Big data-based computer data management method and device, and storage medium

Abstract

This invention relates to the field of network data processing technology, and more particularly to a computer data management method, apparatus, and storage medium based on big data. The method includes: collecting target node data; determining packet rate anomaly based on the packet rate of the target node, determining byte entropy deviation based on the frequency of occurrence of each byte of the target node, and determining the attack index of the target node based on the packet rate anomaly, byte entropy deviation, TCP asymmetry, and node degree centrality; classifying anomaly levels based on the attack index of the target node; determining the attack latency period based on the attack index of the target node, identifying the attack type, and determining a defense strategy; updating the defense strategy based on cross-domain traffic within the attack latency period; and sending in-depth diagnostic prompts to the user based on the classification results of the target node anomaly levels within the management period. This invention effectively improves the processing efficiency of computer network data.

Description

Technical Field

[0001] This invention relates to the field of network data processing technology, and in particular to a computer data management method, apparatus and storage medium based on big data. Background Technology

[0002] As e-commerce platform business scenarios become increasingly complex, attacks outside of peak promotional periods are showing a trend towards greater concealment and combination. Attackers often use cross-domain CC attacks to create false traffic surges and embed probing attack payloads such as SQL injection and XSS into the payload, forming a hybrid threat of "traffic suppression + vulnerability penetration." Traditional defense solutions rely on static rule bases and fixed thresholds, which are insufficient to cope with attackers' dynamically changing obfuscation methods, resulting in persistently high false positive and false negative rates. Furthermore, in high-concurrency business scenarios, overly aggressive defense actions can easily harm genuine users, directly impacting the platform's user experience and revenue.

[0003] Current technologies lack joint analysis of the content and connection layers in detection models based on single traffic characteristics, resulting in significant lag in defense against polymorphic attacks. Therefore, a dynamic protection mechanism that integrates multi-dimensional features is urgently needed to accurately identify hybrid attacks while ensuring business continuity. Summary of the Invention

[0004] The purpose of this invention is to provide a computer data management method, apparatus, and storage medium based on big data, so as to solve at least one of the problems existing in the prior art.

[0005] To achieve the above objectives, the present invention adopts the following technical solution:

[0006] A computer data management method based on big data includes:

[0007] Collect data from the target node;

[0008] The packet rate anomaly is determined based on the packet rate of the target node, the byte entropy deviation is determined based on the frequency of occurrence of each byte of the target node, and the attack index of the target node is determined based on the packet rate anomaly, byte entropy deviation, TCP asymmetry and node degree centrality.

[0009] The anomaly level is classified based on the attack index of the target node;

[0010] The attack latency period is determined based on the attack index of the target node, the attack type is identified, and the defense strategy is determined. The defense strategy is updated based on the cross-domain traffic within the attack latency period.

[0011] The node status is determined based on the classification of the target node's anomaly level within the management cycle, and in-depth diagnostic prompts are sent to the user based on the node status.

[0012] Optionally, the average packet rate of the target node in the previous historical time windows is μp, the standard deviation of the packet rate of the target node in the previous historical time windows is σp, and the packet rate anomaly of the target node in the current time window is Sp.

[0013] Calculate the target node byte entropy Zb based on the frequency of occurrence of each byte of the target node in the current time window, calculate the average value of the target node byte entropy in the historical time windows before the current time window as μz, and calculate the byte entropy deviation Sh of the target node in the current time window.

[0014] Optionally, the first attack coefficient A1 is determined based on the packet rate anomaly degree and byte entropy deviation degree of the target node in the current time window, A1=x1×Sp+x2×Sh, where x1 is the packet rate weight, x2 is the byte entropy weight, and x1+x2=1.

[0015] Optionally, the first anomaly factor is determined based on the TCP asymmetry degree dt of the target node in the current time window. When dt is less than or equal to 1, the first anomaly factor is determined to be 0, and when dt is greater than 1, the first anomaly factor is determined to be [1-exp(1-dt)].

[0016] The second anomaly factor is determined based on the node degree centrality cd of the target node in the current time window. When the ratio B of cd to the node baseline connection number c0 is less than or equal to 1, the second anomaly factor is determined to be 0. When the ratio B of cd to the node baseline connection number c0 is greater than 1, the second anomaly factor is determined to be tanh(B-1).

