A data security management method and system for a trusted terminal environment

Abstract

The present application relates to the field of data processing technology, and in particular to a data security management method and system for a trusted terminal environment. The method includes: obtaining a target behavior feature vector and multiple reference behavior feature vectors of a target user of a server in a target time period; classifying multiple reference behavior feature vectors into categories, and determining the similarity values ​​between the target behavior feature vectors and different categories; obtaining change information of the server's operating load parameters in the target time period, and obtaining the first information entropy of the user behavior of all users of the server in the target time period, and using the change information and the first information entropy to determine the state change value of the server in the target time period; managing the target user's data access behavior to the server based on the similarity value and state change value relative to different categories. Through the above technical solution, it is possible to better manage the data access behavior of the server's users.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to a data security management method and system for an information-based terminal environment. Background Art

[0002] A trusted terminal refers to a terminal device built based on domestically produced software and hardware. For example, the terminal device uses a CPU, operating system, and database independently developed in China. The promotion of trusted terminals can avoid the leakage of sensitive information and dependence on foreign technology.

[0003] Users can operate the trusted terminal to control the trusted terminal to send requests to the server. The server processes the received requests and returns a response to the trusted terminal. Files can be transferred between the trusted terminal and the server through a stream-based protocol or a datagram protocol.

[0004] When the server is processing instructions or download requests from the trusted terminal, some users may perform abnormal access behaviors to the server through the trusted terminal; for example, they may try to log in or log out multiple times in a short period of time, trying to bypass the information system's supervision of access rights to restricted resources; or, some users may access resources at a frequency higher than that achieved manually, affecting the efficiency of the server's information processing, thereby affecting the data security and usage experience of other users.

[0005] When users use the trusted terminal, the storage space of the trusted terminal usually stores the user's key information. If other users have abnormal access to the server, it will consume the server's operating resources, thereby affecting the efficiency of data exchange between the user's terminal and the server. Therefore, it is necessary to manage data access behavior in the trusted terminal environment to ensure user data security. Summary of the Invention

[0006] In order to manage data access behavior in a trusted terminal environment, this application provides a data security management method and system for a trusted terminal environment.

[0007] According to the first aspect of the embodiment of the present application, a data security management method for a trusted terminal environment is provided, including: obtaining a target behavior feature vector of a target user of a server in a target time period, and a plurality of predetermined reference behavior feature vectors; the target behavior feature vector or the reference behavior feature vector is determined based on the interaction with the server; clustering the plurality of reference behavior feature vectors to obtain a plurality of categories, and determining the average behavior feature vector of the same category, and respectively determining the similarity value between the target behavior feature vector and the average behavior feature vectors of different categories; obtaining change information of the operating load parameters of the server in the target time period, and obtaining the first information entropy of the user behavior of all users of the server in the target time period, and determining the state change value of the server in the target time period by using the change information and the first information entropy; the first information entropy is used to characterize the degree of consistency in the number of operations performed by different users in the target time period; determining the risk level value of the target user in the target time period based on the similarity values ​​relative to different categories and the state change values, and managing the target user's data access behavior to the server by using the risk level value of the target user in different time periods.

[0008] In this way, the data access behavior of the server users can be better managed according to the server's operating load performance and the user's access behavior, and the data security of the server can be guaranteed.

[0009] Optionally, determining a state change value of the server within a target time period by using the change information and the first information entropy includes: ,in, is the state change value of the target time period, exp is the exponential function with a natural constant as the base, E is the first information entropy of the user behavior of all users of the server during the target time period, log is the logarithmic function, N is the number of users accessing the server during the target time period, T is the number of types of operating load parameters, and norm is the normalization processing function. For the server The change information of the operating load parameters in the target time period.

[0010] In this way, the obtained state change value can comprehensively reflect the changes in different operating state parameters of the server.

[0011] Optionally, determining the risk level of the target user in the target time period according to the similarity values ​​respectively corresponding to different categories and the state change values ​​includes: , To determine the risk level of the target user in the target time period, exp is an exponential function with a natural constant as the base, max is the maximum value, and K is the number of categories obtained after clustering multiple reference behavior feature vectors. is the cosine similarity between the average behavior feature vector of the kth category and the target behavior feature vector, The server status change value within the target time period.

[0012] Optionally, the target user's risk level value in different time periods is utilized to manage the target user's data access behavior to the server, including: when the target user's risk level value in the target time period is greater than that of other users in the target time period, marking the target user's performance in the target time period as suspected risk; when the target user's performance in multiple consecutive time periods is marked as suspected risk, marking the target user as an abnormal user to restrict the abnormal user's data access behavior to the server.

