Network security protection method and system based on big data technology

Abstract

The invention relates to the technical field of network security management, and discloses a network security protection system based on a big data technology, and the system comprises a data collection module which is used for collecting information data, and the information data comprises user behavior data and server network flow data; the data preprocessing module is used for preprocessing the collected information data; the data storage center is used for storing the preprocessed information data; the analysis module is used for calling the information data stored in the storage center and performing security risk evaluation on the network by analyzing the information data; and the response module is used for determining and executing a protection strategy according to the safety risk evaluation result. According to the invention, the security vulnerabilities of the network are found in time through the monitoring analysis process, and the vulnerabilities are made up through the protection strategy, so that the network security is improved.

Description

Technical Field

[0001] The present invention relates to the field of network security management technology, and in particular to a network security protection method and system based on big data technology. Background Art

[0002] Cybersecurity protection is a network security technology that is dedicated to solving how to effectively control access and how to ensure the security of data transmission. In the digital age, personal privacy and information security are of vital importance. The leakage of personal data may lead to serious problems such as identity theft and property loss.

[0003] In today's fast-paced era, information technology is developing rapidly. Many companies have followed the trend of the times and migrated their businesses to the Internet, which has played a huge role in promoting the development of enterprises. However, at the same time, various network security issues have also arisen. Hackers on the Internet will exploit system vulnerabilities to attack and gain profits. Therefore, for enterprises, network security protection is not only about data protection, but also about business continuity and brand reputation. A malicious network attack may lead to the theft of corporate confidential documents, leakage of customer data, and even paralysis of the entire business system. These incidents will not only cause economic losses, but may also lead to legal proceedings and loss of customer trust, causing a devastating blow to the long-term development of the enterprise.

[0004] In the existing network security protection process, there may be security vulnerabilities in operating systems, applications, etc., which can be exploited by attackers to illegally obtain access to systems or data. Existing technologies cannot detect security vulnerabilities through monitoring and analysis in a timely manner, which will bring potential threats to network security. Summary of the invention

[0005] The purpose of the present invention is to provide a network security protection method and system based on big data technology to solve the above technical problems:

[0006] The purpose of the present invention can be achieved by the following technical solutions:

[0007] The network security protection system based on big data technology includes: a data acquisition module, which is used to collect information data, and the information data includes user behavior data and server network traffic data; a data preprocessing module, which is used to preprocess the collected information data; a data storage center, which is used to store the preprocessed information data; an analysis module, which is used to call the information data stored in the storage center, and through the analysis of the information data, conduct a security risk assessment on the network; a response module, which is used to establish and execute a protection strategy based on the security risk assessment results.

[0008] As a further technical solution, the process of collecting information data by the data collection module includes:

[0009] Obtain the user's historical access information based on log analysis, import the historical access information into the trained conversion model, and output the conversion results as user behavior data indicators;

[0010] The traffic task package of the server port is obtained through the switch mirror, and the traffic change data is obtained by parsing the traffic task package.

[0011] As a further technical solution, the process of preprocessing the collected information data includes:

[0012] By cleaning the information data, the noise, outliers and duplicate data in the information data are eliminated;

[0013] The information data is uniformly converted into a preset format and transmitted to the data storage center.

[0014] As a further technical solution, the process of analyzing the information data includes:

[0015] Get the timestamp and corresponding flow value in the flow change data;

[0016] Sort traffic data by timestamp;

[0017] Draw a flow change diagram according to the sorting results, and obtain a flow change curve by curve smoothing;

[0018] The flow change curve is calculated and analyzed, and the calculation and analysis results indicate whether the flow data is abnormal.

