Network security management system based on big data

Abstract

The invention relates to the technical field of network security management, in particular to a network security management system based on big data, which comprises a data acquisition and integration unit, a dynamic threshold setting unit, a fuzzy comprehensive evaluation unit, a machine learning optimization unit and a control unit. The acquisition process has intelligent characteristics and adopts a block chain to cache data, the dynamic threshold setting unit constructs a model to adjust a threshold by combining a hidden Markov model, kernel density estimation and a reinforcement learning algorithm for different network crime types, and the fuzzy comprehensive evaluation unit determines a membership function and distributes weights by applying a fuzzy mathematical algorithm. And the machine learning optimization unit uses historical data to train and update the model, assists in case-related account determination, effectively solves the problems of missed determination and misjudgment caused by a fixed threshold value in traditional account risk assessment, and improves the accuracy of network criminal account risk assessment.

Description

Technical Field

[0001] The present invention relates to the technical field of network security management, and in particular to a network security management system based on big data. Background Art

[0002] Network security management is an important technology. Account risk assessment is an extremely important part of the fight against cybercrime. However, due to the huge differences in capital flow patterns in different cybercrime scenarios, traditional account risk assessment methods based on fixed thresholds are difficult to adapt to these changes, resulting in significant problems in the current account risk assessment process for cybercrime.

[0003] Traditional account risk assessment methods mainly rely on fixed thresholds to determine whether an account has risks. However, the capital flow of cybercrimes is complex and changeable. Different types of cybercrimes vary greatly in terms of transaction frequency, amount of money involved, and transaction time span. Telecom fraud cybercrimes often have high transaction frequencies and relatively small amounts involved in a single transaction, but the overall amount of money involved grows rapidly. Financial fraud cybercrimes may have a long transaction time span and a large and concentrated amount of money involved. Fixed thresholds cannot adapt to these differences. When facing telecommunications fraud, a large number of suspicious accounts may be missed due to excessively high threshold settings, and risks cannot be detected in time. When dealing with financial fraud, normal accounts may be misjudged as risky accounts due to unreasonable threshold settings, affecting the normal development of financial business. This inaccurate risk assessment method seriously restricts the effectiveness of network security management. In order to solve this technical problem, we provide a network security management system based on big data. Summary of the invention

[0004] The purpose of the present invention is to provide a network security management system based on big data to solve the problems raised in the above background technology.

[0005] 1. Since traditional account risk assessment relies on fixed thresholds and cannot adapt to differences in capital flows in cybercrime, resulting in missed judgments of telecommunications fraud and misjudgments of financial fraud, this case uses a dynamic threshold setting unit to construct a dynamic threshold calculation model for different types of cybercrime. It combines hidden Markov models, kernel density estimation, reinforcement learning and other technologies to adjust the threshold based on transaction frequency, the amount involved and the time span of the transaction. The fuzzy comprehensive evaluation unit introduces fuzzy mathematical algorithms to determine the membership function, assign weights and calculate the comprehensive risk score of the account, which can accurately assess account risks, reduce missed judgments and misjudgments, improve the effectiveness of network security management, and ensure the normal development of financial business.

[0006] 2. Since traditional methods are difficult to process multi-source heterogeneous data related to cybercrime, which affects the accuracy of risk assessment, in this case, the data acquisition and integration unit uses the DATAX multi-source heterogeneous data cleaning technology, including preliminary cleaning, outlier detection, and data repair modules. The acquisition process has the characteristics of intelligent perception and adaptive scheduling. By using deep neural networks to analyze web page structures, ant colony algorithms to schedule tasks, and blockchain technology to cache data, high-quality data can be obtained, providing a reliable basis for subsequent risk assessment and enhancing the reliability and stability of the network security management system.

[0007] To achieve the above objectives, a network security management system based on big data is provided, including the following units: The data acquisition and integration unit is used to collect cybercrime data from multiple data sources and process the cybercrime data using the DATAX multi-source heterogeneous data cleaning technology to obtain its fund flow characteristics; The dynamic threshold setting unit constructs a dynamic threshold calculation model based on the fund flow characteristics and dynamically adjusts the threshold according to the transaction frequency, involved amount, and transaction time of the cybercrime data; The fuzzy comprehensive evaluation unit introduces a fuzzy mathematics algorithm to determine the membership function of the cybercrime data, assigns weights to the transaction frequency, amount concentration, and account relevance respectively, calculates the comprehensive risk score of the cybercrime data accounts through fuzzy transformation, compares the comprehensive risk score with the set risk threshold, and determines the risk accounts according to the comparison results; The machine learning optimization unit uses historical case data to construct a cybercrime training data set, selects a neural network algorithm to train the cybercrime training data set, establishes a fund penetration threshold determination model, then regularly updates the training set with new case data, and finally determines the involved accounts in the risk accounts through the control unit.

