Network security detection method based on multi-source data analysis

Abstract

The invention relates to the technical field of network security detection, in particular to a network security detection method based on multi-source data analysis. The method comprises the following steps: acquiring the access frequency of each data interface at each moment in history according to a network server access log, and obtaining an access frequency sequence corresponding to one data interface every day; obtaining a difference characteristic value corresponding to one data interface in one day, and further obtaining a time characteristic value of the data interface; obtaining the access density of one data interface at one moment; obtaining the abnormal access possibility of one user to the data interface at one moment; obtaining an abnormal access index coefficient of the user at the current moment based on the transition probability of each data interface in the access link of the user at the current moment and the abnormal access possibility of the user to each data interface in the access link at the current moment; and judging whether the access of the user at the current moment is abnormal based on the abnormal access index coefficient. According to the invention, the network security can be accurately detected.

Description

Technical Field

[0001] The present invention relates to the technical field of network security detection, and in particular to a network security detection method based on multi-source data analysis. Background Art

[0002] With the rapid development of information technology, the internet has become a critical infrastructure for governments, businesses, and individuals to access information, conduct business, and engage in daily communication. In this highly digital and networked environment, cyberattack methods are constantly evolving, becoming more diverse, intelligent, and covert, posing a serious threat to the secure and stable operation of network systems. Security incidents such as data leaks, service interruptions, or unauthorized system control can not only harm business operations and compromise user privacy, but can also have significant impacts on national security and social order. Therefore, accurately identifying and providing timely warnings of potential threats without disrupting users' normal network experience has become a critical issue that needs to be addressed in current network security protection systems. Developing a secure, intelligent, and efficient network security detection and defense approach is crucial for improving overall network security and safeguarding critical infrastructure and data assets.

[0003] Existing network security detection methods are generally based on predefined rules and feature libraries, identifying and matching specific behavioral characteristics to determine risk. However, these methods often focus on analyzing a single user behavior characteristic, overlooking the correlations and commonalities across multiple user behavior patterns. This limitation leads to misjudgments in risk identification based on a single data source, and risk warnings can be overly aggressive or inadequate. In actual network applications, this detection mechanism struggles to effectively address the increasingly diverse and covert attack methods, reducing the accuracy and practicality of identifying abnormal operational behavior. Summary of the Invention

[0004] In order to solve the above technical problems, the purpose of the present invention is to provide a network security detection method based on multi-source data analysis. The technical solutions adopted are as follows:

[0005] An embodiment of the present invention provides a network security detection method based on multi-source data analysis, the method comprising:

[0006] Obtain the access frequency of each data interface at each moment in history based on the network server access log. The access frequency of a data interface in a day constitutes an access frequency sequence.

[0007] Obtain the difference characteristic value corresponding to a data interface on a day based on the difference between the access frequency sequence of a data interface on one day and the access frequency sequence of other days; obtain the time characteristic value of a data interface based on the difference characteristic values ​​of each day;

[0008] Obtain the access density of a data interface at a given moment based on the access frequency and number of visitors to the data interface at that moment; obtain the possibility of abnormal access by a user to a data interface at that moment based on the access frequency of the user to the data interface at that moment, the time characteristic value of the data interface, and the access density of the data interface at that moment;

[0009] The abnormal access index coefficient of a user at the current moment is obtained based on the transfer probability of each data interface in the access link of a user at the current moment and the possibility of abnormal access of the user to each data interface in the access link at the current moment; based on the abnormal access index coefficient, it is determined whether the user's access at the current moment is abnormal.

[0010] Preferably, obtaining the access frequency of each data interface at each moment in history based on the network server access log includes:

[0011] In the network server access log, the number of times a data interface is accessed within a preset time period before a moment is obtained and recorded as the access frequency of the data interface at that moment.

