Data security management method and system for credential terminal environment

Abstract

The invention relates to the technical field of data processing, in particular to a data security management method and system for a credential terminal environment. The method comprises the following steps: acquiring a target behavior feature vector and a plurality of reference behavior feature vectors of a target user of a server in a target time period; performing category division on the plurality of reference behavior feature vectors, and determining similarity values between the target behavior feature vector and different categories; obtaining change information of the operation load parameter of the server in the target time period, obtaining a first information entropy of user behaviors of all users of the server in the target time period, and determining a state change value of the server in the target time period by using the change information and the first information entropy; and managing the data access behavior of the target user to the server according to the similarity values and the state change values relative to different categories. According to the technical scheme, the data access behavior of the user of the server can be well managed.

Description

Technical Field

[0001] This application relates to the technical field of data processing, and in particular, to a data security management method and system for a Xinchuang terminal environment. Background Art

[0002] A Xinchuang terminal refers to a terminal device built based on domestic software and hardware. For example, the terminal device uses domestically self-developed CPUs, operating systems, databases, etc.; the promotion of Xinchuang terminals can avoid the leakage of sensitive information and dependence on foreign technologies.

[0003] Users can operate the Xinchuang terminal to control the Xinchuang terminal to send requests to the server, and the server processes the received requests and returns responses to the Xinchuang terminal; files can be transmitted between the Xinchuang terminal and the server through a stream-based protocol or a datagram protocol.

[0004] When the server processes information such as instructions or download requests from the Xinchuang terminal, there may be some users who perform abnormal access behaviors on the server through the Xinchuang terminal; for example, they may try to log in or log out multiple times in a short period, attempting to bypass the supervision of the access rights of the restricted resources by the information system; or, some users may access resources at a higher access frequency than what can be achieved manually, affecting the efficiency of the server in processing information, thereby affecting the data security and usage experience of other users.

[0005] During the process of using the Xinchuang terminal by users, the storage space of the Xinchuang terminal usually stores the users' key information. If there are abnormal access behaviors by other users on the server, it will consume the operating resources of the server, thereby affecting the efficiency of data exchange between the users' terminals and the server. Therefore, it is necessary to manage the data access behaviors in the Xinchuang terminal environment to ensure the data security of users. Summary of the Invention

[0006] To manage the data access behaviors in the Xinchuang terminal environment, this application provides a data security management method and system for a Xinchuang terminal environment.

[0007] According to the first aspect of the embodiments of the present application, a data security management method for a Xinchuang terminal environment is provided, including: obtaining a target behavior feature vector of a target user of a server in a target time period and a plurality of predetermined reference behavior feature vectors; the target behavior feature vector or the reference behavior feature vector is determined according to the interaction situation with the server; clustering the plurality of reference behavior feature vectors to obtain a plurality of categories, and determining the average behavior feature vector of the same category, and respectively determining the similarity values between the target behavior feature vector and the average behavior feature vectors of different categories; obtaining the change information of the operation load parameter of the server in the target time period, and obtaining the first information entropy of the user behaviors of all users of the server in the target time period, and using the change information and the first information entropy to determine the state change value of the server in the target time period; the first information entropy is used to characterize the degree of consistency in the number of operations performed by different users in the target time period; according to the similarity values with respect to different categories and the state change value, determining the risk degree value of the target user in the target time period, and using the risk degree values of the target user in different time periods to manage the data access behavior of the target user to the server.

[0008] In this way, it is possible to better manage the data access behavior of the users of the server according to the operation load performance of the server and the access behavior of the users, and ensure the data security of the server.

[0009] Optionally, using the change information and the first information entropy to determine the state change value of the server in the target time period includes: , where is the state change value of the target time period, exp is the exponential function with the natural constant as the base, E is the first information entropy of the user behaviors of all users of the server in the target time period, log is the logarithmic function, N is the number of users accessing the server in the target time period, T is the number of types of operation load parameters, norm is the normalization processing function, is the th type of change information of the operation load parameter of the server in the target time period.

[0010] In this way, the obtained state change value can comprehensively reflect the change situation of the server in different operation state parameters.

[0011] Optionally, according to the similarity values with respect to different categories and the state change value, determining the risk degree value of the target user in the target time period includes: , is to determine the risk degree value of the target user in the target time period, exp is the exponential function with the natural constant as the base, max is to take the maximum value, K is the number of categories obtained after clustering the plurality of reference behavior feature vectors, is the cosine similarity between the average behavior feature vector of the k-th category and the target behavior feature vector, is the value of the state change of the server during the target time period.

