Communication protection methods based on big data analytics and cloud computing

Abstract

This invention discloses a communication protection method based on big data analysis and cloud computing, belonging to the field of communication security technology. It addresses the shortcomings of automated response mechanisms and multi-scenario adaptability. By collecting multi-dimensional behavioral data from the communication network and combining traffic, protocol fields, and connection frequency to construct a threat assessment model, a risk index for communication behavior is calculated. When the risk index exceeds a preset threshold, a distributed feature extraction algorithm is used to analyze traffic distribution, protocol field length, and connection frequency. If no high-risk behavior is detected, the system further collects time distribution features and data interaction patterns, comprehensively analyzes the degree of anomaly, calculates the confidence level of abnormal behavior, and selects graph neural networks or deep learning classification algorithms to detect abnormal communication, improving detection accuracy and optimizing computational costs. By classifying anomaly types, a basis for subsequent precise correction is provided, meeting the high-efficiency protection needs of modern networks.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of communication security, more particularly, the present application relates to a communication protection method based on big data analysis and cloud computing. BACKGROUND

[0002] Communication protection technology provides security and reliability for communication systems through real-time monitoring and intelligent analysis. However, existing communication protection technologies still have limitations in intelligent analysis, automated response, and multi-scenario adaptation capabilities, and the efficient protection needs in complex network environments have not been fully met.

[0003] After searching, a mobile communication N1N2 interface security protection device and method with publication number CN117793716A is found. This patent uses a bottom protocol stack, a north-south interface, and a security protection processing unit to realize compliance checking of state machines, signaling messages, terminal identities, and base station identities, and supports NAS signaling decryption functions. However, this technical solution relies on preset rules and static strategies for protection, and there is room for improvement in dynamic risk assessment and intelligent decision-making. In addition, its application scenarios mainly focus on the security protection of N1N2 interfaces, and there are certain limitations in expanding to more extensive communication network environments.

[0004] After searching, a power Internet of Things communication protection system with publication number CN114466038A is found. This patent works collaboratively through a proxy module, a sub-center server, and a central server to realize device access admission control and encrypted communication based on cryptographic techniques. However, this technology focuses on device access management and encrypted communication, and fails to fully combine big data analysis techniques for deep mining and anomaly detection of communication behavior. At the same time, the centralized management architecture faces performance bottlenecks and response delays when dealing with large-scale distributed communication networks.

[0005] The above problems show that existing communication protection technologies still have room for improvement in intelligent analysis, dynamic risk assessment, automated response mechanisms, and multi-scenario adaptation capabilities. Therefore, the present application proposes a communication protection method based on big data analysis and cloud computing.

[0006] The above information disclosed in the background section is only used to strengthen the understanding of the background of the present disclosure, and therefore it can include information that does not constitute prior art known to those of ordinary skill in the art. SUMMARY

[0007] In order to overcome the above-mentioned defects of the prior art, the embodiments of the present application provide a communication protection method based on big data analysis and cloud computing, which solves the problems mentioned in the background technology by combining dynamic risk assessment with intelligent threat identification.

[0008] To achieve the above object, the application provides the following technical scheme, a communication protection method based on big data analysis and cloud computing, comprising the following steps:

[0009] Step S1: Collecting multi-dimensional behavior data in a communication network, and preprocessing the data;

[0010] Step S2: Constructing a threat assessment model according to the preprocessed multi-dimensional behavior data, and calculating a risk index of the communication behavior; when the risk index of the communication behavior exceeds a preset threshold, using a distributed feature extraction algorithm to preliminarily analyze the communication behavior;

[0011] Step S3: When the preliminary analysis result shows that the communication behavior does not trigger a high-risk early warning, collecting the time distribution characteristics and data interaction mode of the communication behavior, and comprehensively analyzing the abnormality degree of the communication behavior according to the time distribution characteristics and the data interaction mode; comparing the abnormality degree with a preset threshold, and calculating the confidence degree of the abnormal behavior;

[0012] Step S4: Selecting a graph neural network algorithm or a deep learning classification algorithm according to the abnormality degree to detect whether the communication behavior has an abnormal problem.

