Computer network security protection system based on big data

Abstract

The invention discloses a computer network security protection system based on big data, and relates to the technical field of network security, the computer network security protection system comprises a cloud processing platform, a model library, at least one group of acquisition modules and a working layer, the model library extracts preset key features corresponding to historical working data of a computer network, and establishes a corresponding data big model; the working layer is a basic operation layer of the computer network and is responsible for reflecting various data and behaviors of the computer network in normal operation; and the acquisition module is matched with a corresponding computer network in the working layer, monitors access data in a bypass mode, and transmits the access data to the cloud processing platform. Through fusion of multi-dimensional data features, various types of abnormal traffic can be accurately identified, especially for protection of a novel attack mode, false alarm and missing alarm are reduced, and through real-time traffic analysis and baseline dynamic updating, the system can quickly respond to changes of network traffic.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a computer network security protection system based on big data. Background Art

[0002] With the rapid development of information technology, network security issues are becoming more and more complex, especially in the face of new threats such as distributed denial of service (DDoS) attacks, SQL injection, crawler attacks and brute force cracking, traditional network security protection methods face many challenges. Most of the existing security protection technologies rely on rule-based protection systems to identify malicious traffic by setting fixed rules and signature matching.

[0003] With the rise of big data technology and cloud computing, network security protection technology based on massive data traffic analysis has gradually become a research hotspot. These methods can identify abnormal behaviors and potential threats based on multi-dimensional features (such as IP address distribution, request path, request frequency, etc.) through comprehensive collection and in-depth analysis of traffic, especially for new types of attacks.

[0004] After searching, a Chinese patent (CN118748611B) discloses a network security protection method and system, which includes obtaining user behavior data of the target user and determining the user's current network security level; automatically adjusting the weight parameters of the activity index, login abnormality index, operation index and operation abnormality index according to the real-time status and historical data of the network environment; using the collected user behavior data to establish a mixed state model to identify and predict normal and abnormal behavior patterns; based on the dynamically adjusted weight parameters, calculating the comprehensive security parameters of the target user, and then determining the user's overall security level; dynamically adjusting the network access control policy according to the user's security level.

[0005] In the prior art, the existing anomaly detection methods based on traffic statistics usually rely on historical data for pattern recognition, and have weak rapid response capabilities to real-time traffic. In addition, the existing systems usually only focus on the overall statistical characteristics of traffic, such as the number of IPs, traffic growth rate, etc., but ignore more fine-grained data features such as request paths and request parameters. Such an analysis method may miss some relatively hidden attack behaviors, so the present invention proposes a computer network security protection system based on big data. Summary of the invention

[0006] The purpose of the present invention is to provide a computer network security protection system based on big data to solve the problems mentioned in the above background technology.

[0007] The present invention can be implemented by the following technical solutions: A computer network security protection system based on big data, including a cloud processing platform, a model library, at least one set of acquisition modules and a working layer;

[0008] The model library establishes a corresponding data model based on the historical working data of the corresponding computer network, wherein the historical working data includes the regional distribution data of IP addresses, the traffic data of each regional IP in different time periods, the access content of each regional IP and the request frequency of each IP;

[0009] When collecting historical working data of the corresponding computer network, the model library extracts the preset key features of the corresponding historical data for training the data model. The key features include: time series features, spatial features, content features and traffic statistics features.

[0010] The working layer is the basic operation layer of the computer network, responsible for reflecting various data and behaviors of the computer network in normal operation;

[0011] The acquisition module matches the corresponding computer network in the working layer and uses a bypass method to monitor access data, which can reduce interference with the computer network in the working layer while obtaining access data;

[0012] After obtaining the access data, the acquisition module transmits the access data to the cloud processing platform;

[0013] After receiving the access data, the cloud processing platform analyzes the access data to obtain IP quantity data, real-time distribution data of IP addresses, real-time access content data of IPs, and request frequency of corresponding IPs;

[0014] The cloud processing module calculates the network security index S based on the IP quantity data, the real-time distribution data of IP addresses, the real-time access content data of IPs and the request frequency of the corresponding IPs. t , the specific formula is:

[0015]

[0016] Where N is the number of IPs per unit time, which is obtained through IP quantity data;

[0017] D t It is the real-time geographic distribution entropy of IP addresses, which is obtained through the real-time distribution data of IP addresses. By calculating the distribution of IP addresses in different geographical locations, the concentration of access sources is analyzed.