[0012] Optionally, the data access behavior of the target user to the server is managed by using the risk degree values of the target user in different time periods, including: when the risk degree value of the target user in the target time period is greater than that of other users in the target time period, marking the performance of the target user in the target time period as suspected risk; when the performance of the target user in multiple consecutive time periods is marked as suspected risk, marking the target user as an abnormal user to restrict the data access behavior of the abnormal user to the server.

[0013] In this way, it is possible to restrict access requests from abnormal users and ensure the safe utilization of the server's operating resources.

[0014] Optionally, restricting the data access behavior of abnormal users to the server includes: upon receiving an access request from the target user to the server, obtaining the identity information of the target user; and discarding the access request when the identity information indicates that the target user is an abnormal user.

[0015] Optionally, the data access behavior of the target user to the server is managed by using the risk degree values of the target user in different time periods, including: when the risk degree value of the target user in the target time period is less than or equal to that of other users in the target time period, marking the performance of the target user in the target time period as normal access; and authorizing the data access behavior of the target user to the server when the performance of the target user in multiple consecutive time periods is marked as normal access.

[0016] In this way, it is possible to ensure the access requirements of non-abnormal users of the server to the resources in the server.

[0017] Optionally, the target behavior feature vector is constructed in the following way: obtaining the first access count of the target user to the server during the target time period, the first data transfer volume, the second information entropy of different operation types of the target user during the target time period, and the third information entropy of different objects in the server accessed by the target user during the target time period; and constructing the target behavior feature vector of the target user during the target time period with the first access count, the first data transfer volume, the second information entropy, and the third information entropy as elements.

[0018] In this way, the target behavior feature vector can better evaluate the data access behavior of the target user during the target time period.

[0019] Optionally, the reference behavior feature vector is determined as follows: Obtain the second access times of the reference user to the server within the reference time period, the second data transfer volume, the fourth information entropy of different operation types of the reference user within the reference time period, and the fifth information entropy of different objects in the server accessed by the reference user within the reference time period; Use the second access times, the second data transfer volume, the fourth information entropy, and the fifth information entropy as elements to construct a reference behavior feature vector of the reference user within the reference time period; The duration of the reference time period is the same as the duration of the target time period.

[0020] In this way, by constructing the reference behavior feature vector, it is convenient to determine whether there is an abnormality in the performance of the target user within the target time period.

[0021] Optionally, the operating load parameters include: CPU usage rate, memory occupancy rate, disk read / write rate, and network throughput.

[0022] According to the second aspect of the embodiments of the present application, a data security management system for a Xinchuang terminal environment is provided, including: a processor and a memory, the memory stores computer program instructions, and when the computer program instructions are executed by the processor, the steps of the data security management method for the Xinchuang terminal environment provided in the first aspect of the present application are implemented.

[0023] The technical solutions provided by the embodiments of the present application may include the following beneficial effects: Obtain the target behavior feature vector of the target user of the server within the target time period, determine the similarity value between the target behavior feature vector and the average behavior feature vectors of different categories, and combine the state change value of the server within the target time period. The obtained risk degree value can reflect the probability that the behavior of the target user interferes with the load of the server. Using the risk degree values of the target user in different time periods can achieve better management of the data access behavior of the target user to the server, which helps to ensure the stable operation of the Xinchuang terminals under the jurisdiction of the server.

[0024] It should be understood that the above general description and subsequent detailed description are only exemplary and explanatory, and cannot limit the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 is a flowchart of a data security management method for a Xinchuang terminal environment shown according to an exemplary embodiment; Figure 2 is a schematic structural diagram of a data security management system for a Xinchuang terminal environment shown according to an exemplary embodiment. DETAILED DESCRIPTION

[0026] First, a brief introduction to the application scenario of the embodiments of the present application is given. In the application scenario of the present application, among the users of the information and communication technology (ICT) terminals that perform data transmission with the server, there may be some users with abnormal access behaviors. These abnormal access behaviors will consume a large amount of the server's operating resources and affect the data transmission experience between the ICT terminals where other users are located and the server. Therefore, it is necessary to manage the data access behaviors in the ICT terminal environment.

[0027] It should be noted that all actions of obtaining signals, information, or data in the present application are carried out on the premise of complying with the corresponding data protection regulations and policies of the country where it is located and with the authorization given by the owner of the corresponding device.

[0028] To address the above technical problems, the embodiments of the present application provide a data security management method and system for the ICT terminal environment. Figure 1 It is a flowchart of a data security management method for the ICT terminal environment shown according to an exemplary embodiment. As Figure 1 shown, the method includes the following steps.

[0029] In step S101, obtain the target behavior feature vector of the target user of the server in the target time period, and a plurality of pre-determined reference behavior feature vectors.