[0017] The second attack coefficient A2 is determined based on the first abnormal factor and the second abnormal factor. A2 = w1 × first abnormal factor + w2 × second abnormal factor, where w1 is the weight of the first abnormal factor and w2 is the weight of the second abnormal factor, and w1 + w2 = 1.

[0018] The sum of the first attack coefficient and the second attack coefficient is taken as the attack index, denoted as G.

[0019] Optionally, when the attack index G of the target node is less than or equal to the first attack index threshold g1, the anomaly level is determined to be primary; when the attack index G of the target node is greater than the first attack index threshold g1 and less than or equal to the second attack index threshold g2, the anomaly level is determined to be intermediate; and when the attack index G of the target node is greater than the second attack index threshold g2, the anomaly level is determined to be advanced.

[0020] Optionally, when the attack index of the target node is greater than or equal to 1 for the first time, the start timestamp of the current time window is recorded as the initial timestamp, and the end timestamp of the time window when the attack index of the target node reaches its peak is recorded as the peak timestamp. The time interval between the peak timestamp and the initial timestamp is taken as the attack latency period T. When T is less than the first time threshold, the attack type is determined to be lightning-type, and a lightning-type attack alarm is issued to the user. When T is greater than or equal to the first time threshold, the attack type is determined to be penetration-type, and the cross-domain traffic of the target node is rate-limited with a rate-limiting strength of η1, where η1 is the first limiting factor, and an alarm is issued to the user at the same time.

[0021] Optionally, when the attack type is penetration type, the average attack index of the target node in each time window during the attack latency period is calculated as Gp, and the average cross-domain traffic received by the target node is calculated as Kp. Gp and Kp are fused to determine the anomaly index Yc, Yc=Gp×lg(5×Kp / K0+1) / lg6, where K0 is the cross-domain traffic baseline value;

[0022] When the anomaly index Yc is greater than the anomaly threshold y0, the speed limit intensity is updated to η2, where η2 is the second restriction factor. When the anomaly index Yc is less than or equal to the anomaly threshold y0, the restriction intensity is not updated.

[0023] Optionally, the number of time windows in the statistical management period where the target node has an anomaly level of medium is P1, the number of time windows in the statistical management period where the target node has an anomaly level of high is P2, and a node status index ZT is constructed.

[0024] When the node status index ZT is greater than or equal to the status threshold z0, the node status of the current management cycle is determined to be abnormal, and a deep diagnostic prompt is sent to the user. Conversely, when the node status index ZT is less than or equal to the status threshold z0, the node status of the current management cycle is determined to be normal, and no deep diagnostic prompt is sent to the user.

[0025] According to another aspect of this application, a computer data management device based on big data is provided, comprising:

[0026] Node data acquisition unit, used to acquire data from target nodes;

[0027] The feature construction unit is used to determine the packet rate anomaly degree based on the packet rate of the target node, determine the byte entropy deviation degree based on the occurrence frequency of each byte of the target node, and determine the attack index of the target node based on the packet rate anomaly degree, byte entropy deviation degree, TCP asymmetry degree and node degree centrality degree of the target node.

[0028] The level classification unit is used to classify the anomaly level based on the attack index of the target node;

[0029] The strategy generation unit is used to determine the attack latency period based on the attack index of the target node, identify the attack type, determine the defense strategy, and update the defense strategy based on the cross-domain traffic within the attack latency period.

[0030] The diagnostic prompt unit is used to determine the node status based on the classification results of the target node's abnormality level within the management cycle, and to send in-depth diagnostic prompts to the user based on the node status.

[0031] According to another aspect of this application, a computer-readable storage medium is provided, the computer-readable storage medium storing a computer program, wherein the computer program is used to control the electronic device in which the computer-readable storage medium is located to perform the aforementioned big data-based computer data management method during runtime.

[0032] The beneficial effects of this invention are as follows: This embodiment effectively solves the problem of e-commerce platforms dealing with hybrid attacks in non-promotional scenarios by using multi-dimensional traffic feature modeling and a dynamic adaptive defense mechanism. First, it constructs an attack index by combining traffic burstiness, load randomness, connection asymmetry, and node activity, breaking through the blind spots of traditional rule bases in identifying new composite attacks. Second, it dynamically adjusts the defense strategy based on the attack latency period and cross-domain traffic characteristics, taking into account both the stability of high-concurrency business and the sensitivity of security protection. Through the fusion calculation of the anomaly index and long-term tracking of node status, a closed-loop defense system of attack detection, dynamic suppression, and deep tracing is formed. Attached Figure Description

[0033] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0034] Figure 1 This is a flowchart illustrating the computer data management method based on big data in this embodiment.