[0019] As a further technical solution, the process of calculating and analyzing the flow change curve is as follows:

[0020]

[0021] Among them, σ 2 is the dispersion coefficient, N is the total number of peaks and troughs of the flow change curve within the preset unit interval; f i The peak and trough flow values ​​corresponding to the flow change curve within the preset unit interval. is the average flow rate corresponding to the peak and trough; f(t) is the flow change curve; g(t) is the preset standard reference curve; t1 and t2 are the left and right endpoints of the preset unit interval respectively;

[0022] The flow anomaly risk coefficient r is calculated by formula (1) to (2) f , and compare the traffic anomaly risk coefficient with the first preset threshold r1:

[0023] If r f ≤r1, the server network traffic data is judged to be normal;

[0024] If r f >r1, the server network traffic data is judged to be abnormal and a corresponding warning signal is issued.

[0025] As a further technical solution, the process of analyzing the information data includes:

[0026] When the judgment result indicates that the server network traffic data is abnormal, the user access record information within the corresponding preset unit interval is called from the data storage center;

[0027] By formula Calculate the access anomaly risk factor r v ;

[0028] Among them, ω1, ω2, ω3 are preset weight coefficients; n is the number of user visits in the corresponding preset unit interval; m is the number of changes in the user's access address in the corresponding preset unit interval; d max The maximum value of the distance between two adjacent addresses visited by the user within the preset unit interval;

[0029] The access abnormal risk factor r v Compare with the first preset threshold r2:

[0030] If r v ≤r2, the corresponding user is judged to be a normal access user;

[0031] If r v >r2, the corresponding user is judged as an abnormal access user, and the access IP of the abnormal access user is blocked and an alarm is issued through the response module.

[0032] The network security protection method based on big data technology includes the following steps:

[0033] Step 1: Collect the behavior data of network users and the traffic data of server network;

[0034] Step 2: pre-process the collected behavior data and flow data, and transmit the pre-processed data to the data storage center for storage;

[0035] Step 3: Determine whether the traffic data is abnormal by calculating and analyzing the traffic data of the server network. If the judgment result is that the traffic data is abnormal, generate a corresponding early warning signal.

[0036] As a further technical solution, the method further includes:

[0037] Step 4: Call and analyze the user's historical behavior data, and determine whether the user is an abnormal access user based on the analysis results;

[0038] Step 5: If the user is determined to be an abnormal access user, the access IP of the abnormal access user is blocked and an alarm is issued through the response module.

[0039] Beneficial effects of the present invention:

[0040] The present invention collects and analyzes user behavior data and server network traffic data to conduct a network security assessment, then establishes and executes corresponding protection strategies based on the security assessment results, timely discovers security holes in the network through the monitoring and analysis process, and compensates for the holes through protection strategies, thereby improving network security. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] The present invention will be further described below in conjunction with the accompanying drawings.

[0042] Figure 1 This is a block diagram of the contents of the network security protection system based on big data technology in the present invention;

[0043] Figure 2 This is a flow chart of the network security protection method based on big data technology in the present invention. DETAILED DESCRIPTION

[0044] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0045] See also Figure 1 As shown, the network security protection system based on big data technology includes: a data acquisition module, which is used to collect information data, and the information data includes user behavior data and server network traffic data; a data preprocessing module, which is used to preprocess the collected information data; a data storage center, which is used to store the preprocessed information data. In addition, the data storage center can also perform disaster recovery backup of the information data; an analysis module, which is used to call the information data stored in the storage center, and through the analysis of the information data, perform security risk assessment on the network; a response module, which is used to establish and execute protection strategies according to the security risk assessment results, specifically including sending early warning prompt signals to the current users of the server, and blocking the IP addresses of abnormally accessed users.

[0046] Through the above technical scheme, this embodiment provides a network security protection system based on big data technology. By collecting and analyzing user behavior data and server network traffic data, the network is evaluated for security, and then corresponding protection strategies are formulated and executed according to the security evaluation results. The operation of the system can timely discover security vulnerabilities in the network through the above monitoring and analysis process, and make up for the vulnerabilities through protection strategies, thereby improving network security.