[0030] The target behavior feature vector or the reference behavior feature vector is determined according to the interaction situation with the server; the interaction situation with the server may include the number of types of control instructions for the server, the number of types of resource downloads from the server, the frequency of accessing web pages in the server, and the number of resources accessed in the server.

[0031] When a user communicates with the server through a terminal device such as an ICT terminal, the frequency of resource access and the number of types of resources downloaded usually fall within a certain range. If the number of types of resources accessed by a certain user within the same time period is higher than that of others, the user with a higher number of types of resources accessed is more likely to have abnormal access behaviors; for example, by deploying scripts or software with abnormal behaviors, abnormal access to resources in the server is executed.

[0032] The target behavior feature vector of the target user of the server in the target time period can reflect the access behavior of the target user of the server in the target time period; through the plurality of pre-determined reference behavior feature vectors, a better reference can be provided for the access behavior of the target user in the target time period, so as to determine whether the target user has abnormal access behaviors to the server.

[0033] The target time period may be the time period where the current moment is located, or the target time period may also be a certain time period before the current moment.

[0034] A plurality of pre-determined reference behavior feature vectors can be determined based on the access behavior of the target user to the server within a historical time period, or can be determined based on the access behavior of other users to the server within a historical time period, or can also be determined by combining the access behavior of the target user and other users to the server within the historical time period.

[0035] The target user can refer to any user who has an access behavior to the server within a target time period; since different users usually log in to different accounts, or different users usually use different terminal devices to transmit data with the server, different users correspond to different account identification information or device identification information. Therefore, the server can determine the users who have an access behavior to the server within the target time period by parsing the logs stored by itself.

[0036] In one embodiment, the target behavior feature vector can be constructed in the following manner: obtaining the first access frequency of the target user to the server within the target time period, the first data transmission volume, the second information entropy of different operation types of the target user within the target time period, and the third information entropy of different objects in the server accessed by the target user within the target time period; using the first access frequency, the first data transmission volume, the second information entropy, and the third information entropy as elements to construct the target behavior feature vector of the target user within the target time period.

[0037] The access frequency of the target user to the server within the target time period can be used as the first access frequency; the data transmission volume between the target user and the server within the target time period can be used as the first data transmission volume; the information entropy of different operation types of the target user within the target time period can be used as the second information entropy; the information entropy of different objects in the server accessed by the target user within the target time period can be used as the third information entropy.

[0038] The second information entropy can characterize the complexity of different operation types of the target user within the target time period, and the second information entropy can be determined according to the frequency proportion of different operation types of the target user within the target time period.

[0039] The greater the number of types of different operations performed by the target user within the target time period, or the more inconsistent the frequency proportion of different types of operations performed by the target user within the target time period, the greater the second information entropy of different operation types of the target user within the target time period.

[0040] The different operation types of the target user can respectively correspond to different types of instructions sent to the server. For example, logging in, browsing, querying, and downloading sent to the server belong to different types of instructions.

[0041] Under normal circumstances, when a user interacts with a server using an information technology innovation terminal, the complexity of different operation types that can be executed within the same time period is limited. For example, the user usually executes one to three of various operation types at the same moment and it is difficult to execute all types of operations at the same moment. However, when the user has abnormal behaviors such as accessing resources using an abnormal script, more than 60% or even all types of operations can be executed at the same moment, threatening the stable operation of the server and affecting the stable operation of other information technology innovation terminals under the jurisdiction of the server.

[0042] Since the second information entropy can characterize the complexity of different operation types of the target user within the target time period, and there are differences in the complexity of the operation types executed within the same time period when the user has abnormal access behavior and when there is no abnormal access behavior, the second information entropy can reflect the data access behavior of the target user to the server from the perspective of the complexity of the operation types executed within the same time period.

[0043] Referring to the determination process of the information entropy of different values of the same variable within the same time period, the first information entropy, the second information entropy, the third information entropy, the fourth information entropy, and the fifth information entropy in the embodiments of the present application can be determined.

[0044] Among them, determining the information entropy of a variable within the same time period according to the frequency proportion of different values of the same variable within the same time period belongs to the common knowledge of those skilled in the art, and the embodiments of the present application will not elaborate herein.

[0045] The third information entropy can reflect the complexity of different objects in the server accessed by the target user within the target time period. For example, the proportion of the number of times the target user accesses different objects in the server within the target time period can be determined respectively, and the third information entropy of the target user within the target time period can be determined according to the proportion of the number of times different objects are accessed within the target time period.

[0046] The first access times, the first data transmission volume, the second information entropy, and the third information entropy of the target user within the target time period can respectively reflect the data access behavior of the target user to the server from different perspectives. Constructing a feature vector with the first access times, the first data transmission volume, the second information entropy, and the third information entropy as elements, the obtained target behavior feature vector can more comprehensively describe the access behavior of the target user to the server within the target time period, so as to determine whether there is an abnormality in the access behavior of the target user within the target time period.