[0013] In this way, access requests from abnormal users can be restricted, ensuring the safe use of server operating resources.

[0014] Optionally, restricting abnormal users' data access behavior to the server includes: in response to receiving a target user's access request to the server, obtaining the target user's identity information; and discarding the access request if the identity information indicates that the target user is an abnormal user.

[0015] Optionally, the target user's risk level value in different time periods is used to manage the target user's data access behavior to the server, including: when the target user's risk level value in the target time period is less than or equal to that of other users in the target time period, marking the target user's performance in the target time period as normal access; when the target user's performance in multiple consecutive time periods is marked as normal access, authorizing the target user's data access behavior to the server.

[0016] In this way, the access needs of non-abnormal users of the server to the resources in the server can be guaranteed.

[0017] Optionally, the target behavior feature vector is constructed in the following manner: obtaining the first number of visits of the target user to the server within the target time period, the first data transmission volume, the second information entropy of different operation types of the target user within the target time period, and the third information entropy of different objects in the server visited by the target user within the target time period; using the first number of visits, first data transmission volume, second information entropy and third information entropy as elements to construct the target behavior feature vector of the target user in the target time period.

[0018] In this way, the target behavior feature vector can better realize the evaluation of the data access behavior of the target user within the target time period.

[0019] Optionally, the reference behavior feature vector is determined in the following manner: obtaining the second number of visits to the server by the reference user during the reference time period, the second data transmission volume, the fourth information entropy of different operation types of the reference user during the reference time period, and the fifth information entropy of different objects in the server visited by the reference user during the reference time period; using the second number of visits, the second data transmission volume, the fourth information entropy and the fifth information entropy as elements to construct a reference behavior feature vector of the reference user during the reference time period; the length of the reference time period is the same as the length of the target time period.

[0020] In this way, by constructing a reference behavior feature vector, it is possible to easily determine whether there is any abnormality in the performance of the target user within the target time period.

[0021] Optionally, the operating load parameters include: CPU usage, memory occupancy, disk read and write rate, and network throughput.

[0022] According to the second aspect of the embodiment of the present application, a data security management system for an ICT terminal environment is provided, including: a processor and a memory, the memory storing computer program instructions, and the computer program instructions, when executed by the processor, implement the steps of the data security management method for an ICT terminal environment provided in the first aspect of the present application.

[0023] The technical solution provided by the embodiments of the present application may include the following beneficial effects: obtaining the target behavior feature vector of the target user of the server in the target time period, and determining the similarity value between the target behavior feature vector and the average behavior feature vector of different categories. Combined with the state change value of the server in the target time period, the obtained risk level value can reflect the probability that the target user's behavior will interfere with the server load. By utilizing the risk level value of the target user in different time periods, better management of the target user's data access behavior to the server can be achieved, which helps to ensure the stable operation of the trusted innovation terminal under the jurisdiction of the server.

[0024] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 This is a flow chart of a data security management method for a trusted terminal environment according to an exemplary embodiment;

[0026] Figure 2 It is a structural diagram of a data security management system for a trusted terminal environment according to an exemplary embodiment. DETAILED DESCRIPTION

[0027] First, a brief introduction is given to the application scenario of the embodiment of the present application. In the application scenario of the present application, among the users of the trusted terminal that transmits data with the server, there may be some users with abnormal access behaviors. These abnormal access behaviors will occupy a large amount of server operating resources and affect the data transmission experience between the trusted terminal and the server where other users are located. Therefore, it is necessary to manage the data access behavior in the trusted terminal environment.

[0028] It should be noted that all actions of acquiring signals, information or data in this application are carried out in compliance with the relevant data protection laws and policies of the country where they are located and with the authorization given by the owner of the corresponding device.

[0029] In response to the above technical problems, the present invention provides a data security management method and system for a trusted terminal environment. Figure 1 This is a flow chart of a data security management method for a trusted terminal environment according to an exemplary embodiment. Figure 1 As shown, the method includes the following steps.

[0030] In step S101 , a target behavior feature vector of a target user in a target time period and a plurality of predetermined reference behavior feature vectors are obtained from a server.

[0031] The target behavior feature vector or the reference behavior feature vector is determined based on the interaction with the server; the interaction with the server may include the number of types of control instructions to the server, the number of types of resources downloaded from the server, the frequency of accessing web pages in the server, and the number of resources accessed in the server.