[0013] In a preferred embodiment, in step S1, the multi-dimensional behavior data in the communication network includes traffic data of the communication equipment, usage of the communication protocol, and connection relationship between the communication nodes; the multi-dimensional behavior data is obtained by monitoring the traffic fluctuation range of the communication equipment in real time, analyzing the field information of the communication protocol, and counting the connection frequency between the communication nodes.

[0014] In a preferred embodiment, a plurality of monitoring nodes are arranged, and the traffic data, protocol field information and connection frequency of each monitoring node are collected respectively, and the collected data is normalized to obtain a plurality of groups of traffic coefficient, protocol complexity coefficient and connection strength coefficient.

[0015] In a preferred embodiment, in step S2, the traffic coefficient obtained by processing is merged into a traffic data set, the protocol complexity coefficient is merged into a protocol data set, and the connection strength coefficient is merged into a connection data set.

[0016] The specific steps of constructing the threat assessment model are as follows: the same processing is performed on the three data sets respectively, each data set is taken as an initial analysis data set, the initial analysis data set is divided into two parts with the same number, the standard deviations of the two data sets are calculated and compared, and the part with the standard deviation exceeding the preset standard deviation threshold is selected as a new round of analysis data set; the new round of analysis data set is divided into two parts with the same number to calculate the standard deviation, and the part with the standard deviation lower than the preset standard deviation threshold is selected as the next round of analysis data set, and the operation of taking the maximum and the minimum is alternately repeated to repeatedly operate the data set until the last data is left; the data obtained by processing the three data sets is weighted and summed to set the risk index of the communication behavior.

[0017] In a preferred embodiment, in step S2, the traffic coefficient, protocol complexity coefficient and connection strength coefficient of the to-be-tested communication behavior are calculated, and the three are weighted and summed as the risk index of the communication behavior; when the risk index of the communication behavior exceeds the preset threshold, it is judged that the communication behavior is threatening, and the distributed feature extraction algorithm is used to analyze the traffic distribution, protocol field length and connection frequency of the communication behavior.

[0018] In a preferred embodiment, in step S3, the time distribution feature is obtained by statistically acquiring the proportion of active period and idle period of the communication behavior in unit time; the data interaction mode is obtained by analyzing the difference between the sending frequency and the receiving frequency of the data packet in the communication behavior; the active period proportion and the data packet transmission frequency difference value of the communication behavior are recorded.

[0019] In a preferred embodiment, in step S3, when analyzing the abnormality degree of the communication behavior, the support vector machine is used, and the specific steps are as follows:

[0020] The active period proportion and the data packet transmission frequency difference value are defined as input variables and are divided into discrete intervals; the abnormality degree is defined as an output variable and is divided into different levels; a mapping rule is developed to describe the influence of the active period proportion and the data packet transmission frequency difference value on the abnormality degree; the support vector machine model is trained according to the mapping rule to determine the abnormality degree of the communication behavior.

[0021] In a preferred embodiment, in step S3, when calculating the confidence degree of the abnormal behavior, the active period proportion and the data packet transmission frequency difference value of the communication behavior are multiplied to obtain a weight parameter, and the weight parameter is used to calculate and obtain using a linear normalization formula.

[0022] In a preferred embodiment, in step S4, when the abnormality degree of the communication behavior is less than the preset abnormality threshold, the graph neural network algorithm is used to detect the communication behavior;

[0023] When the abnormality degree of the communication behavior is greater than or equal to the preset abnormal threshold, the communication behavior is detected using a deep learning classification algorithm;

[0024] When the communication behavior is abnormal, the abnormal behavior confidence of the communication behavior is given using the deep learning classification algorithm;

[0025] When there is no abnormality, the communication behavior is marked as normal behavior.