[0047] In one embodiment, the reference behavior feature vector is determined as follows: Obtain the second access count of the reference user to the server within the reference time period, the second data transmission volume, the fourth information entropy of different operation types of the reference user within the reference time period, and the fifth information entropy of different objects in the server accessed by the reference user within the reference time period; Use the second access count, the second data transmission volume, the fourth information entropy, and the fifth information entropy as elements to construct the reference behavior feature vector of the reference user within the reference time period; The duration of the reference time period is the same as the duration of the target time period.

[0048] The construction method of the reference behavior feature vector is the same as that of the target behavior feature vector; The difference between the reference behavior feature vector and the target behavior feature vector lies in the corresponding user or time period being different.

[0049] The durations of the reference time period and the target time period can both be equal to the target duration, and the specific duration of the target duration can be specified in advance or in real time according to actual needs; For example, the target duration can be between 3 minutes and 5 minutes.

[0050] The access count of the reference user to the server within the reference time period can be used as the second access count; The data transmission volume of the reference user to the server within the reference time period can be used as the second data transmission volume; The information entropy of different operation types of the reference user within the reference time period can be used as the fourth information entropy; The information entropy of different objects in the server accessed by the reference user within the reference time period can be used as the fifth information entropy.

[0051] The fourth information entropy of different operation types of the reference user within the reference time period can be determined by referring to the second information entropy of different operation types of the target user within the target time period; The fifth information entropy of different objects in the server accessed by the reference user within the reference time period can be determined by referring to the third information entropy of different objects in the server accessed by the target user within the target time period, and details are not elaborated in this embodiment of the present application.

[0052] The second access count, the second data transmission volume, the fourth information entropy, and the fifth information entropy can respectively reflect the data access situation of the reference user to the server within the reference time period from different perspectives. Using the second access count, the second data transmission volume, the fourth information entropy, and the fifth information entropy as elements to construct the reference behavior feature vector of the reference user within the reference time period, the obtained reference behavior feature vector can more comprehensively reflect the data access behavior of the reference user within the target time period.

[0053] Multiple reference behavior feature vectors can include the behavior feature vectors of different reference users within different reference time periods; The behavior feature vector can be determined by referring to the target behavior feature vector of the target user within the target time period.

[0054] To improve the reference value of the reference behavior feature vectors for the data access behavior of the target user within the target time period, a preset number of reference behavior feature vectors can be determined in advance; the preset number can be greater than or equal to 1000, for example.

[0055] To improve the timeliness of the reference behavior feature vectors, the reference behavior feature vectors can also be updated periodically; for example, the adopted reference behavior feature vectors can be updated every hour or every day to obtain multiple reference behavior feature vectors corresponding to a reference time period closer to the current moment.

[0056] In step S102, multiple reference behavior feature vectors are clustered to obtain multiple categories, and the average behavior feature vector of the same category is determined. The similarity values between the target behavior feature vector and the average behavior feature vectors of different categories are determined respectively.

[0057] Multiple reference behavior feature vectors are clustered to obtain multiple categories, and multiple similar reference behavior feature vectors are included in the same category; the clustering of all reference behavior feature vectors can be implemented by algorithms such as the K-Means clustering algorithm, the hierarchical clustering algorithm, and the DBSCAN (Density-Based Spatial Clustering of Applications with Noise) algorithm.

[0058] After the clustering of all reference behavior feature vectors is completed, since multiple similar reference behavior feature vectors are already included in the same category after clustering, the average value of the elements at the corresponding positions of the reference behavior feature vectors in the same category can be used as the value of the element at the corresponding position in the average behavior feature vector of the same category, so as to obtain the average behavior feature vector composed of different elements.

[0059] For example, when the target category obtained after clustering includes a total of 5 reference behavior feature vectors: (a1, b1, c1, d1), (a2, b2, c2, d2), (a3, b3, c3, d3), (a4, b4, c4, d4), and (a5, b5, c5, d5); the target category can be any one of the multiple categories obtained after clustering all reference behavior feature vectors.

[0060] ((a1 + a2 + a3 + a4 + a5) / 5) can be used as the value of the first element in the average behavior feature vector of the target category; ((b1 + b2 + b3 + b4 + b5) / 5) can be used as the value of the second element in the average behavior feature vector of the target category; ((c1 + c2 + c3 + c4 + c5) / 5) can be used as the value of the third element in the average behavior feature vector of the target category; ((d1 + d2 + d3 + d4 + d5) / 5) can be used as the value of the fourth element in the average behavior feature vector of the target category, so as to obtain the average behavior feature vector composed of 4 elements corresponding to the target category.