[0032] When users communicate with servers through terminal devices such as trusted computing terminals, the frequency of resource access and the number of types of resources downloaded are usually within a certain range. If the number of resource types accessed by a user in the same time period is higher than the number of resource types accessed by others, the user with a higher number of resource types accessed is more likely to have abnormal access behavior; for example, by deploying scripts or software with abnormal behavior, abnormal access to resources in the server is performed.

[0033] The target behavior feature vector of the target user of the server in the target time period can reflect the access behavior of the target user of the server within the target time period; through multiple predetermined reference behavior feature vectors, a better reference can be provided for the access behavior of the target user in the target time period, so as to determine whether the target user has abnormal access behavior to the server.

[0034] The target time period may be the time period of the current moment, or the target time period may be a time period before the current moment.

[0035] The predetermined multiple reference behavior feature vectors can be determined based on the target user's access behavior to the server within a historical time period, or based on the access behavior of other users to the server within a historical time period, or can be determined by combining the access behavior of the target user and other users to the server within a historical time period.

[0036] The target user may refer to any user who has accessed the server within the target time period. Since different users usually log in to different accounts, or different users usually use different terminal devices to transmit data to the server, different users correspond to different account identification information or device identification information. Therefore, the server can determine the users who have accessed the server within the target time period by parsing the logs stored in itself.

[0037] In one embodiment, the target behavior feature vector can be constructed in the following manner: obtaining the first number of visits of the target user to the server within the target time period, the first data transmission volume, the second information entropy of different operation types of the target user within the target time period, and the third information entropy of different objects in the server visited by the target user within the target time period; using the first number of visits, the first data transmission volume, the second information entropy and the third information entropy as elements to construct the target behavior feature vector of the target user in the target time period.

[0038] The number of visits made by the target user to the server within the target time period can be taken as the first number of visits; the amount of data transmitted between the target user and the server within the target time period can be taken as the first data transmission amount; the information entropy of different operation types of the target user within the target time period can be taken as the second information entropy; and the information entropy of different objects in the server visited by the target user within the target time period can be taken as the third information entropy.

[0039] The second information entropy can characterize the complexity of different operation types of the target user within the target time period. The second information entropy can be determined based on the frequency ratio of different operation types of the target user within the target time period.

[0040] The more types of operations performed by the target user in the target time period, or the more inconsistent the frequency ratios of the different types of operations performed by the target user in the target time period, the greater the second information entropy of the different types of operations performed by the target user in the target time period.

[0041] Different operation types of the target user may correspond to different types of instructions sent to the server. For example, different types of instructions such as login, browsing, query, and download sent to the server may be used.

[0042] Under normal circumstances, when users use trusted computing terminals to interact with servers, the complexity of the different types of operations that can be performed within the same time period is limited. For example, users usually perform one to three types of operations at the same time, and it is difficult to perform all types of operations at the same time; however, when users have abnormal behaviors such as using abnormal scripts to access resources, they can perform more than 60% or even all types of operations at the same time, threatening the stable operation of the server and affecting the stable operation of other trusted computing terminals under the server's jurisdiction.

[0043] Since the second information entropy can characterize the complexity of different types of operations performed by the target user within the target time period, and there are differences in the complexity of the types of operations performed within the same time period when the user has abnormal access behavior and when the user does not have abnormal access behavior, the second information entropy can reflect the target user's data access behavior to the server within the target time period from the perspective of the complexity of the types of operations performed within the same time period.

[0044] By referring to the process of determining the information entropy of different values ​​of the same variable in the same time period, the first information entropy, second information entropy, third information entropy, fourth information entropy and fifth information entropy in the embodiment of the present application can be determined.

[0045] Among them, determining the information entropy of a variable in the same time period based on the frequency ratio of different values ​​of the same variable in the same time period is common knowledge among those skilled in the art and will not be further described in the embodiments of the present application.

[0046] The third information entropy can reflect the complexity of different objects in the server visited by the target user during the target time period; for example, the proportion of the number of different objects in the server visited by the target user during the target time period can be determined separately, and the third information entropy of the target user in the target time period can be determined based on the proportion of the number of times different objects are visited during the target time period.

[0047] The first number of visits, the first data transmission volume, the second information entropy and the third information entropy of the target user within the target time period can reflect the target user's data access behavior to the server within the target time period from different perspectives. The first number of visits, the first data transmission volume, the second information entropy and the third information entropy are used as elements to construct a feature vector. The obtained target behavior feature vector can more comprehensively describe the target user's access behavior to the server within the target time period, so as to determine whether there is any abnormality in the target user's access behavior within the target time period.

