A method and system for encrypting big data software

Abstract

The application provides a big data software encryption method and system, relates to the technical field of electric digital data processing, and avoids repeated calculation on irrelevant feature data by dynamically dividing a core part feature set and a non-core part feature set, thereby reducing the calculation burden of the whole system; a dynamic encryption algorithm switching mechanism based on user behavior analysis and risk score driving is proposed, which can flexibly adjust encryption complexity to balance security and performance requirements; a risk feedback mechanism is introduced, a screening threshold of a next monitoring time period is corrected through the risk score output of an isolated warehouse, and the encryption strategy has continuous optimization capability.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of electric digital data processing, in particular to an encryption method and system of big data software. BACKGROUND

[0002] In the comprehensive analysis and application scene of user behavior data, business sensitive data and environmental parameters, the storage and transmission of sensitive data are exposed to potential security risks, and are easy to become the target of external attackers and internal abuse. For enterprises, not only the confidentiality and integrity of the data itself need to be ensured, but also the risk management of data access behavior needs to be accurate, so as to prevent the loss caused by data leakage and illegal use.

[0003] In the prior art, a method for realizing big data security is disclosed, and the method comprises the following steps: after a DFS client receives data, the local cache is accessed to check whether the data has a data encryption key; if yes, a security file corresponding to the data with the data encryption key is obtained, and the content is transmitted to a big data security function board for security protection; if not, a data encryption key is first requested to be generated; a security file corresponding to the data with the data encryption key is obtained by using GetFileinfo; the content of the security file is transmitted to the big data security function board for security protection; the original software and network topology architecture mode for big data security protection is upgraded to directly use hardware protection, and the protection level is upgraded from the original software protection level to the hardware protection level, which greatly improves the attack prevention ability of the big data platform and effectively improves the security of the big data.

[0004] At present, for the data security protection in the big data scene, most methods focus on the direct use of traditional encryption algorithms (such as AES, RSA, etc.) or simply increase the key length to improve the cracking threshold. However, these methods are easy to cause a sharp increase in computational complexity in a high-frequency, multi-source data processing environment, affecting real-time performance, and even negatively affecting the experience of terminal users. In addition, the existing encryption technology lacks the ability of dynamic analysis of user access behavior risk and corresponding strategy adjustment, and cannot provide targeted encryption strategy optimization according to actual security requirements.

[0005] The above information disclosed in the above background section is only used to strengthen the understanding of the background of the present disclosure, and therefore it can include information that does not constitute prior art known to those of ordinary skill in the art. SUMMARY

[0006] The purpose of the present application is to provide an encryption method and system of big data software to solve the problems raised in the above background.

[0007] To achieve the above object, the present application provides the following technical solutions:

[0008] A big data software encryption method, the specific steps include:

[0009] Step S1: collect multiple source data of the target user in the current monitoring time period, the multiple source data includes user behavior data, business sensitive data and environmental parameters, and input the multiple source data into the big data cloud platform for storage and preprocessing;

[0010] The N times stored multiple source data in the big data cloud platform is integrated into a respective multi-dimensional feature vector;

[0011] Step S2: preset the initial screening threshold of the multi-dimensional feature vector, and use the initial screening threshold to screen the core part feature set and the non-core part feature set of the N times stored multi-dimensional feature vector;

[0012] Step S3: obtain the screened core part feature set for analysis and processing to obtain a core risk evaluation coefficient, the core risk evaluation coefficient is used to evaluate the access mode operation risk of the target user in the current monitoring time period, and a risk score is obtained;

[0013] Step S4: obtain the risk score of the target user in the current monitoring time period, and generate a switching strategy of an automatic switching encryption algorithm according to the risk score, the switching strategy includes dynamically adjusting the sequence length and element complexity of the encryption algorithm, and finally generating an encryption element sequence, the encryption algorithm includes symmetric encryption and asymmetric encryption;

[0014] Step S5: according to the generated encryption element sequence, the multiple source data of the target user in the current monitoring time is encrypted, and the encrypted multiple source data is transmitted to the isolated warehouse for storage processing, and the isolated warehouse outputs the risk score of the current monitoring time period according to the value condition, and provides a correction strategy for the initial screening threshold of the next monitoring time period.

[0015] A big data software encryption system, the system is used for executing the big data software encryption method, comprising:

[0016] A big data software encryption system, the system is used for executing the big data software encryption method, comprising:

[0017] Collect and vector generation module: for collecting multiple source data of the target user in the current monitoring time period, the multiple source data includes user behavior data, business sensitive data and environmental parameters, and input the multiple source data into the big data cloud platform for storage and preprocessing;

[0018] The N times stored multiple source data in the big data cloud platform is integrated into a respective multi-dimensional feature vector;

[0019] The screening module is used for pre-setting an initial screening threshold of the multi-dimensional feature vector, and screening the core part feature set and the non-core part feature set of the multi-dimensional feature vector stored for N times using the initial screening threshold;

[0020] The scoring module is used for obtaining the screened core part feature set for analysis and processing to obtain a core risk evaluation coefficient, and the core risk evaluation coefficient is used for evaluating the access mode operation risk of the target user in the current monitoring time period, and obtaining a risk score;

[0021] The encryption algorithm switching module is used for obtaining the risk score of the target user in the current monitoring time period, and generating a switching strategy of automatically switching the encryption algorithm according to the risk score, the switching strategy including dynamically adjusting the sequence length and element complexity of the encryption algorithm, and finally generating an encryption element sequence, and the encryption algorithm including symmetric encryption and asymmetric encryption;

[0022] The correction module is used for encrypting the multi-source data of the target user at the current monitoring time according to the generated encryption element sequence, and transmitting the encrypted multi-source data to the isolated warehouse for storage processing, and the isolated warehouse outputs a risk score of the current monitoring time period according to the value, and provides a correction strategy for the initial screening threshold of the next monitoring time period.