[0035] Figure 2 This is a flowchart illustrating the method for determining the attack index in this embodiment.

[0036] Figure 3 This is a flowchart illustrating the defense strategy determination method in this embodiment.

[0037] Figure 4 This is a schematic diagram of the structure of the computer data management device based on big data in this embodiment. Detailed Implementation

[0038] To more clearly illustrate the present invention, the following description, in conjunction with preferred embodiments and accompanying drawings, further explains the invention. Similar components in the drawings are indicated by the same reference numerals. Those skilled in the art should understand that the specific description below is illustrative rather than restrictive and should not be construed as limiting the scope of protection of the present invention.

[0039] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate for the embodiments of this application described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0040] Specifically, this embodiment is applied to the mixed attack defense scenario of e-commerce platforms during non-major promotional periods. Faced with the sudden influx of user traffic and the composite attacks launched by attackers, this solution accurately distinguishes between malicious requests and real user behavior through multi-dimensional traffic fingerprint modeling and dynamic decision-making mechanisms.

[0041] Please see Figure 1 As shown, it is a flowchart illustrating the computer data management method based on big data in this embodiment, including:

[0042] Step S101: Collect target node data. The target node data includes the packet rate of the target node, the frequency of occurrence of each byte of the target node, the TCP asymmetry of the target node, and the degree centrality of the target node. The TCP asymmetry of the target node is the ratio of the number of SYN packets to the number of ACK packets of the target node. The degree centrality of the target node is the number of active connections between the target node and other nodes. The frequency of occurrence of each byte of the target node is the probability distribution of each possible value (i.e., 0x00 to 0xFF, a total of 256) in the load part of the network protocol when the data stream passes through the target node within a specified time window. The calculation formula is the ratio of the number of times the byte appears to the total number of times all bytes appear. The packet rate is the number of data packets passing through the network node per unit time. The target node is the network node currently being analyzed.

[0043] For example, in this embodiment, the packet rate can be obtained through the port traffic statistics function of the core switch or router. The frequency of occurrence of each byte of the target node can be obtained by deploying traffic mirroring at the ingress of the target node, by using deep packet inspection (DPI) technology to count the frequency of occurrence of each byte value (0-255) in the load part, by configuring traffic filtering rules on firewalls or load balancers to collect TCP asymmetry, and by collecting the number of active connections of the target node through NetFlow / sFlow / IPFIX protocols. In this embodiment, no specific limitation is made on the above data collection methods, and those skilled in the art can set them freely according to their needs.

[0044] Specifically, by collecting multi-dimensional traffic characteristics, a panoramic monitoring system for network behavior is constructed. By utilizing traffic mirroring and deep packet inspection technologies, subtle anomalies in protocol load can be captured in real time. At the same time, it is compatible with the log protocols of mainstream network devices to ensure data integrity and real-time performance in heterogeneous environments, providing highly reliable data for subsequent threat modeling.

[0045] Please continue reading. Figure 1 As shown, the computer data management method based on big data also includes:

[0046] Step S102: Determine the packet rate anomaly degree based on the packet rate of the target node, determine the byte entropy deviation degree based on the occurrence frequency of each byte of the target node, and determine the attack index of the target node based on the packet rate anomaly degree, byte entropy deviation degree, TCP asymmetry degree and node degree centrality degree of the target node.

[0047] Please see Figure 2 As shown, the method for determining the attack index includes:

[0048] Step S201: Determine the packet rate anomaly degree based on the packet rate of the target node, and determine the byte entropy deviation degree based on the occurrence frequency of each byte of the target node.

[0049] Specifically, the average packet rate of the target node in the previous historical time windows is μp, the standard deviation of the packet rate of the target node in the previous historical time windows is σp, and the packet rate anomaly of the target node in the current time window is calculated as Sp, where Sp = max(Ep - μp, 0) / (3 × σp), and Ep is the packet rate of the target node in the current time window.

[0050] Calculate the target node byte entropy Zb based on the frequency of occurrence of each byte of the target node within the current time window. ;pi is the frequency of occurrence of byte i in the current time window. The average value of the byte entropy of the target node in the historical time windows before the current time window is μz. The byte entropy deviation Sh of the target node in the current time window is calculated, Sh=|Zb-μz| / μz.