[0061] For the same category obtained after clustering, there are multiple reference time periods or multiple reference users with similar data access situations; the average behavior feature vector of the target category can represent the overall situation of the data access of the corresponding reference users of the target category to the server. Determining the average behavior feature vector of the target category can facilitate the comparison of the data access of the reference user group with similar data access situations to the server and the data access of the target user to the server.

[0062] Since the same category obtained after clustering the reference behavior feature vectors includes multiple similar reference behavior feature vectors, determining the similarity values between the target behavior feature vector and the average behavior feature vectors of different categories can effectively reduce the number of values to be determined compared with determining the similarity values between the target behavior feature vector and the reference behavior feature vectors respectively, and can ensure the accuracy of the obtained similarity values.

[0063] For example, when the number of reference behavior feature vectors is 1000, after clustering the reference behavior feature vectors, 1000 reference behavior feature vectors may be clustered into 30 categories; here, the number of similarity values to be determined for determining the similarity values between the target behavior feature vector and the average behavior feature vectors of different categories is 30. Compared with determining 1000 similarity values for 1000 reference behavior feature vectors respectively, the number of similarity values to be determined can be significantly reduced while ensuring the accuracy of the obtained similarity values.

[0064] Furthermore, after clustering all the reference behavior feature vectors, the reference behavior feature vectors that exhibit similar data access behaviors to the server are clustered into the same category. The reference behavior feature vectors of the same category can have higher representativeness and can provide a more accurate reference for the data access behavior of the target user in the target time period.

[0065] In step S103, obtain the change information of the server's operating load parameters during the target time period, and obtain the first information entropy of the user behaviors of all users of the server during the target time period. Use the change information and the first information entropy to determine the state change value of the server during the target time period.

[0066] The server's operating load parameters include: CPU usage rate, memory occupancy rate, disk read / write speed, and network throughput.

[0067] The change information of the server's operating load parameters during the target time period is used to characterize the degree of change of the server's operating load parameters during the target time period; the change information of the server's operating load parameters during the target time period may refer to the absolute value of the difference between the operating load parameters of the server at the end moment of the target time period and the operating load parameters of the server at the start moment of the target time period.

[0068] The first information entropy of the user behaviors of all users of the server during the target time period is used to characterize the degree of consistency in the number of operations performed by different users of the server during the target time period.

[0069] The first information entropy of the user behaviors of all users of the server during the target time period can be determined in the following way: Determine the proportion of the number of operations performed by the same user accessing the server during the target time period in the total number of operations received by the server during the target time period; Determine the proportion of the number of operations performed by different users accessing the server during the target time period, and the first information entropy can be determined.

[0070] Taking an exemplary calculation formula as an example below, the process of obtaining the first information entropy in the embodiments of the present application is described: The first information entropy , where M is the number of users accessing the server during the target time period; is the proportion of the number of operations performed by the k-th user accessing the server during the target time period in the total number of operations received by the server during the target time period; ln is the logarithmic function with the natural constant as the base.

[0071] For example, in the first case, there are 5 accessing users during the target time period, and these 5 accessing users perform 80 times, 20 times, 20 times, 20 times, and 20 times respectively during the target time period. Then the total number of operations received by the server during the target time period is 160.

[0072] It can be seen that in the first case, the number of operations received by the server mainly concentrates on User 1. The proportions of the number of operations executed by these 5 accessing users in the total number of operations are 0.5, 0.125, 0.125, 0.125, and 0.125 respectively. The first information entropy obtained in the first case is -((0.5×ln0.5)+(0.125×ln0.125)+(0.125×ln0.125)+(0.125×ln0.125)+(0.125×ln0.125)) = 1.386.

[0073] For example, in the second case, there are 5 accessing users within the target time period. These 5 accessing users executed 30 times, 30 times, 20 times, 40 times, and 40 times respectively within the target time period. Then the total number of operations received by the server within the target time period is 160.

[0074] Among the number of operations received by the server in the second case, the number of operations from different users is relatively uniform, and the total number of operations does not concentrate on a small number of users. The proportions of the number of operations executed by the 5 accessing users in the total number of operations are 0.1875, 0.1875, 0.125, 0.25, and 0.25 respectively. The first information entropy obtained in the first case is -((0.1875×ln0.1875)+(0.1875×ln0.1875)+(0.125×ln0.125)+(0.25×ln0.25)+(0.25×ln0.25)) = 2.28.

[0075] It can be seen that the larger the value of the information entropy within the target time period, the closer the number of operations received by the server from different users within the target time period, and the more the performance of the server within the time period conforms to the performance when the server is not under abnormal access.