[0026] Technical effects and advantages of the present application:

[0027] 1. The present application collects multi-dimensional behavior data in the communication network, constructs a threat assessment model combining traffic data, protocol field information and connection frequency, calculates the risk index of the communication behavior, and uses a distributed feature extraction algorithm to analyze the traffic distribution, protocol field length and connection frequency of the communication behavior when the risk index is higher than the preset threshold. The calculation of the risk index and the distributed feature extraction algorithm reduces the consumption of computing resources, while improving the efficiency of threat identification. When the distributed feature extraction algorithm does not find high-risk behavior, the time distribution characteristics and data interaction mode of the communication behavior are further collected, and the abnormality degree of the communication behavior is comprehensively analyzed. When the abnormality degree is high, the abnormal behavior confidence is calculated. According to the abnormality degree, the graph neural network algorithm or the deep learning classification algorithm is selected to detect whether the communication behavior is abnormal. By selecting the appropriate detection algorithm, the calculation cost is optimized, and the detection accuracy is improved. In addition, the present application classifies the abnormal types of the communication behavior, which provides a basis for subsequent accurate correction, thereby meeting the demand of modern communication network for efficient protection. BRIEF DESCRIPTION OF DRAWINGS

[0028] Figure 1 The flowchart of the communication protection method based on big data analysis and cloud computing of the present application.

[0029] Figure 2 The schematic diagram of the threat assessment model construction process of the communication protection method based on big data analysis and cloud computing of the present application.

[0030] Figure 3 The support vector machine model training process diagram of the communication behavior abnormality degree analysis of the communication protection method based on big data analysis and cloud computing of the present application. DETAILED DESCRIPTION

[0031] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0032] Embodiments:

[0033] The application provides a communication protection method based on big data analysis and cloud computing, and a specific implementation is combined with the accompanying drawings Figure 1 to the accompanying drawings Figure 3 will be described in detail. Figures 1 to 3 As shown in the figure, the overall process from data collection to anomaly detection includes multiple steps, each of which is implemented by specific operation logic and algorithm to ensure that the behavior in the communication network can be efficiently and accurately evaluated and protected.

[0034] In step S1, the system first collects multi-dimensional behavior data in the communication network, including traffic data of communication devices, usage of communication protocols, and connection relationships between communication nodes.

[0035] In order to achieve this goal, the system sets up multiple monitoring nodes in the communication network, which are distributed in different network areas to ensure comprehensive coverage. Each monitoring node is responsible for collecting local traffic data, protocol field information and connection frequency in real time, and uploading the collected data to the cloud for centralized processing.

[0036] In the cloud, the system preprocesses these multi-dimensional behavior data, the main purpose of which is to eliminate noise in the data and improve the consistency of the data.

[0037] The specific operation of preprocessing includes normalization, that is, converting traffic data into traffic coefficient, converting protocol field information into protocol complexity coefficient, and converting connection frequency into connection strength coefficient.

[0038] The calculation of these coefficients is based on a unified formula, for example, the traffic coefficient is obtained by calculating the ratio of the standard deviation of the traffic fluctuation range to the average value within a unit time, the protocol complexity coefficient is obtained by statistical analysis of the protocol field length, and the connection strength coefficient is obtained by weighted summation of the connection frequency between nodes.

[0039] Through this preprocessing method, the system can provide standardized data input for the subsequent threat evaluation model construction.

[0040] In step S2, the system constructs a threat evaluation model according to the preprocessed multi-dimensional behavior data, and the process is as shown in the figure. Figure 2

[0041] First, the system combines the traffic coefficient into a traffic data set, the protocol complexity coefficient into a protocol data set, and the connection strength coefficient into a connection data set.

[0042] Subsequently, the system processes these three data sets in the same way, that is, by iteratively calculating the standard deviation to filter out representative data subsets.​

[0043] Specifically, the system divides each data set into two equal parts, calculates the standard deviation of each part and compares them, and selects the part with a standard deviation exceeding a preset standard deviation threshold as the new round of analysis data set.