[0023] Compared with the prior art, the present application has the following advantages:

[0024] 1) By dynamically dividing the core part feature set and the non-core part feature set, the repeated calculation of irrelevant feature data is avoided, thereby reducing the calculation burden of the whole system;

[0025] 2) A dynamic encryption algorithm switching mechanism based on user behavior analysis and risk score driving is proposed, which can flexibly adjust the encryption complexity to balance the security and performance requirements;

[0026] 3) A risk feedback mechanism is introduced, and the risk score output of the isolated warehouse corrects the screening threshold of the next monitoring time period, so that the encryption strategy has the ability of continuous optimization. BRIEF DESCRIPTION OF DRAWINGS

[0027] Figure 1 It is a whole method flowchart of the present application;

[0028] Figure 2 It is a whole system module block diagram of the present application. DETAILED DESCRIPTION

[0029] In order to make the purpose, technical scheme and advantages of the present application more clear and obvious, the present application is further described in detail below in combination with specific embodiments.

[0030] It should be noted that, unless otherwise defined, technical terms or scientific terms used in the present application shall be understood as having the usual meaning as understood by a person with ordinary skill in the art to which the present application pertains. The terms "first", "second", and similar words used in the present application do not represent any order, number, or importance, but are only used to distinguish different components. The terms "include" or "contain" and similar words mean that the elements or objects before the word cover the elements or objects listed after the word and their equivalents, and do not exclude other elements or objects. The terms "connected" or "connected" and similar words are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect. The terms "up", "down", "left", "right", and the like are only used to represent relative positional relationships, and when the absolute position of the described object changes, the relative positional relationship may also change accordingly.

[0031] Embodiment one:

[0032] Referring to Figure 1 The present application provides a technical solution:

[0033] A big data software encryption method, the specific steps comprising:

[0034] Step S1: Collecting multiple times of multi-source data of the target user in the current monitoring time period, the multi-source data including user behavior data, business sensitive data and environmental parameters, and inputting the multi-source data into a big data cloud platform for storage and preprocessing;

[0035] Integrating the multi-source data stored N times in the big data cloud platform into respective multi-dimensional feature vectors;

[0036] Further explanation: the number of times of collecting multi-source data of the target user in the current monitoring time period is represented as {1, 2, …, i, …, N} in a sequence set, where i represents the index of the collection time period, and N represents the total number of collection time periods;

[0037] Defining the user behavior data to include the average value of keyboard key pressure, the change rate of mouse trajectory curvature, and the window interaction habit index;

[0038] The average value of keyboard key pressure is captured by a pressure-sensitive keyboard to capture the average force of the target user's input in the current monitoring time period;

[0039] The collected multi-source data is uploaded to the big data cloud platform through a secure data transmission protocol HTTPS or TLS to ensure the integrity and security of the data during transmission;

[0040] Create a storage structure using cloud storage services such as Amazon S3, Google Cloud Storage, or Azure Blob Storage, including different data directories for easy classification and management of multi-source data.

[0041] Perform metadata management on the data stored in the cloud, including data source, data type, collection time, and other information, to facilitate subsequent data retrieval and management.

[0042] Clean the uploaded data, remove duplicate and error data, and fill in missing values. This can be done by writing data cleaning scripts or using data cleaning tools such as Apache Spark, Apache NiFi, etc.

[0043] Implement data conversion operations, including data type conversion and on-demand reformatting, to ensure data consistency and compatibility. In this embodiment, the date format is unified to ISO8601 format, and the numerical value is unified to the corresponding unit.

[0044] For subsequent analysis requirements, perform dimensionless or standardization processing to convert all feature values to the same range (0, 1), facilitating subsequent analysis and modeling.

[0045] Define the average value of keyboard key pressure in the collection period i as ; The calculation formula is as follows:

[0046] ;

[0047] Where, is the number of key presses monitored in the collection period i;

[0048] represents the value of the pressure degree under the th key press in the collection period i, with the unit of Newton;

[0049] Set the value range of to , where is the maximum average keyboard key pressure measured in the collection period i;

[0050] The closer to 0, the more relaxed the target user operates and does not need to exert excessive force, reflecting positive emotions; when is larger, it indicates the stress state of the target user, reflecting nervous or anxious emotions;

[0051] The mouse trajectory curvature change rate is recorded by recording the trajectory curvature change rate when the mouse moves.