[0076] When the users of the server perform operations within the target time period, the number of operations of normal users is within a certain range. The closer the number of operations of all users within the target time period, the smaller the probability that the server is under abnormal access behavior within the target time period, and the larger the value of the first information entropy. Therefore, the first information entropy is negatively correlated with the probability that the server is under abnormal access behavior within the target time period.

[0077] The larger the first information entropy of the number of operations of all users of the server within the target time period, the more evenly the number of operations received by the server within the target time period comes from different users; on the contrary, the smaller the first information entropy of the number of operations of all users of the server within the target time period, the more the number of operations received by the server within the target time period mainly concentrates on a smaller number of users.

[0078] Since the first information entropy can reflect the degree of consistency in the number of operations performed by all users during the target time period, and the change information of the server's operating load parameters during the target time period can reflect the change in the server's operating load, therefore, combining the first information entropy and the change information of the operating load can better reflect the change situation of the server during the target time period.

[0079] In one embodiment, using the change information and the first information entropy, determine the state change value of the server during the target time period, including: , where is the state change value of the target time period, exp is the exponential function with the natural constant as the base, E is the first information entropy of the user behavior of all users of the server during the target time period, log is the logarithmic function, N is the number of users accessing the server during the target time period, T is the number of types of operating load parameters, and norm is the normalization processing function. is the th type of change information of the operating load parameter of the server during the target time period.

[0080] Taking as the denominator realizes the normalization processing of the first information entropy E. The greater the change information of the th type of operating load parameter of the server during the target time period, the greater the degree of change of the th type of operating load of the server during the target time period. In order to discover as much as possible the abnormal access behavior that the server may be subject to, a larger state change value can be determined.

[0081] The normalization processing function norm is used to normalize the variable to be normalized to the range of 0 to 1. For example, the normalization processing function can be min-max standardization, logarithmic transformation, arctangent function, and Sigmoid function, etc.

[0082] In this way, it is possible to combine the diversity of operations of all users of the server during the target time period and the change of the server's operating state parameters to obtain a state change value characterizing the abnormal access behavior of the server during the target time period.

[0083] In step S104, according to the similarity values and state change values respectively corresponding to different categories, determine the risk degree value of the target user during the target time period, and use the risk degree values of the target user in different time periods to manage the data access behavior of the target user to the server.

[0084] The categories obtained by clustering all reference behavior feature vectors. The same category can better represent reference users with similar data access behaviors to the server, and the number of abnormal users with abnormal access behaviors to the server is usually less than that of normal users. Among multiple average behavior feature vectors corresponding to different categories respectively, there is usually at least one average behavior feature vector similar to the target behavior feature vector generated under normal data access behaviors, resulting in a higher similarity value corresponding to normal users.

[0085] However, due to the greater difference between the abnormal access behaviors and normal access behaviors of abnormal users, among multiple average behavior feature vectors corresponding to different categories respectively, there may not be an average behavior feature vector similar to the target behavior feature vector of the abnormal access behavior, resulting in a low similarity value corresponding to the abnormal user.

[0086] The state change value of the server within the target time period can reflect the abnormal access behaviors received within the target time period from the perspective of the server load performance; the similarity values of the target user relative to different categories respectively can reflect the probability of the target user being abnormal among all users. Therefore, the risk degree value of the target user within the target time period determined according to the similarity values relative to different categories respectively and the state change value can reflect the probability of the target user having abnormal access behaviors to the server within the target time period.

[0087] In one embodiment, determining the risk degree value of the target user within the target time period according to the similarity values relative to different categories respectively and the state change value includes: , To determine the risk degree value of the target user within the target time period, exp is the exponential function with the natural constant as the base, max is to take the maximum value, and K is the number of categories obtained after clustering multiple reference behavior feature vectors. is the cosine similarity between the average behavior feature vector of the kth category and the target behavior feature vector. is the state change value of the server within the target time period.

[0088] The value range of the pre-similarity is between -1 and 1. Therefore, The value of is between 0 and 1; since different categories respectively represent reference user groups with different data access behaviors, by selecting the maximum value from the corresponding to all categories to participate in the calculation of the risk degree value, the reference user group with the most similar data access behavior to the target user can be selected from all reference user groups.

[0089] The greater the cosine similarity between the target user and the reference user group with the most similar data access behavior, the more it indicates that there is at least a reference user group with data access behavior similar to that of the target user, and the smaller the probability that the target user's data access behavior to the server is abnormal. Therefore, a smaller risk level value can be determined.

[0090] On the contrary, the smaller the cosine similarity between the target user and the reference user group with the most similar data access behavior, the more it indicates that the reference user group with the most similar data access behavior to the target user still has a low similarity with the target user in terms of data access behavior, and the greater the probability that the target user's data access behavior to the server is abnormal. Therefore, a larger risk level value can be determined.

