Protection method and device for important business system data, electronic equipment and storage medium

Abstract

The invention discloses a protection method and device for important business system data, electronic equipment and a storage medium. The method comprises the steps that S1, WEB isolation service is set between a WEB browser and a business system to serve as a front blocking barrier; s2, defining a behavior data acquisition index of user WEB end operation; s3, analyzing, establishing and training the collected historical behavior data of the WEB terminal operation of the user to obtain a user operation behavior classification model, wherein the behavior classification model is used for classifying and marking the historical behavior data of the WEB terminal operation of the user into a normal class, an early warning class and a violation class; and S4, inputting the current behavior data of the user WEB end operation collected in real time into the user operation behavior classification model for classification, associating a classification result to a corresponding action, and feeding back the action to the front end. According to the method, the risk that the text control platform is bypassed is avoided, centralized analysis of user operation behaviors is realized, and the security of important service system data is ensured.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and in particular, to a method, device, equipment and storage medium for protecting important business system data. Background Art

[0002] The document control management platform is an information tool that integrates multiple functions such as security management, control, monitoring, and alarm. It is mainly used to manage and control corporate document systems, aiming to improve the efficiency and security of document management. Its basic functions include data monitoring, permission management, access control, security alarms, vulnerability scanning, etc. Data monitoring can help companies monitor the flow of data in real time, detect data anomalies or leaks in a timely manner, and help companies achieve centralized management and control of information. Through the security control platform, companies can centrally manage and monitor the information of different departments and employees to avoid information leakage and abuse. However, the existing document control management platform has the following problems:

[0003] 1. Risk of being bypassed: From a technical solution perspective, the document control management platform is a post-service rather than a pre-protection barrier. Whether to go through the document control platform depends on management regulations rather than technical means. When the business system has configuration errors, whitelist mechanisms, or code vulnerabilities, the document control management platform can be bypassed.

[0004] 2. There is a lack of centralized and comprehensive user behavior analysis for data browsing and downloading scenarios: Users' data browsing and downloading operations are scattered across various business systems, making it difficult to conduct a unified and centralized analysis of user operation behaviors. Summary of the invention

[0005] On the one hand, the present application provides a method for protecting important business system data to solve the technical problems that the existing document control management platform has the risk of being bypassed and it is difficult to perform unified and centralized analysis of user operation behaviors.

[0006] This application is implemented through the following scheme:

[0007] A method for protecting important business system data, comprising the steps of:

[0008] S1. Set up a web isolation service between the web browser and the business system as a pre-blocking barrier, so that the download blocking behavior does not depend on the business system configuration and is not affected by code bypass;

[0009] S2. Define the behavior data collection index of the user's WEB operation, which is associated with the data security requirements of the business system;

[0010] S3, analyzing the collected historical behavior data of user WEB terminal operations and establishing and training a user operation behavior classification model, wherein the behavior classification model is used to classify and mark the historical behavior data of user WEB terminal operations into three categories: normal category, warning category, and violation category;

[0011] S4. The current behavior data of user WEB operations collected in real time is input into the user operation behavior classification model and classified into three categories: normal class, warning class, and violation class. At the same time, the classification results are associated with corresponding actions and fed back to the front end.

[0012] Furthermore, the behavioral data collection indicators include: number of rows, frequency, cumulative number of times, cumulative number of rows, whether it is suspected sensitive data, consistency of the probability of sensitive fields before and after the behavior, special time periods, and the time spent on the query interface.

[0013] Furthermore, the step S3 specifically includes the steps of:

[0014] S31. Collect historical major violations and define rules to restrict illegal downloads or browser operations from a global perspective;

[0015] S32, extracting historical behavior data of user's WEB terminal operation;

[0016] S33. For each collected single behavior data indicator, a normal distribution model is established, and the behavior data is classified using the 3σ criterion; each single behavior data within the 3σ interval is defined as a normal class, and each single behavior data outside the 3σ interval is defined as an abnormal class, including a warning class and a violation class;

[0017] S34. Classify each single behavior data outside the 3σ interval into violation category and warning category through clustering algorithm and 3σ criterion:

[0018] S35, applying a frequent item extraction algorithm to extract frequent item sets based on the full indicator data set of the user's WEB-side operation behavior indicators, obtaining the correlation between the data indicators, and using the extracted frequent item sets as combined indicators;

[0019] S36. Based on the combined index obtained from the frequent item set analysis, the behavior data is classified into warning and violation categories using a model combining the clustering algorithm and the 3σ criterion classification algorithm;

[0020] S37, forming a user profile by combining the classification results of a single behavior data indicator and a combination indicator based on frequent item sets, and obtaining the categories of the final user operation behavior classification model: normal category, warning category, and violation category;

[0021] S38, adjusting the parameters of the user operation behavior classification model, and forming a stable user operation behavior classification model through multiple rounds of iterations and manual intervention assistance;

[0022] S39, marking the classification results of the historical behavior data of the user's WEB terminal operation and storing them in the database;

[0023] S310, associating the classification results with different actions. For the warning category, a warning pop-up window is inserted during the user operation process; for the violation category, a blue screen or shutdown is triggered to complete the model construction.

[0024] Furthermore, the current behavior data of the user's WEB-side operation is collected in real time and directly extracted from the log.

[0025] Furthermore, the step S2 further comprises the steps of:

[0026] Preprocess the extracted historical behavior data and convert it into a standard data format.

[0027] Furthermore, the step S34 specifically includes the steps of:

[0028] S341, using a clustering algorithm similar to K-means to divide each single behavior data into two categories, and then re-constructing normal distribution models for the two categories of data, and applying the 3σ criterion to distinguish them;

[0029] S342, marking the data within the 3σ interval as core data;

[0030] S343, based on the labeled core data, apply a classification algorithm similar to a decision tree to classify the remaining data;

[0031] S344. Among the above two types of data, the categories that deviate from the overall mean by more than the set threshold are classified as violation categories, rules are formed based on the characteristics of the indicators and added to the rule base, and the remaining categories are defined as warning categories.

[0032] Furthermore, the step S36 specifically includes the steps of:

[0033] S361, using a clustering algorithm similar to K-means to divide the combined indicator behavior data obtained from frequent item set analysis into two categories, and then re-constructing normal distribution models for the two types of behavior data, and applying the 3σ criterion to distinguish them;

[0034] S362, marking the behavior data within the 3σ interval as core data;

[0035] S363, based on the marked core data, apply the decision tree classification algorithm to classify the remaining data;

[0036] S364. Among the above two types of data, the categories that deviate from the overall mean by more than the set threshold are classified as violation categories, rules are formed based on the characteristics of the indicators and added to the rule base, and the remaining categories are defined as warning categories.

[0037] On the other hand, the present application also provides a protection device for important business system data, including:

[0038] The pre-blocking setting module is used to set up a WEB isolation service between the WEB browser and the business system as a pre-blocking barrier, so that the download blocking behavior does not depend on the business system configuration and is not affected by code bypassing;

[0039] A behavior data collection indicator definition module is used to define the behavior data collection indicators of user WEB terminal operations, and the behavior data collection indicators are associated with the data security requirements of the business system;

[0040] The classification model building module is used to analyze the collected historical behavior data of user WEB terminal operations and build and train a user operation behavior classification model. The behavior classification model is used to classify the historical behavior data of user WEB terminal operations and classify and mark them into three situations: normal, warning, and violation;

[0041] The user operation behavior classification module is used to input the current behavior data of user WEB operations collected in real time into the user operation behavior classification model, and classify it into three situations: normal, warning, and violation. At the same time, the classification results are associated with corresponding actions and fed back to the front end.

[0042] On the other hand, the present application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the method for protecting important business system data when executing the computer program.

[0043] On the other hand, the present application further provides a storage medium, which includes a stored program, and when the program is run, controls the device where the storage medium is located to execute the steps of the protection method for important business system data.

[0044] Compared with the prior art, this application has the following beneficial effects:

[0045] 1. This application sets up a WEB isolation service as an isolation method, so that the download blocking behavior does not rely on the business system configuration and is not affected by code bypass, which facilitates centralized and comprehensive user behavior analysis and perfect processing solutions for all user behaviors (data browsing and downloading scenarios).

