Figure 1 A schematic diagram of a process flow of a data security early warning method based on a multidimensional time series provided by an embodiment of the present invention;

[0079] Figure 2 Schematic diagram of a process of discovering an access behavior path corresponding to a historical access behavior in an embodiment of the present invention;

[0080] Figure 3 This is a schematic diagram of the recurrent unit structure corresponding to the long short-term memory network model;

[0081] Figure 4 A schematic diagram of the execution logic corresponding to data security warning by using the data security warning method based on multidimensional time series provided by an embodiment of the present invention;

[0082] Figure 5 A flowchart of an application method of a data security early warning method based on a multi-dimensional time series in a power grid system provided by an embodiment of the present invention;

[0083] Figure 6 A schematic diagram of the composition of a data security early warning system based on multidimensional time series provided by an embodiment of the present invention;

[0084] Figure 7 A schematic diagram of the composition of an application system of a data security early warning method based on a multi-dimensional time series in a power grid system provided by an embodiment of the present invention;

[0085] Figure 8 A schematic diagram of the composition of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0086] The following will describe the embodiments of the present invention with reference to the accompanying drawings and preferred embodiments. Those skilled in the art can easily understand other advantages and effects of the present invention from the contents disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present invention. It should be understood that the preferred embodiments are only for illustrating the present invention, not for limiting the scope of protection of the present invention.

[0087] In the following description, reference is made to “some embodiments”, which describe a subset of all possible embodiments, but it will be understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0088] In the following description, the terms "first\second\third" involved are merely used to distinguish similar objects and do not represent a specific ordering of the objects. It can be understood that "first\second\third" can be interchanged with a specific order or sequence where permitted, so that the embodiments of the present invention described herein can be implemented in an order other than that illustrated or described herein.

[0089] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art of the technical field of the embodiments of the present invention. The terms used herein are only for the purpose of describing the embodiments of the present invention and are not intended to limit the embodiments of the present invention.

[0090] In related technologies, as the value of data becomes more prominent, data security risks are increasing day by day. At the same time, as data becomes increasingly important and widely used in enterprises and organizations, data security risks and attacks become more diverse and complex. Compared with traditional network security threats, the challenges facing data security are no longer limited to attacks using technical means such as security vulnerabilities, malicious traffic, viruses and Trojans, but are more focused on business levels such as data permission abuse and illegal data use. Therefore, for these network behaviors that penetrate into the business level, it is crucial to effectively combine business-level information to warn of data security incidents.

[0091] Based on the above problems, the embodiments of the present invention provide a data security early warning method, application method and system based on multidimensional time series, which can extract the full path access information of access behavior based on database audit logs and terminal user logs, further form a feature representation of the access behavior, and obtain the predicted value through the LSTM multivariate time series prediction model, calculate the security threshold of normal access behavior, so as to achieve high-precision indicator early warning of data security incidents, thereby improving the accuracy and flexibility of data security incident early warning.

[0092] Embodiment 1:

[0093] The embodiment of the present invention provides a data security early warning method based on multidimensional time series, such as Figure 1 As shown in FIG. 1 , a flow chart of a data security early warning method based on a multidimensional time series provided by an embodiment of the present invention is shown in FIG. Figure 1 The following is an explanation:

[0094] Step 101: extract the full-path historical access information of the historical access behavior based on the acquired database historical audit log and terminal historical user log.

[0095] In some embodiments of the present invention, information can be extracted from the acquired database historical audit logs and terminal historical user logs respectively to obtain: full-path historical access information of historical access behavior, which full-path historical access information may include: historical data traffic information and historical interaction behavior information.

[0096] It should be noted that the database audit log is a log file used to record various operations and events in the database system, and is used to track and audit the activities of the database system. These log records can include operations such as user login, query execution, data modification, permission change, as well as system errors, security events and other information.

[0097] Meanwhile, terminal user logs are log files that record the operations and events performed by users on terminal devices. These log records can include various activities performed by users on terminal devices, such as logging in and out, executing commands or operations, accessing files or resources, system errors and warnings, etc. Terminal user logs are often used to monitor and audit the use of terminal devices, track user activities, troubleshoot problems and failures, and ensure system security and compliance.

[0098] Correspondingly, the database historical audit log is a log file that records various historical operations and historical events in the database system; the terminal historical user log is a log file that records the historical operations and historical events performed by the user on the terminal device.

[0099] In some embodiments of the present invention, the above step 101 may be implemented by the following steps 1011 to 1013 (not shown in the figure):

[0100] Step 1011 : extracting the access behavior path corresponding to the historical access behavior from the database historical audit log and the terminal historical user log based on time correlation and content correlation in turn.

[0101] In some embodiments of the present invention, first, based on time correlation, events generated by different nodes in the same time period can be roughly screened out from the database historical audit log and the terminal historical user log, such as: Application Programming Interface (API) requests, database Structured Query Language (SQL) requests, etc.; then, the paths are matched according to the content correlation of the events to complete the discovery of the access behavior paths corresponding to the historical access behaviors.

[0102] It should be noted that the content relevance analysis of events is mainly to analyze the content relevance of events generated at different nodes within the same time period. Text similarity algorithms (such as edit distance, cosine similarity, etc.) can be used to compare the similarity of multiple event contents. If the contents of two events are similar within a certain threshold range, it is considered that there is content relevance between the two events.

[0103] Here, you can refer to Figure 2As shown, it is a schematic diagram of the discovery process of the access behavior path corresponding to the historical access behavior in an embodiment of the present invention; wherein, 201 shows that based on time correlation, events generated by different nodes in the same time period are screened out from the database historical audit log and the terminal historical user log, namely: the API fields generated at these three time points (timestamps): 18:05:23, 18:05:25, and 18:05:27, and the SQL types and their associated database and table name fields corresponding to the SQL requests generated at another three time points (timestamps): 18:05:24, 18:05:26, and 18:05:28.