[0091] In this way, it is possible to comprehensively consider the server's operating load situation during the target time period and the similarity between the target user's data access behavior and the reference user's data access behavior, and use the risk level value to better reflect the probability that the target user has abnormal access to the server during the target time period.

[0092] In one embodiment, the risk level values of the target user in different time periods are used to manage the target user's data access behavior to the server, including: when the risk level value of the target user in the target time period is greater than that of other users in the target time period, marking the performance of the target user in the target time period as suspected risk; when the performance of the target user in multiple consecutive time periods is marked as suspected risk, marking the target user as an abnormal user to restrict the target user's data access behavior to the server.

[0093] Since the risk level value can reflect the probability that the target user has abnormal access behavior, the fact that the risk level value of the target user in the target time period is greater than that of other users in the target time period at least indicates that the target user is the user causing abnormal access behavior during the target time period; here, marking the performance of the target user in the target time period as suspected risk can achieve the marking of users with a certain degree of abnormal performance, so as to observe the subsequent performance of users whose performance is marked as suspected risk.

[0094] If the performance of the target user in multiple consecutive time periods is marked as suspected risk, it means that in addition to having a high probability of abnormal performance, the target user has not stopped the abnormal access behavior in multiple consecutive time periods. In order to prevent abnormal users from further damaging the server's operating resources, the target user can be marked as an abnormal user and the target user's data access behavior to the server can be restricted.

[0095] Alternatively, if the performance of the target user in multiple consecutive time periods is not marked as suspected risk, it indicates that the target user does not have high-risk access behaviors, or the data access behavior of the target user does not conform to the characteristics of abnormal access, and the subsequent performance of the target user can be continuously observed.

[0096] For example, the cumulative number of times the performance of the target user is marked as risky can be obtained. When the cumulative number reaches a preset number, the data access behavior of the target user to the server can be restricted to avoid further deterioration of the server's operation load caused by the data access behavior of the target user. The preset number can be 3 times, for example.

[0097] In this way, it is possible to adaptively determine whether the target user is an abnormal user based on the data access behavior performance of the target user relative to other users. By restricting the data access behavior of abnormal users, the operation resources of the server can be fully utilized to ensure the usage experience of non-abnormal users.

[0098] In one embodiment, restricting the data access behavior of abnormal users to the server includes: upon receiving an access request from the target user to the server, obtaining the identity identification information of the target user; and discarding the access request when the identity identification information indicates that the target user is an abnormal user.

[0099] Users marked as abnormal usually have high risks and may perform large-scale downloads or accesses to the data in the server, resulting in waste of server resources or even paralysis of the server. By discarding access requests from abnormal users, it is possible to ensure that the resources of the server are fully utilized and the operation cost of the server is reduced.

[0100] In one embodiment, managing the data access behavior of the target user to the server by using the risk degree values of the target user in different time periods includes: when the risk degree value of the target user in the target time period is less than or equal to that of other users in the target time period, marking the performance of the target user in the target time period as normal access; and authorizing the data access behavior of the target user to the server when the performance of the target user in multiple consecutive time periods is marked as normal access.

[0101] Since there are usually only a small number (e.g., 1%) of abnormal users among all users, the fact that the risk degree value of the target user in the target time period is less than or equal to that of other users in the target time period at least indicates that the probability of the target user being abnormal is small. Marking the performance of the target user in the target time period as normal access helps to ensure the usage requirements of normal users.

[0102] When the performance of the target user is marked as normal access in multiple consecutive time periods, it indicates that the target user belongs to the users who normally access resources, and the data access behavior of the target user to the server can be authorized.

[0103] In this way, it is possible to avoid blocking the access requests of normal users to the server, improve the utilization rate of server resources, and ensure the usage experience of normal users.

[0104] Figure 2 It is a schematic structural diagram of a data security management system 1000 for a Xinchuang terminal environment shown according to an exemplary embodiment. Refer to Figure 2 , the data security management system 1000 for the Xinchuang terminal environment includes: a processor 1100 and a memory 1200. The memory 1200 stores computer program instructions, and when the computer program instructions are executed by the processor 1100, all or part of the steps of the data security management method for the Xinchuang terminal environment in this application are implemented.

[0105] After considering the specification and practicing the invention disclosed herein, those skilled in the art will readily think of other implementation schemes of this application. This application is intended to cover any variations, uses, or adaptive changes of this application. These variations, uses, or adaptive changes follow the general principles of this application and include the common general knowledge or conventional technical means in the technical field not disclosed in this application. The specification and embodiments are only regarded as exemplary.

[0106] It should be understood that this application is not limited to the exact structure already described and shown in the drawings, and various modifications and changes can be made without departing from its scope.