[0046] 2. This application defines three different operation models: normal, warning and violation, which can judge user behavior in real time, effectively realize data protection and improve data security.

[0047] 3. This application performs multi-step, progressive classification modeling on a single behavioral data indicator, ensuring the stability of the classification model.

[0048] 4. This application obtains a frequent item set (user operation mode) of user behavior data by jointly analyzing multiple behavior data indicators, and then obtains new classification rules based on the operation mode using an analysis method similar to a single indicator. This reduces the complexity of the modeling process.

[0049] 5. This application forms a complete user abnormal behavior analysis model by integrating single behavior data indicators and classification rules of frequent item sets (user operation patterns), which not only improves the accuracy and deep mining capabilities of user behavior classification, but also improves the timeliness and accuracy of abnormal behavior detection.

[0050] In addition to the above-described purposes, features and advantages, the present application also has other purposes, features and advantages. The present application will be further described in detail with reference to the drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] The drawings constituting a part of the present application are used to provide a further understanding of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application.

[0052] Figure 1 It is a flowchart of a method for protecting important business system data according to a preferred embodiment of the present application.

[0053] Figure 2 It is a schematic diagram of the sub-step flow of step S3 of the preferred embodiment of the present application.

[0054] Figure 3 It is a schematic diagram of the sub-step flow of step S34 of the preferred embodiment of the present application.

[0055] Figure 4 It is a schematic diagram of the sub-step flow of step S36 of the preferred embodiment of the present application.

[0056] Figure 5 It is a schematic diagram of a protection device module for important business system data in a preferred embodiment of the present application.

[0057] Figure 6 It is a schematic block diagram of an electronic device entity of a preferred embodiment of the present application.

[0058] Figure 7It is a diagram of the internal structure of a computer device of a preferred embodiment of the present application. DETAILED DESCRIPTION

[0059] The embodiments of the present application are described in detail below in conjunction with the accompanying drawings, but the present application can be implemented in a variety of different ways defined and covered below.

[0060] Example 1

[0061] like Figure 1 As shown, the preferred embodiment of the present application provides a method for protecting important business system data, comprising the steps of:

[0062] S1. Set up a web isolation service between the web browser and the business system as a pre-blocking barrier, so that the download blocking behavior does not depend on the business system configuration and is not affected by code bypass;

[0063] S2. Define the behavior data collection index of the user's WEB operation, which is associated with the data security requirements of the business system;

[0064] S3, analyzing the collected historical behavior data of user WEB terminal operations and establishing and training a user operation behavior classification model, wherein the behavior classification model is used to classify and mark the historical behavior data of user WEB terminal operations into three categories: normal category, warning category, and violation category;

[0065] S4. The current behavior data of user WEB operations collected in real time is input into the user operation behavior classification model and classified into three categories: normal class, warning class, and violation class. At the same time, the classification results are associated with corresponding actions and fed back to the front end.

[0066] This embodiment provides a method for protecting important business system data. The method has the following features:

[0067] Beneficial effects:

[0068] 1. The protection method of this embodiment sets up a WEB isolation service as an isolation means, so that the download blocking behavior does not rely on the business system configuration and is not affected by code bypass, which facilitates centralized and comprehensive user behavior analysis and perfect processing solutions for all user behaviors (data browsing and downloading scenarios).

[0069] 2. The protection method of this embodiment defines three different operation models: normal, warning and violation, which can judge user behavior in real time, effectively realize data protection and improve data security.

[0070] 3. The protection method of this embodiment ensures the stability of the classification model by performing multi-step, progressive classification modeling on a single behavior data indicator.

[0071] 4. The protection method of this embodiment obtains a frequent item set (user operation mode) of user behavior data by jointly analyzing multiple behavior data indicators, and then obtains a new classification rule based on the operation mode using an analysis method similar to a single indicator. This method reduces the complexity of the modeling process.

[0072] 5. The protection method of this embodiment forms a complete user abnormal behavior analysis model by integrating the classification rules of single behavior data indicators and frequent item sets (user operation patterns), which not only improves the accuracy and deep mining capabilities of user behavior classification, but also improves the timeliness and accuracy of abnormal behavior detection.