[0018] and m is the total number of different geographical locations, Q i is the percentage of IP addresses in a certain geographical location i, D tThe larger the value, the more evenly distributed the IP addresses are and the more dispersed the access sources are. t The smaller it is, the more traffic comes from the same area;

[0019] C t It is the diversity of IP access content, which is obtained through the real-time access content data of IP, specifically from the URL, API request, port usage, etc. accessed by IP in real time. The calculation method is:

[0020] Where r is the number of all different content categories, q j is the probability that a URL, API or resource category j is accessed; C t The larger the size, the more diverse the content accessed; C t The smaller it is, the more IP addresses access the same content.

[0021] F t is the IP request frequency, which is obtained by the corresponding IP request frequency; the calculation method is:

[0022] Where N is the number of IPs per unit time; f i is the number of requests from the ith IP within time t;

[0023] P i is the abnormal probability of a single IP;

[0024] And the cloud processing platform will increase the network security index S t Compare with the preset safety threshold;

[0025] If the network security index S t If the preset security threshold is exceeded, the security protection of the corresponding computer network will be triggered, including secondary verification, traffic speed limit, access interception, blacklist control, etc.

[0026] If the network security index S t ≥The preset security threshold will mark the IP as a normal IP and maintain the existing computer network access policy.

[0027] A further technical improvement of the present invention is that: i The method for obtaining comprises the following steps:

[0028] S1. The cloud processing platform calculates the number of IP accesses per unit time and normalizes it to obtain the IP access frequency f' i ;

[0029] S2, the cloud processing platform calculates the resource distribution entropy C accessed by the corresponding IP in different time periods i , to determine whether the access pattern is abnormal, the formula used is

[0030] z is the total number of different content categories accessed by the corresponding IP, q a is the probability of the corresponding IP accessing category a within the time window, that is, q a = Number of visits of category a / total number of visits of the IP;

[0031] S3. The cloud processing platform compares the historical access records and the trusted region database by the IP location to determine the geographical risk score G of the IP. i ;

[0032] S4. Detect whether the port accessed by the IP is an atypical port, whether the protocol usage involves abnormal behavior, and obtain the port abnormality value Y based on the detection results. i If the corresponding IP address does not authorize the port or uses an abnormal protocol, the port abnormal value Y i Increase;

[0033] Y i = Abnormal port access times / total access times;

[0034] S5. Query the security database to determine whether the IP has been marked as a malicious source, and obtain the IP's reputation score B based on the number of times it has been marked. i ;

[0035] B i The value range of is [0,1];

[0036] S6, based on formula P i =ω1·f' i +ω2·C i +v3·G i +ω4·Y i +ω5·B i , calculate the abnormal probability P of a single IP i ;

[0037] Where ω1, ω2, ω3, ω4 and ω5 are the weights of the corresponding features, which are adjusted by historical data.

[0038] A further technical improvement of the present invention is that when the cloud processing platform obtains the real-time distribution data of IP addresses, it counts the geographical location of each IP address and monitors the growth amount and growth rate of the number of IP addresses in each geographical location to determine whether the access data has malicious characteristics.

[0039] A further technical improvement of the present invention is that the method for the cloud processing platform to determine access data includes the following steps:

[0040] Q1. Collect access data in the corresponding time window and analyze the geographical location of each IP in combination with the preset IP location query database;

[0041] Q2: Count the number of unique IP addresses N in different geographical locations loc within a unit time t loc (t), the formula is:

[0042] Where N loc (t) represents the number of unique IPs in a certain geographical location (loc) within time t; I is the total number of IPs; I(IP i ∈loc) is an indicator function, indicating whether the IP belongs to a certain geographical location loc. If an IP address IP i If it belongs to the geographic location loc, the value is 1, otherwise it is 0;

[0043] And the IP growth rate R of each geographical location loc is counted per unit time loc (t);

[0044] Q3. Based on the big data model, the cloud processing platform presets the normal traffic base value and growth threshold for each geographical location loc in the corresponding time period;

[0045] Q4: The cloud processing platform counts the number of unique IP addresses N in each geographic location loc loc (t) and the growth rate R loc (t) comparing with the corresponding preset normal flow base value and growth threshold value respectively;

[0046] If the number of unique IPs corresponding to the geographic location loc is N loc (t)>normal flow base value, and the growth rate R loc When (t) < the growth threshold, secondary verification is triggered to improve security;

[0047] If the number of unique IPs corresponding to the geographic location loc is N loc (t)≤normal flow base value, and the growth rate R loc When (t)≥ the growth threshold, the access frequency of the region is restricted;

[0048] If the number of unique IPs corresponding to the geographic location loc is N loc (t)>normal flow base value, and the growth rate R loc When (t)≥ the growth threshold, a warning message is issued.