[0051] For example, in this embodiment, the time window can be set to 1 second, and the historical time window before the current time window can be the historical time window one month before the current time window; this embodiment does not specifically limit the above settings, and those skilled in the art can set them freely according to their needs.

[0052] Specifically, based on historical baselines, the deviation of packet rates is dynamically calculated to adaptively identify sudden traffic surges and normal business peaks, reducing false negatives caused by misjudgments due to static thresholds. Byte entropy analysis quantifies load randomness, significantly distinguishing normal business traffic from attack payloads, effectively addressing the blind spots of traditional methods in identifying obfuscation attacks.

[0053] Please continue reading. Figure 2 As shown, the method for determining the attack index further includes:

[0054] Step S202: Determine the attack index of the target node based on the packet rate anomaly degree, byte entropy deviation degree, TCP asymmetry degree, and node degree centrality degree of the target node.

[0055] Specifically, the first attack coefficient A1 is determined based on the packet rate anomaly and byte entropy deviation of the target node in the current time window. A1 = x1 × Sp + x2 × Sh, where x1 is the packet rate weight, x2 is the byte entropy weight, and x1 + x2 = 1.

[0056] The first anomaly factor is determined based on the TCP asymmetry degree dt of the target node in the current time window. When dt is less than or equal to 1, the first anomaly factor is determined to be 0. When dt is greater than 1, the first anomaly factor is determined to be [1-exp(1-dt)].

[0057] The second anomaly factor is determined based on the node degree centrality cd of the target node in the current time window. When the ratio B of cd to the node baseline connection number c0 is less than or equal to 1, the second anomaly factor is determined to be 0. When the ratio B of cd to the node baseline connection number c0 is greater than 1, the second anomaly factor is determined to be tanh(B-1).

[0058] The second attack coefficient A2 is determined based on the first abnormal factor and the second abnormal factor. A2 = w1 × first abnormal factor + w2 × second abnormal factor, where w1 is the weight of the first abnormal factor and w2 is the weight of the second abnormal factor, and w1 + w2 = 1.

[0059] The sum of the first attack coefficient and the second attack coefficient is taken as the attack index, denoted as G.

[0060] Specifically, by integrating the characteristics of traffic bursts, content anomalies, and asymmetric connections, a multi-indicator collaborative evaluation is achieved, dynamic weights are assigned, and the model's adaptability to hybrid attacks is enhanced. Through the superposition calculation of asymmetric connection factors and node activity factors, the collaborative behavior of attackers is accurately captured, avoiding misjudgments from single-dimensional analysis.

[0061] For example, in this embodiment, the table rate weight can be set to 0.7, the byte entropy weight can be set to 0.3, the first anomaly weight can be set to 0.6, the second anomaly weight can be set to 0.4, and the node baseline connection number can be set to the mean of the node degree centrality of the target node in the historical time window one month before the current time window; this embodiment does not specifically limit the above settings, and those skilled in the art can set them freely according to their needs.

[0062] Please continue reading. Figure 1 As shown, the computer data management method based on big data also includes:

[0063] Step S103: Classify the anomaly level based on the attack index of the target node.

[0064] Specifically, when the attack index G of the target node is less than or equal to the first attack index threshold g1, the anomaly level is determined to be primary; when the attack index G of the target node is greater than the first attack index threshold g1 and less than or equal to the second attack index threshold g2, the anomaly level is determined to be intermediate; and when the attack index G of the target node is greater than the second attack index threshold g2, the anomaly level is determined to be advanced.

[0065] Specifically, by marking continuous anomaly levels in the time series dimension, a traceable node risk evolution profile is constructed. This hierarchical record provides subsequent node assessment with time-series data on the correlation between event density and threat intensity, thereby locating nodes with persistent vulnerability exposure and assisting operations and maintenance in optimizing weak links in the defense chain.

[0066] For example, in this embodiment, the first attack index threshold can be set to 0.6, and the second attack index threshold can be set to 1.2. This embodiment does not specifically limit the above settings, and those skilled in the art can set them freely according to their needs.

[0067] Please continue reading. Figure 1 As shown, the computer data management method based on big data also includes:

[0068] Step S104: Determine the attack latency period based on the attack index of the target node, determine the attack type, and determine the defense strategy. Update the defense strategy based on the cross-domain traffic within the attack latency period.