[0008] As a further improvement of this technical solution, when the data acquisition and integration unit processes the cybercrime data using the DATAX multi-source heterogeneous data cleaning technology: The preliminary cleaning module based on pattern matching and rule constraints is used to screen out the problem data, and then the outlier detection module based on the improved isolation forest algorithm is enabled to randomly divide the feature dimensions of the remaining data and construct isolation trees. The average path length of the data points in the isolation trees is used as the outlier score to identify the suspected outlier data; Finally, for the outlier data, the data repair module based on the generative adversarial network is used to repair the outlier data.

[0009] As a further improvement of this technical solution, the acquisition process of the data acquisition and integration unit has the characteristics of intelligent perception and adaptive scheduling: In the acquisition source detection stage, a web structure parser based on a deep neural network is used to learn and identify the data storage structures and update frequency patterns of different types of websites, and an acquisition path planning template is constructed; When collecting from distributed data sources, a task scheduling mechanism based on the ant colony algorithm is adopted to analogize the acquisition tasks to the foraging paths of ants, and the acquisition task priorities are dynamically assigned; And a trusted data caching mechanism based on blockchain is built in to cope with network fluctuations and data source limitations during the acquisition process, and the collected data fragments are stored in the form of blockchain blocks.

[0010] As a further improvement of this technical solution, when the dynamic threshold setting unit constructs the dynamic threshold calculation model: The hidden Markov model is introduced to mine the hidden states of fund transfers in cybercrime data, and a hidden state model of fund transfers is constructed. Then, the parameters of the hidden state model of fund transfers are trained through algorithms; Combined with the non-parametric statistical method based on kernel density estimation, the probability density distributions of the fund transaction frequency, the amount involved in the case, and the transaction time under different hidden states are calculated from the historical transaction data of cybercrime. Based on this, the initial threshold range of the dynamic threshold calculation model is set; At the same time, the Q-learning algorithm in the reinforcement learning algorithm is used to optimize the threshold adjustment strategy of the dynamic threshold calculation model, and the accurate early warning rate is used as the reward signal to dynamically adjust the threshold.

[0011] As a further improvement of this technical solution, when the dynamic threshold setting unit dynamically adjusts the threshold according to real-time data: The time-frequency analysis technology based on wavelet transform is used to perform multi-scale decomposition on the fund transaction flow data of cybercrime to obtain the transaction frequency and the amount involved in the case. The transaction frequency and the amount involved in the case are decomposed into different frequency sub-bands to capture the short-term mutations and long-term trends in the transaction data, and different threshold adjustment rules are designed for different frequency sub-bands.

[0012] As a further improvement of this technical solution, when the fuzzy comprehensive evaluation unit determines the membership function: The membership function is determined by the transaction frequency, the amount concentration, and the account relevance of cybercrime data; The fuzzy C-means clustering method driven by the particle swarm optimization algorithm is used to initialize the transaction frequency, the amount concentration, and the account relevance, and 50 initial particles are obtained and the fitness function of each particle is constructed. The initial particles represent different combinations of membership function parameters, and then the fitness function of each particle is iterated to find the optimal membership function for identifying risk accounts; At the same time, the uncertainty correction mechanism of the D-S evidence theory is introduced to fuse multiple groups of evidence information about the same risk account obtained from different data sources, and the trust weights are dynamically allocated according to the evidence conflict degree, which is used to evaluate the risk account result.

[0013] As a further improvement of this technical solution, in the link of allocating weights by the fuzzy comprehensive evaluation unit: First, the analytic hierarchy process based on interval numbers is used to construct a judgment matrix, and pairwise comparison judgments are made in the form of interval numbers for different cybercrime scenarios. After consistency test and interval number operation, the subjective weight is determined. Finally, based on the combined weighting model of the least squares method, the subjective weight and the objective weight are fused, and the optimal combination coefficient is solved with the minimum sum of squared deviations between the two as the goal, which is used for the determination of the comprehensive risk score.

[0014] As a further improvement of this technical solution, when the fuzzy comprehensive evaluation unit performs fuzzy transformation to calculate the comprehensive risk score of the account: A fuzzy model based on intuitionistic fuzzy reasoning is used to construct a rule base. According to the intuitionistic fuzzy membership degrees of transaction frequency, amount concentration, and account relevance, the intuitionistic fuzzy evaluation result of the account risk is obtained through fuzzy implication operation and compositional reasoning.

[0015] Compared with the prior art, the beneficial effects of the present invention are as follows: In the network security management system based on big data, the dynamic threshold setting unit constructs a dynamic threshold calculation model, adjusts the threshold according to the characteristics of cybercrime fund flow by combining multiple algorithms, accurately adapts to the differences of different types of crimes. The fuzzy comprehensive evaluation unit uses fuzzy mathematical algorithms to accurately determine the membership function and weight, and calculates the comprehensive risk score of the account. The machine learning optimization unit uses historical data to train the model and regularly updates and optimizes it, improving the accuracy of the determination of the involved accounts and enhancing the accuracy of the risk assessment of cybercrime accounts. Brief Description of the Drawings

[0016] Figure 1 It is the system architecture diagram of the present invention.