[0049] A further technical improvement of the present invention is that the cloud processing platform performs correlation analysis on the real-time access content of the same IP within a unit time window to determine whether the corresponding IP is an abnormal access, so as to assist in determining whether the IP is malicious traffic, and the steps include:

[0050] Q1. Count the different access paths accessed by the corresponding IP in the time window T and record them as: C i (T) = {L1, L2, ..., L n}, where C i (T) is the collection of access contents of the corresponding IP in the time window T; L n is the nth access path;

[0051] Q2. Calculate the access path similarity S of the corresponding IP c , the formula used is:

[0052]

[0053] In the formula, S c is the access path similarity of the corresponding IP; C i (T) is the access path set of the corresponding IP in the time window T; C ba A collection of access paths for normal users; |C i (T)∪C ba | is the intersection size of the corresponding IP access path and the normal user access path; |C i (T)∪C ba | is the union size of the corresponding IP access path and the normal user access path;

[0054] Q3. Statistics of request parameter set Q corresponding to IP access i (t), Q i (t) = {q1,q2,...q n}, and calculate the request parameter similarity S of the corresponding IP Q , the formula used is:

[0055]

[0056] In the formula, S Q is the request parameter similarity of the corresponding IP; Q i (T) is the request parameter set of the corresponding IP in the time window T; Q ba A set of request parameters for normal users; |Q i (T)∩Q ba | is the size of the intersection of the parameter set used by the corresponding IP and the normal user parameter set; |Q i (T)∪Q ba | is the union size of the parameter set used by the corresponding IP and the normal user parameter set;

[0057] Q4. Count the access time interval sequence △t of the corresponding IP, △t={t1-t0,t2-t1,...,ti -t i-1}, and calculate the mean value μT of the access time interval;

[0058] Then calculate the time distribution variance

[0059] Q5. Preset access path similarity S c Normal area threshold A, request parameter similarity S Q The normal area threshold B and time distribution variance The normal threshold C;

[0060] When the access path similarity S c , find the parameter similarity S Q or time distribution variance When any item is not within the corresponding normal area threshold A, normal area threshold B or normal threshold C, the corresponding IP is marked as malicious traffic.

[0061] A further technical improvement of the present invention is that: the access path set C of a normal user ba and the normal user's request parameter set Q ba The method for obtaining comprises the following steps:

[0062] Z1. The cloud processing platform collects the real-time access content data of each IP within the preset time window D, obtains the path request of the user marked as a normal IP, and extracts the request parameters and access path in the path request;

[0063] Z2. Collect all access paths marked as normal IP accesses within time window D, and construct access path set C after deduplication. ba ;

[0064] Z3. Collect all request parameters used by normal IP access in time window D, and construct request parameter set Q after deduplication. ba .

[0065] A further technical improvement of the present invention is that: the cloud processing platform accesses the set of paths C ba and parameter set Q ba Set the minimum access frequency threshold and the minimum request frequency threshold respectively;

[0066] And the cloud processing platform is building the access path set C ba and the request parameter set Q ba When , the access paths with a frequency lower than the minimum access frequency threshold and the request parameters with a frequency lower than the minimum request frequency threshold are removed, and only the frequently used access paths and request parameters are retained.

[0067] Compared with the prior art, the present invention has the following beneficial effects:

[0068] The present invention can accurately identify various types of abnormal traffic through the integration of multi-dimensional data features, especially for the protection of new attack modes, reduce false positives and false negatives, and through real-time traffic analysis and dynamic baseline updates, the system can quickly respond to changes in network traffic, and timely detect and block potential malicious traffic;

[0069] At the same time, the present invention significantly improves the security and stability of the network through effective identification and processing of abnormal traffic, effectively prevents common threats such as DDoS attacks, SQL injections, crawler attacks, and improves the network protection capability;

[0070] On the other hand, through continuous traffic monitoring and analysis, the system can automatically optimize and update the detection model according to real-time data, so that the system can dynamically adapt to the ever-changing network traffic and attack patterns, and can promptly identify and adjust protection measures when facing new and complex attacks; in addition, the present invention further improves the ability to identify malicious traffic through geographic location analysis of IP addresses and calculation of traffic growth rate, and can effectively identify abnormal traffic from specific geographic locations, promptly limit the source of attack, and prevent further damage to network services. BRIEF DESCRIPTION OF THE DRAWINGS

[0071] In order to facilitate understanding by those skilled in the art, the present invention is further described below with reference to the accompanying drawings.