[0012] Preferably, obtaining a difference feature value corresponding to a day based on the difference between the access frequency sequence of a data interface on one day and the access frequency sequence of other days includes:

[0013] The access frequency in the access frequency sequence corresponding to a data interface on one day is normalized to obtain a normalized access frequency sequence; the DTW algorithm is used to obtain the matching distance values ​​between the normalized access frequency sequence of a data interface on one day and the normalized access frequency sequences of the data interface on other days, and the average of the matching distance values ​​is calculated to obtain the difference feature value corresponding to the data interface on that day.

[0014] Preferably, obtaining the time characteristic value of a data interface based on the difference characteristic values ​​of each day of the data interface includes:

[0015] The absolute values ​​of the differences between the difference characteristic values ​​corresponding to one day of the data interface and the difference characteristic values ​​corresponding to other days are obtained respectively, and the average is calculated to obtain the first characteristic value corresponding to the day; the average value of the difference characteristic values ​​corresponding to each day of the data interface is multiplied by the average value of the first characteristic values ​​corresponding to each day to obtain the multiplication result, and the exponential function with a natural constant as the base is used to perform negative correlation mapping on the multiplication result to obtain the time characteristic value of the data interface.

[0016] Preferably, obtaining the access density of a data interface at a time point according to the access frequency and the number of visitors of the data interface at a time point on each day includes:

[0017] Get the average of the access frequency of a data interface at the same time on each day, and record it as the average access frequency at that time; get the average of the number of visitors to a data interface at that time on each day, and record it as the average number of visitors at that time; the ratio of the average access frequency at that time to the average number of visitors at that time is the access density of the data interface at that time.

[0018] Preferably, obtaining the possibility of abnormal access of a user to a data interface at a moment based on the access frequency of a user to a data interface at a moment, the time characteristic value of the data interface, and the access density of the data interface at the moment includes:

[0019] An exponential function with a natural constant as the base is used to map the difference between a user's access frequency to a data interface at a certain moment and the access density of the data interface at that moment, and multiply it by the time characteristic value of the data interface to obtain the possibility of abnormal access of the user to the data interface at that moment.

[0020] Preferably, obtaining the abnormal access index coefficient of a user at the current moment according to the transfer probability of each data interface in the access link of a user at the current moment and the abnormal access possibility of the user to each data interface in the access link at the current moment includes:

[0021] An exponential function with a natural constant as the base is used to negatively correlate the transfer probability of a data interface in a user's current access link, and multiply it by the user's abnormal access possibility to the data interface at the current moment to obtain the access abnormality degree corresponding to the data interface. The access abnormality degrees corresponding to each data interface in the user's current access link are averaged and normalized to obtain the abnormal access index coefficient of the user at the current moment.

[0022] Preferably, judging whether the user's current access is abnormal based on the abnormal access index coefficient includes:

[0023] When the abnormal access index coefficient of a user at the current moment is greater than the reference threshold, the user's access at the current moment is abnormal.

[0024] The embodiments of the present invention have at least the following beneficial effects: the present application obtains the access frequency of each data interface at each moment, thereby obtaining the access frequency sequence corresponding to each data interface every day, and then performs time correlation analysis on the access characteristics of the data interfaces in a time series. The difference characteristic value corresponding to the day is obtained based on the difference between the access frequency sequence of a data interface on one day and the access frequency sequence of other days, and finally obtains the time characteristic value of each data interface. This can focus on the characteristics of the data interface under various user behavior patterns, thereby improving the accuracy of network security detection. Then, the access density of each data interface at each moment, the access frequency of each user to each data interface at each moment, and the time characteristic value of each data interface are analyzed to obtain the probability of abnormal access of each data interface by each user at each moment. Then, in the access link of the user at the current moment, based on the transition probability of each data interface in the access link and the probability of abnormal access of each data interface by the user at the current moment, the abnormal access index coefficient of the user at the current moment is obtained, which is used to determine whether the user's access at the current moment is abnormal. This can improve the accuracy of anomaly detection under predefined rules based on traditional methods, while improving the efficiency of network security detection and the user experience of normal users. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] In order to more clearly illustrate the technical solutions and advantages of the embodiments of the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the prior art descriptions. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0026] Figure 1 A flowchart of a network security detection method based on multi-source data analysis provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0027] To further illustrate the technical means and effectiveness of the present invention to achieve its intended purpose, the following, in conjunction with the accompanying drawings and preferred embodiments, describes in detail the specific implementation, structure, features, and effectiveness of a network security detection method based on multi-source data analysis proposed by the present invention. In the following description, different references to "one embodiment" or "another embodiment" do not necessarily refer to the same embodiment. Furthermore, specific features, structures, or characteristics of one or more embodiments may be combined in any suitable manner.