[0017] The meanings of the various labels in the figure are as follows: 1. Data collection and integration unit; 2. Dynamic threshold setting unit; 3. Fuzzy comprehensive evaluation unit; 4. Machine learning optimization unit; 5. Control unit. Detailed Embodiments

[0018] The following will clearly and completely describe the technical solutions in the embodiments of the present invention with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without creative efforts shall fall within the protection scope of the present invention.

[0019] The present invention provides a network security management system based on big data. Please refer to Figure 1 as shown, which includes the following units: The data collection and integration unit 1 is used to collect network crime data from multiple data sources, and use the DATAX multi-source heterogeneous data cleaning technology to process the network crime data to obtain its fund flow characteristics; When the data collection and integration unit 1 uses the DATAX multi-source heterogeneous data cleaning technology to process the network crime data: There is a large amount of data with format errors, data type mismatches, and data that obviously violates business logic in multi-source heterogeneous data. The preliminary cleaning module based on pattern matching and rule constraints is used to screen out the problematic data. A predefined data format template library is established, which contains more than 50 common data formats, and more than 20 key business rules are formulated. For example, the transaction amount cannot be negative, and the user age should be within a reasonable range. The multi-source heterogeneous data collected is scanned line by line, and each piece of data is matched with the data format template and business rules to screen out the data that does not meet the requirements, which reduces the burden for subsequent outlier detection and data repair. Then, the outlier detection module based on the improved isolation forest algorithm is enabled to randomly subspace partition the feature dimensions of the remaining data and construct isolation trees. The average path length of the data points in the tree is used as the outlier score to identify suspected outlier data. The feature dimensions of the remaining data are randomly subspace partitioned, and each subspace contains some features. 100 isolation trees with a depth of 15 are constructed. The construction process of each tree is to randomly select a feature and a split point to divide the data into two parts, and this process is recursively carried out until each leaf node contains only one data point or reaches the maximum depth. Calculate the average path length of each data point in all isolation trees and use it as the outlier score. The higher the outlier score, the more likely the data point is an outlier. Set an outlier score threshold to identify the data points with scores higher than the threshold as suspected outlier data, which provides a clear target for subsequent data repair. Finally, for the outlier data, the data repair module based on the generative adversarial network is used to repair the outlier data. A generative adversarial network is constructed, in which the generator adopts a 5-layer convolutional neural network architecture. The transaction data over a period of time is organized into a form similar to an image matrix. Different attributes of the transaction are used as different channels or dimensions of the matrix, and the transaction time sequence is used as the rows or columns of the matrix. In this way, the convolutional neural network can perform feature extraction and processing on it like processing image data, making full use of the advantages of the convolutional neural network in processing multi-dimensional data. Input random noise and output repair candidate data similar to the original data distribution. The discriminator adopts a 4-layer fully connected network, inputs the original data and the repair candidate data generated by the generator, and discriminates its authenticity. The generator and the discriminator perform adversarial training. The goal of the generator is to generate repair candidate data that can deceive the discriminator, and the goal of the discriminator is to accurately distinguish the original data and the generated repair candidate data. The training process lasts for 1000 rounds. After the training is completed, the generator is used to repair the suspected outlier data to obtain the repaired data. After being processed by this repair module, the repair accuracy of the data is greatly improved, providing a reliable data basis for subsequent data analysis and mining.

