Data security monitoring system and method based on behavior analysis

Abstract

The invention relates to the technical field of data protection, and discloses a data security monitoring system and method based on behavior analysis, and the system comprises a data security account supervision module, a data security user identity supervision module, and a data security user position supervision module. And the user identity information verification unit is used for carrying out real-time intelligent processing of identity information verification of the user on the data login platform based on the user identity feature image information in combination with an artificial intelligence recognition algorithm and the data login platform user identity verification feature image data stored based on big data. The data login platform performs advanced data security verification based on the real-time identity information of the user; and according to the geographical distance information between the location of the user and the account login location and the target user information supervision geographical distance threshold, carrying out scientific verification processing on the position information of the user on the data login platform, and realizing scientific supervision of data security based on behavior information of user information login and login position distribution.

Description

Technical Field

[0001] The present invention relates to the technical field of data protection, and in particular to a data security monitoring system and method based on behavior analysis. Background Art

[0002] Data security management aims to achieve unified control capabilities for data asset management and sensitive data identification; to achieve centralized management of data security policies, unified control of security incidents and security risks, and centralized operations and maintenance; and to provide analytical and display capabilities for sensitive data distribution views, sensitive data event views, sensitive data risk views, and sensitive data policy views. A data security standard library is established. Data security monitoring implements centralized monitoring capabilities and basic protection requirements, and integrates with existing platforms to form overall data security monitoring and protection capabilities. Data security operations provide information support for data security through capabilities such as data resource security operations, data security policy operations, data security incident operations, and data security risk operations. Data security control forms a closed-loop management of data security control through the development of capabilities such as data discovery, policy control, event monitoring, and risk analysis. With the development of AI technology, traditional data security monitoring methods that verify account and user identity characteristics also pose significant risks. Current data security monitoring cannot achieve dual, scientific, and intelligent monitoring of user information based on both data information and user location information, reducing the security and reliability of data use.

[0003] A Chinese invention patent with announcement number CN116150800B discloses a computer information security monitoring system and method based on big data. The system obtains and monitors relevant image information; analyzes the acquired image information and performs a security assessment; processes images that need to improve security after the assessment, and improves the user experience through interaction, thereby ensuring the overall coordination of the image, meeting the actual needs of the user, and improving the security of privacy information. However, the above technical solution only monitors user information security through simple data processing, and cannot achieve scientific monitoring of user information based on data information and user location information. Summary of the Invention

[0004] (1) Technical problems solved

[0005] In order to solve the problem that the current data security monitoring cannot realize the dual scientific and intelligent monitoring of user information based on data information and user location information, which reduces the security and reliability of data use, the above-mentioned purpose of autonomously and accurately analyzing user account security, efficiently identifying user identity security, accurately analyzing user location information security, and realizing scientific dual data security supervision based on data information and user location information is achieved.

[0006] (2) Technical solution

[0007] The present invention is implemented through the following technical solution: a data security monitoring method based on behavior analysis, the method comprising the following steps:

[0008] S1. Collect account feature text data;

[0009] S2. Verify the user's account information on the data login platform based on the account feature text data and the data login platform account verification feature text data, and generate user account information verification result data; if the account verification fails, terminate the current data usage operation;

[0010] S3. When the account verification is passed, collect the user's identity feature image data;

[0011] S4. Performing identity verification on the data login platform based on the user identity feature image data and the user identity verification feature image data of the data login platform to generate user identity verification result data; if the identity verification fails, terminating the current data usage operation;

[0012] S5. When the identity verification is successful, the account login geographic location coordinate data and the user's location coordinate data are collected and the geographic distance between the user's location and the account login location is measured to generate geographic distance data between the user's location and the account login location;

[0013] S6. Searching for a supervisory geographical distance threshold between the user's location and the account login location based on the account feature text data and the user information supervisory geographical distance threshold of the data login platform to generate a target user information supervisory geographical distance threshold;

[0014] S7. Verify the user's location information on the data login platform based on the geographical distance data between the user's location and the account login location and the target user information supervision geographical distance threshold, and generate user geographical information verification result data. When the location verification fails, the data usage operation is terminated; when the location verification passes, the user continues to perform the data usage operation.

[0015] Preferably, the steps for collecting account feature text data are as follows:

[0016] S11. Collect the user's login account number information, login password information and user contact information of the user's registered account on the data login platform online through the data input dialog box, and generate account feature text data M. The data login platform includes a comprehensive e-commerce platform, a social e-commerce platform, a social interaction platform and a video live broadcast platform.