[0048] In one embodiment, the reference behavior feature vector is determined in the following manner: obtaining the second number of visits to the server by the reference user within the reference time period, the second data transmission volume, the fourth information entropy of different operation types of the reference user within the reference time period, and the fifth information entropy of different objects in the server visited by the reference user within the reference time period; using the second number of visits, the second data transmission volume, the fourth information entropy and the fifth information entropy as elements to construct the reference behavior feature vector of the reference user in the reference time period; the length of the reference time period is the same as the length of the target time period.

[0049] The construction method of the reference behavior feature vector is the same as that of the target behavior feature vector; the difference between the reference behavior feature vector and the target behavior feature vector is that they correspond to different users or time periods.

[0050] The duration of the reference time period and the target time period may both be equal to the target duration. The specific duration of the target duration may be specified in advance or in real time according to actual needs; for example, the target duration may be between 3 minutes and 5 minutes.

[0051] The number of visits made by the reference user to the server within the reference time period can be used as the second number of visits; the amount of data transmitted by the reference user to the server within the reference time period can be used as the second data transmission amount; the information entropy of different operation types of the reference user within the reference time period can be used as the fourth information entropy; and the information entropy of different objects in the server visited by the reference user within the reference time period can be used as the fifth information entropy.

[0052] The fourth information entropy of different operation types of the reference user within the reference time period can be determined by referring to the second information entropy of different operation types of the target user within the target time period; the fifth information entropy of different objects in the server accessed by the reference user within the reference time period can be determined by referring to the third information entropy of different objects in the server accessed by the target user within the target time period. The embodiments of this application will not be repeated here.

[0053] The second number of accesses, the second data transmission volume, the fourth information entropy, and the fifth information entropy can respectively reflect the data access situation of the reference user on the server during the reference time period from different perspectives. The second number of accesses, the second data transmission volume, the fourth information entropy, and the fifth information entropy are used as elements to construct a reference behavior feature vector of the reference user during the reference time period. The obtained reference behavior feature vector can more comprehensively reflect the data access behavior of the reference user during the target time period.

[0054] The multiple reference behavior feature vectors may include behavior feature vectors of different reference users in different reference time periods; the behavior feature vector may be determined with reference to a target behavior feature vector of a target user in a target time period.

[0055] In order to improve the reference value of the reference behavior feature vector to the data access behavior of the target user within the target time period, a preset number of reference behavior feature vectors may be predetermined; the preset number may be greater than or equal to 1000, for example.

[0056] In order to improve the real-time performance of the reference behavior feature vector, the reference behavior feature vector can also be updated periodically; for example, the reference behavior feature vector used can be updated every hour or every day to obtain multiple reference behavior feature vectors corresponding to reference time periods closer to the current moment.

[0057] In step S102 , multiple reference behavior feature vectors are clustered to obtain multiple categories, and the average behavior feature vector of the same category is determined. Similarity values ​​between the target behavior feature vector and the average behavior feature vectors of different categories are determined respectively.

[0058] Clustering multiple reference behavior feature vectors to obtain multiple categories, where the same category includes multiple similar reference behavior feature vectors; clustering of all reference behavior feature vectors can be achieved through algorithms such as the K-Means clustering algorithm, the hierarchical clustering algorithm, and the DBSCAN (Density-Based Spatial Clustering of Applications with Noise) algorithm.

[0059] After completing the clustering of all reference behavior feature vectors, since the same category after clustering already includes multiple similar reference behavior feature vectors, the average value of the elements at the corresponding positions of the reference behavior feature vectors in the same category can be used as the value of the elements at the corresponding positions in the average behavior feature vector of the same category to obtain the average behavior feature vector composed of different elements.

[0060] For example, when the target categories obtained after clustering include five reference behavior feature vectors, namely (a1, b1, c1, d1), (a2, b2, c2, d2), (a3, b3, c3, d3), (a4, b4, c4, d4), and (a5, b5, c5, d5), the target category can be any one of the multiple categories obtained after clustering all the reference behavior feature vectors.