Claims

1. A data security management method for the information technology application innovation terminal environment, characterized in that Including: Obtaining a target behavior feature vector of a target user of the server in a target time period, and a plurality of predetermined reference behavior feature vectors; The target behavior feature vector or the reference behavior feature vector is determined according to the interaction situation with the server; Performing clustering on the plurality of reference behavior feature vectors to obtain a plurality of categories, determining an average behavior feature vector of the same category, and respectively determining similarity values between the target behavior feature vector and the average behavior feature vectors of different categories; Obtaining change information of the operating load parameter of the server in the target time period, and obtaining a first information entropy of the user behaviors of all users of the server within the target time period, and determining a state change value of the server in the target time period by using the change information and the first information entropy; the first information entropy is used to characterize the degree of consistency in the number of operations performed by different users within the target time period; Determining a risk degree value of the target user in the target time period according to the similarity values with respect to different categories and the state change value, and managing the data access behavior of the target user to the server by using the risk degree values of the target user in different time periods.

2. The data security management method for the domestic innovation terminal environment according to claim 1, wherein Determining a state change value of the server in the target time period by using the change information and the first information entropy, including: , where is the state change value of the target time period, exp is the exponential function with the natural constant as the base, E is the first information entropy of the user behaviors of all users of the server within the target time period, log is the logarithmic function, N is the number of users accessing the server within the target time period, T is the number of types of running load parameters, and norm is the normalization function. is the change information of the th type of running load parameter of the server within the target time period.

3. The data security management method for the domestic information technology innovation terminal environment according to claim 1, wherein, Determining a risk degree value of the target user in the target time period according to the similarity values with respect to different categories and the state change value, including: , To determine the risk level value of the target user during the target time period, exp is the exponential function with the natural constant as the base, max is to take the maximum value, K is the number of categories obtained after clustering multiple reference behavior feature vectors, is the cosine similarity between the average behavior feature vector of the k-th category and the target behavior feature vector, is the state change value of the server during the target time period.

4. The data security management method for the domestic information technology innovation terminal environment according to claim 1, wherein, Managing the data access behavior of the target user to the server by using the risk degree values of the target user in different time periods, including: When the risk degree value of the target user in the target time period is greater than that of other users in the target time period, marking the performance of the target user in the target time period as suspected risk; When the performance of the target user in a continuous plurality of time periods is marked as suspected risk, marking the target user as an abnormal user to restrict the data access behavior of the abnormal user to the server.

5. The data security management method for the domestic innovation terminal environment according to claim 4, wherein, Restricting the data access behavior of the abnormal user to the server, including: In response to receiving an access request of the target user to the server, obtaining the identity identification information of the target user; when the identity identification information indicates that the target user is an abnormal user, discarding the access request.

6. The data security management method for the information and communication technology (ICT) innovation terminal environment according to claim 1, wherein Managing the data access behavior of the target user to the server by using the risk degree values of the target user in different time periods, including: When the risk degree value of the target user in the target time period is less than or equal to that of other users in the target time period, marking the performance of the target user in the target time period as normal access; When the performance of the target user in a continuous plurality of time periods is marked as normal access, authorizing the data access behavior of the target user to the server.

7. The data security management method for the domestic information technology innovation terminal environment according to claim 1, wherein The target behavior feature vector is constructed in the following manner: Obtaining a first access count of the target user to the server in the target time period, a first data transmission volume, a second information entropy of different operation types of the target user in the target time period, and a third information entropy of different objects in the server accessed by the target user in the target time period; Construct a target behavior feature vector of the target user in the target time period with the first access count, the first data transmission volume, the second information entropy, and the third information entropy as elements.

8. The data security management method for the domestic information technology innovation terminal environment according to claim 1, wherein, The reference behavior feature vector is determined as follows: Obtain the second access count of the reference user to the server in the reference time period, the second data transmission volume, the fourth information entropy of different operation types of the reference user in the reference time period, and the fifth information entropy of different objects in the servers accessed by the reference user in the reference time period; Construct a reference behavior feature vector of the reference user in the reference time period with the second access count, the second data transmission volume, the fourth information entropy, and the fifth information entropy as elements; the duration of the reference time period is the same as that of the target time period.

9. The data security management method for the domestic information technology innovation terminal environment according to claim 1, wherein The operating load parameters include: CPU usage rate, memory occupancy rate, disk read / write rate, and network throughput.

10. A data security management system for a domestic information technology innovation terminal environment, characterized in that, It includes: A processor and a memory, where the memory stores computer program instructions, and when the computer program instructions are executed by the processor, the data security management method of the information and communication technology (ICT) terminal environment according to any one of claims 1-9 is implemented.

Images