[0044] Then, the system divides the new round of analysis data set into two equal parts again, calculates the standard deviation, and selects the part with a standard deviation lower than the preset standard deviation threshold as the next round of analysis data set.

[0045] It should be noted that the standard deviation threshold is obtained by the experimenters based on the clustering stability analysis results of historical network behavior data and the sensitivity test results of typical abnormal behavior samples, which will not be repeated here.

[0046] This process alternately takes the maximum and minimum, and repeats until each data set is left with only one data. The core of this step is to gradually focus on the most representative features in the data set through dynamic screening of standard deviation, thereby reducing the complexity of subsequent calculations.

[0047] Finally, the system weights and sums the data obtained by processing the three data sets, and sets it as the risk index of the communication behavior.

[0048] The calculation formula of the risk index is: risk index = a x flow data set result + β x protocol data set result + γ x connection data set result;

[0049] Where a, β, and γ are the weights of the flow coefficient, protocol complexity coefficient, and connection strength coefficient, respectively. The weights are adjusted according to the needs of the actual application scenario.

[0050] When the risk index of the communication behavior exceeds the preset threshold, the system determines that the communication behavior is threatening and starts the distributed feature extraction algorithm to further analyze the traffic distribution, protocol field length, and connection frequency of the communication behavior.

[0051] In step S3, when the preliminary analysis result of the distributed feature extraction algorithm shows that the communication behavior does not trigger a high-risk warning, the system further collects the time distribution characteristics and data interaction mode of the communication behavior, and comprehensively analyzes the abnormality degree of the communication behavior.

[0052] The time distribution characteristics are obtained by calculating the proportion of active and idle periods in unit time. Specifically, the system records the traffic changes of the communication behavior every hour in a day, and calculates the time proportion of active and idle periods.

[0053] The data interaction mode is obtained by analyzing the difference between the sending frequency and the receiving frequency of data packets in the communication behavior. Specifically, the system counts the number of data packets sent and received per second in the communication behavior and calculates the difference between the two.

[0054] The system takes the active period ratio and the data packet transmission frequency difference value as input variables and uses a support vector machine model to train the anomaly degree classifier.

[0055] As shown in Figure 3 The training process of the support vector machine model includes the following steps: first, the active period ratio and the data packet transmission frequency difference value are divided into multiple discrete intervals, and the boundary value of each interval is determined by the statistical results of historical data.

[0056] Second, define the anomaly degree as the output variable and divide it into different levels, such as low anomaly, medium anomaly, and high anomaly.

[0057] Then, develop a mapping rule to describe the influence of the input variable on the output variable, for example, when the active period ratio is high and the data packet transmission frequency difference value is large, the anomaly degree is determined as high anomaly.

[0058] Finally, the system trains the support vector machine model according to the mapping rule to determine the anomaly degree of the communication behavior.

[0059] Compare the anomaly degree with the preset threshold value. When the anomaly degree is greater than or equal to the preset threshold value, the system further calculates the confidence of the abnormal behavior, and the specific calculation formula is: confidence = active period ratio x data packet transmission frequency difference value / maximum possible value;

[0060] It should be noted that the preset threshold value is obtained by the experimenters based on the classification boundary analysis results of multi-dimensional abnormal behavior samples and the balance evaluation results of model recognition accuracy and false positive rate under different threshold conditions, which will not be repeated here.

[0061] Among them, the maximum possible value is the maximum product of the active period ratio and the data packet transmission frequency difference value in the historical data.

[0062] In step S4, the system selects a suitable detection algorithm according to the anomaly degree of the communication behavior for further analysis.

[0063] When the anomaly degree of the communication behavior is less than the preset anomaly threshold value, the system uses the graph neural network algorithm 7 to detect the communication behavior.