[0072] Figure 1 It is a system block diagram of the present invention. DETAILED DESCRIPTION

[0073] In order to further explain the technical means and effects adopted by the present invention to achieve the predetermined invention purpose, the specific implementation methods, structures, features and effects of the present invention are described in detail below in conjunction with the accompanying drawings and preferred embodiments.

[0074] See also Figure 1 As shown, the present invention provides a computer network security protection system based on big data, including a cloud processing platform, a model library, at least one set of acquisition modules and a working layer;

[0075] The model library builds a corresponding data model based on the historical working data of the corresponding computer network, where the historical working data includes the regional distribution data of IP addresses, the traffic data of each regional IP in different time periods, the access content of each regional IP and the request frequency of each IP;

[0076] When collecting historical working data of the corresponding computer network, the model library extracts the preset key features of the corresponding historical data for training the data t large model. The key features include: a. Time series features:

[0077] Time distribution of IP access: Some IPs may be active during specific time periods. We analyze the distribution of these time periods and construct time series features.

[0078] Traffic change rate: the growth rate of each IP traffic in different time periods, capturing the trend of sudden increase and decrease of traffic;

[0079] b. Spatial characteristics:

[0080] Distribution of IP addresses: For example, which geographic locations or network ranges the IP addresses come from, which can help detect abnormal traffic from a certain area;

[0081] c. Content characteristics:

[0082] Frequency of access to content: URLs accessed by each IP, request type (GET, POST, etc.), request content, etc.;

[0083] Access pattern: whether certain IP addresses frequently request certain specific resources;

[0084] d. Traffic statistics characteristics:

[0085] Total traffic volume per IP: The cumulative traffic volume per IP address can reflect the activity of the IP;

[0086] Traffic peak: records the maximum traffic of each IP in a certain period of time to help identify traffic bursts;

[0087] Request frequency: the number of requests sent by each IP per unit time. Abnormal request frequency may be a sign of attack;

[0088] When the model library builds the corresponding computer network data model, it converts the original data of historical work data into a structured format and performs standardization so that the processed data can be effectively used in the model. For example, traffic data needs to be converted into numerical types, time data into timestamps, and access content needs to be extracted from text features (such as using bag-of-words models, TF-IDF, etc.);

[0089] The model library uses a suitable model to train the historical working data of the computer network, such as a clustering algorithm, a classification algorithm, an Autoencoder or a time series analysis. The model library uses the historical normal traffic data of the corresponding computer network to train the data big model, and teaches the data big model to learn the distribution characteristics of normal traffic. The model library uses a separate validation set to evaluate the accuracy and generalization ability of the data big model, and adjusts the parameters of the data big model through evaluation indicators such as precision, recall rate, and F1 score to optimize its performance.

[0090] The working layer is the basic operation layer of the computer network, responsible for reflecting the various data and behaviors of the computer network in normal operation;

[0091] The acquisition module matches the corresponding computer network in the working layer and uses a bypass method to monitor access data. While obtaining access data, it can reduce interference with the computer network in the working layer.

[0092] In this embodiment, the protection system uses port mirroring to monitor traffic, which copies traffic to the collection module on the switch or router, and the collection module does not directly participate in data transmission;

[0093] After obtaining the access data, the acquisition module transmits the access data to the cloud processing platform;

[0094] After receiving the access data, the cloud processing platform analyzes the access data to obtain IP quantity data, real-time distribution data of IP addresses, real-time access content data of IPs, and request frequency of corresponding IPs;

[0095] The cloud processing module calculates the network security index S based on the IP quantity data, the real-time distribution data of IP addresses, the real-time access content data of IPs and the request frequency of the corresponding IPs. t , the specific formula is:

[0096]

[0097] Where N is the number of IPs per unit time, which is obtained through IP quantity data;

[0098] D t It is the real-time geographic distribution entropy of IP addresses, which is obtained through the real-time distribution data of IP addresses. By calculating the distribution of IP addresses in different geographical locations, the concentration of access sources is analyzed.

[0099] and m is the total number of different geographical locations, Q i is the percentage of IP addresses in a certain geographical location i, D t The larger the value, the more evenly distributed the IP addresses are and the more dispersed the access sources are. t The smaller it is, the more traffic comes from the same area;

[0100] C t It is the diversity of IP access content, which is obtained through the real-time access content data of IP, specifically from the URL, API request, port usage, etc. accessed by IP in real time. The calculation method is:

[0101] Where r is the number of all different content categories, q jis the probability that a URL, API or resource category j is accessed; C t The larger the size, the more diverse the content accessed; C t The smaller it is, the more IP addresses access the same content.