[0052] The mouse trajectory curvature change rate at the collection time period i is defined as ; The calculation formula is as follows:

[0053] ;

[0054] Wherein, is the number of mouse trajectory points recorded in the collection time period i;

[0055] represents the change in the arc of the mouse between the two consecutive mouse trajectory points j2+1 and j2;

[0056] ; ;

[0057] represents the straight line distance between the two consecutive mouse trajectory points j2+1 and j2, in meters;

[0058] , wherein is the maximum curvature change measured in the collection time period i;

[0059] When tends to 0, it represents the user's smooth operation, which is the stable operation of the target user; when tends to , it indicates that the target user is trying to operate quickly or complexly, indicating that there is a robot operation or abnormal behavior;

[0060] The window interaction habit index is to count the user's operation data on the window in the software interface, including the number of window dragging times and the amplitude habit of adjusting the window size;

[0061] The window interaction habit index at the collection time period i is defined as ; The calculation formula is as follows:

[0062] ;

[0063] Wherein, represents the number of window interactions in the collection time period i;

[0064] represents the distance of window dragging in the j3th interaction in the collection time period i, in pixels;

[0065] represents the amplitude of window size adjustment in the j3th interaction in the collection time period i, in pixels.

[0066] The value range of is wherein is the maximum window interaction habit index that can be achieved in the system;

[0067] When closer to 0, it means that the target user has less operation on the current encrypted window, and tends to use the default setting or little interaction;

[0068] When closer to 1, it means that the target user has more operation on the current encrypted window, and tends to use the default setting or little interaction; , it indicates that the user frequently adjusts the window, which can better reflect the user's personalized needs and use habits.

[0069] The definition of the business sensitive data includes the modification consistency index of the target user on the sensitive data, the dynamic change frequency of the access permission, and the business data use time length index;

[0070] The modification consistency index is to record the modification frequency of the target user on the sensitive business data field;

[0071] The modification consistency index in the collection period i is defined as ; The calculation formula is as follows:

[0072] ;

[0073] wherein, is the number of modifications on the sensitive data field in the collection period i;

[0074] is a mapping amplitude adjustment parameter, which controls the steepness of the curve;

[0075] is a balance parameter for zero-point translation of data, which is set to the modification frequency standard value of the system;

[0076] The value range of is (0, 1);

[0077] When closer to 0, it means that the modification frequency is lower, indicating that the user operation is more stable;

[0078] When closer to 1, it means that the modification frequency is higher, indicating that the user operation is less stable, and the probability of risk operation is higher;

[0079] The dynamic change frequency of access permission is to monitor the frequency of real-time dynamic change of the target user's permission in normal business operation;

[0080] The dynamic change frequency of access permission in the collection period i is defined as ; The calculation formula is as follows:

[0081] ;

[0082] wherein, is the number of permission changes identified in the collection period i;

[0083] and is a constant for adjusting the sensitivity of the frequency response; controls the dynamic range of the frequency; is a bias value to ensure that the output of the calculation formula is not invalid.

[0084] The value range of is (0, 1);

[0085] When tends to 0, is smaller, indicating that the number of permission changes is less, and the permission changes are more stable;

[0086] When tends to 1, is larger, indicating that the permission is changed more frequently, and the operation safety is lower.

[0087] The business data usage duration indicator is to count the duration of the target user accessing the sensitive data file or field;

[0088] The business data usage duration indicator in the collection period i is defined as ; The calculation formula is as follows:

[0089] ;

[0090] wherein, is the duration of the target user staying on the business sensitive data in the collection period i, in seconds;

[0091] is the normal access duration standard value set by the target user in the collection period i, in seconds;

[0092] When tends to 0, the access time is shorter, indicating fast access;

[0093] When the value is larger, indicating that the target user uses the business sensitive data for a longer time, indicating that the target user is performing deep operation;

[0094] The environment parameters include the location consistency indicator of the operation device, and the temperature fluctuation and network jitter rate of the operation device during the execution of the encryption operation;

[0095] The position consistency index is used to evaluate the stability and consistency of the positioning data of the operating device within a certain time period;

[0096] The position consistency index defined in the collection time period i is The calculation formula is as follows:

[0097] ;

[0098] Wherein, is the positioning data variation frequency of the operating device within the collection time period i; it is obtained by analyzing the number of position changes of the operating device, and in this embodiment, equal-interval-time sampling is performed within the collection time period i, and when the position of the operating device changes relative to the last measured position, it is recorded as one position change;

[0099] is the normal position data variation threshold of the operating device, which is obtained based on statistical analysis of historical data; the change of the positioning data is determined based on the moving position of the mobile terminal device, and specifically, the straight-line distance between the reference position and the current position is determined through GPS navigation route;

[0100] is the steepness parameter, which is used to control the sensitivity of the output, so as to quickly respond to changes when detecting consistency;

[0101] The value range of is (0, 1);

[0102] When tends to , it indicates that the positioning data of the operating device tends to be consistent, and the operation is more stable;

[0103] When is greater than , the greater the value is, the more unstable the position of the operating device in the unintended range is;

[0104] The temperature fluctuation of the operating device during the execution of the encryption operation within the collection time period i is defined as The calculation formula is as follows:

[0105] ;

[0106] Wherein, is the highest temperature of the operating device recorded during the execution of the encryption operation within the collection time period i, in units of degrees Celsius;

[0107] is the lowest temperature of the operating device recorded during the execution of the encryption operation within the collection time period i, in units of degrees Celsius;

[0108] is the average temperature of the operating device recorded during the encryption operation in the collection time period i, in degrees Celsius.

[0109] is a small positive number to avoid the denominator being zero,

[0110] The smaller the value, the more stable the temperature fluctuation of the operating device, indicating that the operating device is running more normally.