[0104] Correspondingly, continue to refer to Figure 2 As shown, in 202, it is determined that the API field: AAA generated by the timestamp of 18:05:23 and the SQL type: update in the SQL request generated by the timestamp of 18:05:26 and the corresponding database and table name field BBB have similarities within a certain threshold range, and it is considered that there is content correlation between the two.

[0105] Step 1012: extract historical interaction behavior information and historical data flow information from the access behavior path.

[0106] In some embodiments of the present invention, historical interaction behavior information and historical data flow information may be further extracted based on the access behavior path corresponding to the extracted historical access behavior.

[0107] It should be noted that historical interaction behavior information is extracted based on historical interactions between the client and the website (Web) server, which is included in the terminal historical user log, and its corresponding information may include access time and data nodes, such as application API. Correspondingly, historical data flow information is extracted based on the interaction between the Web server and the database server, which is included in the database historical audit log, including access time, SQL statement type and data node (such as database, table name).

[0108] For example, the historical interaction behavior information is represented as {u1,u2,...,u m}, and u i ={time i ,API i}; where time i and API i They correspond to the time field and API endpoint of the application API request. Correspondingly, the historical data flow information can be expressed as {s1,s2,...,s n}, and s j ={time j ,sql_typej ,source j}; where time j It is the time field of the database SQL request, sql_type j It is the type field of the SQL statement, such as select, update, truncate, etc., source j is the database / table name, i is in the range [1, m], and j is in the range [1, n].

[0109] Step 1013: Concatenate the historical interaction behavior information and the historical data flow information to obtain the full-path historical access information.

[0110] In some embodiments of the present invention, the extracted interaction behavior information and data flow information are spliced ​​to obtain the full path historical access information g = {u1, u2, ..., u m ,s1,s2,...,s n}.

[0111] In this way, through time correlation and content correlation, relevant information can be extracted and spliced ​​from the database historical audit logs and terminal historical user logs, so that more comprehensive and accurate full-path historical access information can be extracted.

[0112] Step 102: vectorize the full-path historical access information to obtain a historical feature representation of the historical access behavior.

[0113] In some embodiments of the present invention, the full-path historical access information may be vectorized first, and then the characteristic information obtained after the vectorization may be adjusted in relevant length to obtain the historical characteristic representation of the historical access behavior.

[0114] In some embodiments of the present invention, the above step 102 may be implemented by the following steps 1021 and 1022 (not shown in the figure):

[0115] Step 1021: vectorize the full-path historical access information to obtain feature information of the historical access behavior.

[0116] In some embodiments of the present invention, the full path historical access information can be vectorized. Furthermore, corresponding vectorization processing can be performed based on the field attributes in the full path historical access information, such as: using the Word2Vec method to vectorize all fields in the full path historical access information except the time field; and using the time module in the Python programming data processing library Pandas to vectorize the time field in the full path historical access information to obtain corresponding feature information, that is, feature information corresponding to the historical access behavior (full path historical access information).

[0117] Step 1022: Using a preset feature vector length, perform a truncation operation or a zero-filling operation on the feature information to obtain the historical feature representation.

[0118] In some embodiments of the present invention, the feature information may be truncated or padded with zeros based on a preset feature vector length k (wherein the value of k may be determined according to actual conditions and is not limited in the present invention). Exemplarily, if the feature vector length corresponding to the feature information of the historical access behavior is greater than or equal to k, the first k feature elements are truncated to form the historical feature representation; if the feature vector length corresponding to the feature information of the historical access behavior is less than k, zeros are padded at the end to make its length become k, so as to finally generate a historical feature representation with a length of k.

[0119] In this way, by vectorization processing, the length of the feature vector corresponding to the feature information is truncated or padded with 0 in turn to obtain the historical feature representation corresponding to the historical access behavior, thereby providing parameter support for subsequent related predictions.

[0120] Step 103: Input the historical feature representation into the long short-term memory network model for prediction to obtain a safe access threshold of the access behavior.

[0121] In some embodiments of the present invention, the historical feature representation corresponding to the historical access behavior may be used as the input of the LSTM, and the predicted value output by the LSTM model may be used to obtain the security access threshold.

[0122] It should be noted that the LSTM model is a variant of the Recurrent Neural Network (RNN). Its main feature is the ability to capture and remember dependencies in long sequence data. It is suitable for processing time series data, natural language processing, and other sequence data modeling tasks.

[0123] In some embodiments of the present invention, the feature representation of a series of continuous historical access behaviors, i.e., the historical feature representation, is converted into the input format of the LSTM model, such as: (samples, time_steps, k); wherein samples is the number of samples, i.e., the number of historical access behaviors, time_steps is the time step parameter, and k is the vector length of the historical feature representation corresponding to the historical access behaviors. The data converted into the input format of the LSTM model is used as the input of the LSTM model, and the feature information of the next t access behaviors can be predicted by adjusting the time step parameter of the LSTM model to t simultaneously, which is the output of the model.

[0124] It should be noted that for the parameters used to train the LSTM model, Adam is selected as the optimizer. The specific settings corresponding to the model parameters of the trained LSTM model are shown in Table 1 below:

[0125] Table 1 Model parameters of LSTM model

[0126] parameter quantity Hidden_size 32 Prevent overfitting (Dropout) ratio 0.2 Batch 128 Network Layers 3 Learning Rate 0.001

[0127] Here, the LSTM model is a deep learning model commonly used to process sequence data, especially suitable for modeling and prediction of time series data. And three types of gates are introduced into the LSTM model, namely: Input Gate t , ForgetGate t And output gate (OutputGate)o t .