[0069] Please see Figure 3 As shown, the defense strategy determination method includes:

[0070] Step S301: Determine the attack latency period based on the attack index of the target node, and determine the attack type.

[0071] Specifically, when the attack index of the target node is greater than or equal to 1 for the first time, the start timestamp of the current time window is recorded as the initial timestamp, and the end timestamp of the time window when the attack index of the target node reaches its peak is recorded as the peak timestamp. The time interval between the peak timestamp and the initial timestamp is taken as the attack latency period T. When T is less than the first time threshold, the attack type is determined to be lightning-type, and a lightning-type attack alarm is issued to the user. When T is greater than or equal to the first time threshold, the attack type is determined to be penetration-type, and the cross-domain traffic of the target node is rate-limited with a rate-limiting strength of η1, where η1 is the first limiting factor, and an alarm is issued to the user at the same time.

[0072] Specifically, in this embodiment, the first time the attack index of the target node is greater than or equal to 1 is the first time after the end of the previous incubation period. If there is no previous incubation period in the current time window, the first time the attack index of the target node is greater than or equal to 1 is recorded as the starting timestamp.

[0073] Specifically, the cross-domain traffic described in this embodiment refers to data traffic sent from an external autonomous system to a target node within the current autonomous system, that is, the transmission behavior of data across different network management domains.

[0074] Specifically, defense strategies are dynamically adapted based on incubation period and attack patterns. Lightning-type attacks trigger immediate traffic scrubbing to prevent business interface crashes; penetration-type attacks employ a tiered rate-limiting mechanism to gradually suppress attack traffic, avoiding overreaction due to instantaneous blocking. Combined with cross-domain traffic source analysis, spoofed requests and legitimate access are accurately identified, ensuring the targeted and flexible nature of defense actions.

[0075] For example, in this embodiment, the first time threshold can be set to 5 minutes, and the first restriction factor can be set to 0.8. That is, the restricted rate of cross-domain traffic of the target node after restriction is the product of the base rate and the restriction factor. If the abnormal level of the target node is primary for 50 consecutive time windows after the rate limit is set, the rate limit is lifted. This embodiment does not specifically limit the above settings, and those skilled in the art can set them freely according to their needs.

[0076] Please continue reading. Figure 3 As shown, the defense strategy determination method further includes:

[0077] Step S302: Determine the anomaly index based on the attack type and cross-domain traffic during the attack latency period, and update the rate limit intensity based on the anomaly index.

[0078] Specifically, when the attack type is penetration, the average attack index of the target node in each time window during the attack incubation period is Gp, and the average cross-domain traffic received by the target node is denoted as Kp. Gp and Kp are fused to determine the anomaly index Yc, Yc=Gp×lg(5×Kp / K0+1) / lg6, where K0 is the cross-domain traffic baseline value.

[0079] When the anomaly index Yc is greater than the anomaly threshold y0, the speed limit intensity is updated to η2, where η2 is the second restriction factor. When the anomaly index Yc is less than or equal to the anomaly threshold y0, the restriction intensity is not updated.

[0080] Specifically, by fusing cross-domain traffic characteristics and attack indices during the attack latency period into a model, the challenge of progressive rate limiting for covert probing behaviors in penetration attacks is addressed. Based on the anomaly index, the rate limiting strength is dynamically calibrated to achieve a non-linear match between defense and attack intensity. This mechanism strengthens the dynamic suppression capability against distributed, coordinated attacks by statistically analyzing the global scale of potential attack chains.

[0081] For example, in this embodiment, cross-domain traffic can be counted through a firewall / router, and cross-domain traffic baseline values ​​can be collected interactively. This embodiment does not specifically limit the data collection method, and those skilled in the art can freely set it according to their needs.

[0082] For example, in this embodiment, the abnormal threshold can be set to 0.7, the second restriction factor can be set to 0.5, and the abnormal threshold can be set to 0.8. This embodiment does not specifically limit the above settings, and those skilled in the art can set them freely according to their needs.

[0083] Please continue reading. Figure 1 As shown, the computer data management method based on big data also includes:

[0084] Step S105: Determine the node status based on the classification results of the target node's abnormality level within the management cycle, and send a deep diagnostic prompt to the user based on the node status.

[0085] Specifically, the number of time windows in the statistical management period where the target node has an anomaly level of medium is P1, and the number of time windows in the statistical management period where the target node has an anomaly level of high is P2. A node status index is constructed as ZT, ZT=(P1+L×P2) / P0.