[0111] The larger the value, the more unstable the temperature fluctuation of the operating device, indicating that the operating device is running more abnormally.

[0112] is defined as the network jitter rate of the operating device during the encryption operation in the collection time period i ; The calculation formula is as follows:

[0113]

[0114] wherein, is the time difference between the arrival of two consecutive data packets, in milliseconds;

[0115] P4 is the number of data packets recorded in the collection time period i;

[0116] is the maximum delay allowed value between the arrival of two consecutive data packets in the collection time period i, in milliseconds;

[0117] The smaller is, the more stable the network connection is, and the higher the transmission quality is;

[0118] The larger is, the more unstable the network connection is, and the lower the transmission quality is; the greater the efficiency of the encryption operation is;

[0119] The multi-dimensional feature vector under the collection time period i is represented as ;

[0120] All feature values in are uniformly dimensionless processed; the unified value range is (0, 1), and the specific processing is as follows:

[0121] The normalization formula is as follows:

[0122] ;

[0123] wherein, represents the original feature data. and ​​These are the minimum and maximum values ​​of the feature, respectively.

[0124] Each eigenvalue is transformed into a uniform range of (0,1) after being dimensionless, ensuring that each eigenvector can be compared fairly and further operations can be performed.

[0125] After dimensionless processing, the multidimensional feature vectors that have undergone consistent dimensionless processing are represented as follows:

[0126] ;

[0127] in, , and These represent the feature values ​​of user behavior data, business-sensitive data, and environmental parameters after being uniformly dimensionless within the collection period i, respectively.

[0128] Step S2: Pre-set the initial screening threshold for the multidimensional feature vectors, and use the initial screening threshold to screen the core feature set and non-core feature set of the N stored multidimensional feature vectors;

[0129] Further explanation: Obtaining dimensionless multidimensional feature vectors ;

[0130] set up The initial screening thresholds for each parameter value are as follows: ;

[0131] In this embodiment, The setting principle is: calculate the multidimensional feature vectors stored in N times respectively. The average value is calculated, and a correction value is subtracted from each average value. The initial correction value is set to 1 to ensure that the average value after subtracting the correction value is below 0.5. These values ​​are then used as... ;

[0132] It can also be determined using the fuzzy hierarchical analysis method (FAHP), which will not be elaborated here;

[0133] Calculate the following proportions of the stored multidimensional feature vectors N times:

[0134] ;

[0135] Initially All parameter values ​​are used as the core feature set;

[0136] If it meets the requirements When the number of multidimensional feature vectors is less than n1, and n1 is less than N, the value of n1 is within... Selected from, and both represent rounding up, then is taken as a non-core part feature;

[0137] If the number of multi-dimensional feature vectors meeting is below n1, then is taken as a non-core part feature;

[0138] If the number of multi-dimensional feature vectors meeting is below n1, then is taken as a non-core part feature;

[0139] The initial screening threshold values of each parameter value in are respectively set as ;

[0140] The following proportion values of the N times stored multi-dimensional feature vectors are calculated:

[0141] ;

[0142] All parameter values in are initially taken as a core part feature set;

[0143] If the number of multi-dimensional feature vectors meeting is below n1, then is taken as a non-core part feature;

[0144] If the number of multi-dimensional feature vectors meeting is below n1, then is taken as a non-core part feature;

[0145] If the number of multi-dimensional feature vectors meeting is below n1, then is taken as a non-core part feature;

[0146] The initial screening threshold values of each parameter value in are respectively set as ;

[0147] The following proportion values of the N times stored multi-dimensional feature vectors are calculated:

[0148] ;

[0149] All parameter values in are initially taken as a core part feature set;

[0150] If the number of multi-dimensional feature vectors meeting is below n1, then is taken as a non-core part feature;

[0151] If the number of multi-dimensional feature vectors satisfying the condition of is below n1, then is taken as a non-core part feature;

[0152] If the number of multi-dimensional feature vectors satisfying the condition of is below n1, then is taken as a non-core part feature;

[0153] It should be noted that The setting needs to ensure that at least one of satisfies the definition of the core part feature set;

[0154] The setting needs to ensure that at least one of satisfies the definition of the core part feature set;

[0155] The setting needs to ensure that at least one of satisfies the definition of the core part feature set;

[0156] The embodiment sets ; represents the ceiling number, is the adjustment factor; is used to ensure that , and at least one of them satisfies the definition of the core part feature set.

[0157] Step S3: Obtain the screened core part feature set for analysis and processing to obtain a core risk evaluation coefficient, which is used to evaluate the access mode operation risk of the target user in the current monitoring time period, and obtain a risk score;

[0158] Further explanation: each parameter in , and is denoted as , and respectively;

[0159] If it is a core part feature, ; if it is a non-core part feature, ;

[0160] Combine and analyze each parameter in to obtain the following user behavior trend coefficients:

[0161] ;

[0162] Among them, is a user behavior trend coefficient, output value is positively correlated with or or for a positive correlation, , and are weight coefficients of the corresponding parameters, and , and take values in the interval (0, 1), ;

[0163] It should be noted that: or or The greater the corresponding ratio, the greater the change trend of the keyboard key pressure average, the mouse trajectory curvature change rate and the window interaction habit index, respectively; the greater the degree of abnormality of user behavior;

[0164] Combine the parameters in to obtain the following business sensitive trend coefficients:

[0165] Among them, is a business sensitive trend coefficient, output value is positively correlated with or or for a positive correlation; and represent the index of the adjacent two collection time periods; , and are weight coefficients of the corresponding parameters, and , and take values in the interval (0, 1), ;

[0166] It should be noted that: or or The greater the corresponding ratio, the greater the change trend of the modification consistency index, the access permission dynamic change frequency and the business data usage duration index, respectively; the greater the degree of abnormality of business sensitive data;

[0167] Combine the parameters in to obtain the following environment trend coefficients:

[0168] ;

[0169] Among them, is an environment trend coefficient, output value and or or for positive correlation, , and are weight coefficients of the corresponding parameters, and , and take values in the interval (0, 1), ;

[0170] It should be noted that: or or The greater the corresponding ratio, the greater the change trend of the position consistency index, temperature fluctuation and network jitter rate, respectively; the greater the influence of the environmental parameters on the security of the encrypted data;

[0171] The core risk evaluation coefficient calculation formula is defined as follows:

[0172]

[0173] wherein, is the core risk evaluation coefficient, , and are weight coefficients of the corresponding parameters, and , and take values in the interval (0, 1), ;

[0174] The value range of is set to (0, 1); and the judgment threshold interval of is set to ; are the upper limit value and the lower limit value of the judgment threshold interval, is contained in (0, 1); in this embodiment, is determined by an expert group using fuzzy analytic hierarchy process (FAHP); in this embodiment, is initially set to ;

[0175] When , the access mode operation risk of the target user in the current monitoring time period is low risk, and the risk score is recorded as 0;

[0176] When , the access mode operation risk of the target user in the current monitoring time period is medium risk, and the risk score is recorded as 1;

[0177] When When the access pattern operation risk of the target user in the current monitoring time period is high, the risk score is recorded as 10;

[0178] It should be noted that the above content , , , , , , , , , , and The corresponding weight is determined by entropy weight method and fuzzy analytic hierarchy process (FAHP).

[0179] Step S4: Obtain the risk score of the target user in the current monitoring time period, and generate a switching strategy for automatically switching encryption algorithms according to the risk score. The switching strategy includes dynamically adjusting the sequence length and element complexity of the encryption algorithm, and finally generating an encrypted element sequence. The encryption algorithm includes symmetric encryption (AES) and asymmetric encryption (RSA);

[0180] Further description: the switching strategy for automatically switching encryption algorithms, specifically including:

[0181] When the risk score corresponding to the access pattern operation risk is 0, use AES symmetric encryption for data encryption, and generate a low-length encrypted element sequence;

[0182] The low-length encrypted element sequence is a 128-bit key, which ensures sufficient security while minimizing resource consumption.

[0183] When the risk score corresponding to the access pattern operation risk is 1, continue to use AES symmetric encryption for data encryption, but increase the key length or the number of rounds to improve security, to generate a medium-length encrypted element sequence;

[0184] The medium-length encrypted element sequence is a 256-bit key and 14 rounds of encryption;

[0185] When the risk score corresponding to the access pattern operation risk is 10, switch to RSA asymmetric encryption; and generate a high-length encrypted element sequence;

[0186] The high-length encrypted element sequence (such as 2048 bits) is to ensure higher security.

[0187] Step S5: According to the generated sequence of encrypted elements, the multi-source data of the target user at the current monitoring time is encrypted, and the encrypted multi-source data is transmitted to the isolated warehouse for storage processing. The isolated warehouse outputs the risk score according to the current monitoring time period, and provides a correction strategy for the initial screening threshold of the next monitoring time period.

[0188] Further explanation: The isolated warehouse is a secure environment designed specifically for storing sensitive data or important information; this environment is isolated from other systems or networks to prevent unauthorized access and data leakage.

[0189] The isolated warehouse of this embodiment adopts the data lake or AWS "isolated bastion" (AWS Bastion Host) model;

[0190] The correction strategy for the initial screening threshold of the next monitoring time period includes:

[0191] If the risk score output value of the current monitoring time period is 0, no correction is made to the initial screening threshold of the next monitoring time period;

[0192] If the risk score output value of the current monitoring time period is 1, the initial screening threshold of the next monitoring time period is corrected by one level;

[0193] The one-level correction strategy of , and is defined as:

[0194] ;

[0195] Among them, represents , and the initial screening threshold;

[0196] represents the initial screening threshold after the corresponding parameter correction; represents the weight coefficient of the corresponding parameter in the user behavior trend coefficient, the business sensitive trend coefficient and the environment trend coefficient;

[0197] The formula setting of makes the obtained relative to , and The numerical values of the initial screening thresholds are adjusted, thereby reducing the non-core part features in the next monitoring period, increasing the core part features, and enriching the calculation content of the subsequent user behavior trend coefficient, business sensitive trend coefficient, and environmental trend coefficient, thereby improving the calculation accuracy and ultimately improving the risk assessment accuracy of the core risk evaluation coefficient. The introduction of the setting allows for different degrees of initial screening threshold correction based on the weight of the corresponding parameters, further improving the adjustment precision of the core risk evaluation coefficient.

[0198] Further explanation: For the above correction strategy, the following tests are conducted:

[0199] The goal of the test is to improve the accuracy of data screening and risk assessment by correcting and optimizing the initial screening threshold. The key steps of this test are as follows:

[0200] The corrected initial screening threshold values calculated are applied to the existing data set to re-screen the data features.