[0017] Preferably, the user's account information on the data login platform is verified based on the account feature text data and the data login platform account verification feature text data to generate user account information verification result data; when the account verification fails, the operation steps for ending this data usage operation are as follows:

[0018] S21. Establish a data login platform account verification feature text data set G = (g1,…,g a ,…,g χ ), a=1,2,3,…,χ; where g a represents the data login platform account verification feature text data corresponding to the a-th user, x represents the maximum number of users, and the data login platform account verification feature text data represents the account information generated by the user after secure registration on the data login platform;

[0019] S22, using the Rabin-Karp search algorithm to compare the account feature text data M with the data login platform account verification feature text data set G. a Perform account information character matching and generate user account information verification result data M based on the account information character matching result yanzheng ;

[0020] When M and g a If the account information characters are not matched successfully, it means that the login account is not securely registered on the data login platform, then the user account information verification result data M is output. yanzheng The account verification fails, and the data usage operation ends at this time;

[0021] When M and g a If the account information character matching is successful, it means that the login account has been securely registered on the data login platform, and the user account information verification result data M is output. yanzheng The account has been verified.

[0022] Preferably, when the account verification is passed, the steps for collecting the user identity feature image data are as follows:

[0023] S31, when the user account information verification result data M yanzheng When the account verification is passed, the user's identity feature image information is collected online through the user identity information collection device to complete the account login and generate user identity feature image data N. The user identity information collection device includes any one of a facial collection device, a fingerprint collection device, and an iris collection device. The user identity feature image data includes any one of the user's facial feature image, fingerprint feature image, and iris feature image.

[0024] Preferably, based on the user identity feature image data and the user identity authentication feature image data of the data login platform, the user identity information verification process is performed on the data login platform to generate user identity information verification result data; when the identity authentication fails, the operation steps for ending the current data usage operation are as follows:

[0025] S41. Establishing a data login platform user identity authentication feature image data set H = (h1,…,h a ,…,h χ ), where h a The data login platform user identity verification feature image data corresponding to the a-th user, wherein the data login platform user identity verification feature image data represents the personal identity feature image information reserved by the user on the data login platform;

[0026] S42: compare the user identity feature image data N with the data login platform user identity verification feature image data set H. a Perform identity feature image matching and generate user identity information verification result data N based on the identity feature image matching results yanzheng , execute to generate the user identity information verification result data N yanzheng The specific steps are as follows:

[0027] S421, initialize parameters, update the number of authentication crow population, maximum number of iterations, and flight distance η;

[0028] S422, initialize the initial position and memory of the identity authentication crow individual in the search space of the data login platform user identity authentication feature image data set H, and randomly distribute Ψ identity authentication crow individuals in a multidimensional search space, and randomly distribute Ψ identity authentication crow individuals in the search space of the data login platform user identity authentication feature image data set H with a spatial dimension of χ; in the first iteration, assume that the identity authentication crow individual will match the user identity feature image data N in the search space of the data login platform user identity authentication feature image data set H. a The food is hidden in the initial position;

[0029] S423, calculate the data login platform user identity verification feature image data h in the search space of the user identity feature image data N and the data login platform user identity verification feature image data set H a The fitness value of

[0030] S424. Update the position of the identity verification crow individual in the search space of the user identity verification feature image data set H of the data login platform. The identity verification crow individual position update formula is as follows: in represents the new position of the t+1th iteration authentication crow individual i in the search space of the user authentication feature image dataset H of the data login platform, represents the position of the t-th iteration authentication crow individual i in the search space of the user authentication feature image data set H of the data login platform, ∫ represents a random number uniformly distributed between

[01] , represents the flight distance of the t-th iteration authentication crow individual i in the search space of the user authentication feature image dataset H of the data login platform, The data login platform user identity authentication feature image data h that matches the user identity feature image data N in the search space of the data login platform user identity authentication feature image data set H for the tth iteration authentication crow individual i is represented by a where the food is hidden;

[0031] S425. Determine the feasibility of the new position, and determine the feasibility of the new position of each identity verification crow individual; if the new position of the identity verification crow individual is feasible, the identity verification crow individual will update its position, and search the data login platform user identity verification feature image data set H for the data login platform user identity verification feature image data h that matches the user identity feature image data N. a , the identity authentication crow individual is updated to the data login platform user identity authentication feature image data h that matches successfully a Otherwise, the authentication crow individual stays at the current location and does not move to the new location;

[0032] S426, evaluate the fitness value of the new position, calculate the fitness value of each identity verification crow in the new position, that is, calculate the fitness value of the user identity verification feature image data N in the search space of the data login platform user identity verification feature image data set H and the data login platform user identity verification feature image data h at the new position a The fitness value of

[0033] S427, update memory, if the fitness value of the new position of the identity authentication crow is greater than the fitness value of the initial position in the memory, the identity authentication crow updates its memory through the new position, otherwise it does not update its memory; search the data login platform user identity authentication feature image data set H for the data login platform user identity authentication feature image data h that has the largest fitness value with the user identity feature image data N.a ;

[0034] S428: When the maximum number of iterations is met, output the user identity feature image data N and the data login platform user identity verification feature image data h. a Perform identity feature image matching results and generate user identity information verification result data N yanzheng ;

[0035] When N and h a If the identity feature images are not matched successfully, it means that the login user identity information is not securely registered in the data login platform, then the user identity information verification result data N is output. yanzheng The authentication fails, and the data usage operation ends at this time;

[0036] When N and h a If the identity feature image is matched successfully, it means that the login user's identity information has been securely registered on the data login platform, and the user identity information verification result data N is output. yanzheng Authentication passed.