[0128] like Figure 3 As shown, c t represents the internal state of the loop unit at time t, represents the candidate state of the recurrent unit at time t, h t represents the external state of the loop unit at time t, f t Represents the forget gate of the recurrent unit at time t, which is used to control how much information needs to be included in the internal state c t-1 Forgotten. Here. c t-1 is the state at the previous time t-1, i t Represents the input gate at time t, which is used to control the candidate state at the current time How much information needs to be saved? t Represents the output gate at time t, which is used to control the external state h t The internal state c received from the current moment t The proportion of the sent status information is the internal state c at the current moment t The total amount. t-1represents the external state of the recurrent unit at time t-1, x t The input at the current moment.

[0129] Here, the candidate state can be calculated by the following formula (1):

[0130]

[0131] Among them, W c , U c is the corresponding weight matrix, b c is the corresponding bias vector, and tanh is the hyperbolic tangent function.

[0132] At the same time, for the internal state c t Use the following formula (2) and formula (3) to calculate:

[0133]

[0134] h t =o t ·tanh(c t ) formula (3).

[0135] Here, at each time t, the historical information so far is recorded in the internal state c at the current time t The use of the gating mechanism is the core idea of ​​the LSTM model. The gate values ​​in the LSTM model are not discrete, but continuous, and usually the value range falls between (0,1). Here, the calculation formulas of the three gates (InputGate, ForgetGate, OutputGate) can refer to formula (4):

[0136]

[0137] Among them, W i , W f , W o , U i , U f , U o are the weight matrices corresponding to their respective gates, b i 、b f 、b o are the bias vectors corresponding to their respective gates, and σ is the sigmiod function.

[0138] In some embodiments of the present invention, the above step 103 may be implemented by the following steps 1031 to 1033 (not shown in the figure):

[0139] Step 1031: Use the input data format corresponding to the long short-term memory network model to convert the format of the historical feature representation to obtain data to be input.

[0140] In some embodiments of the present invention, the historical feature representation is first converted into a format according to the input data format corresponding to the LSTM model to obtain the corresponding data to be input. For example, the historical feature representation A is converted into the data to be input represented in the form of (n, t1, k); wherein n is the number of historical access behaviors, t1 is the time step parameter, and k is the vector length of the historical feature representation corresponding to the historical access behavior.

[0141] Step 1032: input the data to be input into the long short-term memory network model for feature prediction to obtain multiple feature vectors of the access behavior.

[0142] The number of the multiple feature vectors is the same as the time step parameter of the long short-term memory network model.

[0143] In some embodiments of the present invention, the data to be input is directly input into the LSTM model for feature prediction to obtain multiple feature vectors for predicting future access behaviors. Here, the number of the predicted multiple feature vectors is the same as the time step parameter of the LSTM model. For example, if the time step parameter is 10, then the number of feature vectors for predicting future access behaviors is 10.

[0144] Step 1033: Use a preset quantitative statistical method to count the number of data appearing in the multiple feature vectors to obtain the security access threshold.

[0145] In some embodiments of the present invention, the preset quantity statistical method may be to count the number of data appearing in multiple feature vectors, and use the statistical value as the corresponding security access threshold. Exemplarily, if the preset quantity statistical method is to count the maximum value, that is, to determine the number of data A appearing in each feature vector in multiple feature vectors (i.e., the frequency of occurrence) to obtain quantity 1, quantity 2, and quantity 3 (here, the number of multiple feature vectors is 3 as an example), select the maximum value from quantity 1, quantity 2, and quantity 3 as the security access threshold corresponding to the data A, that is, the security access threshold corresponding to the data A in subsequent access behaviors.

[0146] It should be noted that the preset quantitative statistical method may be a statistically corresponding maximum value, mean value, minimum value, median, variance, etc., and the present invention does not impose any limitation on this.

[0147] In this way, by inputting the historical feature representation into the multivariate time series prediction model (LSTM model) for prediction, the security access threshold of subsequent access behavior is generated, which can effectively capture the long-term dependencies in the time period corresponding to the historical access behavior in the LSTM model. Therefore, by processing multi-dimensional features through the LSTM model, that is, historical feature representation, it is possible to more comprehensively utilize the correlation and influence between multiple feature variables, better capture the feature information corresponding to the historical access behavior, that is, the inherent laws and trends of the historical feature representation, and then obtain a higher-precision security access threshold to achieve subsequent high-precision event warnings.

[0148] Step 104: Based on the acquired current access behavior and the security access threshold, an access volume warning is issued for the access data in the current access behavior.

[0149] In some embodiments of the present invention, first, based on the acquired current access behavior, the current feature representation corresponding to the current access behavior can be determined; then, the data volume statistics of the access data in the current feature representation are performed to obtain the current access statistics corresponding to the access data in the current access behavior; finally, the current access statistics are compared with the security access threshold, and based on the comparison result, an access volume warning is issued for the access data in the current access behavior.

[0150] In some embodiments of the present invention, the above step 104 may be implemented by the following steps 1041 and 1042 (not shown in the figure):

[0151] Step 1041: Obtain current access statistics corresponding to the access data in the current access behavior.

[0152] In some embodiments of the present invention, the subsequent network access behavior is monitored in real time, such as monitoring the real-time network access behavior) to obtain the current access behavior, and the access data in the current access behavior is counted to obtain the corresponding current access statistics. Here, the access data in the current access behavior is counted, and the frequency of the access data appearing in the data (feature information or feature representation) corresponding to the current access behavior can be counted according to a preset quantity counting method; wherein, the preset quantity counting method can refer to the above description, and will not be repeated here.