[0102] F t is the IP request frequency, which is obtained by the corresponding IP request frequency; the calculation method is:

[0103] Where N is the number of IPs per unit time; f i is the number of requests from the ith IP within time t;

[0104] P i The abnormal probability of a single IP, the method for obtaining the abnormal probability includes the following steps:

[0105] S1. Calculate the number of IP visits per unit time and perform normalization to obtain the IP visit frequency f' i , and f' i The value range is [0,1];

[0106] S2. Calculate the resource distribution entropy C accessed by the corresponding IP in different time periods i , to determine whether the access pattern is abnormal, the formula used is

[0107] z is the total number of different content categories accessed by the corresponding IP, q a is the probability of the corresponding IP accessing category a within the time window, that is, q a = Number of visits of category a / total number of visits of the IP;

[0108] C i The value range of is [0,1];

[0109] S3. Determine the geographical risk score G of the IP by comparing the historical access records and the trusted region database based on the IP location. i ,

[0110] G i The value range of is [0,1];

[0111] For example, the value of a region marked as high risk is 1, the value of an unconventional region (different from the historical access records) is 0.8, and the value of a normal region is 0;

[0112] S4. Detect whether the port accessed by the IP is an atypical port, whether the protocol usage involves abnormal behavior, and obtain the port abnormality value Y based on the detection results. i If the corresponding IP address does not authorize the port or uses an abnormal protocol, the port abnormal value Y iIncrease;

[0113] Y i = Abnormal port access times / total access times;

[0114] Y i The value range of is [0,1];

[0115] S5. Query the security database to determine whether the IP has been marked as a malicious source, and obtain the IP's reputation score B based on the number of times it has been marked. i ;

[0116] B i The value range of is [0,1];

[0117] In this embodiment, IPs are divided into blacklisted IPs, suspicious IPs, and risk-free IPs;

[0118] Blacklisted IP reputation score B i The value is 1, and the reputation score of the suspicious IP is B. i The value is 0.5, and the reputation score of risk-free IP is B i The value is 0;

[0119] S6, based on formula P i =ω1·f' i +ω2·C i +ω3·G i +ω4·Y i +ω5·B i , calculate the abnormal probability P of a single IP i ;

[0120] In the formula, ω1, ω2, ω3, ω4 and ω5 are the weights of the corresponding features, which are adjusted by historical data;

[0121] And the cloud processing platform will increase the network security index S t Compare with the preset safety threshold;

[0122] If the network security index S t If the preset security threshold is exceeded, the security protection of the corresponding computer network will be triggered, including secondary verification, traffic speed limit, access interception, blacklist control, etc.

[0123] And in this embodiment, in the network security index S t When the security threshold is less than the preset value, a mapping table with different processing methods is set for different value areas. t When in the corresponding numerical range, the corresponding computer network executes the mapping processing method;

[0124] If the network security index St ≥The preset security threshold will mark the IP as a normal IP and maintain the existing computer network access policy.

[0125] When the cloud processing platform obtains the real-time distribution data of IP addresses, it counts the geographical location of each IP address and monitors the growth amount and growth rate of the number of IP addresses in each geographical location to determine whether the access data has malicious characteristics;

[0126] The method for the cloud processing platform to determine access to data includes the following steps:

[0127] Q1. Collect access data in the corresponding time window and analyze the geographical location of each IP in combination with the preset IP location query database;

[0128] Q2: Count the number of unique IP addresses N in different geographical locations loc within a unit time t loc (t), the formula is:

[0129] Where N loc (t) represents the number of unique IPs in a certain geographical location (loc) within time t; I is the total number of IPs; loc represents the specific geographical location; I (IP i ∈loc) is an indicator function, indicating whether the IP belongs to a certain geographical location loc. If an IP address IP i If it belongs to the geographic location loc, the value is 1, otherwise it is 0;

[0130] And the IP growth rate R of each geographical location loc is counted per unit time loc (t);

[0131] Q3. Based on the big data model, the cloud processing platform presets the normal traffic base value and growth threshold for each geographical location loc in the corresponding time period;

[0132] Q4: The cloud processing platform counts the number of unique IP addresses N in each geographic location loc loc (t) and the growth rate R loc (t) comparing with the corresponding preset normal flow base value and growth threshold value respectively;

[0133] If the number of unique IPs corresponding to the geographic location loc is N loc (t)>normal flow base value, and the growth rate R loc When (t) < the growth threshold, secondary verification is triggered to improve security;

[0134] If the number of unique IPs corresponding to the geographic location loc is N loc (t)≤normal flow base value, and the growth rate R locWhen (t)≥ the growth threshold, the access frequency of the region is restricted;

[0135] If the number of unique IPs corresponding to the geographic location loc is N loc (t)>normal flow base value, and the growth rate R loc When (t)≥ the growth threshold, a warning message is issued.