[0037] Preferably, when the identity authentication is passed, the account login geographic location coordinate data and the user's geographic location coordinate data are collected and the geographic space distance between the user's location and the account login location is measured and processed to generate the geographic distance data between the user's location and the account login location. The operation steps are as follows:

[0038] S51, when the user identity information verification result data N yanzheng When the identity verification is passed, the spatial location coordinates of the login device used by the user to log in to the account information are obtained online through the data login platform, and the account login geographic location coordinate data X is generated. The account login geographic location coordinate data includes the longitude, latitude and altitude of the user account login location;

[0039] Obtaining the spatial coordinates of the user's contact device online through the data login platform based on the user contact information in the account feature text data M, and generating the user's geographic location coordinate data Y, wherein the user's geographic location coordinate data includes the longitude, latitude, and altitude of the user's location;

[0040] S52: Based on the account login location coordinate data X and the user location coordinate data Y, the spatial distance between the account login location and the user location is measured using the spatial straight-line distance formula, and the geographical distance data L between the user location and the account login location is generated. X,Y , where L X,Y The unit is meter.

[0041] Preferably, the operation steps for generating the target user information supervision geographical distance threshold value are as follows:

[0042] S61. Establish a geographical distance threshold set R = (r1,…,r a ,…,r χ ), where r a represents the geographical distance threshold of the user information supervision of the data login platform corresponding to the ath user. The geographical distance threshold of the user information supervision of the data login platform represents the maximum spatial safety distance between the user's location and the account login location reserved by the user on the data login platform. r a The unit is meter;

[0043] S62, using a bidirectional search algorithm to compare the account feature text data M with the data login platform user information supervision geographical distance threshold r in the data login platform user information supervision geographical distance threshold set R. a Perform user feature information matching and search for the data login platform user information supervision geographical distance threshold r corresponding to the account feature text data M a , and generate the target user information supervision geographical distance threshold r through data identification mubiao , where r mubiao The unit is meter.

[0044] Preferably, the user's location information on the data login platform is verified based on the geographical distance data between the user's location and the account login location and the target user information supervision geographical distance threshold, and user geographical information verification result data is generated. If the location verification fails, the data usage operation is terminated; if the location verification passes, the user continues to perform the data usage operation in the following steps:

[0045] S71, the geographical distance data L between the user's location and the account login location X,Y The geographical distance threshold r from the target user information supervision mubiao Perform distance value comparison and verify result data E based on user geographic information of distance value comparison result;

[0046] When L X,Y >r mubiao , indicating that the distance between the real-time location of the user logging into the data login platform and the user's actual real-time location exceeds the data login safety distance threshold set by the user, then the user geographic information verification result data E is output as location verification failure, and this data usage operation is terminated;

[0047] When L X,Y≤r mubiao , indicating that the distance between the real-time location of the user logging into the data login platform and the user's actual real-time location does not exceed the data login safety distance threshold set by the user, then the user geographic information verification result data E is output as location verification passed, and the user continues to perform data usage operations.

[0048] A data security monitoring system based on behavior analysis, used to implement the data security monitoring method based on behavior analysis, the system comprising a data security account monitoring module, a data security user identity monitoring module, and a data security user location monitoring module;

[0049] The data security account supervision module includes an account information collection unit, a data login platform account information storage unit, and a user account information verification unit;

[0050] The account information collection unit collects account feature text data through a data input dialog box; the data login platform account information storage unit is used to store the data login platform account verification feature text data; the user account information verification unit performs user account information verification processing on the data login platform based on the account feature text data and the data login platform account verification feature text data, and generates user account information verification result data;

[0051] The data security user identity supervision module includes a user identity feature information collection unit, a data login platform user identity feature information storage unit, and a user identity information verification unit;

[0052] The user identity feature information collection unit collects user identity feature image data through a user identity information collection device; the data login platform user identity feature information storage unit is used to store the data login platform user identity authentication feature image data; the user identity information verification unit performs a user identity information verification process on the data login platform based on the user identity feature image data and the data login platform user identity authentication feature image data, and generates user identity information verification result data;

[0053] The data security user location supervision module includes an account login geographic location collection unit, a user location geographic location collection unit, a distance measurement unit between the user location and the account login location, a data login platform user information supervision geographic distance threshold storage unit, a user information supervision geographic distance threshold search unit, and a data security user location verification unit;

[0054] The account login geographic location collection unit collects account login geographic location coordinate data through the data login platform; the user's geographic location collection unit collects user's geographic location coordinate data through the data login platform; the user's location and account login location distance measurement unit measures the geographic distance between the user's location and the account login location based on the account login geographic location coordinate data and the user's geographic location coordinate data, and generates geographic distance data between the user's location and the account login location; the data login platform user information supervision geographic distance threshold storage unit is used to store the data login platform user information supervision geographic distance threshold; the user information supervision geographic distance threshold search unit searches for the supervision geographic distance threshold between the user's location and the account login location based on the account feature text data and the data login platform user information supervision geographic distance threshold, and generates a target user information supervision geographic distance threshold; the data security user location verification unit verifies the user's location information on the data login platform based on the geographic distance data between the user's location and the account login location and the target user information supervision geographic distance threshold, and generates user geographic information verification result data.