[0028] Unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs.

[0029] The following describes in detail a specific solution of a network security detection method based on multi-source data analysis provided by the present invention with reference to the accompanying drawings.

[0030] Example: The main application scenario of this invention is that there may be illegal requests and other behaviors in the network, which may pose a threat to user information security. However, existing network security detection usually focuses on analyzing a single behavioral feature of a user, ignoring the correlation and common performance of users in multiple behavioral patterns. This limitation makes risk identification based on a single data source prone to misjudgment, and risk warnings may be too radical or insufficient. Therefore, a more accurate method is needed to detect abnormal behaviors in the network, improve network security, and thus ensure the security of user information.

[0031] See also Figure 1 , which shows a method flow chart of a network security detection method based on multi-source data analysis provided by an embodiment of the present invention, the method comprising the following steps:

[0032] Step S1: Obtain the access frequency of each data interface at each moment in history based on the network server access log. The access frequency of a data interface in one day constitutes an access frequency sequence.

[0033] The main purpose of this application is to achieve more accurate detection of security behaviors in the network. Therefore, it is necessary to obtain data related to user access to the network server through the network server access log. It is necessary to obtain the user's login ID or IP to distinguish users, and to obtain the timestamp of each user's access to the data interface and the name of the data interface accessing the network server.

[0034] Furthermore, at least one month of network service logs are collected here as sample data for subsequent analysis. The access frequency of each data interface at each moment in history is obtained based on the network server access log. Specifically, in the network server access log, the number of times a data interface is accessed within a preset time period before a moment is obtained, and recorded as the access frequency of the data interface at that moment. For example, if the number of times a data interface is accessed within a period of 10 minutes before moment t is 100, then the access frequency of the data interface at moment t is 100; the value of the preset time length needs to be determined by the implementer based on actual conditions.

[0035] Finally, the access frequencies of a data interface at each moment of the day are grouped into a sequence, which serves as the access frequency sequence of the data interface on that day.

[0036] Step S2: obtaining a difference characteristic value corresponding to a data interface on a day based on the difference between the access frequency sequence of the data interface on that day and the access frequency sequence of other days; obtaining a time characteristic value of the data interface based on the difference characteristic values ​​of each day.

[0037] The core goal of network security testing is to identify unusual user access behaviors or operational patterns on network servers and other terminal systems, thereby promptly detecting potential security threats. Accurately identifying abnormal behavior can effectively prevent the leakage of server data and sensitive user information, thereby avoiding the resulting system damage, business interruption, financial loss, and reputational risk, thereby ensuring the stable operation of network systems and the security of data assets.

[0038] In network services, access to different types of data can be significantly correlated with time. For example, access to enterprise office systems is typically concentrated during the daytime on weekdays, while peak customer data query requests often occur during specific business hours. Abnormal data access, such as large-scale data downloads late at night or frequent login attempts during off-peak hours, may be potential abnormal behavior.

[0039] In order to enable the network security detection system to automatically identify and analyze the user's access characteristics and behavior patterns to the network server, thereby avoiding the traditional predefined fixed rules for identifying anomalies and thereby improving the accuracy of network security detection, the time characteristics of accessing the data interface are analyzed.

[0040] Because access to different types of data interfaces may be temporally correlated with user behavior, in order to understand the temporal correlation between access to different types of data interfaces, it is necessary to normalize the access frequencies in a data interface's daily access frequency sequence to obtain a normalized access frequency sequence. This prevents amplitude variations in the frequency sequence from impacting subsequent analysis. If the access characteristics of the data interface being analyzed have a strong temporal correlation with time, then the access characteristics of that data interface may be relatively stable and similar across different days.