[0086] When the node status index ZT is greater than or equal to the status threshold z0, the node status of the current management cycle is determined to be abnormal and a deep diagnostic prompt is sent to the user; otherwise, the node status of the current management cycle is determined to be normal and no deep diagnostic prompt is sent to the user.

[0087] Where L is the correction factor and P0 is the total number of time windows within the management period.

[0088] Specifically, based on anomaly frequency statistics within the management cycle, a node assessment model is constructed. By weighting the high-level alarm frequency, persistent risk nodes (such as long-term low-frequency penetration attacks) are identified, and in-depth diagnostic suggestions (such as full protocol backtracking or rule base updates) are triggered. This mechanism helps the operations team focus on high-threat nodes, shorten the vulnerability exposure window, form a closed-loop management of "detection-defense-optimization," and improve the overall resilience of the system against attacks.

[0089] For example, in this embodiment, the management period can be set to 3 days. This embodiment does not specifically limit the setting of the management period, and those skilled in the art can set it freely according to their needs.

[0090] For example, in this embodiment, the correction factor can be set to 1.3 and the state threshold can be set to 0.3. This embodiment does not specifically limit the above settings, and those skilled in the art can set them freely according to their needs.

[0091] Please see Figure 4 As shown, the computer data management device based on big data includes:

[0092] Node data acquisition unit, used to acquire data from target nodes;

[0093] The feature construction unit is used to determine the packet rate anomaly degree based on the packet rate of the target node, determine the byte entropy deviation degree based on the occurrence frequency of each byte of the target node, and determine the attack index of the target node based on the packet rate anomaly degree, byte entropy deviation degree, TCP asymmetry degree and node degree centrality degree of the target node.

[0094] The level classification unit is used to classify the anomaly level based on the attack index of the target node;

[0095] The strategy generation unit is used to determine the attack latency period based on the attack index of the target node, identify the attack type, determine the defense strategy, and update the defense strategy based on the cross-domain traffic within the attack latency period.

[0096] The diagnostic prompt unit is used to determine the node status based on the classification results of the target node's abnormality level within the management cycle, and to send in-depth diagnostic prompts to the user based on the node status.

[0097] The big data-based computer data management device provided in this application embodiment can execute the big data-based computer data management method provided in any embodiment of this application, and has the corresponding functional modules and beneficial effects of the execution method.

[0098] Obviously, the above embodiments of the present invention are merely examples for clearly illustrating the present invention, and are not intended to limit the implementation of the present invention. For those skilled in the art, other variations or modifications can be made based on the above description. It is impossible to exhaustively list all the implementation methods here. All obvious variations or modifications derived from the technical solutions of the present invention are still within the protection scope of the present invention.

Claims

1. A computer data management method based on big data, characterized in that, include: Collect data from the target node; The packet rate anomaly is determined based on the packet rate of the target node, the byte entropy deviation is determined based on the frequency of occurrence of each byte of the target node, and the attack index of the target node is determined based on the packet rate anomaly, byte entropy deviation, TCP asymmetry and node degree centrality. The anomaly level is classified based on the attack index of the target node; The attack latency period is determined based on the attack index of the target node, the attack type is identified, and the defense strategy is determined. The defense strategy is updated based on the cross-domain traffic within the attack latency period. The node status is determined based on the classification of the target node's anomaly level within the management cycle, and in-depth diagnostic prompts are sent to the user based on the node status. When the attack index of the target node is greater than or equal to 1 for the first time, the start timestamp of the current time window is recorded as the initial timestamp, and the end timestamp of the time window when the attack index of the target node reaches its peak is recorded as the peak timestamp. The time interval between the peak timestamp and the initial timestamp is taken as the attack latency period T. When T is less than the first time threshold, the attack type is determined to be lightning-type, and a lightning-type attack alarm is issued to the user. When T is greater than or equal to the first time threshold, the attack type is determined to be penetration-type, and the cross-domain traffic of the target node is rate-limited with a rate-limiting strength of η1, where η1 is the first limiting factor. At the same time, an alarm is issued to the user. When the attack type is penetration, the average attack index of the target node in each time window during the attack incubation period is Gp, and the average cross-domain traffic received by the target node is recorded as Kp. Gp and Kp are fused to determine the anomaly index Yc, Yc=Gp×lg(5×Kp / K0+1) / lg6, where K0 is the cross-domain traffic baseline value. When the anomaly index Yc is greater than the anomaly threshold y0, the speed limit intensity is updated to η2, where η2 is the second restriction factor. When the anomaly index Yc is less than or equal to the anomaly threshold y0, the restriction intensity is not updated.