[0061] (a1+a2+a3+a4+a5) / 5 can be used as the value of the first element in the average behavior feature vector of the target category; (b1+b2+b3+b4+b5) / 5 can be used as the value of the second element in the average behavior feature vector of the target category; (c1+c2+c3+c4+c5) / 5 can be used as the value of the third element in the average behavior feature vector of the target category; (d1+d2+d3+d4+d5) / 5 can be used as the value of the fourth element in the average behavior feature vector of the target category, so as to obtain the average behavior feature vector consisting of 4 elements corresponding to the target category.

[0062] For the same category obtained after clustering, there are multiple reference time periods or multiple reference users with similar data access situations; the average behavioral feature vector of the target category can represent the overall data access situation of the reference users corresponding to the target category to the server. Determining the average behavioral feature vector of the target category can facilitate comparison of the data access situation of the reference user group with similar data access situations to the server with the data access situation of the target user to the server.

[0063] Since the same category obtained after clustering the reference behavior feature vectors includes multiple similar reference behavior feature vectors, determining the similarity value between the target behavior feature vector and the average behavior feature vectors of different categories can effectively reduce the number of values ​​that need to be determined and ensure the accuracy of the obtained similarity value compared to separately determining the similarity value between the target behavior feature vector and the reference behavior feature vector.

[0064] For example, when the number of reference behavior feature vectors is 1000, after clustering the reference behavior feature vectors, the 1000 reference behavior feature vectors may be clustered into 30 categories; here, to determine the similarity value between the target behavior feature vector and the average behavior feature vectors of different categories, the number of similarity values ​​that need to be determined is 30. Compared with determining 1000 similarity values ​​respectively relative to 1000 reference behavior feature vectors, the number of similarity values ​​that need to be determined can be significantly reduced while ensuring the accuracy of the obtained similarity values.

[0065] Furthermore, after clustering all reference behavior feature vectors, the reference behavior feature vectors that represent similar data access behaviors to the server are clustered into the same category. The reference behavior feature vectors of the same category can be more representative and can provide a more accurate reference for the target user's data access behavior within the target time period.

[0066] In step S103, the change information of the server's operating load parameters in the target time period is obtained, and the first information entropy of the user behavior of all users of the server in the target time period is obtained, and the state change value of the server in the target time period is determined by using the change information and the first information entropy.

[0067] The server's operating load parameters include: CPU usage, memory usage, disk read and write rates, and network throughput.

[0068] The change information of the server's operating load parameters in the target time period is used to characterize the degree of change of the server's operating load parameters in the target time period; the change information of the server's operating load parameters in the target time period may refer to the absolute value of the difference between the server's operating load parameters at the end time of the target time period and the server's operating load parameters at the start time of the target time period.

[0069] The first information entropy of the user behaviors of all users of the server within the target time period is used to characterize the consistency in the number of operations performed by different users of the server within the target time period.

[0070] The first information entropy of the user behavior of all users of the server during the target time period can be determined by: determining the proportion of the number of operations performed by the same user accessing the server during the target time period to the total number of operations received by the server during the target time period; determining the proportion of the number of operations performed by different users accessing the server during the target time period to determine the first information entropy.

[0071] The following is an example of an exemplary calculation formula to illustrate the process of obtaining the first information entropy in the embodiment of the present application: , where M is the number of users accessing the server during the target time period; is the number of operations performed by the k-th user accessing the server during the target time period, as a percentage of the total number of operations received by the server during the target time period; ln is a logarithmic function with a natural constant as the base.

[0072] For example, in the first case, there are 5 access users in the target time period, and these 5 access users execute 80 times, 20 times, 20 times, 20 times, and 20 times respectively in the target time period. The total number of operations received by the server in the target time period is 160.

[0073] It can be seen that in the first case, the number of operations received by the server is mainly concentrated in user 1. The number of operations performed by these five visiting users accounts for 0.5, 0.125, 0.125, 0.125 and 0.125 of the total number of operations respectively. The first information entropy obtained in the first case is -((0.5×ln0.5)+(0.125×ln0.125)+(0.125×ln0.125)+(0.125×ln0.125)+(0.125×ln0.125))=1.386.

[0074] For example, in the second case, there are 5 access users in the target time period, and these 5 access users execute 30 times, 30 times, 20 times, 40 times and 40 times respectively in the target time period. The total number of operations received by the server in the target time period is 160.

[0075] In the second case, the number of operations received by the server is relatively uniform among different users, and the total number of operations is not concentrated in a small number of users. The number of operations performed by the five visiting users accounts for 0.1875, 0.1875, 0.125, 0.25, and 0.25 of the total number of operations, respectively. The first information entropy obtained in the first case is -((0.1875×ln0.1875)+(0.1875×ln0.1875)+(0.125×ln0.125)+(0.25×ln0.25)+(0.25×ln0.25))=2.28.