[0073] Example 2

[0074] The behavioral data collection indicators include: number of rows, frequency, cumulative number of times, cumulative number of rows, whether it is suspected sensitive data, the probability of sensitive fields, the consistency of previous and subsequent behaviors, special time periods, and the time spent on the query interface. The above data collection indicators are closely related to the data security of the business system. By setting the above indicators, the necessary data support is provided for the protection of important business system data.

[0075] Example 3

[0076] like Figure 2 As shown, the step S3 specifically includes the steps of:

[0077] S31. Collect historical major violations and define rules to restrict illegal downloads or browser operations from a global perspective;

[0078] S32, extracting historical behavior data of user's WEB terminal operation;

[0079] S33. For each collected single behavior data indicator, a normal distribution model is established, and the behavior data is classified using the 3σ criterion; each single behavior data within the 3σ interval is defined as a normal class, and each single behavior data outside the 3σ interval is defined as an abnormal class, including a warning class and a violation class;

[0080] S34. Classify each single behavior data outside the 3σ interval into violation category and warning category through clustering algorithm and 3σ criterion:

[0081] S35, applying a frequent item extraction algorithm to extract frequent item sets based on the full indicator data set of the user's WEB-side operation behavior indicators, obtaining the correlation between the data indicators, and using the extracted frequent item sets as combined indicators;

[0082] S36. Based on the combined index obtained from the frequent item set analysis, the behavior data is classified into warning and violation categories using a model combining the clustering algorithm and the 3σ criterion classification algorithm;

[0083] S37, forming a user profile by combining the classification results of a single behavior data indicator and a combination indicator based on frequent item sets, and obtaining the categories of the final user operation behavior classification model: normal category, warning category, and violation category;

[0084] S38, adjusting the parameters of the user operation behavior classification model, and forming a stable user operation behavior classification model through multiple rounds of iterations and manual intervention assistance;

[0085] S39, marking the classification results of the historical behavior data of the user's WEB terminal operation and storing them in the database;

[0086] S310, associating the classification results with different actions. For the warning category, a warning pop-up window is inserted during the user operation process; for the violation category, a blue screen or shutdown is triggered to complete the model construction.

[0087] This embodiment analyzes the collected historical behavior data of user WEB operations and establishes and trains a user operation behavior classification model, which has the following benefits: a risk warning mechanism can be established to promptly discover and deal with potential security threats, thereby taking timely measures to ensure user account security.

[0088] Example 4

[0089] When collecting the current behavior data of user web-side operations in real time, it is directly extracted from the log to ensure the reliability of the source of the behavior data and the accuracy of the behavior data.

[0090] Example 5

[0091] In the preferred embodiment of the present invention, the step S2 further comprises the steps of:

[0092] Preprocess the extracted historical behavior data and convert it into a standard data format.

[0093] This embodiment converts historical behavior data in different formats into a standard data format to facilitate subsequent equivalent analysis and processing of the data.

[0094] Example 6

[0095] like Figure 3 As shown, the step S34 specifically includes the steps of:

[0096] S341, using a clustering algorithm similar to K-means to divide each single behavior data into two categories, and then re-constructing normal distribution models for the two categories of data, and applying the 3σ criterion to distinguish them;

[0097] S342, marking the data within the 3σ interval as core data;

[0098] S343, based on the labeled core data, apply a classification algorithm similar to a decision tree to classify the remaining data;

[0099] S344. Among the above two types of data, the categories that deviate from the overall mean by more than the set threshold are classified as violation categories, rules are formed based on the characteristics of the indicators and added to the rule base, and the remaining categories are defined as warning categories.

[0100] This embodiment ensures the stability of the classification model by performing multi-step, progressive classification modeling on a single behavior data indicator.

[0101] Example 7

[0102] like Figure 4 As shown, the step S36 specifically includes the steps of:

[0103] The step S36 specifically includes the following steps:

[0104] S361, using a clustering algorithm similar to K-means to divide the combined indicator behavior data obtained from frequent item set analysis into two categories, and then re-constructing normal distribution models for the two types of behavior data, and applying the 3σ criterion to distinguish them;

[0105] S362, marking the behavior data within the 3σ interval as core data;

[0106] S363, based on the marked core data, apply the decision tree classification algorithm to classify the remaining data;

[0107] S364. Among the above two types of data, the categories that deviate from the overall mean by more than the set threshold are classified as violation categories, rules are formed based on the characteristics of the indicators and added to the rule base, and the remaining categories are defined as warning categories.