[0064] The core of the graph neural network algorithm is to analyze the potential anomalies of the communication behavior by constructing the topology structure of the communication network and using the connection relationship between nodes.

[0065] Specifically, the system takes the communication nodes as the vertices of the graph and the connection relationship between the nodes as the edges of the graph, and captures the global pattern of the communication behavior by iteratively updating the feature vector of the node.

[0066] When the abnormality degree of the communication behavior is greater than or equal to the preset abnormal threshold, the system detects the communication behavior by using a deep learning classification algorithm.

[0067] It should be noted that the preset abnormal threshold is obtained by the experimenters based on the distribution characteristics of the communication behavior under the abnormality degree quantitative index and the detection performance comparison experimental results of the graph neural network and the deep learning classification algorithm under different threshold switching conditions, which will not be repeated here.

[0068] The core of the deep learning classification algorithm is to extract deep features of the communication behavior through a multi-layer neural network, so as to realize accurate identification of abnormal behavior.

[0069] During the detection process, the system not only judges whether the communication behavior is abnormal, but also calculates the confidence of the abnormal behavior.

[0070] When the confidence of the abnormal behavior exceeds the preset threshold, the system marks the communication behavior as an abnormal behavior; otherwise, the system marks the communication behavior as a normal behavior.

[0071] During the entire implementation process, the various modules of the system cooperate through explicit logical relationships and data flows.

[0072] For example, the collection and preprocessing of multi-dimensional behavior data provide basic data support for the construction of the threat assessment model, the output result of the threat assessment model determines whether to start the distributed feature extraction algorithm, and the result of the distributed feature extraction algorithm further affects the analysis process of the time distribution feature and the data interaction mode.

[0073] In addition, the selection and application of the support vector machine model, the graph neural network algorithm and the deep learning classification algorithm are all based on the abnormality degree of the communication behavior, which ensures the efficiency and accuracy of the detection process.

[0074] Through such modular design and cooperative work, the system can realize dynamic risk assessment and intelligent threat identification in the communication network, meeting the needs of modern communication networks for efficient protection.

[0075] In order to better enable relevant persons in the technical field to fully understand and implement the present application, the specific implementation principles of the present application are further supplemented below in combination with a specific application scenario.

[0076] In the communication network of a certain large enterprise, the enterprise simultaneously runs multiple business systems, including internal office communication, production management system and online service platform for customers.

[0077] Because these systems are distributed across different network environments and have diverse communication needs, traditional protection methods are insufficient to meet their requirements for dynamic risk assessment and intelligent threat identification.

[0078] Therefore, the communication protection method based on big data analysis and cloud computing proposed in this invention can effectively solve the above problems.

[0079] First, in step S1, the system collects multidimensional behavioral data from the communication network through multiple pre-deployed monitoring nodes.

[0080] For example, several monitoring nodes are distributed within the enterprise, each responsible for real-time monitoring of traffic data, protocol field information, and connection frequency in a specific area.

[0081] These monitoring nodes cover all critical network nodes within the enterprise, ensuring comprehensive data collection. The collected data is then uploaded to the cloud for preprocessing to eliminate noise and improve consistency.

[0082] Specific preprocessing operations include normalization, which converts traffic data into traffic coefficients, protocol field information into protocol complexity coefficients, and connection frequency into connection strength coefficients.

[0083] For example, the flow coefficient is calculated as the ratio of the standard deviation to the mean of the flow fluctuation range per unit time, which allows flow data of different scales to be compared on a uniform scale. This standardized data input lays the foundation for the subsequent construction of threat assessment models.

[0084] Secondly, in step S2, the system constructs a threat assessment model based on the preprocessed multidimensional behavioral data.

[0085] like Figure 2 As shown, the system merges traffic coefficients into a traffic dataset, protocol complexity coefficients into a protocol dataset, and connection strength coefficients into a connection dataset, and then dynamically filters these three datasets respectively.