[0055] (3) Beneficial effects

[0056] The present invention provides a data security monitoring system and method based on behavior analysis. It has the following beneficial effects:

[0057] 1. Obtain account feature information online through the data input dialog box to provide real data support for accurate verification of user account information; based on account feature information combined with intelligent search algorithms and scientifically preset data login platform account verification feature information, conduct autonomous and efficient verification of user account information on the data login platform, enable the data login platform to perform primary data security verification based on user registration account information, and improve the efficiency of data security supervision of the data login platform.

[0058] 2. Dynamically collect user identity feature image information through user identity information collection equipment to provide reliable data support for user identity information verification on the data login platform; based on user identity feature image information combined with artificial intelligence recognition algorithm and user identity authentication feature image data of the data login platform based on big data storage, perform real-time intelligent processing of user identity information verification on the data login platform, realize advanced data security verification based on real-time user identity information of the data login platform, and improve the reliability of data security supervision of the data login platform.

[0059] 3. Accurately obtain the geographic location coordinates of the user account login and the geographic location coordinates of the user's location through the data login platform to provide reliable data support for the scientific supervision of user data security; conduct online dynamic measurement and processing of the geographic distance between the user's location and the account login location based on the account login geographic location coordinates and the user's location geographic location coordinates, and accurately search and filter the regulatory geographic distance threshold between the user's location and the account login location, so as to achieve scientific and efficient acquisition of real-time geographic distance information between the user's location and the account login location based on data processing, and accurately search and filter the regulatory geographic distance threshold between the user's location and the account login location; scientifically verify and process the user's location information on the data login platform based on the geographic distance information between the user's location and the account login location and the regulatory geographic distance threshold of the target user information, realize intelligent and reliable supervision of user data security based on the dual security mechanism of user identity information and user geographic location information, and realize scientific supervision of data security based on behavioral information of user information login and login location distribution; improve the applicability and effectiveness of data security supervision on the data login platform. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] Figure 1 A module diagram of a data security monitoring system based on behavior analysis provided by the present invention;

[0061] Figure 2 This is a flow chart of a data security monitoring method based on behavior analysis provided by the present invention. DETAILED DESCRIPTION

[0062] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0063] The embodiment of the data security monitoring system and method based on behavior analysis is as follows:

[0064] Example 1:

[0065] See also Figure 1 - Figure 2 A data security monitoring method based on behavior analysis includes the following steps:

[0066] S1. Collect account feature text data;

[0067] S2. Verify the user's account information on the data login platform based on the account feature text data and the data login platform account verification feature text data, and generate user account information verification result data; if the account verification fails, terminate the data usage operation;

[0068] S3. When the account verification is passed, collect the user's identity feature image data;

[0069] S4. Verify the user's identity information on the data login platform based on the user identity feature image data and the user identity authentication feature image data of the data login platform, and generate user identity information verification result data; if the identity authentication fails, end the data usage operation;

[0070] S5. When the identity verification is successful, the account login geographic location coordinate data and the user's location coordinate data are collected and the geographic distance between the user's location and the account login location is measured to generate geographic distance data between the user's location and the account login location;

[0071] S6. Search and process the supervisory geographic distance threshold between the user's location and the account login location based on the account feature text data and the user information supervisory geographic distance threshold of the data login platform to generate the target user information supervisory geographic distance threshold;

[0072] S7. Verify the user's location information on the data login platform based on the geographical distance data between the user's location and the account login location and the target user information supervision geographical distance threshold, and generate user geographical information verification result data. If the location verification fails, the data usage operation is terminated; if the location verification passes, the user continues to perform the data usage operation.

[0073] For further information, see Figure 1 - Figure 2 The steps for collecting account feature text data are as follows:

[0074] S11. Collect the user's login account number information, login password information and user contact information of the user's registered account on the data login platform online through the data input dialog box, and generate account feature text data M. The data login platform includes a comprehensive e-commerce platform, a social e-commerce platform, a social interaction platform and a video live broadcast platform.