[0041] Furthermore, the difference characteristic value corresponding to a data interface on a day is obtained based on the difference between the access frequency sequence of the data interface on one day and the access frequency sequence of other days. Specifically, for a data interface, the difference between the normalized access frequency sequence of any two days of the data interface can be indirectly represented by obtaining a matching distance value using DTW (Dynamic Time Warping). This algorithm is usually used to describe the similarity between two data sequences. The larger the matching distance value, the lower the similarity between the two sequences, and vice versa. Since this technology is a well-known technology, it will not be repeated here. Thus, the DTW algorithm is used to obtain the matching distance values ​​of the normalized access frequency sequence of a data interface on one day and the normalized access frequency sequence of the data interface on other days, and the matching distance values ​​are averaged to obtain the difference characteristic value corresponding to the data interface on that day.

[0042] The specific calculation model of the difference eigenvalue is:

[0043] Among them, T a In the access history of a data interface currently being analyzed, the difference characteristic value between the access frequency sequence on day a and the access frequency sequence on the remaining access days is also the difference characteristic value corresponding to day a of the data interface. DTW(X a ,X b ) represents the DTW matching distance value between the normalized access frequency sequences of day a and day b in the access history of the data interface currently being analyzed, and m represents the number of days for data collection.

[0044] Finally, the time characteristic value of a data interface is obtained based on the daily difference characteristic values ​​of the data interface. Specifically, the absolute values ​​of the differences between the difference characteristic values ​​corresponding to one day and the difference characteristic values ​​corresponding to other days are obtained, and the average is calculated to obtain the first characteristic value corresponding to that day. The average value of the difference characteristic values ​​corresponding to each day of the data interface is multiplied by the average value of the first characteristic values ​​corresponding to each day to obtain the multiplication result. The multiplication result is negatively correlated with an exponential function with a natural constant as the base to obtain the time characteristic value of the data interface.

[0045] The specific calculation model of the time characteristic value is: in

[0046] R is the time characteristic value of a data interface, which is used to indicate the correlation between the access characteristics of the data interface and time; T a Indicates the difference eigenvalue corresponding to the ath day of the data interface. exp[] represents an exponential function with a natural constant as the base, which is used for negative correlation mapping. Indicates the mean of the difference feature values ​​of all days in the access history of the data interface. The smaller the value, the smaller the overall difference in the access frequency series corresponding to different days in the historical access records of the data interface, indicating that the access characteristics of the data interface are strongly correlated with time. Indicates the first eigenvalue of the data interface on day a. This represents the mean of the first feature value of the data interface on day a. The smaller the value, the more stable the temporal distribution of the access records of the data interface on different days. The larger the value, the stronger the correlation between the access feature and time. This allows us to obtain the temporal feature value of each data interface.

[0047] Step S3, obtaining the access density of a data interface at a moment according to the access frequency and the number of visitors of a data interface at a moment on each day; obtaining the possibility of abnormal access of the user to the data interface at a moment based on the access frequency of the user to the data interface at a moment, the time characteristic value of the data interface and the access density of the data interface at a moment.

[0048] This allows us to derive the correlation coefficient between any data interface and time, effectively defining the temporal characteristic value of any data interface. Because different data interfaces perform different functions, users access them with varying frequencies and in varying ways. If a user's access density for a particular interface is significantly higher than that of other users within a specific time period, the likelihood of that user engaging in anomalous behavior is higher.

[0049] Therefore, it is necessary to obtain the access density of a data interface at a certain moment based on the access frequency and the number of visitors at a certain moment on each day. Specifically, obtain the average of the access frequency of a data interface at the same moment on each day, and record it as the average access frequency at that moment; obtain the average of the number of visitors to a data interface at that moment on each day, and record it as the average number of visitors at that moment; the ratio of the average access frequency at that moment to the average number of visitors at that moment is the access density of the data interface at that moment. The method for obtaining the number of visitors to a data interface at a certain moment is the same as the method for obtaining the access frequency at a certain moment, and the number of people who visited the data interface within a period of time before a certain moment is taken as the number of visitors to the data interface at that moment. If the same user visits multiple times, the number of visitors is 1.