[0076] It can be seen that the larger the value of the information entropy in the target time period, the closer the number of operations received by the server from different users in the target time period, and the more consistent the performance of the server in the time period is with the performance when the server is not subjected to abnormal access.

[0077] When the users of the server perform operations within the target time period, the number of operations of normal users is within a certain range. The closer the number of operations of all users within the target time period is, the smaller the probability that the server is accessed abnormally within the target time period, and the larger the value of the first information entropy. Therefore, the first information entropy is negatively correlated with the probability that the server is accessed abnormally within the target time period.

[0078] The larger the first information entropy of the number of operations of all users of the server during the target time period, the more evenly the number of operations received by the server during the target time period comes from different users; on the contrary, the smaller the first information entropy of the number of operations of all users of the server during the target time period, the more concentrated the number of operations received by the server during the target time period is on a smaller number of users.

[0079] Since the first information entropy can reflect the degree of consistency in the number of operations performed by all users within the target time period, the change information of the server's operating load parameters within the target time period can reflect the change in the server's operating load. Therefore, combining the first information entropy and the change information of the operating load can better reflect the changes in the server within the target time period.

[0080] In one embodiment, determining a state change value of a server within a target time period using the change information and the first information entropy includes: ,in, is the state change value of the target time period, exp is the exponential function with a natural constant as the base, E is the first information entropy of the user behavior of all users of the server during the target time period, log is the logarithmic function, N is the number of users accessing the server during the target time period, T is the number of types of operating load parameters, and norm is the normalization processing function. For the server The change information of the operating load parameters in the target time period.

[0081] Will As the denominator, the first information entropy E is normalized. The greater the change information of the t-th operating load parameter in the target time period, the greater the degree of change of the t-th operating load of the server in the target time period. In order to discover as many abnormal access behaviors as possible to the server, a larger state change value can be determined.

[0082] The normalization function norm is used to normalize the variable to be normalized to the range of 0 to 1. For example, the normalization function can be minimum-maximum standardization, logarithmic transformation, inverse tangent function, and sigmoid function.

[0083] In this way, the diversity of operations of all users of the server within the target time period and the changes in the server's operating status parameters can be combined to obtain a state change value representing abnormal access behavior to the server within the target time period.

[0084] In step S104, the risk level of the target user in the target time period is determined based on the similarity values ​​and state change values ​​corresponding to different categories, and the target user's data access behavior to the server is managed using the risk level of the target user in different time periods.

[0085] The categories obtained by clustering all reference behavior feature vectors are such that the same category can better represent reference users with similar data access behaviors to the server, and abnormal users with abnormal access behaviors to the server are usually less than normal users. Among the multiple average behavior feature vectors corresponding to different categories, there is usually at least one average behavior feature vector that is similar to the target behavior feature vector generated under normal data access behaviors, making the similarity value corresponding to normal users higher.

[0086] However, since the difference between the abnormal access behavior of abnormal users and normal access behavior is greater, among the multiple average behavior feature vectors corresponding to different categories, there may not be an average behavior feature vector similar to the target behavior feature vector of the abnormal access behavior, resulting in a low similarity value corresponding to the abnormal user.

[0087] The state change value of the server during the target time period can reflect the abnormal access behavior received during the target time period from the perspective of server load performance; the similarity values ​​of the target user relative to different categories can reflect the probability that the target user is abnormal among all users. Therefore, the risk level value of the target user in the target time period determined based on the similarity values ​​and state change values ​​relative to different categories can reflect the probability that the target user has abnormal access behavior to the server during the target time period.

[0088] In one embodiment, determining the risk level of the target user in the target time period according to the similarity values ​​for different categories and the state change values ​​includes: , To determine the risk level of the target user in the target time period, exp is an exponential function with a natural constant as the base, max is the maximum value, and K is the number of categories obtained after clustering multiple reference behavior feature vectors. is the cosine similarity between the average behavior feature vector of the kth category and the target behavior feature vector, The server status change value within the target time period.

[0089] The value range of the pre-similarity is between -1 and 1, so The value of is between 0 and 1. Since different categories represent reference user groups with different data access behaviors, The largest one is selected to participate in the calculation of the risk level value, and the reference user group with the most similar data access behavior to the target user can be selected from all reference user groups.