[0075] Verify the user's account information on the data login platform based on the account feature text data and the data login platform account verification feature text data, and generate user account information verification result data; if the account verification fails, the steps to end this data usage operation are as follows:

[0076] S21. Establish a data login platform account verification feature text data set G = (g1,…,ga ,…,g χ ), a=1,2,3,…,χ; where g a represents the data login platform account verification feature text data corresponding to the a-th user, χ represents the maximum number of users, and the data login platform account verification feature text data represents the account information generated by the user after secure registration on the data login platform;

[0077] S22, using the Rabin-Karp search algorithm to compare the account feature text data M with the data login platform account verification feature text data set G. a Perform account information character matching and generate user account information verification result data M based on the account information character matching result yanzheng ;

[0078] When M and g a If the account information characters are not matched successfully, it means that the login account is not securely registered on the data login platform, then the user account information verification result data M is output. yanzheng The account verification fails, and the data usage operation ends at this time;

[0079] When M and g a If the account information character matching is successful, it means that the login account has been securely registered on the data login platform, and the user account information verification result data M is output. yanzheng The account has been verified.

[0080] Through the account information collection unit, account feature information is obtained online using the data input dialog box to provide real data support for accurate verification of user account information; the user account information verification unit conducts autonomous and efficient verification of the user's account information on the data login platform based on the account feature information combined with the intelligent search algorithm and the scientifically preset data login platform account verification feature information, enabling the data login platform to perform primary data security verification based on the user's registered account information, thereby improving the efficiency of data security supervision of the data login platform.

[0081] For further information, see Figure 1 - Figure 2 When the account verification is passed, the steps for collecting the user's identity feature image data are as follows:

[0082] S31, when the user account information verification result data M yanzhengWhen the account verification is passed, the user's identity feature image information is collected online through the user identity information collection device to complete the account login and generate user identity feature image data N. The user identity information collection device includes any one of a facial collection device, a fingerprint collection device, and an iris collection device. The user identity feature image data includes any one of the user's facial feature image, fingerprint feature image, and iris feature image.

[0083] The user's identity information on the data login platform is verified based on the user's identity feature image data and the user's identity authentication feature image data on the data login platform, and the user's identity information verification result data is generated. If the identity authentication fails, the steps to end this data usage operation are as follows:

[0084] S41. Establishing a data login platform user identity authentication feature image data set H = (h1,…,h a ,…,h χ ), where h a The data login platform user identity verification feature image data corresponding to the a-th user, the data login platform user identity verification feature image data represents the personal identity feature image information reserved by the user on the data login platform;

[0085] S42, compare the user identity feature image data N with the data login platform user identity verification feature image data set H. a Perform identity feature image matching and generate user identity information verification result data N based on the identity feature image matching results yanzheng , execute to generate user identity information verification result data N yanzheng The specific steps are as follows:

[0086] S421, initializing parameters, updating the number of authentication crow populations, the maximum number of iterations, and the flight distance η;

[0087] S422, initialize the initial position and memory of the identity authentication crow individual in the search space of the data login platform user identity authentication feature image data set H, Ψ identity authentication crow individuals are randomly distributed in a multidimensional search space, Ψ identity authentication crow individuals are randomly distributed in the search space of the data login platform user identity authentication feature image data set H with a spatial dimension of χ; in the first iteration, it is assumed that the identity authentication crow individual will match the user identity feature image data N in the search space of the data login platform user identity authentication feature image data set H. a The food is hidden in the initial position;

[0088] S423, calculate the data login platform user identity authentication feature image data h in the search space of the user identity feature image data N and the data login platform user identity authentication feature image data set H a The fitness value of

[0089] S424. Update the position of the authentication crow individual in the search space of the user authentication feature image data set H of the data login platform. The authentication crow individual position update formula is as follows: in represents the new position of the authentication crow individual i in the search space of the user authentication feature image dataset H of the data login platform at the t+1th iteration, represents the position of the t-th iteration authentication crow individual i in the search space of the user authentication feature image data set H of the data login platform, ∫ represents a random number uniformly distributed between

[01] , represents the flight distance of the t-th iteration authentication crow individual i in the search space of the user authentication feature image dataset H of the data login platform, It represents the data login platform user identity authentication feature image data h that matches the user identity feature image data N in the search space of the data login platform user identity authentication feature image data set H at the tth iteration authentication crow individual i. a where the food is hidden;

[0090] S425. Determine the feasibility of the new position, and determine the feasibility of the new position of each identity verification crow individual; if the new position of the identity verification crow individual is feasible, the identity verification crow individual will update its position, and search the data login platform user identity verification feature image data set H for the data login platform user identity verification feature image data h that matches the user identity verification feature image data N. a , the authentication crow individual is updated to the matching successful data login platform user authentication feature image data h a Otherwise, the authentication crow individual stays at the current location and does not move to the new location;

[0091] S426, evaluate the fitness value of the new position, calculate the fitness value of each identity verification crow at the new position, that is, calculate the user identity feature image data N in the search space of the data login platform user identity verification feature image data set H and the data login platform user identity verification feature image data h at the new position a The fitness value of

[0092] S427, update memory. If the fitness value of the new position of the identity authentication crow is greater than the fitness value of the initial position in the memory, the identity authentication crow updates its memory with the new position. Otherwise, it does not update its memory. Search the data login platform user identity authentication feature image data set H for the data login platform user identity authentication feature image data h that has the largest fitness value with the user identity feature image data N. a ;