[0050] For a data interface, the calculation model of its access density at any given time is:

[0051] Among them, G t It represents the access density of a data interface at the tth moment, that is, the access density of a data interface at the tth moment every day in its corresponding historical records. It represents the average access frequency of the data interface at the tth time of each day, that is, the average access frequency at the tth time. It represents the average number of visitors to the data interface at the tth moment of each day, that is, the average number of visitors at the tth moment, It represents the ratio of the average access frequency of the data interface at time t in the historical access records to the average number of visitors at that time, that is, the overall historical access density at that time.

[0052] The above data shows the historical access density of a data interface at any given moment. When analyzing a data interface, if its access behavior exhibits a clear temporal correlation—that is, if access density and frequency patterns are stable over a specific time period—then the access model built based on historical data will be more valuable for assessing current user behavior. In this case, whether current access deviates from historical patterns can serve as a crucial basis for identifying anomalies or potential attacks, thereby improving the accuracy and effectiveness of security detection.

[0053] Furthermore, based on the access frequency of a user to a data interface at a moment, the time characteristic value of the data interface and the access density of the data interface at the moment, the possibility of abnormal access of the user to the data interface at the moment is obtained.

[0054] Specifically, an exponential function with a natural constant as the base is used to map the difference between a user's access frequency to a data interface at a moment and the access density of the data interface at that moment, and multiply it by the time characteristic value of the data interface to obtain the possibility of abnormal access of the user to the data interface at that moment.

[0055] The specific calculation model for the probability of a user abnormally accessing a data interface at a certain moment is:

[0056]

[0057] Among them, Y st is the probability of abnormal access to a data interface by the sth user at the tth time, indicating the probability that the sth user has abnormal access to the data interface at the tth time of the day. e represents a natural constant, F st G represents the access frequency of the sth user to the data interface at the tth time, that is, how many times the sth user has accessed the data interface in the access frequency corresponding to the tth time; t represents the access density of the data interface at time t, R represents the time characteristic value of the data interface; F st -G tIt represents the difference between the access frequency of the sth user to the data interface at the tth moment and the access density of the data interface in the historical data at the tth moment, and takes it as the exponential part of the natural constant to ensure While taking positive values, avoid F st -G t When it is 0, the calculation will bring about the impact of subsequent analysis, where The larger the value, the higher the access frequency of the sth user at time t to the data interface compared to the access frequency characteristics of the same historical moment, and the higher the possibility of abnormal access at that moment. Similarly, the stronger the correlation between the access characteristics of the data interface and time, that is, the larger the corresponding R, the higher the credibility of the results of the historical data comparison analysis. Therefore, the larger the value, the greater the possibility of abnormal access to the data interface by this user at this time. This shows the probability of abnormal access by each user at each time when accessing each data interface.

[0058] Step S4, obtaining the abnormal access index coefficient of the user at the current moment based on the transfer probability of each data interface in the access link of the user at the current moment and the possibility of abnormal access of the user to each data interface in the access link at the current moment; and judging whether the user's access at the current moment is abnormal based on the abnormal access index coefficient.

[0059] The above analysis indicates that any user's access to any data interface at any time is likely to be abnormal. Because network data intrusions often have clear objectives, their server access methods differ from normal user behavior. Therefore, further analysis and comparison of the current user's access links to the server with those of normal users is necessary. This is then combined with a comprehensive analysis of the abnormality coefficients of the user's access to the accessed data interface to obtain an abnormality score for the user at the time of detection. This allows for a more comprehensive and accurate assessment of whether the user's behavior deviates from normal patterns, ultimately forming a more targeted abnormality warning indicator.