[0047] The process of collecting information data by the data acquisition module includes:

[0048] Obtain the user's historical access information based on log analysis, import the historical access information into the trained conversion model, and output the conversion results as user behavior data indicators;

[0049] The traffic task package of the server port is obtained through the switch mirror, and the traffic change data is obtained by parsing the traffic task package.

[0050] Through the above technical solution, this embodiment provides a process for collecting information data. Specifically, firstly, the user's historical access information is obtained according to log analysis, and the historical access information is imported into the trained conversion model, and the conversion result is output as a user behavior data indicator. The indicator may specifically include: user's access frequency, access address, access time, etc. The flow task package of the server port is obtained through the switch mirror, and the flow change data is obtained by parsing the flow task package.

[0051] The process of preprocessing the collected information data includes:

[0052] By cleaning the information data, the noise, outliers and duplicate data in the information data are eliminated;

[0053] The information data is uniformly converted into a preset format and transmitted to the data storage center.

[0054] Through the above technical solution, this embodiment provides a process for preprocessing information data, specifically, cleaning the information data, eliminating noise, abnormal values ​​and duplicate data in the information data, where abnormal values, such as negative values ​​in traffic or access frequency, are eliminated. The information data is then uniformly converted into a preset format to facilitate subsequent calculation and analysis processes, and finally transmitted to a data storage center.

[0055] The process of analyzing information data includes:

[0056] Get the timestamp and corresponding flow value in the flow change data;

[0057] Sort traffic data by timestamp;

[0058] Draw a flow change diagram according to the sorting results, and obtain a flow change curve by curve smoothing;

[0059] The flow change curve is calculated and analyzed, and the calculation and analysis results indicate whether the flow data is abnormal.

[0060] Through the above technical solution, this embodiment provides a process for analyzing information data. Specifically, firstly, the traffic packet is parsed to obtain the timestamp and the corresponding traffic value in the traffic change data, then the traffic data is sorted according to the timestamp, and the traffic change graph is drawn according to the sorting result. Finally, the traffic change curve is obtained by curve smoothing, and the smoothed traffic change curve is obtained by smoothing. The traffic change curve is calculated and analyzed, and the calculation and analysis results indicate whether the traffic data is abnormal. Usually, when a service is attacked, there will be a sudden increase in traffic and abnormal traffic fluctuations.

[0061] The process of calculating and analyzing the flow change curve is as follows:

[0062]

[0063] Among them, σ 2 is the dispersion coefficient, N is the total number of peaks and troughs of the flow change curve within the preset unit interval; f i The peak and trough flow values ​​corresponding to the flow change curve within the preset unit interval. is the average flow rate corresponding to the peak and trough; f(t) is the flow change curve; g(t) is the preset standard reference curve; t1 and t2 are the left and right endpoints of the preset unit interval respectively;

[0064] The flow anomaly risk coefficient r is calculated by formula (1) to (2) f , and compare the traffic anomaly risk coefficient with the first preset threshold r1:

[0065] If r f ≤r1, the server network traffic data is judged to be normal;

[0066] If r f >r1, the server network traffic data is judged to be abnormal and a corresponding warning signal is issued.

[0067] Through the above technical solution, this embodiment provides a process for calculating and analyzing the flow change curve. Specifically, firstly, the flow abnormality risk coefficient r is obtained through formulas (1) to (2): f , and then compare the traffic anomaly risk coefficient with the first preset threshold r1: f ≤r1, the server network traffic data is considered normal. fWhen >r1, it means that the traffic suddenly increases or fluctuates greatly, so the server network traffic data is judged to be abnormal and a corresponding warning signal is issued. It should be noted that in formulas (1) to (2), g(t) is a preset standard reference curve, which can be obtained based on empirical data (such as fitting the historical record value in the case of network security), which will not be elaborated here.