[0093] S428: When the maximum number of iterations is met, output the user identity feature image data N and the data login platform user identity verification feature image data h. a Perform identity feature image matching results and generate user identity information verification result data N yanzheng ;

[0094] When N and h a If the identity feature images are not matched successfully, it means that the login user's identity information is not securely registered in the data login platform, then the user identity information verification result data N will be output. yanzheng The authentication fails, and the data usage operation ends at this time;

[0095] When N and h a If the identity feature image matching is successful, it means that the login user's identity information has been securely registered on the data login platform, and the user identity information verification result data N is output. yanzheng Authentication passed.

[0096] Through the user identity feature information collection unit, user identity feature image information is dynamically collected using user identity information collection equipment to provide reliable data support for user identity information verification on the data login platform; the user identity information verification unit performs real-time intelligent processing of user identity information verification on the data login platform based on user identity feature image information combined with artificial intelligence recognition algorithm and user authentication feature image data of the data login platform based on big data storage, realizing advanced data security verification of the data login platform based on real-time identity information of users, thereby improving the reliability of data security supervision of the data login platform.

[0097] For further information, see Figure 1 - Figure 2 When identity verification is passed, the account login geographic coordinate data and the user's location coordinate data are collected, and the geographic distance between the user's location and the account login location is measured. The steps for generating the geographic distance data between the user's location and the account login location are as follows:

[0098] S51, when the user identity information verification result data N yanzhengWhen the identity verification is passed, the spatial location coordinates of the login device used by the user to log in to the account information are obtained online through the data login platform, and the account login geographic location coordinate data X is generated. The account login geographic location coordinate data includes the longitude, latitude and altitude of the user's account login location;

[0099] The spatial location coordinates of the user's contact device are obtained online through the data login platform based on the user's contact information in the account feature text data M, and the user's geographic location coordinate data Y is generated. The user's geographic location coordinate data includes the longitude, latitude and altitude of the user's location;

[0100] S52: Based on the account login location coordinate data X and the user's location coordinate data Y, the spatial distance between the account login location and the user's location is measured using the spatial straight-line distance formula, and the geographical distance data L between the user's location and the account login location is generated. X,Y , where L X,Y The unit is meter.

[0101] Based on the account feature text data and the user information supervision geographical distance threshold of the data login platform, the supervision geographical distance threshold between the user's location and the account login location is searched and processed. The steps for generating the target user information supervision geographical distance threshold are as follows:

[0102] S61. Establish a geographical distance threshold set R = (r1,…,r a ,…,r χ ), where r a The geographical distance threshold of the user information supervision of the data login platform corresponding to the ath user represents the maximum spatial safety distance between the user's location and the account login location reserved by the data login platform. a The unit is meter;

[0103] S62, using a bidirectional search algorithm to compare the account feature text data M with the data login platform user information supervision geographical distance threshold value r in the data login platform user information supervision geographical distance threshold value set R. a Perform user feature information matching and search for the data login platform user information supervision geographical distance threshold r corresponding to the account feature text data M a , and generate the target user information supervision geographical distance threshold r through data identification mubiao , where r mubiao The unit is meter.

[0104] The user's location information on the data login platform is verified based on the geographical distance data between the user's location and the account login location, and the target user information supervision geographical distance threshold. The user's geographical information verification result data is generated. If the location verification fails, the data usage operation is terminated. If the location verification passes, the user continues to perform the data usage operation. The steps are as follows:

[0105] S71, the geographical distance data L between the user's location and the account login location X,Y Geographic distance threshold r from target user information supervision mubiao Perform distance value comparison and verify result data E based on user geographic information of distance value comparison result;

[0106] When L X,Y >r mubiao , indicating that the distance between the real-time location of the user logging into the data login platform and the user's actual real-time location exceeds the data login safety distance threshold set by the user, then the user geographic information verification result data E is output as location verification failure, and this data usage operation ends;

[0107] When L X,Y ≤r mubiao , indicating that the distance between the real-time location of the user logging into the data login platform and the user's actual real-time location does not exceed the data login safety distance threshold set by the user, then the user geographic information verification result data E is output as location verification passed, and the user continues to perform data usage operations.

[0108] Through the user identity feature information collection unit, user identity feature image information is dynamically collected using user identity information collection equipment to provide reliable data support for user identity information verification on the data login platform; the user identity information verification unit performs real-time intelligent processing of user identity information verification on the data login platform based on user identity feature image information combined with artificial intelligence recognition algorithm and user authentication feature image data of the data login platform based on big data storage, realizing advanced data security verification of the data login platform based on real-time identity information of users, thereby improving the reliability of data security supervision of the data login platform.