[0153] In some embodiments of the present invention, the above step 1041 may be implemented by the following process:

[0154] The first step is to extract the full path current access information of the current access behavior based on the current audit log of the database and the current user log of the terminal.

[0155] In some embodiments of the present invention, the implementation of extracting the full path current access information of the current access behavior in the first step here can refer to the implementation of the relevant step 101 in the above embodiment, or the implementation of the relevant steps 1011 to 1013, which will not be repeated here.

[0156] It should be noted that the database current audit log is a log file that records various current operations and current events in the database system; the terminal current user log is a log file that records the current operations and current events performed by the user on the terminal device. Correspondingly, the full path current access information may include: current data flow information and current interactive behavior information.

[0157] The second step is to vectorize the current access information of the entire path to obtain a current feature representation of the current access behavior.

[0158] In some embodiments of the present invention, the current characteristic representation of the current access behavior is obtained in the second step. Please refer to the implementation of step 102 in the above embodiment, or the vision of steps 1021 and 1022, which will not be repeated here.

[0159] It should be noted that the lengths of the feature vectors corresponding to the historical feature representation and the current feature representation must be equal to facilitate subsequent comparison and logical processing of related data.

[0160] The third step is to collect statistics on the access data in the current feature representation to obtain current access statistics corresponding to the access data.

[0161] In some embodiments of the present invention, the access data in the current feature representation, such as the frequency of occurrence of data t, can be directly counted based on the preset quantitative statistical method mentioned above (statisticing the corresponding maximum value, mean value, minimum value, median, variance, etc.) to obtain the current access statistics for the data t in the current access behavior.

[0162] In this way, data or information is extracted from the current audit log of the database and the current user log of the terminal to obtain the full-path current access information of the current access behavior, and then the full-path current access information is vectorized to further generate a k-dimensional feature representation of the current access behavior, that is, the current feature representation. Finally, the access data in the k-dimensional feature representation of the current access behavior, such as the statistics of data t, is selected and calculated to obtain the corresponding current access statistics.

[0163] It should be noted that the current access statistics can be expressed in numerical values, such as 20, 30, etc.

[0164] In this way, based on the current audit log of the database and the current user log of the terminal, the full path current access information of the current access behavior is extracted and vectorized to obtain the current feature representation for data volume statistics to obtain the corresponding current access statistics. In this way, the current access statistics corresponding to the access data in the current access behavior can be determined more conveniently and accurately.

[0165] Step 1042: Based on the current access statistics and the security access threshold, an access volume warning is issued for the access data.

[0166] In some embodiments of the present invention, the current access statistics and the security access threshold can be directly compared numerically. If the current access statistics are greater than the security access threshold, it is necessary to issue an access volume warning for the access data in the current access behavior, that is, trigger the corresponding warning mechanism (including but not limited to: voice warning, text warning, etc.). If the current access volume is less than or equal to the security access threshold, it is assumed that the access to the access data in the current access behavior is in a safe state and no warning is required.

[0167] In some embodiments of the present invention, the difference between the current access statistics and the access threshold to be compared can also be determined first; if the difference is greater than a preset threshold (depending on actual needs), an access volume warning is required for the access data in the current access behavior; if the difference is less than or equal to the safe access threshold, it is assumed that the access to the access data in the current access behavior is in a safe state and no warning is required.

[0168] In some embodiments of the present invention, the security access threshold includes: the access threshold to be compared of the access data, that is, the above step 1042 can be implemented by the following process:

[0169] The first step is to determine the difference between the current access statistic and the access threshold to be compared.

[0170] In the second step, if the difference is greater than a preset threshold, an access volume warning is issued for the access data.

[0171] In some embodiments of the present invention, the security access threshold includes: the access threshold corresponding to each of multiple data in the subsequent access behavior, such as: the access threshold 1 corresponding to data 1 in the subsequent access behavior, the access threshold 2 corresponding to data 2 in the subsequent access behavior, etc. Here, the subsequent access behavior, such as: the access threshold to be compared in the access data in the current access behavior, can be screened out for comparison with the current access statistics of the access data in the current access behavior.

[0172] In some embodiments of the present invention, first, the difference between the current access statistic (a) and the access threshold to be compared (b) is determined, that is, the difference x=ab is determined; then, if the calculation determines that the difference x is greater than the preset threshold (y), an access volume warning is required for the access data.

[0173] In some embodiments of the present invention, when it is detected that relevant data, such as: access volume warning (abnormal event) of access data, an alarm can be promptly issued to notify the relevant security administrator, and corresponding measures can be taken to handle and respond.

[0174] In this way, the current access statistics are directly compared with the access threshold to be compared of the access data to achieve early warning of the access volume corresponding to the access data, so that early warning of data security events can be achieved more efficiently and conveniently.

[0175] In this way, based on the current access statistics corresponding to the access data in the current access behavior, relevant numerical comparisons are made with the predicted security access thresholds to achieve access volume warnings for the access data in the current access behavior. This can achieve high-precision data access warnings, i.e., data security warnings, thereby helping related systems to promptly discover and respond to security threats in the database or network, thereby ensuring data security in related systems and the stability of continuous business operations.

[0176] For further information, please refer to Figure 4 As shown, it is a schematic diagram of the execution logic corresponding to the data security warning method based on multidimensional time series provided by the embodiment of the present invention, and its specific execution logic is as follows:

[0177] 401, start.

[0178] 402, extracting characteristic information of access behavior. Here, historical characteristic information of historical access behavior is extracted.