[0086] Specifically, the system divides each dataset into two equal parts, calculates the standard deviation of each part and compares them, and selects the part with the larger standard deviation as the dataset for the next round of analysis; then, the dataset for the next round of analysis is divided into two equal parts, the standard deviation is calculated and the part with the smaller standard deviation is selected as the dataset for the next round of analysis.

[0087] This alternating process of selecting the largest and smallest values ​​is repeated until only one data point remains in each dataset. In this way, the system gradually focuses on the most representative features in the dataset, thereby reducing the complexity of subsequent calculations.

[0088] Finally, the system calculates a weighted sum of the processed data from the three datasets and sets it as the risk index for communication behavior.

[0089] For example, if the risk index of a certain communication behavior exceeds a preset threshold, the system determines that the communication behavior may pose a threat and initiates a distributed feature extraction algorithm to further analyze it.

[0090] This process significantly improves the accuracy and efficiency of threat assessment through dynamic filtering and weighted calculation of data.

[0091] Next, in step S3, when the preliminary analysis results of the distributed feature extraction algorithm show that the communication behavior has not triggered a high-risk warning, the system further collects the time distribution characteristics and data interaction patterns of the communication behavior, and comprehensively analyzes the degree of abnormality of the communication behavior.

[0092] The temporal distribution characteristics are obtained by statistically analyzing the ratio of active to idle periods in communication behavior per unit time.

[0093] For example, the system records the traffic changes of a certain communication behavior every hour of the day and calculates the time ratio of active periods to idle periods.

[0094] The data interaction mode is obtained by analyzing the differences in the sending and receiving frequencies of data packets in the communication behavior.

[0095] For example, the system counts the number of data packets sent and received per second in a certain communication activity and calculates the difference between the two.

[0096] Subsequently, the system uses the proportion of active periods and the difference in data packet transmission and reception frequency as input variables, and trains a classifier for the degree of anomaly using a support vector machine model.

[0097] like Figure 3 As shown, the training process of the support vector machine model includes dividing the input variables into multiple discrete intervals and formulating mapping rules to describe the influence of the input variables on the output variables.

[0098] For example, when the proportion of active periods is high and the difference in data packet transmission and reception frequency is large, the anomaly level is judged as high anomaly.

[0099] In addition, the system also calculates the confidence level of abnormal behavior, with the specific formula being: Confidence level = Proportion of active periods × Difference in data packet transmission and reception frequency / Maximum possible value.

[0100] In this way, the system can accurately quantify the degree of abnormality in communication behavior, providing a basis for subsequent detection.

[0101] Finally, in step S4, the system selects an appropriate detection algorithm based on the abnormality level of the communication behavior for further analysis.

[0102] When the abnormality level of the communication behavior is low, the system uses a graph neural network algorithm to detect it.

[0103] For example, the system takes the communication nodes as the vertices of the graph and the connection relationship between the nodes as the edges of the graph, and captures the global pattern of the communication behavior by iteratively updating the feature vector of the node.

[0104] The core of this step is to analyze the potential abnormal behavior using the topology of the communication network, thereby improving the accuracy of detection.

[0105] When the abnormality level of the communication behavior is high, the system uses a deep learning classification algorithm to detect it.

[0106] For example, the system extracts deep-level features of the communication behavior through a multi-layer neural network, thereby achieving accurate identification of abnormal behavior.

[0107] During the detection process, the system not only judges whether the communication behavior is abnormal, but also calculates the confidence of the abnormal behavior.

[0108] For example, when the abnormal behavior confidence of a certain communication behavior exceeds the preset threshold, the system marks it as an abnormal behavior; otherwise, the system marks it as a normal behavior.

[0109] Through this hierarchical detection method, the system can select the optimal detection algorithm according to the specific situation of the communication behavior, thereby optimizing the computational cost and improving the detection efficiency.

[0110] During the entire implementation process, the various modules of the system cooperate through explicit logical relationships and data flows.