[0109] 3. Through the cooperation of the account login geographic location collection unit and the user location geographic location collection unit, the data login platform is used to accurately obtain the user account login geographic location coordinates and the user's location geographic location coordinates, providing reliable data support for the scientific supervision of user data security. The user location and account login location distance measurement unit and the user information supervision geographic distance threshold search unit cooperate with each other to perform online dynamic measurement and processing of the geographic distance between the user's location and the account login location based on the account login geographic location coordinates and the user's location geographic location coordinates, and accurately search and filter the supervision geographic distance threshold between the user's location and the account login location, thereby achieving scientific and efficient acquisition of real-time geographic distance information between the user's location and the account login location based on data processing, and accurately search and filter the supervision geographic distance threshold between the user's location and the account login location. The data security user location verification unit scientifically verifies the user's location information on the data login platform based on the geographic distance information between the user's location and the account login location and the target user information supervision geographic distance threshold, realizing intelligent and reliable supervision of user data security based on the dual security mechanism of user identity information and user geographic location information, and realizing scientific supervision of data security based on behavioral information of user information login and login location distribution; and improving the applicability and effectiveness of data security supervision on the data login platform.

[0110] Example 2:

[0111] See also Figure 1 - Figure 2 , a data security monitoring system based on behavior analysis, used to implement a data security monitoring method based on behavior analysis, the system includes a data security account supervision module, a data security user identity supervision module, and a data security user location supervision module;

[0112] The data security account supervision module includes an account information collection unit, a data login platform account information storage unit, and a user account information verification unit;

[0113] An account information collection unit collects account feature text data through a data input dialog box; a data login platform account information storage unit is used to store data login platform account verification feature text data; a user account information verification unit verifies the user's account information on the data login platform based on the account feature text data and the data login platform account verification feature text data, and generates user account information verification result data;

[0114] The data security user identity supervision module includes a user identity feature information collection unit, a data login platform user identity feature information storage unit, and a user identity information verification unit;

[0115] A user identity feature information collection unit collects user identity feature image data through a user identity information collection device; a data login platform user identity feature information storage unit is used to store the data login platform user identity authentication feature image data; a user identity information verification unit performs user identity information verification processing on the data login platform based on the user identity feature image data and the data login platform user identity authentication feature image data, and generates user identity information verification result data;

[0116] The data security user location supervision module includes an account login geographic location collection unit, a user location geographic location collection unit, a distance measurement unit between the user's location and the account login location, a data login platform user information supervision geographic distance threshold storage unit, a user information supervision geographic distance threshold search unit, and a data security user location verification unit;

[0117] The account login geographic location collection unit collects the account login geographic location coordinate data through the data login platform; the user's geographic location collection unit collects the user's geographic location coordinate data through the data login platform; the user's location and account login location distance measurement unit measures the geographic distance between the user's location and the account login location based on the account login geographic location coordinate data and the user's geographic location coordinate data, and generates the geographic distance data between the user's location and the account login location; the data login platform user information supervision geographic distance threshold storage unit is used to store the data login platform user information supervision geographic distance threshold; the user information supervision geographic distance threshold search unit searches for the supervision geographic distance threshold between the user's location and the account login location based on the account feature text data and the data login platform user information supervision geographic distance threshold, and generates the target user information supervision geographic distance threshold; the data security user location verification unit verifies the user's location information on the data login platform based on the geographic distance data between the user's location and the account login location and the target user information supervision geographic distance threshold, and generates the user geographic information verification result data.

[0118] While embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions, and variations may be made to these embodiments without departing from the principles and spirit of the invention, and that the scope of the invention is defined by the appended claims and their equivalents.

Claims

1. A data security monitoring method based on behavior analysis, characterized in that: The method comprises the following steps: S1. Collect account feature text data; S2. Verify the user's account information on the data login platform and generate user account information verification result data; if the account verification fails, end the data usage operation; S3. When the account verification is passed, collect the user's identity feature image data; S4. Verify the user's identity information on the data login platform and generate user identity verification result data; if the identity verification fails, end the data usage operation; S5. When the identity verification is successful, the account login geographic location coordinate data and the user's location coordinate data are collected and the geographic distance between the user's location and the account login location is measured to generate geographic distance data between the user's location and the account login location; S6. Performing a search process for a supervisory geographic distance threshold between the user's location and the account login location to generate a supervisory geographic distance threshold for target user information; S7. Perform location information verification on the data login platform to generate user geographic information verification result data. If the location verification fails, the data usage operation is terminated; if the location verification passes, the user continues to perform the data usage operation.

2. The data security monitoring method based on behavior analysis according to claim 1, characterized in that: Said S1 comprises the following steps: S11. Collect the user's registered account number information, login password information and user contact information on the data login platform online through the data input dialog box, and generate account feature text data M.