[0020] The acquisition process of the data acquisition and integration unit 1 has the characteristics of intelligent perception and adaptive scheduling: In the acquisition source detection stage, a web page structure parser based on a deep neural network is used to learn and identify the data storage structures and update frequency patterns of different types of websites, construct an acquisition path planning template, collect a large number of web page samples of 5 major types of common websites, namely social platforms, e-commerce, official websites of financial institutions, news media, and government affairs websites, annotate these web pages, and the annotation content includes information such as data storage locations and data update times. A deep neural network is constructed, which includes an input layer, multiple hidden layers, and an output layer. The input layer receives the HTML code or DOM tree information of the web page. The hidden layer combines a convolutional layer and a recurrent layer. The convolutional layer is used to extract the local features of the web page, and the recurrent layer is used to process the sequential information of the web page. The output layer outputs the prediction results of the data storage structure and update frequency pattern of the website. The prepared annotated data is used to train the deep neural network, and the cross-entropy loss function and the stochastic gradient descent optimization algorithm are adopted. After multiple iterative trainings, the model can accurately learn the data storage structures and update frequency patterns of different types of websites. According to the prediction results of the trained model, more than 20 targeted acquisition path planning templates are constructed for each type of website. The templates contain information such as the starting position of data acquisition, acquisition rules, and acquisition frequencies, realizing the rapid and accurate positioning of the acquisition source; When collecting from distributed data sources, a task scheduling mechanism based on the ant colony algorithm is adopted to analogize the collection tasks to the foraging paths of ants, and the priorities of the collection tasks are dynamically assigned. The collection tasks are analogized to the foraging paths of ants, and parameters such as the number of ants, pheromone evaporation coefficient, and heuristic factor are defined. Eight key indicators such as the data update activity of the data source, network bandwidth availability, and server response delay are comprehensively considered, and a comprehensive score is calculated for each data source. Each ant selects a data source as the next collection target according to the current pheromone concentration and the comprehensive score of the data source. After completing the collection task, pheromone is released on this path. The update rule of the pheromone is as follows: after the pheromone evaporates, the pheromone on the path where valuable data is successfully collected increases, and the pheromone on the path where no valuable data is collected decreases. As the collection process progresses, the pheromone concentration and the comprehensive score of the data source are continuously updated, and the priorities of the collection tasks are dynamically adjusted, reducing the waiting time and data redundancy in the collection process; And it has a built-in blockchain-based trusted data caching mechanism to address network fluctuations and data source limitations during the collection process. The collected data fragments are stored in the form of blockchain blocks, and the collected high-value data fragments are stored in the form of blockchain blocks. Each block contains information such as data content, timestamp, and hash pointer. The hash pointer is used to link to the previous block, forming a chain structure of the blockchain to ensure the immutability and traceability of the data. A buffer is set for each data source. When new data is collected, it is added to the corresponding buffer. At the same time, the buffer is regularly cleaned to delete expired or useless data. When data collection is interrupted due to network fluctuations or data source limitations, the stored data is read from the buffer to continue data collection or analysis to ensure data continuity.

[0021] The dynamic threshold setting unit 2 constructs a dynamic threshold calculation model based on the characteristics of fund transfer, and dynamically adjusts the threshold according to the transaction frequency, involved amount, and transaction time of the cybercrime data. When the dynamic threshold setting unit 2 constructs the dynamic threshold calculation model: The hidden Markov model is introduced to mine the hidden state of fund transfer in the cybercrime data, and a hidden state model of fund transfer is constructed. Through algorithm training of the model parameters, a hidden Markov model with 5 - 8 hidden states is constructed respectively. Each hidden Markov model consists of the initial state probability distribution 、the state transition matrix and the observation probability matrix Composed of, a large amount of fund transfer data related to each type of cybercrime is collected. Information such as the frequency, amount, and time of fund transactions is used as the observation sequence, and an algorithm is used to train the hidden Markov model. This algorithm is an iterative expectation-maximization algorithm, and the specific steps are as follows: Initialize the model parameters 、 and , according to the current model parameters, calculate the posterior probability of each hidden state sequence under the observation sequence, and update the model parameters 、 and based on the obtained posterior probability, providing a more accurate basis for subsequent threshold setting; Combined with the non-parametric statistical method based on kernel density estimation, estimate the probability density distribution of the fund transaction frequency, involved amount scale, and transaction time span in different states from the historical transaction data. Based on this, set the initial threshold range. Extract the data of the fund transaction frequency, involved amount scale, and transaction time span under different types of cybercrimes from the massive historical transaction data. Select the Gaussian kernel function and bandwidth parameter to perform kernel density estimation on the data of each feature (transaction frequency, involved amount scale, transaction time span). The formula for kernel density estimation is ; where is the estimated probability density function, is the number of data points, is the bandwidth parameter, is the kernel function, is the -th data point. Based on the probability density distribution obtained from kernel density estimation, the initial threshold range for each feature is determined. For example, the quantiles of the distribution (such as the 90% and 95% quantiles) can be selected as the thresholds. Without relying on specific parametric distribution assumptions, it can better adapt to complex actual data and improve the rationality and accuracy of initial threshold setting; Meanwhile, the Q - learning algorithm in the reinforcement learning algorithm is used to optimize the threshold adjustment strategy. The current characteristics of fund transaction data (transaction frequency, involved amount scale, transaction time span) and the prediction results of the model (whether it is a suspicious transaction) are used as the state. A series of threshold adjustment actions are defined, such as increasing the threshold, decreasing the threshold, keeping the threshold unchanged, etc. The accurate warning rate is used as the reward signal. +10 reward is given for each successful identification of a potential cyber - crime behavior, and - 5 punishment is given for each misjudgment. A Q - table is created to store the Q - values of each state - action pair. Initially, the Q - values are all set to 0. At each time step, according to the current state select an action , and adopt the - greedy policy to randomly select an action with a probability of , and select the action with the maximum Q - value with a probability of . Execute the action to obtain the next state and the reward . Update the Q - values in the Q - table. Repeat the above steps until the Q - table converges, and dynamically adjust the threshold according to the real - time cyber - crime situation to improve the adaptability and accuracy of the system and reduce the misjudgment rate.