[0179] 403, generating a feature representation of the access behavior. Here, vectorization processing is performed with the help of the feature information extracted in 402 to generate a historical feature representation of the historical access behavior.

[0180] 404, input the feature representation into a multivariate time series prediction model (LSTM model) to generate a security threshold for subsequent access behavior. Here, the feature representation generated in 403 (specifically, the historical feature representation) is converted into a data format and input into the LSTM model for prediction to obtain a plurality of predicted feature vectors, and then the plurality of predicted feature vectors are used for quantitative statistics to obtain a security access threshold for specific data in subsequent access behavior.

[0181] 405, extracting the feature representation of the current access behavior. Here, the full path current access information corresponding to the current access behavior can be extracted based on the current data (such as the current audit log of the database and the current user log of the terminal), and then vectorized processing is performed based on the full path current access information to obtain the current feature representation.

[0182] 406, calculating statistics based on the feature representation of the actual access log, that is, counting the number of specific data in the feature representation (current feature representation) corresponding to the actual access log (current access behavior) to obtain corresponding statistics.

[0183] 407, compare the statistics and the security threshold, and issue an event warning. Here, the statistics and the security threshold can be numerically compared to implement an event warning for related data, such as a visit volume warning.

[0184] 408, ended.

[0185] It should be noted that Figure 4 402 to 404 in the above are the early security threshold predictions. They can be assumed to be based on relevant historical data, such as database historical audit logs and terminal historical user logs, and use the LSTM model to predict the security threshold. Correspondingly, Figure 4 405 to 407 are the current statistics and the predicted safety thresholds for event warning.

[0186] Based on the above description, in order to achieve high-precision early warning of data security incidents to solve data security problems. That is, in an enterprise's network security management system, the data security early warning method based on multidimensional time series provided by this solution can be used to deal with security threats and abnormal behaviors in the network. The reason is: this solution can build a high-precision prediction model (LSTM model) based on the multidimensional feature space of access behavior, and indirectly infer the abnormal degree of actual access behavior events by predicting future normal access behavior logs (that is, by learning the effective judgment boundary of normal access behavior, high-precision indicator early warning of data security incidents can be achieved, and abnormal access behavior in the network can be effectively detected) to achieve high-precision early warning of data security incidents, that is, a data security incident early warning solution based on multidimensional time series is given. The solution mainly includes four steps: extracting feature information, forming feature representation, generating security thresholds and event early warnings. Specifically:

[0187] Step 1: Extract feature information, which can be based on database audit logs and terminal user logs to extract full-path access information of normal access behaviors (such as historical access behaviors), and the full-path access information includes data flow information and interactive behavior information.

[0188] Step 2: forming a feature representation, which may be to vectorize the full path access information of the extracted normal access behavior, and further generate a feature representation of the normal access behavior.

[0189] Step 3: Generate a security threshold. Take the feature representation of normal access behavior as the input of the LSTM multivariate time series prediction model, and use the predicted value of the LSTM multivariate time series prediction model to obtain the security threshold.

[0190] Step 4: Event warning, monitor the current access behavior in the network, and issue data security event warnings based on the current statistics corresponding to the current access behavior and the security threshold obtained in the previous step.

[0191] In this way, based on the multi-dimensional feature space of access behavior, a high-precision early warning model is constructed, and by learning the effective discrimination boundary of normal access behavior and inferring the degree of abnormality of the event, a high-precision early warning of data security events is achieved. In other words, the embodiment of the present invention can provide an effective method for combining business-level information to conduct data security event early warning to cope with increasingly complex and diverse data security risks. It can build a multi-dimensional prediction model (LSTM model) by making full use of the characteristics and information at the business level, extract security thresholds from the prediction results for early warning, so as to improve the accuracy and flexibility of data security event early warning. Furthermore, relevant enterprises can establish an effective network security monitoring and event early warning system based on the solution provided by this embodiment to help them promptly discover and respond to security threats in the network and ensure data security and the stability of continuous business operation.

[0192] The data security early warning method based on multidimensional time series proposed by the present invention extracts the features of historical access behaviors based on the terminal historical user logs and the database historical audit logs, and can effectively integrate the information of different data sources, so as to simultaneously analyze the user data content information and the operation behavior information, and restore the complete information of the whole process of data interaction to the greatest extent, so as to better carry out event early warning to maintain network security. At the same time, the multivariate time series prediction model (LSTM model) can effectively capture the long-term dependency between access behaviors in the recurrent neural network, and by processing multidimensional features, it can more comprehensively utilize the correlation and influence between multiple feature variables, better capture the inherent laws and trends of the access behavior feature information, and achieve high-precision data security event early warning.

[0193] Embodiment 2:

[0194] The embodiment of the present invention also provides an application method of a data security early warning method based on a multidimensional time series in a power grid system. The data security early warning method based on a multidimensional time series is a data security early warning method based on a multidimensional time series described in the above embodiment. Figure 5 FIG. 1 is a flow chart of an application method of a data security early warning method based on a multidimensional time series in a power grid system provided by an embodiment of the present invention. Figure 5 The following is an explanation:

[0195] Step 501: The acquired database historical audit log is a power grid database historical audit log, and the acquired terminal historical user log is a power grid terminal historical user log.

[0196] Step 502: extract the full-path access information of the historical grid access behavior according to the historical audit log of the grid database and the historical user log of the grid terminal.

[0197] Step 503: vectorize the full-path access information to obtain a power grid historical feature representation of the historical power grid access behavior.

[0198] Step 504: input the power grid historical feature representation into the long short-term memory network model for prediction to obtain an access threshold of the power grid access behavior.