[0111] For example, the collection and preprocessing of multi-dimensional behavior data provide basic data support for the construction of the threat assessment model, the output result of the threat assessment model determines whether to start the distributed feature extraction algorithm, and the result of the distributed feature extraction algorithm further affects the analysis process of the time distribution feature and the data interaction mode.

[0112] In addition, the selection and application of the support vector machine model, the graph neural network algorithm, and the deep learning classification algorithm are all based on the abnormality level of the communication behavior, ensuring the efficiency and accuracy of the detection process.

[0113] Through this modular design and collaborative work, the system can achieve dynamic risk assessment and intelligent threat identification in complex communication network environments, meeting the needs of modern communication networks for efficient protection.

[0114] The above formulas are all de-dimensioned to calculate the numerical values, the formulas are obtained by collecting a large amount of data to simulate a formula of the most recent real situation, and the preset parameters in the formulas are set by a person skilled in the art according to the actual situation.

[0115] The above embodiments can be implemented wholly or partially by software, hardware, firmware, or any other combination. When implemented by software, the above embodiments can be implemented wholly or partially in the form of a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, the processes or functions described in the embodiments of the present application are wholly or partially generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer-readable storage medium or transferred from one computer-readable storage medium to another, for example, the computer instructions can be transferred from one website, computer, server, or data center to another website, computer, server, or data center through a wired or wireless (such as infrared, wireless, microwave, etc.) manner. The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server, data center, etc. containing one or more available medium collections. The available medium can be a magnetic medium (such as a floppy disk, a hard disk, a magnetic tape), an optical medium (such as a DVD), or a semiconductor medium. The semiconductor medium can be a solid-state disk.

[0116] It should be understood that the size of the sequence number of each process described above in various embodiments of the present application does not mean the order of execution, and the execution order of each process should be determined by its function and inherent logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0117] Those of ordinary skill in the art can realize that the units and algorithm steps of the examples described in conjunction with the embodiments disclosed herein can be realized in electronic hardware, or a combination of computer software and electronic hardware. Whether the functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. A person skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0118] Those skilled in the art can clearly understand that, for the convenience and brevity of the description, the specific working processes of the above-described system, device, and unit can refer to the corresponding processes in the foregoing method embodiments, which will not be described here.

[0119] In several embodiments provided in the present application, it should be understood that the disclosed system, device and method can be implemented in other manners. For example, the described device embodiments are merely schematic. For example, the division of the units is only a logical function division. There can be another division manner for the actual implementation, for example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the displayed or discussed mutual couplings or direct couplings or communication connections between the units can be indirect couplings or communication connections through some interfaces, devices or units, and can be electrical, mechanical or in other forms.

[0120] The units described as separate components can or can not be physically separate, and the components shown as units can or can not be physical units, i.e., can be located in one place, or can be distributed on multiple network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the embodiment.

[0121] In addition, each functional unit in the various embodiments of the present application can be integrated into a processing unit, or each unit can be a physically separate unit, or two or more units can be integrated into a unit.

[0122] If the functions are implemented in the form of software function units and sold or used as independent products, they can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the present application can be embodied in the form of a software product, and the computer software product is stored in a storage medium, and includes several instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and various media that can store program codes.