[0022] During the process of the dynamic threshold setting unit 2 adjusting the threshold according to real - time data: The time - frequency analysis technology based on wavelet transform is used to perform multi - scale decomposition on the fund transaction flow data. The transaction frequency and the involved amount are decomposed into different frequency sub - bands to capture the short - term mutations and long - term trends in the transaction data. And different threshold adjustment rules are designed for different frequency components to pre - process the real - time obtained fund transaction flow data. According to the characteristics of the fund transaction data, the wavelet basis function is selected. Different wavelet basis functions have different characteristics. The Daubechies wavelet basis has compact support and orthogonality, which is suitable for analyzing signals with mutation characteristics. The selected wavelet basis function is used to perform multi - scale decomposition on the pre - processed transaction frequency and involved amount data, and the data is decomposed into the approximate components and detail components of different frequency sub - bands. For example, perform 3 - layer decomposition to obtain the low - frequency approximate component High-frequency detail component , where the approximation component reflects the long-term trend of the data, and the detail component reflects the short-term changes of the data. Through the multi-scale decomposition of wavelet transform, the abnormal change points in the data can be identified more accurately, providing a more precise basis for subsequent threshold adjustment. Analyze the decomposed high-frequency detail component, and detect short-term mutations by setting a certain threshold. For example, calculate the standard deviation of each detail component. When the value of the detail component at a certain moment exceeds 3 times the standard deviation, it is determined as a short-term mutation point. Conduct trend analysis on the low-frequency approximation component. Methods such as linear regression can be used to fit the change trend of the approximation component to obtain the long-term change direction and rate of the data, making the threshold adjustment more in line with the actual transaction situation and improving the early warning accuracy of the system. For the short-term mutations detected by the high-frequency detail component, if it is determined as a normal trading peak (such as increased transactions caused by promotional activities, holidays, etc.), adopt a slow change coefficient strategy. For example, the threshold is only increased by 5%-10% within 1 hour to avoid misjudgment caused by normal short-term fluctuations. If it is determined as an abnormal fluctuation (such as abnormal large transactions, frequent small transactions, etc.), the threshold is instantly increased by 50%-80% to enhance the sensitivity of the system to abnormal behaviors. For the long-term trend reflected by the low-frequency approximation component, dynamically adjust the threshold adjustment step size according to the trend slope. When the trend slope is greater than 0.3, it indicates that the transaction data shows an obvious upward trend, and the threshold is increased by 15%-25% every 6 hours. When the trend slope is less than -0.3, it indicates that the transaction data shows an obvious downward trend, and the threshold is decreased by 10%-20% every 6 hours. When the trend slope is between -0.3 and 0.3, it is considered that the transaction data is relatively stable and the threshold remains unchanged. Through the differential threshold adjustment rules, the system can better cope with different types of transaction data changes and effectively reduce the misjudgment rate.

[0023] The fuzzy comprehensive evaluation unit 3 introduces a fuzzy mathematics algorithm to determine the membership function of network crime data, and assigns weights to the transaction frequency, amount concentration, and account correlation respectively. Calculate the comprehensive risk score of the network crime data account through fuzzy transformation, compare the comprehensive risk score with the set risk threshold, and determine the risk account according to the comparison result; When the fuzzy comprehensive evaluation unit 3 determines the membership function: Use the fuzzy C-means clustering method driven by the particle swarm optimization algorithm to initialize 50 particles representing different combinations of membership function parameters for the transaction frequency, amount concentration, and account correlation, and construct the fitness function of each particle, and then iterate to find the optimal membership function for identifying account risks; Collect data such as transaction frequency, amount concentration, and account correlation, and use them as input data. Initialize 50 particles, each particle representing a different combination of membership function parameters. These parameters are used to describe the cluster centers and membership matrices in fuzzy C-means clustering. Construct the fitness function for each particle, using the within-class compactness and between-class separation as indicators. The within-class compactness measures the tightness between data points in the same class, and the between-class separation measures the distance between data points in different classes. The expression of the fitness function can be designed as ; where is the weight coefficient, used to balance the importance of within-class compactness and between-class separation, is the within-class compactness, is the between-class separation, is the fitness function. The particle swarm algorithm starts to iterate. Each particle searches in the solution space according to its own velocity and position information. In each iteration, the particle updates its velocity and position. After 200 iterations, the algorithm terminates. At this time, the combination of membership function parameters corresponding to the global optimal position is the optimal membership function, which is convenient for more accurately identifying potential risk accounts; At the same time, introduce the uncertainty correction mechanism of D-S evidence theory to fuse multiple groups of evidence information about the same account obtained from different data sources, and dynamically allocate trust weights according to the evidence conflict degree, which is used to evaluate the account risk result; Obtain multiple groups of evidence information about the same account from different data sources (such as transaction records, account behavior logs, social network information, etc.). Conduct basic probability assignment for each group of evidence information to determine the support degree of each evidence for different risk levels (such as low risk, medium risk, high risk). Calculate the conflict degree between different evidences. The conflict degree calculation formula is ; where, is the conflict degree, and are the basic probability assignment functions of two different evidences, and are different propositions. Dynamically allocate trust weights according to the evidence conflict degree. When the evidence conflict degree is high, reduce the trust weight of the conflicting evidence. When the evidence conflict degree is low, increase the trust weight of the evidence. Use the combination rule of D-S evidence theory to fuse multiple groups of evidence to obtain the final account risk assessment result, which is convenient for effectively handling the uncertainty and conflict in multi-source evidence information, comprehensively considering the information from different data sources, and improving the credibility of the account risk assessment result.