[0199] Step 505: Based on the acquired current grid access behavior and the access threshold, an access volume warning is performed on the grid access data in the current grid access behavior.

[0200] In some embodiments of the present invention, a data security warning method based on a multidimensional time series is applied to a power grid system, and the execution parameters involved in the corresponding application execution all correspond to power grid data. For example, the full-path access information of historical power grid access behaviors can be extracted based on the historical audit logs of the power grid database and the historical user logs of the power grid terminals. Correspondingly, the full-path access information can be vectorized to obtain a historical feature representation of the power grid of the historical power grid access behavior, and the historical feature representation of the power grid is input into the LSTM model for prediction to obtain an access threshold of the power grid access behavior. Based on the acquired current power grid access behavior and the access threshold, an access volume warning is performed on the power grid access data in the current power grid access behavior.

[0201] It should be noted that the description corresponding to the relevant execution logic of the application method of the data security warning method based on multidimensional time series in the power grid system is similar to the description of the above-mentioned data security warning method based on multidimensional time series embodiment, and the present invention will not go into details about it.

[0202] The application method of a data security early warning method based on a multidimensional time series provided by an embodiment of the present invention in a power grid system is based on the historical user logs of power grid terminals and the historical audit logs of power grid databases to extract the features of historical access behaviors of power grids, which can effectively integrate the information of different data sources in the power grid system, so that the user data content information and operation behavior information in the power grid system can be analyzed at the same time, and the complete information of the whole process of data interaction can be restored to the greatest extent, so as to better warn the relevant events in the power grid system to maintain the network security of the power grid system. At the same time, through the multivariate time series prediction model (LSTM model), the long-term dependency between access behaviors in the recurrent neural network can be effectively captured, and by processing multidimensional features, the correlation and influence between multiple feature variables can be more comprehensively utilized, and the inherent laws and trends of access behavior feature information can be better captured, so as to realize high-precision data security event early warning in the power grid system. In this way, the power grid system can timely discover and respond to security threats in the network to ensure the data security and the stability of continuous business operation in the power grid system.

[0203] Example 3

[0204] Based on the same inventive concept, the present invention also provides a data security early warning system based on multidimensional time series, see Figure 6 FIG. 1 is a schematic diagram of a data security early warning system based on a multidimensional time series according to an embodiment of the present invention. Figure 6 The system 600 is illustrated as shown, wherein the system 600 includes:

[0205] The first extraction module 601 is used to extract the full path historical access information of the historical access behavior based on the acquired database historical audit log and terminal historical user log;

[0206] A first vectorization module 602, configured to perform vectorization processing on the full-path historical access information to obtain a historical feature representation of the historical access behavior;

[0207] A first prediction module 603 is used to input the historical feature representation into a long short-term memory network model for prediction to obtain a safe access threshold of the access behavior;

[0208] The first warning module 604 is used to issue an access volume warning to the access data in the current access behavior based on the acquired current access behavior and the security access threshold.

[0209] Optionally, the first prediction module 603 includes:

[0210] A conversion unit, configured to convert the format of the historical feature representation using an input data format corresponding to the long short-term memory network model to obtain data to be input;

[0211] A prediction unit, used for inputting the data to be input into the long short-term memory network model for feature prediction to obtain a plurality of feature vectors of the access behavior; wherein the number of the plurality of feature vectors is the same as the time step parameter of the long short-term memory network model;

[0212] The statistical unit is used to use a preset quantitative statistical method to count the number of data appearing in the multiple feature vectors to obtain the security access threshold.

[0213] Optionally, the first extraction module 601 includes:

[0214] A first extraction unit is used to extract the access behavior path corresponding to the historical access behavior from the database historical audit log and the terminal historical user log based on time correlation and content correlation in sequence;

[0215] A second extraction unit, configured to extract historical interaction behavior information and historical data flow information from the access behavior path;

[0216] The splicing unit is used to splice the historical interaction behavior information and the historical data flow information to obtain the full-path historical access information.

[0217] Optionally, the first vectorization module 602 includes:

[0218] A vectorization unit, used for performing vectorization processing on the full-path historical access information to obtain feature information of the historical access behavior;

[0219] The adjustment unit is used to use a preset feature vector length to perform a truncation operation or a zero-filling operation on the feature information to obtain the historical feature representation.

[0220] Optionally, the first early warning module 604 includes:

[0221] An acquisition unit, configured to acquire current access statistics corresponding to the access data in the current access behavior;

[0222] The early warning unit is used to issue an access volume early warning to the access data based on the current access statistics and the security access threshold.

[0223] Optionally, the acquisition unit is specifically used to extract the full path current access information of the current access behavior based on the current audit log of the database and the current user log of the terminal;

[0224] Performing vectorization processing on the current access information of the entire path to obtain a current feature representation of the current access behavior;

[0225] Statistics are collected on the access data in the current feature representation to obtain current access statistics corresponding to the access data.

[0226] Optionally, the security access threshold includes: an access threshold to be compared of the access data,

[0227] The early warning unit is specifically used to determine the difference between the current access statistic and the access threshold to be compared;

[0228] If the difference is greater than a preset threshold, an access volume warning is issued for the access data.

[0229] It should be noted that the description of the data security early warning system based on multidimensional time series is similar to the description of the data security early warning method embodiment based on multidimensional time series, and has similar beneficial effects as the method embodiment. For technical details not disclosed in the system embodiment of the present invention, please refer to the description of the method embodiment of the present invention for understanding.