[0201] Compare the changes in the core risk evaluation coefficient before and after adjustment to analyze the actual effect of the screening threshold adjustment.

[0202] 1) Data set preparation:

[0203] Collect access logs from internet service platforms, including user behavior, business requests, environmental information, and other data. These data reflect the user's behavior trend, business sensitivity, and environmental changes.

[0204] Determine three main trend coefficients: user behavior trend coefficient, business sensitive trend coefficient, and environmental trend coefficient.

[0205] 2) Parameter and weight determination:

[0206] Determine the weight coefficients of the user behavior trend coefficient, business sensitive trend coefficient, and environmental trend coefficient corresponding to

[0207] The following table shows the proportion of core features before and after correction based on experimental data:

[0208]

[0209] Data analysis:

[0210] ​​The above data show that by applying the screening threshold correction method of the present application, the core feature ratio after correction is significantly improved compared to before correction; the core feature ratio of the user behavior trend coefficient corresponding parameter increases from 20% before correction to 25% after correction; this improvement shows that by reducing the value of non-core features (reduction ratio between 7% and 12%), the concentration of features in the data can be improved, thereby improving the accuracy of user behavior, business sensitivity and environmental factor evaluation. The increase in the corrected feature ratio means that the system has improved the importance of core features, so the risk assessment and behavior prediction ability of the model have also been enhanced. This feature is particularly critical in data-intensive businesses, helping to improve decision-making quality and response efficiency.

[0211] The specific description is as follows:

[0212] The initial screening threshold corresponding to the user behavior data is The following primary correction strategy is performed:

[0213] ;

[0214] Among them, , and are the initial screening thresholds after correction of the corresponding parameters;

[0215] The initial screening threshold corresponding to the business sensitive data is The following primary correction strategy is performed:

[0216] ;

[0217] Among them, , and are the initial screening thresholds after correction of the corresponding parameters;

[0218] The initial screening threshold corresponding to the environmental parameter is The following primary correction strategy is performed:

[0219] ;

[0220] Among them, , and are the initial screening thresholds after correction of the corresponding parameters;

[0221] If the risk score output value of the current monitoring time period is 10, the initial screening threshold for the next monitoring time period is corrected at the secondary level;

[0222] , , and The secondary correction strategy is defined as:

[0223] ;

[0224] It should be noted that the secondary correction strategy has the same specific implementation as the above primary correction strategy, and will not be described again.

[0225] The adjustment range of the primary correction is smaller than that of the secondary correction.

[0226] The secondary correction strategy is higher than the primary correction strategy ; and the adjustment range of the secondary correction strategy is greater than that of the primary correction strategy.

[0227] Embodiment two:

[0228] Please refer to Figure 2 : an encryption system of a big data software, the system is used for executing the encryption method of the big data software, comprising:

[0229] Collect and vector generation module: for collecting multiple source data of target users in the current monitoring time period multiple times, the multiple source data includes user behavior data, business sensitive data and environmental parameters, and inputting the multiple source data into a big data cloud platform for storage and preprocessing;

[0230] The N times of the multiple source data stored in the big data cloud platform are integrated into respective multi-dimensional feature vectors;

[0231] Filtering module: for pre-setting an initial filtering threshold of the multi-dimensional feature vector, using the initial filtering threshold to filter the core part feature set and the non-core part feature set of the N times of the stored multi-dimensional feature vector;

[0232] Scoring module: for obtaining the filtered core part feature set for analysis and processing to obtain a core risk evaluation coefficient, the core risk evaluation coefficient is used for evaluating the access mode operation risk of the target user in the current monitoring time period, and obtaining a risk score;

[0233] Encryption algorithm switching module: for obtaining the risk score of the target user in the current monitoring time period, and generating a switching strategy of automatically switching encryption algorithm according to the risk score, the switching strategy includes dynamically adjusting the sequence length and element complexity of the encryption algorithm, and finally generating an encryption element sequence, the encryption algorithm includes symmetric encryption and asymmetric encryption;

[0234] The correction module is used for encrypting the multi-source data of the target user at the current monitoring moment according to the generated sequence of encryption elements, and transmitting the encrypted multi-source data to the isolated warehouse for storage processing, and the isolated warehouse provides a correction strategy for the initial screening threshold of the next monitoring time period according to the risk score output value of the current monitoring time period.

[0235] It should be noted that all the calculation formulas in the present application file adopt regression analysis including but not limited to machine learning algorithms to deeply analyze the collected relevant parameters, identify their natural trend and mutual relationship. Professional software such as Python Scikit-learn library or R language is used to automatically generate mathematical models matching the data. Then, the performance of the model is objectively evaluated by cross-validation and other methods, and combined with continuous feedback and optimization, to ensure that the created formula truly reflects the inherent law of the data, thereby ensuring its effectiveness and accuracy, and ensuring that the calculation process conforms to the constraints of natural laws, rather than being based on artificially set rules.

[0236] The technical solutions of the present application can be embodied in the form of a software product, which can be stored in a computer-readable storage medium such as a floppy disk, a read-only memory (ROM), a random access memory (RAM), a FLASH, a hard disk or an optical disk, etc., including a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the method of each embodiment of the present application.