[0024] Weight allocation link of the fuzzy comprehensive evaluation unit 3: First, use the analytic hierarchy process based on interval numbers to construct a judgment matrix, and make pairwise comparison judgments in the form of interval numbers for different network crime scenarios. After consistency testing and interval number operations, determine the subjective weights. Make pairwise comparison judgments for each factor and give the comparison results in the form of interval numbers. For example, factor is between and in terms of importance relative to factor , denoted as . Thus, construct the interval number judgment matrix , where . Conduct a consistency test on the interval number judgment matrix to ensure the rationality of the judgment. By calculating the consistency index and the random consistency ratio , when , it is considered that the judgment matrix has satisfactory consistency. If not, it is necessary to re - judge and adjust the matrix. After the consistency test passes, use the interval number sorting method, such as the possibility sorting method, to determine the subjective weight interval of each factor, where is the minimum value of the subjective weight of each factor, is the maximum value of the subjective weight of each factor. Then process these intervals, and methods such as taking the median can be used to obtain the final subjective weight . The subjective weight can better reflect the experts' judgment on the importance of each factor based on experience and knowledge, improving the reliability of weight allocation. Finally, based on the combined weighting model of the least - squares method, fuse the subjective weight and the objective weight. Solve the optimal combination coefficient with the goal of minimizing the sum of the squared deviations of the two for the determination of the comprehensive risk score. Standardize the original data to eliminate the influence of the dimension of data of different factors. Introduce the concept of information granularity and improve the traditional entropy weight calculation. For the th factor, the calculation formula of its information entropy is adjusted after considering the information granularity, which can be determined according to the actual improvement method. Calculate the objective weight of each factor according to the information entropy, and the formula is ; where is the total number of factors, is the objective weight of each factor, is the information entropy of the th factor. The objective weight provides a data - driven basis for the determination of the comprehensive weight, enhancing the objectivity of weight allocation. Let the combined weight be , where is the combination coefficient, and construct the objective function ; is the objective function, is the final subjective weight, and the goal is to make is the smallest. For the objective function find the derivative with respect to , and set the derivative to 0 to solve for the optimal combination coefficients . Substitute the optimal combination coefficients into the combination weight formula to obtain the comprehensive weights of each factor . It comprehensively considers subjective experience and objective data, and enables the comprehensive weights to reflect the actual situation of the data by optimizing the combination coefficients.

[0025] When the fuzzy comprehensive evaluation unit 3 performs fuzzy transformation to calculate the comprehensive risk score of the account: A fuzzy model based on intuitionistic fuzzy reasoning is used to construct a rule base. The transaction frequency, amount concentration, and account correlation are used as input variables, and the account risk level is used as the output variable. The account risk level can be divided into several levels such as low risk, medium risk, and high risk. Corresponding intuitionistic fuzzy sets are defined for each input and output variable. For example, for the transaction frequency, intuitionistic fuzzy sets such as "low frequency", "medium frequency", and "high frequency" can be defined. Each intuitionistic fuzzy set is described by a membership degree, a non-membership degree, and a hesitation degree. A rule base containing 10 fuzzy rules is constructed according to historical data. The general form of the rule is "If (the transaction frequency is A) and (the amount concentration is B) and (the account correlation is C), then (the account risk is D)", where A, B, C, and D are the intuitionistic fuzzy sets of the corresponding variables respectively. Compared with the traditional fuzzy rule base, it can capture the characteristics of account risk more accurately and provide a more comprehensive basis for subsequent risk assessment. According to the intuitionistic fuzzy membership degrees of the transaction frequency, amount concentration, and account correlation, the intuitionistic fuzzy evaluation result of the account risk is obtained through fuzzy implication operation and compositional reasoning. According to the determined membership function, the membership degree, non-membership degree, and hesitation degree of the transaction frequency, amount concentration, and account correlation under their respective intuitionistic fuzzy sets are calculated. For each rule in the rule base, the intuitionistic fuzzy implication operator is used for operation, and the input intuitionistic fuzzy set is combined and inferred with each rule in the rule base. The inference results of all rules are synthesized to obtain the intuitionistic fuzzy evaluation result of the account risk. This result includes the membership degree, non-membership degree, and hesitation degree of the account risk at each risk level, so as to more truly reflect the risk status of the account and improve the accuracy of risk assessment. The intuitionistic fuzzy evaluation result of the account risk is represented in the form of an intuitionistic fuzzy set. For example, for the three levels of low risk, medium risk, and high risk, their membership degrees, non-membership degrees, and hesitation degrees are given respectively. According to the intuitionistic fuzzy evaluation result, it is possible to intuitively understand the possibility and existing uncertainty of the account at different risk levels. For example, if the membership degree of the account at the high risk level is relatively high and the hesitation degree is relatively low, it indicates that the account is very likely to be in a high risk state, making the account risk assessment result more intuitive and easy to understand, and helping decision-makers formulate corresponding risk response strategies according to the actual situation, thus improving the practicality of risk assessment.