[0230] Embodiment 4:

[0231] Based on the same inventive concept, the present invention also provides an application system of a data security early warning method based on a multi-dimensional time series in a power grid system, see Figure 7 FIG. 1 is a schematic diagram of a composition of an application system of a data security early warning method based on a multidimensional time series in a power grid system provided by an embodiment of the present invention, combined with Figure 7 The system 700 is illustrated as shown, wherein the system 700 includes:

[0232] The acquisition module 701 is used to acquire the database historical audit log, which is the power grid database historical audit log, and acquire the terminal historical user log, which is the power grid terminal historical user log;

[0233] A second extraction module 702 is used to extract the full path access information of the historical power grid access behavior according to the historical audit log of the power grid database and the historical user log of the power grid terminal;

[0234] A second vectorization module 703, configured to perform vectorization processing on the full path access information to obtain a power grid historical feature representation of the historical power grid access behavior;

[0235] A second prediction module 704 is used to input the power grid historical feature representation into the long short-term memory network model for prediction to obtain an access threshold of the power grid access behavior;

[0236] The second warning module 705 is used to issue an access volume warning to the grid access data in the current grid access behavior based on the acquired current grid access behavior and the access threshold.

[0237] It should be noted that the description of the application system of the data security early warning method based on multidimensional time series in the power grid system is similar to the description of the application method embodiment of the data security early warning method based on multidimensional time series in the power grid system, and has similar beneficial effects as the method embodiment. For technical details not disclosed in the system embodiment of the present invention, please refer to the description of the method embodiment of the present invention for understanding.

[0238] Embodiment 5:

[0239] Based on the same inventive concept, Figure 8 As shown, the present invention also provides an electronic device, which may be a computer device, a single-chip device, an intelligent mobile device, etc. The electronic device in this embodiment may include a processor 810, a memory 820, a transceiver component 830, etc. The processor 810, the memory 820 and the transceiver component 830 are connected via a bus 840; the memory 820 can be used to store an execution program, and an exemplary execution program may include instructions; the processor 810 is used to execute the instructions stored in the memory. The memory 820 can also be used to store data, which can be called and / or modified when executing instructions.

[0240] The processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. It is the computing core and control core of the terminal, which is suitable for implementing one or more instructions, specifically suitable for loading and executing one or more instructions in a storage medium to implement corresponding method processes or corresponding functions, so as to realize a data security early warning method based on a multidimensional time series in the above-mentioned embodiment, or an application method of a data security early warning method based on a multidimensional time series in a power grid system.

[0241] Embodiment 6:

[0242] Based on the same inventive concept, the present invention also provides a readable storage medium, specifically an electronic device readable storage medium (Memory), the electronic device readable storage medium is a memory device in the electronic device, which is used to store programs and data. It can be understood that the storage medium here can include both the built-in storage medium in the electronic device and the extended storage medium supported by the electronic device. The storage medium provides a storage space, which stores the operating system of the terminal. In addition, one or more instructions suitable for being loaded and executed by the processor are also stored in the storage space, and these instructions can be one or more execution programs (including program codes). It should be noted that the storage medium here can be a high-speed RAM memory or a non-volatile memory, such as at least one disk memory. The processor loads and executes one or more instructions stored in the storage medium to implement a data security early warning method based on a multidimensional time series in the above embodiment, or an application method of the data security early warning method based on a multidimensional time series in a power grid system.

[0243] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0244] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0245] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0246] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0247] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the relevant field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents. Any modification or equivalent replacement that does not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A data security early warning method based on multidimensional time series, characterized in that: The method comprises: Based on the acquired database historical audit logs and terminal historical user logs, extract the full path historical access information of historical access behaviors; Vectorizing the full-path historical access information to obtain a historical feature representation of the historical access behavior; Inputting the historical feature representation into a long short-term memory network model for prediction to obtain a safe access threshold of the access behavior; Based on the acquired current access behavior and the security access threshold, an access volume warning is issued for the access data in the current access behavior.

2. The method according to claim 1, characterized in that The inputting the historical feature representation into the long short-term memory network model for prediction to obtain the safe access threshold of the access behavior includes: Using the input data format corresponding to the long short-term memory network model, the historical feature representation is format-converted to obtain data to be input; Inputting the data to be input into the long short-term memory network model for feature prediction to obtain multiple feature vectors of access behavior; wherein the number of the multiple feature vectors is the same as the time step parameter of the long short-term memory network model; A preset quantity statistical method is used to count the number of data appearing in the multiple feature vectors to obtain the security access threshold.

3. The method according to claim 1 or 2, characterized in that: The full-path historical access information of the historical access behavior is extracted based on the acquired database historical audit logs and terminal historical user logs, including: Extracting the access behavior path corresponding to the historical access behavior from the database historical audit log and the terminal historical user log based on time correlation and content correlation in turn; Extracting historical interaction behavior information and historical data flow information from the access behavior path; The historical interaction behavior information and the historical data flow information are spliced ​​to obtain the full-path historical access information.

4. The method according to claim 1 or 2, characterized in that: The vectorization processing of the full-path historical access information to obtain the historical feature representation of the historical access behavior includes: Vectorizing the full-path historical access information to obtain feature information of the historical access behavior; The preset feature vector length is used to perform a truncation operation or a zero-filling operation on the feature information to obtain the historical feature representation.

5. The method according to claim 1 or 2, characterized in that: The step of providing access volume warning for access data in the current access behavior based on the acquired current access behavior and the security access threshold includes: Obtaining current access statistics corresponding to the access data in the current access behavior; Based on the current access statistics and the security access threshold, an access volume warning is performed on the access data.

6. The method according to claim 5, characterized in that The obtaining of current access statistics corresponding to the access data in the current access behavior includes: Extracting the full path current access information of the current access behavior based on the current audit log of the database and the current user log of the terminal; Performing vectorization processing on the current access information of the entire path to obtain a current feature representation of the current access behavior; Statistics are collected on the access data in the current feature representation to obtain current access statistics corresponding to the access data.