[0237] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered a list of executable instructions for implementing logical functions, and can be specifically embodied in any computer-readable medium for use by an instruction execution system, device or apparatus, such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute the instructions, or in conjunction with these instruction execution systems, devices or apparatus. For the purpose of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transport programs for use by an instruction execution system, device or apparatus or in conjunction with these instruction execution systems, devices or apparatus.

[0238] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present application and not to limit it, although the present application has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present application can be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present application, which should be covered in the scope of the claims of the present application.

[0239] It should be noted that the above examples are only used to illustrate the technical solutions of the present application but not to limit the present application. Although the present application has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present application can be modified or equivalently replaced without departing from the spirit and scope of the present application, and all modifications and equivalents should be included in the scope of the claims of the present application.

Claims

1. A method for encrypting big data software, characterized by, The specific steps include: Step S1: Collecting multiple-source data of the target user in the current monitoring time period multiple times, the multiple-source data including user behavior data, business sensitive data and environmental parameters, and inputting the multiple-source data into a big data cloud platform for storage and preprocessing; The number of times of collecting the multiple-source data of the target user in the current monitoring time period is expressed as a sequence set {1, 2, …, i, …, N}, wherein i represents the index of the number of collection time periods, and N represents the total number of collection time periods; The N times of stored multiple-source data in the big data cloud platform are individually integrated into respective multi-dimensional feature vectors; Step S2: Pre-setting an initial screening threshold of the multi-dimensional feature vector, and using the initial screening threshold to screen the N times of stored multi-dimensional feature vectors into a core part feature set and a non-core part feature set; Defining the user behavior data to include an average keyboard key pressure, a mouse trajectory curvature change rate and a window interaction habit index; The keyboard key pressure average value defined at the collection time period i is The keyboard key pressure average value is captured by the pressure-sensitive keyboard when the target user inputs the average force of the keyboard press in the current monitoring time period. The mouse trajectory curvature change rate is defined as The mouse trajectory curvature change rate is recorded by recording the trajectory curvature change rate when the mouse is moved. The window interaction habit index defined in the collection time period i is The window interaction habit index is statistical data of user operations on windows in the software interface, including the number of window dragging times and the amplitude habit of adjusting window size. Defining the business sensitive data to include a target user modification consistency index of sensitive data, an access permission dynamic change frequency and a business data use time length index; The modified consistency indicator at the collection time period i is defined as , where the modified consistency indicator is the frequency of modification of the sensitive business data field by the target user. The frequency of dynamic change of access rights in the collection time period i is defined as The frequency of dynamic change of access rights is the frequency of real-time dynamic change of the monitoring target user's rights in normal business operations. The service data usage duration indicator defined at the collection time period i is The service data usage duration indicator is the duration of the target user's access to the sensitive data file or field. Defining the environmental parameters to include a location consistency index of an operating device, and a temperature fluctuation and a network jitter rate of the operating device during execution of an encryption operation; The position consistency index at the collection time period i is defined as The position consistency index is used to evaluate the stability and consistency of the positioning data of the operating device within a certain time period. It is defined that the temperature fluctuation of the operating device during the execution of the cryptographic operation within the collection period i is ; It is defined that the network jitter rate of the operating device during the execution of the encryption operation within the collection time period i is ; The multi-dimensional feature vector under the collection time period i is represented as ; right All eigenvalues ​​are uniformly dimensionless. The multi-dimensional feature vector subjected to consistent dimensionless processing is represented as: ； wherein, , and respectively represent the characteristic values of the user behavior data, the business sensitive data and the environmental parameters after consistent dimensionless over the collection time period i. Acquiring a dimensionless processed multi-dimensional feature vector ; Setting The initial screening threshold values of each parameter value in the middle are respectively ; The following proportion values of the N times of stored multi-dimensional feature vectors are calculated: ； Initially, the parameters values in the core part feature set are all the parameter values in the core part feature set; If it meets the requirements When the number of multidimensional feature vectors is less than n1, then... As a non-core feature; and the value of n1 is in Selected from, and Both represent rounding up to the nearest integer; If it meets the requirements When the number of multidimensional feature vectors is less than n1, then... As a non-core feature; If the number of multi-dimensional feature vectors that meet is below n1, then is taken as a non-core part feature; Setting The initial screening threshold values of each parameter value in the middle are respectively ; The following proportion values of the N times of stored multi-dimensional feature vectors are calculated: ； Initially, the parameters values in the core part feature set are all the parameter values in the core part feature set; If it meets the requirements When the number of multidimensional feature vectors is less than n1, then... As a non-core feature; If it meets the requirements When the number of multidimensional feature vectors is less than n1, then... As a non-core feature; If it meets the requirements When the number of multidimensional feature vectors is less than n1, then... As a non-core feature; Setting The initial screening threshold values of each parameter value in the middle are respectively ; The following proportion values of the N times of stored multi-dimensional feature vectors are calculated: ； Initially, the parameters values in the core set of features are all parameters values as the core set of features; If the number of multi-dimensional feature vectors that meet is below n1, then is taken as a non-core part feature; If the number of multi-dimensional feature vectors is below n1, then the is considered as a non-core part feature ; If the number of multi-dimensional feature vectors is below n1, then the is considered as a non-core part feature ; Step S3: Obtaining the screened core part feature set for analysis and processing to obtain a core risk evaluation coefficient, the core risk evaluation coefficient being used to evaluate an access mode operation risk of the target user in the current monitoring time period, and obtaining a risk score; The parameters in , and are denoted as , and respectively; if the feature is a core part feature, ; if the feature is a non-core part feature, ; Combining the parameters, the following user behavior trend coefficients are obtained: ； in, It is a user behavior trend coefficient. Output value and or or A positive correlation indicates that , and These are the weighting coefficients of the corresponding parameters, and , and The value is within the interval (0,1). ; Will By combining and analyzing the various parameters, the following business sensitivity trend coefficients are obtained: wherein, is a business sensitive trend coefficient, the output value is related to or or a positive correlation indicates; and denote the index of the two adjacent collection time periods; , and are the weight coefficients of the corresponding parameters, respectively, and , and take values in the interval (0, 1), ; Combining the parameters in each of the above equations, the following environmental trend coefficients are obtained: ； wherein, is an environmental trend coefficient, the output value is correlated with or or a positive correlation indicates, , and are weight coefficients of the respective parameters, and , and take values in the interval (0, 1), ; The core risk evaluation coefficient calculation formula is defined as follows: ； wherein, is a core risk evaluation coefficient, , and are weight coefficients of the respective parameters, and , and take values in the interval (0, 1), ; set up The value range is (0,1); and set The judgment threshold range is ; These are the upper and lower limits of the threshold interval, respectively. Contained in (0,1); When the target user's access pattern operating risk in the current monitoring time period is low risk, and the risk score is recorded as 0; When the access pattern operation risk of the target user in the current monitoring time period is medium risk, and the risk score is recorded as 1; When the target user's access pattern operating risk in the current monitoring time period is high risk, and the risk score is recorded as 10; Step S4: Obtaining the risk score of the target user in the current monitoring time period, and generating a switching strategy of an automatic switching encryption algorithm according to the risk score, the switching strategy including dynamic adjustment of a sequence length and an element complexity of the encryption algorithm, and finally generating an encryption element sequence, the encryption algorithm including symmetric encryption and asymmetric encryption; Step S5: According to the generated encryption element sequence, encrypting the multiple-source data of the target user at the current monitoring time, and transmitting the encrypted multiple-source data to an isolated warehouse for storage processing, the isolated warehouse outputting a risk score of the current monitoring time period according to a value condition, and providing a correction strategy for an initial screening threshold of a next monitoring time period; The correction strategy for the initial screening threshold of the next monitoring time period specifically includes: If the risk score output value of the current monitoring time period is 0, the initial screening threshold of the next monitoring time period is not corrected; If the risk score output value of the current monitoring time period is 1, the initial screening threshold of the next monitoring time period is corrected at a first level; The primary corrective strategy for , and is defined as: ； wherein, characterized , and each initial screening threshold in the group of characterize the initial screening threshold after correction of the respective parameters; characterize the weight coefficients of the respective parameters in the user behavior trend coefficient, the service sensitivity trend coefficient, and the environment trend coefficient; If the risk score output value of the current monitoring time period is 10, the initial screening threshold of the next monitoring time period is corrected at a second level; The secondary correction strategy of , and is defined as follows: ； The adjustment amplitude of the first level correction is less than that of the second level correction.