[0068] The process of analyzing information data also includes:

[0069] When the judgment result indicates that the server network traffic data is abnormal, the user access record information within the corresponding preset unit interval is called from the data storage center;

[0070] By formula Calculate the access anomaly risk factor r v ;

[0071] Among them, ω1, ω2, and ω3 are preset weight coefficients, which can be obtained through experimental fitting; n is the number of user visits in the corresponding preset unit interval; m is the number of changes in the user's access address in the corresponding preset unit interval; d max The maximum value of the distance between two adjacent addresses visited by the user within the preset unit interval;

[0072] The access abnormal risk factor r v Compare with the first preset threshold r2:

[0073] If r v ≤r2, the corresponding user is judged to be a normal access user;

[0074] If r v >r2, the corresponding user is judged as an abnormal access user, and the access IP of the abnormal access user is blocked and an alarm is issued through the response module.

[0075] Through the above technical solution, this embodiment provides other processes for analyzing information data. Specifically, if the judgment result indicates that the server network traffic data is abnormal, the user access record information within the corresponding preset unit interval is called from the data storage center, and then the formula is used. Calculate the access anomaly risk factor r v , the access abnormal risk coefficient r v Compare with the first preset threshold r2, when r v >r2, it means that the user's access is too frequent or the IP address is frequently changed, so there is a high suspicion that it is the source of the attack. Therefore, the corresponding user is judged as an abnormal access user, and the access IP of the abnormal access user is blocked and an alarm is issued through the response module.

[0076] See also Figure 2As shown, the network security protection method based on big data technology includes the following steps:

[0077] Step 1: Collect the behavior data of network users and the traffic data of server network;

[0078] Step 2: pre-process the collected behavior data and flow data, and transmit the pre-processed data to the data storage center for storage;

[0079] Step 3: Determine whether the traffic data is abnormal by calculating and analyzing the traffic data of the server network. If the judgment result is that the traffic data is abnormal, generate a corresponding early warning signal.

[0080] Step 4: Call and analyze the user's historical behavior data, and determine whether the user is an abnormal access user based on the analysis results;

[0081] Step 5: If the user is determined to be an abnormal access user, the access IP of the abnormal access user is blocked and an alarm is issued through the response module.

[0082] Through the above technical solution, this embodiment provides a network security protection method based on big data technology, which collects and analyzes user behavior data and server network traffic data, conducts a security evaluation of the network, and then establishes and executes a corresponding protection strategy based on the security evaluation results, timely discovers security vulnerabilities in the network through the monitoring and analysis process, and compensates for the vulnerabilities through the protection strategy, thereby improving network security. In addition, the specific order of the monitoring and analysis process is to first determine whether the network traffic data within a certain time period is abnormal, and if it is abnormal, it triggers the analysis of the user behavior data within the time period. Therefore, the entire judgment process does not need to monitor the user's behavior information at all times, which not only protects the user's privacy to a certain extent, but also saves the computing power occupied by the continuous monitoring process.

[0083] The present invention may be a system, a method and / or a computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for causing a processor to implement various aspects of the present invention.

[0084] A computer-readable storage medium may be a tangible device that can hold and store instructions used by an instruction execution device. A computer-readable storage medium may be, for example, but not limited to, an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. More specific examples of computer-readable storage media (a non-exhaustive list) include: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disk read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanical encoding device, such as a punch card or a raised structure in a groove on which instructions are stored, and any suitable combination of the foregoing. As used herein, a computer-readable storage medium is not to be interpreted as a transient signal per se, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagating through a waveguide or other transmission medium (e.g., a light pulse through a fiber optic cable), or an electrical signal transmitted through a wire.

[0085] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing / processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in the computer-readable storage medium in each computing / processing device.

[0086] Although the present invention is disclosed as above, the protection scope of the present invention is not limited thereto. Those skilled in the art may make various changes and modifications without departing from the spirit and scope of the present invention, and these changes and modifications will fall within the protection scope of the present invention.