[0090] The greater the cosine similarity between the target user and the reference user group with the most similar data access behavior, the more likely it is that there is at least a reference user group with similar data access behavior to the target user. The probability that the target user's data access behavior to the server is abnormal is smaller, and therefore, a smaller risk level value can be determined.

[0091] On the contrary, the smaller the cosine similarity between the target user and the reference user group whose data access behavior is most similar to that of the target user, the lower the similarity between the reference user group whose data access behavior is most similar to that of the target user and the target user in data access behavior. The probability that the target user's data access behavior to the server is abnormal is greater. Therefore, a larger risk level value can be determined.

[0092] In this way, we can comprehensively consider the operating load of the server during the target time period and the similarity between the target user's data access behavior and the reference user's data access behavior, and use the risk level value to better reflect the probability of the target user having abnormal access to the server during the target time period.

[0093] In one embodiment, the target user's risk level value in different time periods is utilized to manage the target user's data access behavior to the server, including: when the target user's risk level value in the target time period is greater than that of other users in the target time period, the target user's performance in the target time period is marked as suspected risk; when the target user's performance in multiple consecutive time periods is marked as suspected risk, the target user is marked as an abnormal user to restrict the abnormal user's data access behavior to the server.

[0094] Since the risk level value can reflect the probability that the target user has abnormal access behavior, the risk level value of the target user in the target time period is greater than that of other users in the target time period, which at least indicates that the target user is the user who caused abnormal access behavior in the target time period; here, marking the target user's performance in the target time period as suspected risk can achieve the marking of users with a certain degree of abnormality in their performance, so as to observe the subsequent performance of users whose performance is marked as suspected risk.

[0095] If the target user's performance in multiple consecutive time periods is marked as suspected risk, it means that in addition to having a high probability of abnormal performance, the target user has not stopped abnormal access behavior in multiple consecutive time periods. In order to prevent abnormal users from further damaging the server's operating resources, the target user can be marked as an abnormal user and the abnormal user's data access behavior on the server can be restricted.

[0096] Alternatively, if the target user's performance in multiple consecutive time periods is not marked as suspected risk, it means that the target user does not have any high-risk access behavior, or if the target user's data access behavior does not meet the characteristics of abnormal access, the target user's subsequent performance can be further observed.

[0097] For example, the cumulative number of times the target user's performance is marked as risky can be obtained. When the cumulative number reaches a preset number, the target user's data access to the server can be restricted to prevent the target user's data access behavior from further worsening the server's operating load; the preset number can be, for example, 3 times.

[0098] In this way, it is possible to adaptively determine whether the target user is an abnormal user based on the target user's data access behavior relative to other users. By restricting the data access behavior of abnormal users, the server's operating resources can be fully utilized to ensure the user experience of non-abnormal users.

[0099] In one embodiment, restricting abnormal users' data access to a server includes: in response to receiving a target user's access request to the server, obtaining the target user's identity information; and discarding the access request if the identity information indicates that the target user is an abnormal user.

[0100] Users marked as abnormal are usually high-risk and may download or access data on the server on a large scale, resulting in a waste of server resources or even causing the server to crash. By discarding access requests from abnormal users, the server resources can be fully utilized and the server's operating costs can be reduced.

[0101] In one embodiment, the target user's risk level values ​​in different time periods are used to manage the target user's data access behavior to the server, including: when the target user's risk level value in the target time period is less than or equal to that of other users in the target time period, the target user's performance in the target time period is marked as normal access; when the target user's performance in multiple consecutive time periods is marked as normal access, the target user's data access behavior to the server is authorized.

[0102] Since there are usually only a small number of abnormal users (for example, 1%) among all users, the risk level of the target user in the target time period is less than or equal to that of other users in the target time period, which at least indicates that the probability of the target user being abnormal is small. Marking the target user's performance in the target time period as normal access helps to ensure the usage needs of normal users.

[0103] When the target user's performance in multiple consecutive time periods is marked as normal access, it means that the target user is a user who normally accesses resources and can be authorized to access data on the server.

[0104] In this way, blocking of normal users' access requests to the server can be avoided, server resource utilization can be improved, and the usage experience of normal users can be guaranteed.

[0105] Figure 2 1 is a structural diagram of a data security management system 1000 for a trusted terminal environment according to an exemplary embodiment. Figure 2 The data security management system 1000 of the trusted terminal environment includes: a processor 1100 and a memory 1200, wherein the memory 1200 stores computer program instructions, and when the computer program instructions are executed by the processor 1100, all or part of the steps of the data security management method of the trusted terminal environment in this application are implemented.