3. The data security monitoring method based on behavior analysis according to claim 2, characterized in that: The S2 comprises the following steps: S21. Establish a data login platform account verification feature text data set G = (g1,…,g a ,…,g χ ), a=1,2,3,…,χ; where g a represents the data login platform account verification feature text data corresponding to the a-th user, and χ represents the maximum number of users; S22, using Rabin-Karp search algorithm to compare the M with the g in G. a Perform account information character matching and generate user account information verification result data M based on the account information character matching result yanzheng ; When M and g a If the account information characters are not matched successfully, the M yanzheng The account verification fails, and the data usage operation ends at this time; When M and g a If the account information character matching is successful, the M yanzheng The account has been verified.

4. The data security monitoring method based on behavior analysis according to claim 3 is characterized by: The S3 includes the following steps: S31, when the M yanzheng When the account verification is passed, the user's identity feature image information is collected online through the user identity information collection device to complete the account login and generate user identity feature image data N.

5. The data security monitoring method based on behavior analysis according to claim 4 is characterized in that: The S4 comprises the following steps: S41. Establishing a data login platform user identity authentication feature image data set H = (h1,…,h a ,…,h χ ), where h a Represents the user identity authentication feature image data of the data login platform corresponding to the a-th user; S42, the N and the h in the H a Perform identity feature image matching and generate user identity information verification result data N based on the identity feature image matching results yanzheng , execute to generate the user identity information verification result data N yanzheng The specific steps are as follows: S421, initializing parameters, updating the number of authentication crow populations, the maximum number of iterations, and the flight distance η; S422, initialize the initial position and memory of the identity verification crow individual in the search space of H, and randomly distribute Ψ identity verification crow individuals in a multidimensional search space, and randomly distribute Ψ identity verification crow individuals in the search space of H with a spatial dimension of χ; in the first iteration, assume that the identity verification crow individual in the search space of H will match the h of N a The food is hidden in the initial position; S423, calculate the data login platform user identity authentication feature image data h in the search space of N and H a The fitness value of S424, updating the position of the authentication crow individual in the search space of H; S425, determine the feasibility of the new position, determine the feasibility of the new position of each identity verification crow individual; if the new position of the identity verification crow individual is feasible, the identity verification crow individual will update its position, search for the h that matches the N in the H a , the authentication crow individual is updated to the h that matches successfully a Otherwise, the authentication crow individual stays at the current location and does not move to the new location; S426, evaluate the fitness value of the new position, calculate the fitness value of each identity verification crow at the new position, that is, calculate the fitness value of the new position of the N in the search space of H and the h of the new position. a The fitness value of S427, update memory, if the fitness value of the new position of the identity authentication crow is greater than the fitness value of the initial position in the memory, the identity authentication crow updates its memory with the new position, otherwise it does not update its memory; search for the h with the largest fitness value with the N in the H a ; S428. When the maximum number of iterations is met, output the N and the h a Perform identity feature image matching results and generate user identity information verification result data N yanzheng ; When N and h a If the identity feature image is not matched successfully, the N yanzheng The authentication fails, and the data usage operation ends at this time; When N and h a If the identity feature image is matched successfully, the N yanzheng Authentication passed.

6. The data security monitoring method based on behavior analysis according to claim 5, characterized in that: The S5 comprises the following steps: S51, when the N yanzheng When the identity verification is passed, the spatial location coordinates of the login device used by the user to log in to the account information are obtained online through the data login platform, and the account login geographic location coordinate data X is generated; Obtain the spatial location coordinates of the user's contact device online through the data login platform based on the user contact information in M, and generate the user's geographical location coordinate data Y; S52: Based on X and Y and in combination with the spatial straight-line distance formula, perform a numerical measurement of the spatial distance between the account login location and the user's location, and generate the geographical distance data L between the user's location and the account login location. X,Y , where L X,Y The unit is meter.

7. The data security monitoring method based on behavior analysis according to claim 6, characterized in that: The S6 comprises the following steps: S61. Establish a geographical distance threshold set R = (r1,…,r a ,…,r χ ), where r a represents the geographical distance threshold of user information supervision on the data login platform corresponding to the a-th user, r a The unit is meter; S62, using a bidirectional search algorithm to compare the M with the r in the R a Perform user feature information matching and search for the r corresponding to the M a , and generate the target user information supervision geographical distance threshold r through data identification mubiao , where r mubiao The unit is meter.

8. The data security monitoring method based on behavior analysis according to claim 7, characterized in that: The S7 comprises the following steps: S71, the L X,Y With the r mubiao Perform distance value comparison and verify result data E based on user geographic information of distance value comparison result; When L X,Y >r mubiao , then the output E indicates that the location verification has failed, and the data usage operation ends; When L X,Y ≤r mubiao , indicating that the distance between the real-time location of the user logging into the data login platform and the user's actual real-time location does not exceed the data login safety distance threshold set by the user, then the output E is that the location verification is passed, and the user continues to perform the data usage operation.

9. A data security monitoring system based on behavior analysis, used to implement the data security monitoring method based on behavior analysis according to any one of claims 1 to 8, characterized in that: The system includes a data security account supervision module, a data security user identity supervision module, and a data security user location supervision module.

Images