[0136] Example 2

[0137] A computer network security protection system based on big data, comprising a cloud processing platform, a model library, at least one set of acquisition modules and a working layer;

[0138] The model library builds the corresponding data model based on the historical working data of the corresponding computer network;

[0139] The working layer is the basic operation layer of the computer network, responsible for reflecting the various data and behaviors of the computer network in normal operation;

[0140] The acquisition module matches the corresponding computer network in the working layer and uses a bypass method to monitor access data. While obtaining access data, it can reduce interference with the computer network in the working layer.

[0141] In this embodiment, the protection system uses port mirroring to monitor traffic, which copies traffic to the collection module on the switch or router, and the collection module does not directly participate in data transmission;

[0142] After obtaining the access data, the acquisition module transmits the access data to the cloud processing platform;

[0143] After receiving the access data, the cloud processing platform analyzes the access data to obtain IP quantity data, real-time distribution data of IP addresses, real-time access content data of IPs, and request frequency of corresponding IPs;

[0144] The cloud processing module calculates the network security index S based on the IP quantity data, the real-time distribution data of IP addresses, the real-time access content data of IPs and the request frequency of the corresponding IPs. t , the specific formula is:

[0145]

[0146] And the cloud processing platform will increase the network security index S t Compare with the preset safety threshold;

[0147] If the network security index S t If the preset security threshold is exceeded, the security protection of the corresponding computer network will be triggered, including secondary verification, traffic speed limit, access interception, blacklist control, etc.

[0148] If the network security index S t ≥The preset security threshold will mark the IP as a normal IP and maintain the existing computer network access policy.

[0149] When the cloud processing platform obtains the real-time distribution data of IP addresses, it counts the geographical location of each IP address and monitors the growth amount and growth rate of the number of IP addresses in each geographical location to determine whether the access data has malicious characteristics;

[0150] The method for the cloud processing platform to determine access to data includes the following steps:

[0151] Q1. Collect access data in the corresponding time window and analyze the geographical location of each IP in combination with the preset IP location query database;

[0152] Q2: Count the number of unique IP addresses N in different geographical locations loc within a unit time t loc (t), the formula is:

[0153] Where N loc (t) represents the number of unique IPs in a certain geographical location (loc) within time t; I is the total number of IPs; loc represents the specific geographical location; I (IP i ∈loc) is an indicator function, indicating whether the IP belongs to a certain geographical location loc. If an IP address IP i If it belongs to the geographic location loc, the value is 1, otherwise it is 0;

[0154] And the IP growth rate R of each geographical location loc is counted per unit time loc (t);

[0155] Q3. Based on the big data model, the cloud processing platform presets the normal traffic base value and growth threshold for each geographical location loc in the corresponding time period;

[0156] Q4: The cloud processing platform counts the number of unique IP addresses N in each geographic location loc loc (t) and the growth rate R loc (t) comparing with the corresponding preset normal flow base value and growth threshold value respectively;

[0157] If the number of unique IPs corresponding to the geographic location loc is N loc (t)>normal flow base value, and the growth rate R loc When (t) < the growth threshold, secondary verification is triggered to improve security;

[0158] If the number of unique IPs corresponding to the geographic location loc is N loc (t)≤normal flow base value, and the growth rate Rloc When (t)≥ the growth threshold, the access frequency of the region is restricted;

[0159] If the number of unique IPs corresponding to the geographic location loc is N loc (t)>normal flow base value, and the growth rate R loc When (t)≥ the growth threshold, a warning message is issued.

[0160] The cloud processing platform also performs correlation analysis on the real-time access content of the same IP within a unit time window to determine whether the corresponding IP is an abnormal access, so as to assist in determining whether the IP is malicious traffic. The steps include:

[0161] Q1. Count the different access paths accessed by the corresponding IP in the time window T and record them as: C i (T) = {L1, L2, ..., L n}, where C i (T) is the collection of access contents of the corresponding IP in the time window T; L n is the nth access path;

[0162] Q2. Calculate the access path similarity S of the corresponding IP c , the formula used is:

[0163]

[0164] In the formula, S c is the access path similarity of the corresponding IP; C i (T) is the access path set of the corresponding IP in the time window T; C ba A collection of access paths for normal users; |C i (T)∩C ba | is the intersection size of the corresponding IP access path and the normal user access path; |C i (T)∪C ba | is the union size of the corresponding IP access path and the normal user access path;