[0123] The above is merely specific embodiments of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art can easily think of changes or replacements within the technical scope disclosed in the present application, which should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A method for communication protection based on big data analysis and cloud computing, characterized in that: The method comprises the following steps: Step S1: collecting multi-dimensional behavior data in a communication network, and preprocessing the data; Step S2: constructing a threat assessment model according to the preprocessed multi-dimensional behavior data, and calculating a risk index of the communication behavior; when the risk index of the communication behavior exceeds a preset threshold, a distributed feature extraction algorithm is used to preliminarily analyze the communication behavior; In step S2, the traffic coefficient, the protocol complexity coefficient and the connection strength coefficient of the communication behavior to be tested are calculated, and the three are weighted and summed as the risk index of the communication behavior; when the risk index of the communication behavior exceeds the preset threshold, it is judged that the communication behavior is threatening, and the distributed feature extraction algorithm is used to analyze the traffic distribution, the protocol field length and the connection frequency of the communication behavior; Step S3: when the preliminary analysis result shows that the communication behavior does not trigger a high-risk warning, the time distribution characteristics and the data interaction mode of the communication behavior are collected, and the abnormality degree of the communication behavior is analyzed comprehensively according to the time distribution characteristics and the data interaction mode; the abnormality degree is compared with a preset threshold, and the confidence of the abnormal behavior is calculated; In step S3, support vector machine is used to analyze the abnormality degree of the communication behavior, and the specific steps are as follows: The active period proportion and the data packet transmission frequency difference value are defined as input variables, which are divided into discrete intervals; the abnormality degree is defined as an output variable, which is divided into different levels; a mapping rule is developed to describe the influence of the active period proportion and the data packet transmission frequency difference value on the abnormality degree; a support vector machine model is trained according to the mapping rule to determine the abnormality degree of the communication behavior; Step S4: selecting a graph neural network algorithm or a deep learning classification algorithm according to the abnormality degree to detect whether the communication behavior has an abnormal problem.

2. The method for communication protection based on big data analysis and cloud computing according to claim 1, characterized in that: In step S1, the multi-dimensional behavior data in the communication network includes the traffic data of the communication equipment, the use of the communication protocol and the connection relationship between the communication nodes; The multi-dimensional behavior data is obtained by monitoring the traffic fluctuation range of the communication equipment, analyzing the field information of the communication protocol and counting the connection frequency between the communication nodes in real time. 3.The communication protection method based on big data analysis and cloud computing according to claim 2, characterized in that: A plurality of monitoring nodes are set up to collect the traffic data, the protocol field information and the connection frequency of each monitoring node, and the collected data is normalized to obtain a plurality of sets of traffic coefficients, protocol complexity coefficients and connection strength coefficients.

4. The method of claim 3, wherein the method further comprises: In step S2, the traffic coefficients obtained by processing are combined into a traffic data set, the protocol complexity coefficients are combined into a protocol data set, and the connection strength coefficients are combined into a connection data set; The specific steps of constructing the threat assessment model are as follows: the same processing is performed on the three data sets, each data set is taken as an initial analysis data set, the initial analysis data set is divided into two parts with the same number, the standard deviations of the two data sets are calculated and compared, and the part with the standard deviation exceeding the preset standard deviation threshold is selected as the analysis data set of the next round; The new round of analysis data set is divided into two parts with the same number to calculate the standard deviation, and the part with the standard deviation lower than the preset standard deviation threshold is selected as the next round of analysis data set. The operation of taking large and small alternately is repeated on the data set until the last data is left; the data obtained by processing the three data sets is weighted and summed to set the risk index of the communication behavior.

5. The method for communication protection based on big data analysis and cloud computing according to claim 4, characterized in that: In step S3, the time distribution feature is obtained by counting the proportion of active period and idle period of the communication behavior in unit time; the data interaction mode is obtained by analyzing the difference value of the sending frequency and receiving frequency of the data packet in the communication behavior; the proportion of active period and the difference value of data packet sending and receiving frequency of the communication behavior are recorded.

6. The method of claim 5, wherein the method further comprises: In step S4, when the abnormality degree of the communication behavior is less than the preset abnormal threshold, the communication behavior is detected by using the graph neural network algorithm; When the abnormality degree of the communication behavior is greater than or equal to the preset abnormal threshold, the communication behavior is detected by using the deep learning classification algorithm; When the communication behavior is detected to be abnormal by using the deep learning classification algorithm, the abnormal behavior confidence of the communication behavior is given; When there is no abnormality, the communication behavior is marked as normal behavior.

Images