7. The method according to claim 6, characterized in that The security access threshold includes: the access threshold to be compared of the access data, and the access volume warning for the access data based on the current access statistics and the security access threshold includes: Determine the difference between the current access statistic and the access threshold to be compared; If the difference is greater than a preset threshold, an access volume warning is issued for the access data.

8. A data security early warning system based on multidimensional time series, characterized in that: The system comprises: A first extraction module is used to extract the full path historical access information of the historical access behavior based on the acquired database historical audit log and terminal historical user log; A first vectorization module, configured to perform vectorization processing on the full-path historical access information to obtain a historical feature representation of the historical access behavior; A first prediction module is used to input the historical feature representation into a long short-term memory network model for prediction to obtain a safe access threshold of the access behavior; The first warning module is used to issue an access volume warning to the access data in the current access behavior based on the acquired current access behavior and the security access threshold.

9. The system according to claim 8, characterized in that The first prediction module comprises: A conversion unit, configured to convert the format of the historical feature representation using an input data format corresponding to the long short-term memory network model to obtain data to be input; A prediction unit, used for inputting the data to be input into the long short-term memory network model for feature prediction to obtain a plurality of feature vectors of the access behavior; wherein the number of the plurality of feature vectors is the same as the time step parameter of the long short-term memory network model; The statistical unit is used to use a preset quantitative statistical method to count the number of data appearing in the multiple feature vectors to obtain the security access threshold.

10. The system according to claim 8 or 9, characterized in that The first extraction module comprises: A first extraction unit is used to extract the access behavior path corresponding to the historical access behavior from the database historical audit log and the terminal historical user log based on time correlation and content correlation in sequence; A second extraction unit, configured to extract historical interaction behavior information and historical data flow information from the access behavior path; The splicing unit is used to splice the historical interaction behavior information and the historical data flow information to obtain the full-path historical access information.

11. The system according to claim 8 or 9, characterized in that: The first vectorization module includes: A vectorization unit, used for performing vectorization processing on the full-path historical access information to obtain feature information of the historical access behavior; The adjustment unit is used to use a preset feature vector length to perform a truncation operation or a zero-filling operation on the feature information to obtain the historical feature representation.

12. The system according to claim 8 or 9, characterized in that The first early warning module includes: An acquisition unit, configured to acquire current access statistics corresponding to the access data in the current access behavior; The early warning unit is used to issue an access volume early warning to the access data based on the current access statistics and the security access threshold.

13. The system according to claim 12, characterized in that The acquisition unit is specifically used to extract the full path current access information of the current access behavior based on the current audit log of the database and the current user log of the terminal; Performing vectorization processing on the current access information of the entire path to obtain a current feature representation of the current access behavior; Statistics are collected on the access data in the current feature representation to obtain current access statistics corresponding to the access data.

14. The system according to claim 13, characterized in that The security access threshold includes: the access threshold to be compared of the access data, The early warning unit is specifically used to determine the difference between the current access statistic and the access threshold to be compared; If the difference is greater than a preset threshold, an access volume warning is issued for the access data.

15. An application method of a data security early warning method based on multidimensional time series in a power grid system, characterized in that: The data security early warning method based on multidimensional time series is a data security early warning method based on multidimensional time series according to claims 1 to 7, and the application method of the data security early warning method based on multidimensional time series in the power grid system includes: The acquired database historical audit log is the power grid database historical audit log, and the acquired terminal historical user log is the power grid terminal historical user log; Extracting full-path access information of historical grid access behaviors according to the historical audit log of the grid database and the historical user log of the grid terminal; Vectorizing the full-path access information to obtain a power grid historical feature representation of the historical power grid access behavior; Inputting the power grid historical feature representation into the long short-term memory network model for prediction to obtain the access threshold of the power grid access behavior; Based on the acquired current grid access behavior and the access threshold, an access volume warning is performed on the grid access data in the current grid access behavior.

16. An application system of a data security early warning method based on multidimensional time series in a power grid system, characterized in that: The data security early warning method based on multidimensional time series is a data security early warning method based on multidimensional time series according to claims 1 to 7, and the application system of the data security early warning method based on multidimensional time series in the power grid system includes: An acquisition module, used to acquire the database historical audit log, which is the power grid database historical audit log; and acquire the terminal historical user log, which is the power grid terminal historical user log; A second extraction module is used to extract the full path access information of the historical power grid access behavior according to the historical audit log of the power grid database and the historical user log of the power grid terminal; A second vectorization module, configured to perform vectorization processing on the full path access information to obtain a power grid historical feature representation of the historical power grid access behavior; A second prediction module is used to input the power grid historical feature representation into the long short-term memory network model for prediction to obtain an access threshold of the power grid access behavior; The second warning module is used to issue an access volume warning to the grid access data in the current grid access behavior based on the acquired current grid access behavior and the access threshold.

17. An electronic device, characterized in that: include: at least one processor and memory; The memory and the processor are connected via a bus; The memory is used to store one or more programs; When the one or more programs are executed by the at least one processor, the data security early warning method based on the multidimensional time series as described in any one of claims 1 to 7 is implemented, or the application method of the data security early warning method based on the multidimensional time series in the power grid system as described in claim 15 is implemented.

18. A readable storage medium, characterized in that: An execution program is stored thereon, and when the execution program is executed, it implements the data security early warning method based on multidimensional time series as described in any one of claims 1 to 7, or the application method of the data security early warning method based on multidimensional time series in the power grid system as described in claim 15.

Images