[0165] Q3. Statistics of request parameter set Q corresponding to IP access i (t), Q i (t) = {q1,q2,...q n}, and calculate the request parameter similarity S of the corresponding IP Q , the formula used is:

[0166]

[0167] In the formula, S Q is the request parameter similarity of the corresponding IP; Q i(T) is the request parameter set of the corresponding IP in the time window T; Q ba A set of request parameters for normal users; |Q i (T)∪Q ba | is the size of the intersection of the parameter set used by the corresponding IP and the normal user parameter set; |Q i (T)∪Q ba | is the union size of the parameter set used by the corresponding IP and the normal user parameter set;

[0168] Q4. Count the access time interval sequence △t of the corresponding IP, △t={t1-t0,t2-t1,...,t i -t i-1}, and calculate the mean value μT of the access time interval;

[0169] Then calculate the time distribution variance

[0170] Q5. Preset access path similarity S c Normal area threshold A, request parameter similarity S Q The normal area threshold B and time distribution variance The normal threshold C;

[0171] When the access path similarity S c , find the parameter similarity S Q or time distribution variance When any item is not within the corresponding normal area threshold A, normal area threshold B or normal threshold C, the corresponding IP is marked as malicious traffic.

[0172] Access path set C of normal users ba and the normal user's request parameter set Q ba The method for obtaining comprises the following steps:

[0173] Z1. The cloud processing platform collects the real-time access content data of each IP within the preset time window D, obtains the path request of the user marked as a normal IP, and extracts the request parameters and access path in the path request;

[0174] Request parameters such as URL query parameters, form data, and API request parameters; for example, id and category in / product?id=123&category=electronics are request parameters;

[0175] Z2. Collect all access paths marked as normal IP accesses within time window D, and construct access path set C after deduplication. ba ;

[0176] Z3. Collect all request parameters used by normal IP access in time window D, and construct request parameter set Q after deduplication. ba .

[0177] The cloud processing platform has access to the set of paths C ba and parameter set Q ba Set the minimum access frequency threshold and the minimum request frequency threshold respectively;

[0178] And the cloud processing platform is building the access path set C ba and the request parameter set Q ba When , the access paths with a frequency lower than the minimum access frequency threshold and the request parameters with a frequency lower than the minimum request frequency threshold are removed, and only the frequently used access paths and request parameters are retained.

[0179] The above description is only a preferred embodiment of the present invention and does not limit the present invention in any form. Although the present invention has been disclosed as a preferred embodiment as above, it is not used to limit the present invention. Any technical personnel in this field can make some changes or modify the technical contents disclosed above into equivalent embodiments without departing from the scope of the technical solution of the present invention. However, any simple modification, equivalent change and modification made to the above embodiments according to the technical essence of the present invention without departing from the content of the technical solution of the present invention still fall within the scope of the technical solution of the present invention.

Claims

1. A computer network security protection system based on big data, comprising a cloud processing platform, a model library, at least one set of acquisition modules and a working layer, characterized in that: The model library extracts the preset key features of the corresponding computer network historical work data and establishes the corresponding data big model; The working layer is the basic operation layer of the computer network, responsible for reflecting various data and behaviors of the computer network in normal operation; The acquisition module matches the corresponding computer network in the working layer, monitors the access data in a bypass manner, and transmits the access data to the cloud processing platform; After receiving the access data, the cloud processing platform analyzes the access data to obtain IP quantity data, real-time distribution data of IP addresses, real-time access content data of IPs, and request frequency of corresponding IPs; And the cloud processing platform obtains the real-time geographic distribution entropy D through the real-time distribution data of IP addresses t , obtain access content diversity through real-time access content data of IP t , the network security index S is calculated by the formula t , the specific formula is: Where N is the number of IPs per unit time; F t is the IP request frequency; P i is the abnormal probability of a single IP; And the cloud processing platform will increase the network security index S t Compare with the preset safety threshold; If the network security index S t < the preset security threshold, the security protection of the corresponding computer network will be triggered; If the network security index S t ≥The preset security threshold, mark the IP as a normal IP.

2. According to the computer network security protection system based on big data in claim 1, it is characterized in that: The key features of historical work data include temporal features, spatial features, content features and traffic statistics features.