2. The computer data management method based on big data according to claim 1, characterized in that, The average packet rate of the target node in the previous historical time windows is μp, the standard deviation of the packet rate of the target node in the previous historical time windows is σp, and the packet rate anomaly of the target node in the current time window is calculated as Sp, where Sp=max(Ep-μp,0) / (3×σp), and Ep is the packet rate of the target node in the current time window. Calculate the target node byte entropy Zb based on the occurrence frequency of each byte of the target node in the current time window, calculate the average value of the target node byte entropy in the historical time windows before the current time window as μz, and calculate the byte entropy deviation Sh of the target node in the current time window, Sh=|Zb-μz| / μz.

3. The computer data management method based on big data according to claim 2, characterized in that, The first attack coefficient A1 is determined based on the packet rate anomaly and byte entropy deviation of the target node in the current time window. A1 = x1 × Sp + x2 × Sh, where x1 is the packet rate weight, x2 is the byte entropy weight, and x1 + x2 = 1.

4. The computer data management method based on big data according to claim 3, characterized in that, The first anomaly factor is determined based on the TCP asymmetry degree dt of the target node in the current time window. When dt is less than or equal to 1, the first anomaly factor is determined to be 0. When dt is greater than 1, the first anomaly factor is determined to be [1-exp(1-dt)]. The second anomaly factor is determined based on the node degree centrality cd of the target node in the current time window. When the ratio B of cd to the node baseline connection number c0 is less than or equal to 1, the second anomaly factor is determined to be 0. When the ratio B of cd to the node baseline connection number c0 is greater than 1, the second anomaly factor is determined to be tanh(B-1). The second attack coefficient A2 is determined based on the first abnormal factor and the second abnormal factor. A2 = w1 × first abnormal factor + w2 × second abnormal factor, where w1 is the weight of the first abnormal factor and w2 is the weight of the second abnormal factor, and w1 + w2 = 1. The sum of the first attack coefficient and the second attack coefficient is taken as the attack index, denoted as G.

5. The computer data management method based on big data according to claim 4, characterized in that, When the attack index G of the target node is less than or equal to the first attack index threshold g1, the anomaly level is determined to be primary. When the attack index G of the target node is greater than the first attack index threshold g1 and less than or equal to the second attack index threshold g2, the anomaly level is determined to be intermediate. When the attack index G of the target node is greater than the second attack index threshold g2, the anomaly level is determined to be advanced.

6. The computer data management method based on big data according to claim 5, characterized in that, The number of time windows with an anomaly level of medium for the target node within the statistical management period is P1, and the number of time windows with an anomaly level of high for the target node within the statistical management period is P2. A node status index is constructed as ZT. When the node status index ZT is greater than or equal to the status threshold z0, the node status of the current management cycle is determined to be abnormal, and a deep diagnostic prompt is sent to the user. Conversely, when the node status index ZT is less than or equal to the status threshold z0, the node status of the current management cycle is determined to be normal, and no deep diagnostic prompt is sent to the user.

7. A computer data management device based on big data, applied to the computer data management method based on big data as described in any one of claims 1-6, characterized in that, include: Node data acquisition unit, used to acquire data from target nodes; The feature construction unit is used to determine the packet rate anomaly degree based on the packet rate of the target node, determine the byte entropy deviation degree based on the occurrence frequency of each byte of the target node, and determine the attack index of the target node based on the packet rate anomaly degree, byte entropy deviation degree, TCP asymmetry degree and node degree centrality degree of the target node. The level classification unit is used to classify the anomaly level based on the attack index of the target node; The strategy generation unit is used to determine the attack latency period based on the attack index of the target node, identify the attack type, determine the defense strategy, and update the defense strategy based on the cross-domain traffic within the attack latency period. The diagnostic prompt unit is used to determine the node status based on the classification results of the target node's abnormality level within the management cycle, and to send in-depth diagnostic prompts to the user based on the node status.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, wherein the computer program is used to control the electronic device on which the computer-readable storage medium is located to perform the computer data management method based on big data as described in any one of claims 1-6 during runtime.

Images