2. The method of claim 1, wherein: The switching strategy of the automatic switching encryption algorithm specifically includes: When the risk score corresponding to the access mode operation risk is 0, data encryption is performed using AES symmetric encryption, and a low-length sequence of encrypted elements is generated; When the risk score corresponding to the access mode operation risk is 1, data encryption is continued using AES symmetric encryption, but the key length or the number of rounds is increased to improve security, to generate a medium-length sequence of encrypted elements; When the risk score corresponding to the access mode operation risk is 10, RSA asymmetric encryption is switched to; and a high-length sequence of encrypted elements is generated.

3. A system for encrypting big data software, the system comprising: The system is used to perform the encryption method of the big data software according to any one of claims 1-2, comprising: a collection and vector generation module for collecting multi-source data of a target user in a current monitoring time period for multiple times, the multi-source data including user behavior data, business sensitive data and environmental parameters, and inputting the multi-source data into a big data cloud platform for storage and preprocessing; integrating the N times of stored multi-source data into respective multi-dimensional feature vectors; a screening module for pre-setting an initial screening threshold of the multi-dimensional feature vectors, and using the initial screening threshold to screen the N times of stored multi-dimensional feature vectors into a core feature set and a non-core feature set; a scoring module for obtaining the screened core feature set for analysis and processing to obtain a core risk evaluation coefficient, the core risk evaluation coefficient being used to evaluate the access mode operation risk of the target user in the current monitoring time period and obtain a risk score; an encryption algorithm switching module for obtaining the risk score of the target user in the current monitoring time period, and generating a switching strategy of automatically switching encryption algorithms according to the risk score, the switching strategy including dynamically adjusting the sequence length and element complexity of the encryption algorithms, and finally generating an encrypted element sequence, the encryption algorithms including symmetric encryption and asymmetric encryption; a correction module for encrypting the multi-source data of the target user at the current monitoring time according to the generated encrypted element sequence, and transmitting the encrypted multi-source data to an isolated warehouse for storage processing, the isolated warehouse outputting a value according to the risk score of the current monitoring time period, and providing a correction strategy for the initial screening threshold of the next monitoring time period.

Images