3. According to the computer network security protection system based on big data in claim 1, it is characterized in that: The P i The method for obtaining comprises the following steps: S1. The cloud processing platform calculates the number of IP accesses per unit time and normalizes it to obtain the IP access frequency f' i ; S2, the cloud processing platform calculates the resource distribution entropy C accessed by the corresponding IP in different time periods i , to determine whether the access pattern is abnormal; S3. Determine the geographical risk score G of the IP by comparing the historical access records and the trusted region database based on the IP location. i , S4. Detect whether the port accessed by the IP is an atypical port, whether the protocol usage involves abnormal behavior, and obtain the port abnormality value Y based on the detection results. i ; S5. Query the security database to determine whether the IP has been marked as a malicious source, and obtain the IP's reputation score B based on the number of times it has been marked. i ; S6, based on formula P i =ω1·f' i +ω2·C i +ω3·G i +ω4·Y i +ω5·B i , calculate the abnormal probability P of a single IP i ; Where ω1, ω2, ω3, ω4 and ω5 are the weights of the corresponding features, which are adjusted by historical data.

4. According to the computer network security protection system based on big data in claim 1, it is characterized in that: When obtaining the real-time distribution data of IP addresses, the cloud processing platform counts the geographical location of each IP address and monitors the growth amount and growth rate of the number of IP addresses in each geographical location to determine whether the access data has malicious characteristics.

5. A computer network security protection system based on big data according to claim 4, characterized in that: The method for the cloud processing platform to determine access data includes the following steps: Q1. Collect access data in the corresponding time window and analyze the geographical location of each IP in combination with the preset IP location query database; Q2: Count the number of unique IP addresses in different geographical locations within a unit of time t and the IP growth rate in each geographical location; Q3. The cloud processing platform presets the normal traffic base value and growth threshold for the corresponding time period in each geographical location based on the big data model; Q4: The cloud processing platform compares the number of unique IP addresses and growth rate in each geographic location with the corresponding preset normal traffic base value and growth threshold; If the number of unique IP addresses in the corresponding geographic location is greater than the normal traffic base value, and the growth rate is less than the growth threshold, secondary verification is triggered; If the number of unique IP addresses in the corresponding geographical location is ≤ the normal traffic base value, and the growth rate is ≥ the growth threshold, the access frequency of the area is restricted; If the number of unique IPs in the corresponding geographic location is greater than the normal traffic base value, and the growth rate is ≥ the growth threshold, a warning message will be issued.

6. A computer network security protection system based on big data according to claim 1, characterized in that: The cloud processing platform performs correlation analysis on the real-time access content of the same IP within a unit time window to determine whether the corresponding IP is abnormal access, so as to assist in determining whether the IP is malicious traffic. The steps include: Q1. Count the different access paths accessed by the corresponding IP in the time window T and record them as: C i (T) = {L1, L2, ..., L n }, where C i (T) is the collection of access contents of the corresponding IP in the time window T; L n is the nth access path; Q2. Obtain the access path similarity S of the corresponding IP by calculating the intersection and union of the preset normal user's access path set and the access path of the corresponding IP in the time window T. c ; Q3. Statistics of request parameter set Q corresponding to IP access i (t), Q i (t) = {q1,q2,...q n }, and calculate the intersection and union of the preset normal user's request parameter set and the corresponding IP's request parameters in the time window T, and obtain the request parameter similarity S of the corresponding IP Q ; Q4. Count the access time interval sequence △t of the corresponding IP, △t={t1-t0,t2-t1,...,t i -t i-1 }, and calculate the mean value μT of the access time interval; Then calculate the time distribution variance Q5. Preset access path similarity S c Normal area threshold A, request parameter similarity S Q Normal area threshold B and time distribution variance The normal threshold C; When the access path similarity S c , find the parameter similarity S Q or time distribution variance When any item is not within the corresponding normal area threshold A, normal area threshold B or normal threshold C, the corresponding IP is marked as malicious traffic.

7. A computer network security protection system based on big data according to claim 6, characterized in that: The method for obtaining the access path set of a normal user and the request parameter set of a normal user includes the following steps: Z1. The cloud processing platform collects the real-time access content data of each IP within the preset time window D, obtains the path request of the user marked as a normal IP, and extracts the request parameters and access path in the path request; Z2, collect all access paths marked as normal IP access within time window D, and construct an access path set after deduplication; Z3. Collect all request parameters used by the marked normal IP access within the time window D, and construct a request parameter set after deduplication.

8. A computer network security protection system based on big data according to claim 7, characterized in that: The cloud processing platform sets a minimum access frequency threshold and a minimum request frequency threshold for the access path set and the parameter set respectively; When constructing the access path set and the request parameter set, the cloud processing platform removes the access paths with a frequency lower than the minimum access frequency threshold and the request parameters with a frequency lower than the minimum request frequency threshold, and only retains the frequently used access paths and request parameters.

Images