[0026] The machine learning optimization unit 4 constructs a network crime training data set using historical case data, selects a neural network algorithm to train the network crime training data set, establishes a fund penetration threshold determination model, then regularly updates the training set with new case data, and finally determines the involved accounts in the risk accounts through the control unit 5; Collect data related to fund penetration from channels such as historical case files and databases, covering various aspects of information such as transaction amount, transaction time, transaction object, and account association relationship, and perform cleaning. Extract features that have an important impact on fund penetration determination from the cleaned data, such as transaction frequency, concentration of fund flow, account activity, etc. According to the final determination results of historical cases, label each piece of data with whether it is involved in fund penetration, where 0 indicates not involved and 1 indicates involved. Select a neural network architecture and initialize the parameters of the neural network, including weights and biases. Divide the training dataset into a training set and a validation set, and use the training set to train the model. During the training process, calculate the output of the model through forward propagation, compare it with the true labels, calculate the error using a loss function, and then update the parameters of the model through the backpropagation algorithm to continuously optimize the performance of the model. Use the validation set to evaluate the trained model, and adjust the parameters and hyperparameters of the model according to the evaluation results until the model reaches better performance. Regularly collect new case data, integrate it with the original training dataset, and perform preprocessing operations such as cleaning, feature extraction, and label annotation on the newly added data to ensure that the format and features of the new data are consistent with the original training dataset. Use the new validation set to evaluate the retrained model, and adjust the parameters and hyperparameters of the model according to the evaluation results to ensure that the performance of the model is improved. Input the relevant data of the account to be determined into the trained fund penetration threshold determination model, including transaction records, account association information, etc. The model makes a prediction based on the input data and outputs the probability or determination result of whether the account is an involved account. The control unit 5 makes a final determination of the involved account according to the output result of the model and the preset determination rules. For example, if the involved probability output by the model exceeds 80%, it is determined that the account is an involved account; if the probability is less than 20%, it is determined as not an involved account. For accounts with probabilities between 20% and 80%, further manual review or other auxiliary means can be used for determination. Output the determination result and perform corresponding processing, such as freezing and monitoring the involved accounts, and record the determination result and relevant information for subsequent auditing and analysis, so as to be able to accurately determine involved accounts in a timely manner and effectively prevent fund penetration risks.

[0027] In the present invention, a multi-source data acquisition and integration unit 1 acquires and cleans multi-source data. The acquisition process has intelligent features and uses blockchain to cache data. A dynamic threshold setting unit 2 constructs a model to adjust the threshold for different types of cybercrimes by combining the hidden Markov model, kernel density estimation, and reinforcement learning algorithms. A fuzzy comprehensive evaluation unit 3 uses fuzzy mathematics algorithms to determine the membership function, assign weights, and calculate the comprehensive risk score of the account. A machine learning optimization unit 4 trains and updates the model using historical data to assist in the determination of the involved accounts, effectively solving the problems of missed and misjudgments caused by fixed thresholds in traditional account risk assessments and improving the accuracy of cybercrime account risk assessments.

[0028] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited by the above embodiments. The above embodiments and the descriptions in the specification are only preferred examples of the present invention and are not used to limit the present invention. Without departing from the spirit and scope of the present invention, the present invention will have various changes and improvements, and all these changes and improvements fall within the scope of the present invention claimed. The scope of the present invention claimed is defined by the appended claims and their equivalents.

Claims

1. A network security management system based on big data, characterized in that: The following units are included: The data collection and integration unit (1) is used to collect cybercrime data from multiple data sources, and use DATAX multi-source heterogeneous data cleaning technology to process the cybercrime data to obtain its capital flow characteristics; The dynamic threshold setting unit (2) constructs a dynamic threshold calculation model according to the capital flow characteristics, and dynamically adjusts the threshold according to the transaction frequency, the amount involved, and the transaction time of the cybercrime data; The fuzzy comprehensive evaluation unit (3) introduces a fuzzy mathematical algorithm to determine the membership function of the cybercrime data, and assigns weights to the transaction frequency, amount concentration, and account correlation, respectively. The comprehensive risk score of the cybercrime data account is calculated through fuzzy transformation, and the comprehensive risk score is compared with the set risk threshold, and the risk account is determined based on the comparison result. The machine learning optimization unit (4) uses historical case data to construct a cybercrime training data set, selects a neural network algorithm to train the cybercrime training data set, establishes a fund penetration threshold determination model, and then regularly uses new case data to update the training set. Finally, the control unit (5) determines the accounts involved in the risk accounts.