[0060] Therefore, in order to achieve the above purpose, the Markov chain model is further used to obtain the transition probability of each data interface (path node) in the access link of a user at the current moment (if the user accesses a single node in the link at this time, that is, only accesses one data interface, the transition probability at this time is marked as 0). Since the method of obtaining the transition probability of the data interface accessed by the user using the Markov chain model is a well-known technology, it will not be described in detail here. The acquisition of the access link is a well-known technology.

[0061] The transition probability given in the Markov chain model is used to measure the probability of a user jumping to a certain data interface under the normal access sequence. When the probability of jumping to a certain accessed data interface is very small, for example 0.01, but a user actually executes the jump, it means that this is an "unconventional behavior". The more suspicious the access, the higher the anomaly score.

[0062] Thus, the abnormal access index coefficient for a user at the current moment is obtained based on the transition probability of each data interface in the user's current access link and the user's current probability of abnormal access to each data interface in the access link. Specifically, an exponential function with a natural constant as the base is used to negatively correlate the transition probability of a data interface in the user's current access link, and then multiplied by the user's current probability of abnormal access to the data interface to obtain the corresponding access abnormality level of the data interface. The abnormal access index coefficient for the user at the current moment is obtained by averaging the access abnormality levels corresponding to each data interface in the user's current access link and normalizing them.

[0063] The calculation model of the abnormal access index coefficient is as follows:

[0064] Among them, Z st represents the abnormal access index coefficient of the sth user at the tth moment (current moment), norm represents the normalization operation, and n st is the number of data interfaces in the access link during the session of the sth user at time t, e represents a natural constant; P sti It represents the transfer probability corresponding to the sth user accessing the i-th data interface in the link at the t-th time. The smaller the value, the The larger the value, the greater the possibility that the node, that is, the data interface, is accessed by abnormal behavior. At the same time, the user's abnormal access probability coefficient Y for the data interface at time t is sti The larger the value, the higher the possibility of abnormal access to the data interface. Indicates the access abnormality level of the i-th data interface in the access link, It represents the mean value of the access anomaly degree of all data interfaces in the access link of the s-th user at time t, that is, the abnormal access index coefficient when the user accesses the server at time t.

[0065] Through the above, we can obtain the abnormal access index coefficient of any user accessing the network server at any time, and then set the reference threshold T. The reference threshold T of this application is set to 0.4. The specific setting is based on the actual network service security level by the network operation and maintenance personnel, and will not be repeated here.

[0066] When a user's abnormal access index coefficient at the current moment is greater than the reference threshold, it is considered that the user has abnormal access behavior operations, and timely warnings are required to trigger relevant measures, such as timely flow control or human-machine verification of their requests, so as to reduce their malicious access and attacks on the network server, thereby improving the security and operation efficiency of the network server.

[0067] In summary, this application links the access to the data interface with the timing characteristics, analyzes the user's operations on each data interface in the access link when accessing, and obtains the abnormal access index coefficient of the user's access, so as to achieve more accurate detection of network access behavior.

[0068] It should be noted that the order in which the embodiments of the present invention are described above is for illustrative purposes only and does not necessarily represent the superiority or inferiority of the embodiments. Furthermore, the foregoing descriptions of specific embodiments of this specification are provided. Furthermore, the processes depicted in the accompanying drawings do not necessarily require the specific order or sequential sequence shown to achieve the desired results. In certain embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0069] The various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on the differences from other embodiments.

[0070] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A network security detection method based on multi-source data analysis, characterized in that: The method includes: Obtain the access frequency of each data interface at each moment in history based on the network server access log. The access frequency of a data interface in a day constitutes an access frequency sequence. Obtain the difference characteristic value corresponding to a data interface on a day based on the difference between the access frequency sequence of a data interface on one day and the access frequency sequence of other days; obtain the time characteristic value of a data interface based on the difference characteristic values ​​of each day; Obtain the access density of a data interface at a given moment based on the access frequency and number of visitors to the data interface at that moment; obtain the possibility of abnormal access by a user to a data interface at that moment based on the access frequency of the user to the data interface at that moment, the time characteristic value of the data interface, and the access density of the data interface at that moment; The abnormal access index coefficient of a user at the current moment is obtained based on the transfer probability of each data interface in the access link of a user at the current moment and the possibility of abnormal access of the user to each data interface in the access link at the current moment; based on the abnormal access index coefficient, it is determined whether the user's access at the current moment is abnormal.