Claims

1. A network security protection system based on big data technology, characterized by: The system comprises: A data collection module is used to collect information data, wherein the information data includes user behavior data and server network flow data; A data preprocessing module is used to preprocess the collected information data; Data storage center, used to store pre-processed information data; The analysis module is used to call the information data stored in the storage center and conduct security risk assessment on the network by analyzing the information data; The response module is used to establish and execute protection strategies based on the security risk assessment results.

2. The network security protection system based on big data technology according to claim 1 is characterized in that: The process of collecting information data by the data acquisition module includes: Obtain the user's historical access information based on log analysis, import the historical access information into the trained conversion model, and output the conversion results as user behavior data indicators; The traffic task package of the server port is obtained through the switch mirror, and the traffic change data is obtained by parsing the traffic task package.

3. The network security protection system based on big data technology according to claim 2 is characterized in that: The process of preprocessing the collected information data includes: By cleaning the information data, the noise, outliers and duplicate data in the information data are eliminated; The information data is uniformly converted into a preset format and transmitted to the data storage center.

4. The network security protection system based on big data technology according to claim 3 is characterized in that: The process of analyzing information data includes: Get the timestamp and corresponding flow value in the flow change data; Sort traffic data by timestamp; Draw a flow change graph according to the sorting results, and obtain a flow change curve by curve smoothing; The flow change curve is calculated and analyzed, and the calculation and analysis results indicate whether the flow data is abnormal.

5. The network security protection system based on big data technology according to claim 4 is characterized in that: The process of calculating and analyzing the flow change curve is as follows: Among them, σ 2 is the dispersion coefficient, N is the total number of peaks and troughs of the flow change curve within the preset unit interval; f i The peak and trough flow values ​​corresponding to the flow change curve within the preset unit interval. is the average flow rate corresponding to the peak and trough; f(t) is the flow change curve; g(t) is the preset standard reference curve; t1 and t2 are the left and right endpoints of the preset unit interval respectively; The flow anomaly risk coefficient r is calculated by formula (1) to (2) f , and compare the traffic anomaly risk coefficient with the first preset threshold r1: If r f ≤r1, the server network traffic data is judged to be normal; If r f >r1, the server network traffic data is judged to be abnormal and a corresponding warning signal is issued.

6. The network security protection system based on big data technology according to claim 5 is characterized in that: The process of analyzing information data also includes: When the judgment result indicates that the server network traffic data is abnormal, the user access record information within the corresponding preset unit interval is called from the data storage center; By formula Calculate the access anomaly risk factor r v ; Among them, ω1, ω2, ω3 are preset weight coefficients; n is the number of user visits in the corresponding preset unit interval; m is the number of changes in the user's access address in the corresponding preset unit interval; d max The maximum value of the distance between two adjacent addresses visited by the user within the preset unit interval; The access abnormal risk factor r v Compare with the first preset threshold r2: If r v ≤r2, the corresponding user is judged to be a normal access user; If r v >r2, the corresponding user is judged as an abnormal access user, and the access IP of the abnormal access user is blocked and an alarm is issued through the response module.

7. A network security protection method based on big data technology, characterized in that: The method is executed in a network security protection system based on big data technology according to any one of claims 1 to 6, and the method comprises the following steps: Step 1: Collect the behavior data of network users and the traffic data of server network; Step 2: pre-process the collected behavior data and flow data, and transmit the pre-processed data to the data storage center for storage; Step 3: Determine whether the traffic data is abnormal by calculating and analyzing the traffic data of the server network. If the judgment result is that the traffic data is abnormal, generate a corresponding early warning signal.

8. The network security protection method based on big data technology according to claim 7 is characterized in that: The method further comprises: Step 4: Call and analyze the user's historical behavior data, and determine whether the user is an abnormal access user based on the analysis results; Step 5: If the user is determined to be an abnormal access user, the access IP of the abnormal access user is blocked and an alarm is issued through the response module.

Images