[0106] Those skilled in the art will readily conceive of other embodiments of the present invention after considering the specification and practicing the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of the present invention that follow the general principles of the present invention and include common knowledge or customary techniques in the art not disclosed herein, and the description and examples are to be considered merely as exemplary.

[0107] It will be understood that the present application is not limited to the exact construction that has been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof.

Claims

1. A data security management method for a trusted terminal environment, characterized in that: include: Obtaining a target behavior feature vector of a target user of the server in a target time period, including: obtaining a first number of visits to the server by the target user in the target time period, a first data transmission volume, a second information entropy of different operation types of the target user in the target time period, and a third information entropy of different objects in the server accessed by the target user in the target time period; constructing a target behavior feature vector of the target user in the target time period using the first number of visits, the first data transmission volume, the second information entropy, and the third information entropy as elements; The different operation types of the target user refer to the login, browsing, query and download instructions sent to the server respectively; the second information entropy and the third information entropy respectively represent the complexity of the different operation types of the target user in the target time period and the complexity of the different objects in the server accessed; Acquire a plurality of predetermined reference behavior feature vectors; the target behavior feature vector or the reference behavior feature vector is determined based on the interaction with the server; Clustering multiple reference behavior feature vectors to obtain multiple categories, determining the average behavior feature vector of the same category, and determining similarity values ​​between the target behavior feature vector and the average behavior feature vectors of different categories; Obtaining change information of the server's operating load parameters during a target time period and obtaining first information entropy of user behavior of all users of the server during the target time period; and determining a state change value of the server during the target time period using the change information and the first information entropy, including: , is the state change value in the target time period, exp is an exponential function with a natural constant as the base, is the first information entropy of the user behavior of all users of the server within the target time period, log is the logarithmic function, is the number of users accessing the server during the target time period, is the number of types of operating load parameters, norm is the normalization function, For the server The first information entropy is used to characterize the consistency of the number of operations performed by different users in the target time period; Determine the risk level of the target user in the target time period based on the similarity values ​​and status change values ​​relative to different categories, including: , To determine the risk level of the target user in the target time period, max is the maximum value, K is the number of categories obtained after clustering multiple reference behavior feature vectors, is the cosine similarity between the average behavior feature vector of the kth category and the target behavior feature vector; the target user's risk level value in different time periods is used to manage the target user's data access behavior to the server.

2. The data security management method for the trusted terminal environment according to claim 1 is characterized in that: Utilize the target user's risk level in different time periods to manage the target user's data access behavior to the server, including: If the risk level of the target user in the target time period is greater than that of other users in the target time period, the target user's performance in the target time period is marked as suspected risk; If the target user's performance is marked as suspected risk for multiple consecutive time periods, the target user will be marked as an abnormal user to restrict the abnormal user's data access behavior on the server.

3. The data security management method for the trusted terminal environment according to claim 2 is characterized in that: Restrict abnormal users' access to server data, including: In response to receiving an access request from a target user to a server, identity information of the target user is obtained; if the identity information indicates that the target user is an abnormal user, the access request is discarded.

4. The data security management method for the trusted terminal environment according to claim 1 is characterized in that: Use the target user's risk level in different time periods to manage the target user's data access behavior to the server, including: If the risk level of the target user in the target time period is less than or equal to that of other users in the target time period, the target user's performance in the target time period is marked as normal access; If the target user's performance is marked as normal access for multiple consecutive time periods, the target user is authorized to access data on the server.

5. The data security management method for the trusted terminal environment according to claim 1 is characterized in that: The reference behavior feature vector is determined in the following way: Obtaining a second number of visits to the server by the reference user within a reference time period, a second data transmission volume, a fourth information entropy of different operation types of the reference user within the reference time period, and a fifth information entropy of different objects in the server accessed by the reference user within the reference time period; The second number of visits, the second data transmission volume, the fourth information entropy and the fifth information entropy are used as elements to construct a reference behavior feature vector of the reference user in a reference time period; the length of the reference time period is the same as the length of the target time period.

6. The data security management method for the trusted terminal environment according to claim 1 is characterized in that: The operating load parameters include: CPU usage, memory usage, disk read and write rates, and network throughput.

7. A data security management system for a trusted terminal environment, characterized in that: include: A processor and a memory, wherein the memory stores computer program instructions, and when the computer program instructions are executed by the processor, the data security management method for the trusted terminal environment according to any one of claims 1 to 6 is implemented.

Images