[0108] This embodiment obtains a frequent item set (user operation mode) of user behavior data by jointly analyzing multiple behavior data indicators, and then obtains new classification rules based on the operation mode using an analysis method similar to a single indicator, thereby reducing the complexity of the modeling process.

[0109] Example 8

[0110] like Figure 5 As shown, another preferred embodiment of the present application provides a protection device for important business system data, including:

[0111] The pre-blocking setting module is used to set up a WEB isolation service between the WEB browser and the business system as a pre-blocking barrier, so that the download blocking behavior does not depend on the business system configuration and is not affected by code bypassing;

[0112] A behavior data collection indicator definition module is used to define the behavior data collection indicators of user WEB terminal operations, and the behavior data collection indicators are associated with the data security requirements of the business system;

[0113] The classification model building module is used to analyze the collected historical behavior data of user WEB terminal operations and build and train a user operation behavior classification model. The behavior classification model is used to classify the historical behavior data of user WEB terminal operations and classify and mark them into three situations: normal, warning, and violation;

[0114] The user operation behavior classification module is used to input the current behavior data of user WEB operations collected in real time into the user operation behavior classification model, and classify it into three situations: normal, warning, and violation. At the same time, the classification results are associated with corresponding actions and fed back to the front end.

[0115] like Figure 6 As shown, a preferred embodiment of the present application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the method for protecting important business system data in the above-mentioned embodiment when executing the computer program.

[0116] like Figure 7 As shown, the preferred embodiment of the present application also provides a computer device, which can be a terminal or a liveness detection server, and its internal structure diagram can be as shown in Figure 7 As shown. The computer device includes a processor, a memory and a network interface connected via a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the computer device is used to communicate with other external computer devices via a network connection. When the computer program is executed by the processor, the steps of the above-mentioned method for protecting important business system data are implemented.

[0117] Those skilled in the art will understand that Figure 7 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0118] A preferred embodiment of the present application further provides a storage medium, which includes a stored program, and when the program is executed, controls the device where the storage medium is located to execute the steps of the method for protecting important business system data in the above embodiment.

[0119] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0120] If the functions described in the method of this embodiment are implemented in the form of software functional units and sold or used as independent products, they can be stored in one or more computing devices readable storage media. Based on this understanding, the part of the embodiment of the present application that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions to enable a computing device (which can be a personal computer, server, mobile computing device or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program code.

[0121] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of complete hardware embodiments, complete software embodiments, or embodiments in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code. The scheme in the embodiments of the present application can be implemented in various computer languages, for example, object-oriented programming language Java and literal scripting language JavaScript, etc.

[0122] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0123] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0124] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0125] Although the preferred embodiments of the present application have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0126] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A method for protecting important business system data, characterized in that: Includes steps: S1. Set up a web isolation service between the web browser and the business system as a pre-blocking barrier, so that the download blocking behavior does not depend on the business system configuration and is not affected by code bypassing; S2. Define the behavior data collection index of the user's WEB operation, which is associated with the data security requirements of the business system; S3, analyzing the collected historical behavior data of user WEB terminal operations and establishing and training a user operation behavior classification model, wherein the behavior classification model is used to classify and mark the historical behavior data of user WEB terminal operations into three categories: normal category, warning category, and violation category; S4. The current behavior data of user WEB operations collected in real time is input into the user operation behavior classification model and classified into three categories: normal class, warning class, and violation class. At the same time, the classification results are associated with corresponding actions and fed back to the front end.

2. The method for protecting important business system data according to claim 1, characterized in that: The behavioral data collection indicators include: number of rows, frequency, cumulative number of times, cumulative number of rows, whether it is suspected sensitive data, consistency of the probability of sensitive fields before and after the behavior, special time periods, and the time spent on the query interface.