2. A network security detection method based on multi-source data analysis according to claim 1, characterized in that: The method of obtaining the access frequency of each data interface at each moment in history according to the network server access log includes: In the network server access log, the number of times a data interface is accessed within a preset time period before a moment is obtained and recorded as the access frequency of the data interface at that moment.

3. The network security detection method based on multi-source data analysis according to claim 1 is characterized in that: The method of obtaining a difference feature value corresponding to a day based on the difference between the access frequency sequence of a data interface on one day and the access frequency sequence of other days includes: The access frequency in the access frequency sequence corresponding to a data interface on one day is normalized to obtain a normalized access frequency sequence; the DTW algorithm is used to obtain the matching distance values ​​between the normalized access frequency sequence of a data interface on one day and the normalized access frequency sequences of the data interface on other days, and the average of the matching distance values ​​is calculated to obtain the difference feature value corresponding to the data interface on that day.

4. A network security detection method based on multi-source data analysis according to claim 1, characterized in that: The step of obtaining a time characteristic value of a data interface based on the difference characteristic values ​​of each day of the data interface includes: The absolute values ​​of the differences between the difference characteristic values ​​corresponding to one day of the data interface and the difference characteristic values ​​corresponding to other days are obtained respectively, and the average is calculated to obtain the first characteristic value corresponding to the day; the average value of the difference characteristic values ​​corresponding to each day of the data interface is multiplied by the average value of the first characteristic values ​​corresponding to each day to obtain the multiplication result, and the exponential function with a natural constant as the base is used to perform negative correlation mapping on the multiplication result to obtain the time characteristic value of the data interface.

5. The network security detection method based on multi-source data analysis according to claim 1 is characterized in that: The step of obtaining the access density of a data interface at a time point according to the access frequency and the number of visitors of the data interface at a time point on each day includes: Get the average of the access frequency of a data interface at the same time on each day, and record it as the average access frequency at that time; get the average of the number of visitors to a data interface at that time on each day, and record it as the average number of visitors at that time; the ratio of the average access frequency at that time to the average number of visitors at that time is the access density of the data interface at that time.

6. The network security detection method based on multi-source data analysis according to claim 1 is characterized in that: The obtaining of the possibility of abnormal access of the user to the data interface at a moment based on the access frequency of the user to the data interface at a moment, the time characteristic value of the data interface, and the access density of the data interface at the moment includes: An exponential function with a natural constant as the base is used to map the difference between a user's access frequency to a data interface at a certain moment and the access density of the data interface at that moment, and multiply it by the time characteristic value of the data interface to obtain the possibility of abnormal access of the user to the data interface at that moment.

7. The network security detection method based on multi-source data analysis according to claim 1 is characterized in that: The step of obtaining the abnormal access index coefficient of a user at the current moment according to the transfer probability of each data interface in the access link of a user at the current moment and the abnormal access possibility of the user to each data interface in the access link at the current moment includes: An exponential function with a natural constant as the base is used to negatively correlate the transfer probability of a data interface in a user's current access link, and multiply it by the user's abnormal access possibility to the data interface at the current moment to obtain the access abnormality degree corresponding to the data interface. The access abnormality degrees corresponding to each data interface in the user's current access link are averaged and normalized to obtain the abnormal access index coefficient of the user at the current moment.

8. The network security detection method based on multi-source data analysis according to claim 1 is characterized in that: The determining whether the user's current access is abnormal based on the abnormal access index coefficient includes: When the abnormal access index coefficient of a user at the current moment is greater than the reference threshold, the user's access at the current moment is abnormal.

Images