2. The network security management system based on big data according to claim 1 is characterized in that: When the data collection and integration unit (1) processes the cybercrime data using the DATAX multi-source heterogeneous data cleaning technology: The preliminary cleaning module based on pattern matching and rule constraints is used to filter out data that does not meet the requirements. Then the outlier detection module based on the isolation forest algorithm is used to perform random subspace partitioning on the feature dimensions of the remaining data and construct an isolation tree. The average path length of the data point in the isolation tree is used as the anomaly score to identify abnormal data. Finally, the abnormal data is repaired using a data repair module based on a generative adversarial network.

3. The network security management system based on big data according to claim 1 is characterized in that: The data collection and integration unit (1) has the characteristics of intelligent perception and adaptive scheduling: In the acquisition source detection phase, a web page structure parser based on a deep neural network is used to learn and identify the data storage structure and update frequency patterns of different types of websites, and to build an acquisition path planning template; When collecting from distributed data sources, a task scheduling mechanism based on the ant colony algorithm is used to compare the collection tasks to the foraging paths of ants, and dynamically assign the collection task priorities; It also has a built-in blockchain-based trusted data caching mechanism to cope with network fluctuations and data source limitations during the collection process, and store the collected data fragments in the form of blockchain blocks.

4. The network security management system based on big data according to claim 1 is characterized in that: When the dynamic threshold setting unit (2) constructs the dynamic threshold calculation model: The Hidden Markov Model is introduced to mine the hidden state of capital flow in cybercrime data, and a hidden state model of capital flow is constructed. The parameters of the hidden state model of capital flow are then trained through algorithms. Combining the nonparametric statistical method based on kernel density estimation, the probability density distribution of fund transaction frequency, the amount involved and the transaction time under different hidden states is calculated from the historical transaction data of cybercrime, and the initial threshold range of the dynamic threshold calculation model is set based on this. At the same time, the Q learning algorithm in the reinforcement learning algorithm is used to optimize the threshold adjustment strategy of the dynamic threshold calculation model, and the accurate warning rate is used as the reward signal to dynamically adjust the threshold.

5. The network security management system based on big data according to claim 1 is characterized in that: The dynamic threshold setting unit (2) dynamically adjusts the threshold according to real-time data: The time-frequency analysis technology based on wavelet transform is used to perform multi-scale decomposition of the financial transaction flow data of cybercrime, obtain the transaction frequency and the amount involved, decompose the transaction frequency and the amount involved into different frequency sub-bands, capture the short-term mutations and long-term trends in the transaction data, and design differentiated threshold adjustment rules for different frequency sub-bands.

6. The network security management system based on big data according to claim 1 is characterized in that: When the fuzzy comprehensive evaluation unit (3) determines the membership function: The membership function is determined by the transaction frequency, amount concentration and account correlation of the cybercrime data; The fuzzy C-means clustering method driven by the particle swarm optimization algorithm is used to initialize the transaction frequency, amount concentration and account correlation, obtain 50 initialized particles and construct the fitness function of each particle. The initialized particles represent different membership function parameter combinations, and then the fitness function of each particle is iterated to find the optimal membership function for identifying risky accounts; At the same time, the uncertainty correction mechanism of DS evidence theory is introduced to fuse multiple sets of evidence information about the same risk account obtained from different data sources, and dynamically assign trust weights based on the degree of evidence conflict to evaluate risk account results.

7. The network security management system based on big data according to claim 1 is characterized in that: The fuzzy comprehensive evaluation unit (3) allocates weights: First, the judgment matrix is ​​constructed using the hierarchical analysis method based on interval numbers, and pairwise comparative judgments are performed in the form of interval numbers for different cybercrime scenarios. The subjective weights are determined through consistency tests and interval number operations. Finally, the subjective weights are integrated with the objective weights using a combined weighting model based on the least squares method. The optimal combination coefficient is solved with the goal of minimizing the sum of squared deviations between the two, which is used to determine the comprehensive risk score.

8. The network security management system based on big data according to claim 1 is characterized in that: When the fuzzy comprehensive evaluation unit (3) performs fuzzy transformation to calculate the comprehensive risk score of the account: A fuzzy model based on intuitionistic fuzzy reasoning is used to construct a rule base. According to the intuitionistic fuzzy membership of transaction frequency, amount concentration and account correlation, the intuitionistic fuzzy evaluation results of account risk are obtained through fuzzy implication operation and synthetic reasoning.

Images