3. The method for protecting important business system data according to claim 1, characterized in that: The step S3 specifically comprises the following steps: S31. Collect historical major violations and define rules to restrict illegal downloads or browser operations from a global perspective; S32, extracting historical behavior data of user's WEB terminal operation; S33. For each collected single behavior data indicator, a normal distribution model is established, and the behavior data is classified using the 3σ criterion; each single behavior data within the 3σ interval is defined as a normal class, and each single behavior data outside the 3σ interval is defined as an abnormal class, including a warning class and a violation class; S34. Classify each single behavior data outside the 3σ interval into violation category and warning category through clustering algorithm and 3σ criterion: S35, applying a frequent item extraction algorithm to extract frequent item sets based on the full indicator data set of the user's WEB-side operation behavior indicators, obtaining the correlation between the data indicators, and using the extracted frequent item sets as combined indicators; S36. Based on the combined index obtained from frequent item set analysis, the behavior data is classified into warning and violation categories using a model combining clustering algorithm and 3σ criterion classification algorithm; S37, forming a user profile by combining the classification results of a single behavior data indicator and a combination indicator based on frequent item sets, and obtaining the categories of the final user operation behavior classification model: normal category, warning category, and violation category; S38, adjusting the parameters of the user operation behavior classification model, and forming a stable user operation behavior classification model through multiple rounds of iterations and manual intervention assistance; S39, marking the classification results of the historical behavior data of the user's WEB terminal operation and storing them in the database; S310, associating the classification results with different actions. For the warning category, a warning pop-up window is inserted during the user operation process; for the violation category, a blue screen or shutdown is triggered to complete the model construction.

4. The method for protecting important business system data according to claim 1, characterized in that: When collecting the current behavior data of user web operations in real time, it is extracted directly from the log.

5. The method for protecting important business system data according to claim 1, characterized in that: The step S2 further comprises the steps of: Preprocess the extracted historical behavior data and convert it into a standard data format.

6. The method for protecting important business system data according to claim 3, characterized in that: The step S34 specifically includes the following steps: S341, using a clustering algorithm similar to K-means to divide each single behavior data into two categories, and then re-constructing normal distribution models for the two categories of data, and applying the 3σ criterion to distinguish them; S342, marking the data within the 3σ interval as core data; S343, based on the labeled core data, apply a classification algorithm similar to a decision tree to classify the remaining data; S344. Among the above two types of data, the categories that deviate from the overall mean by more than the set threshold are classified as violation categories, rules are formed based on the characteristics of the indicators and added to the rule base, and the remaining categories are defined as warning categories.

7. The method for protecting important business system data according to any one of claim 3, characterized in that: The step S36 specifically includes the following steps: S361, using a clustering algorithm similar to K-means to divide the combined indicator behavior data obtained from frequent item set analysis into two categories, and then re-constructing normal distribution models for the two types of behavior data, and applying the 3σ criterion to distinguish them; S362, marking the behavior data within the 3σ interval as core data; S363, based on the marked core data, apply the decision tree classification algorithm to classify the remaining data; S364. Among the above two types of data, the categories that deviate from the overall mean by more than the set threshold are classified as violation categories, rules are formed based on the characteristics of the indicators and added to the rule base, and the remaining categories are defined as warning categories.

8. A protection device for important business system data, characterized in that: include: The pre-blocking setting module is used to set up a WEB isolation service between the WEB browser and the business system as a pre-blocking barrier, so that the download blocking behavior does not depend on the business system configuration and is not affected by code bypassing; A behavior data collection indicator definition module is used to define the behavior data collection indicators of user WEB terminal operations, and the behavior data collection indicators are associated with the data security requirements of the business system; The classification model building module is used to analyze the collected historical behavior data of user WEB terminal operations and build and train a user operation behavior classification model. The behavior classification model is used to classify the historical behavior data of user WEB terminal operations and classify and mark them into three situations: normal, warning, and violation; The user operation behavior classification module is used to input the current behavior data of user WEB operations collected in real time into the user operation behavior classification model, and classify it into three situations: normal, warning, and violation. At the same time, the classification results are associated with corresponding actions and fed back to the front end.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the method for protecting important business system data as described in any one of claims 1 to 7 are implemented.

10. A storage medium, comprising a stored program, which controls a device where the storage medium is located to execute the steps of the method for protecting important business system data as claimed in any one of claims 1 to 7 when the program is executed.

Images