Privacy data security protection method and system for business information platform and medium

Abstract

The application relates to the technical field of flow security, in particular to a privacy data security protection method and system for a business information platform and a medium, the method comprising the following steps: acquiring an initial flow set and a historical flow set; determining reference flows of each initial flow from the historical flow set; determining classification error probabilities of each attribute included in each initial flow based on attribute value similarities between attribute values of the same attribute of each initial flow and each corresponding reference flow; dividing the initial flows included in the initial flow set into normal flows and disguised flows based on the classification error probabilities of each attribute included in each initial flow; and performing isolation treatment on the disguised flows in the case that a resource occupancy rate of the disguised flows is greater than a resource occupancy rate threshold. The method can analyze disguised flows hidden in the initial flows and difficult to be distinguished by conventional means, and improves the security of network protection.

Description

Technical Field

[0001] This invention relates to the field of traffic security technology, specifically to a method, system, and medium for protecting privacy data security for business information platforms. Background Technology

[0002] In related technologies, security protection is typically achieved through methods such as World Wide Web (Web) application firewalls, distributed denial-of-service (DDoS) protection services, and intrusion detection systems. These methods mainly filter and intercept network traffic based on predefined rule bases or protocol features, and can effectively deal with known attack patterns and overt threats.

[0003] However, with the evolution of attack techniques, some malicious traffic can disguise itself as legitimate business requests. While it is compliant at the protocol level, it can circumvent traditional detection mechanisms by carrying malicious content with logical anomalies, making it difficult to identify and detect, thus posing a risk to network security. Summary of the Invention

[0004] To address the technical problem that some malicious traffic can disguise itself as legitimate business requests, circumventing traditional detection mechanisms and becoming difficult to identify and detect, thus posing a risk to network security, the present invention aims to provide a method, system, and medium for privacy data security protection of business information platforms. The specific technical solution adopted is as follows:

[0005] This invention provides a method for protecting privacy data security in business information platforms, the method comprising:

[0006] Obtain an initial traffic set and a historical traffic set. Each traffic item includes attribute values ​​of multiple attributes and at least one labeled category. Determine a reference traffic for each initial traffic item from the historical traffic set. The attributes of a reference traffic item include one or more attributes of the initial traffic item. Based on the similarity of attribute values ​​between each initial traffic item and its corresponding reference traffic item for the same attribute, determine the classification error probability of each attribute included in each initial traffic item. The classification error probability of an attribute of an initial traffic item is used to characterize the degree to which the attribute included in the initial traffic item does not match the labeled category of the initial traffic item. Based on the classification error probability of each attribute included in each initial traffic item, classify the initial traffic items included in the initial traffic set into normal traffic and spoofed traffic. If the resource occupancy rate of spoofed traffic exceeds a resource occupancy rate threshold, isolate the spoofed traffic.

[0007] Optionally, the method further includes: when the first attribute included in the first initial traffic is a numeric type, determining the attribute value similarity between the first initial attribute value and the first reference attribute value based on the difference between the first initial attribute value and the first reference attribute value, wherein the first initial attribute value is the attribute value of the first attribute included in the first initial traffic, the first reference attribute value is the attribute value of the first attribute included in the first reference traffic of the first initial traffic, the first initial traffic is one of the initial traffic sets, the first attribute is one of multiple attributes of the first initial traffic, and the first reference traffic is one of multiple reference traffic of the first initial traffic; when the first attribute included in the first initial traffic is a text type, determining the attribute value similarity between the first initial attribute value and the first reference attribute value based on the cosine similarity between the keywords in the first initial attribute value and the keywords in the first reference attribute value.

[0008] Optionally, each initial traffic item includes at least one labeled category corresponding to a grade number. The above-mentioned determination of the classification error probability of each attribute included in each initial traffic item based on the attribute value similarity between the attribute values ​​of the first initial traffic item and the corresponding reference traffic item in the same attribute includes: determining the attribute value similarity corresponding to each labeled category included in the first initial traffic item from the attribute value similarity between the attribute values ​​of the first initial traffic item and the corresponding reference traffic item in the first attribute, wherein the first initial traffic item is one of the initial traffic item sets; determining the overall relevance between the first attribute and each labeled category based on the attribute value similarity corresponding to each labeled category; and determining the classification error probability of the first attribute included in the first initial traffic item based on the overall relevance between the first attribute and each labeled category and the grade number of each labeled category.

[0009] Optionally, the above-mentioned method of classifying the initial traffic in the initial traffic set into normal traffic and spoofed traffic based on the classification error probability of each attribute included in each initial traffic flow includes: clustering the attributes included in each initial traffic flow based on the classification error probability of each attribute included in each initial traffic flow to obtain the misclassification cluster and the correct classification cluster corresponding to each initial traffic flow; determining the overall relevance of each erroneous attribute included in each initial traffic flow to each category in all categories, wherein the erroneous attribute included in an initial traffic flow is the attribute included in the erroneous classification cluster corresponding to that initial traffic flow; determining the spoofing probability of each initial traffic flow based on the overall relevance of each erroneous attribute included in each initial traffic flow to each category and the classification error probability of each erroneous attribute included in each initial traffic flow; and classifying the initial traffic in the initial traffic set into normal traffic and spoofed traffic based on the spoofing probability of each initial traffic flow.

[0010] Optionally, determining the spoofing probability of each initial traffic flow based on the overall relevance of each erroneous attribute included in each initial traffic flow to each category, and the classification error probability of each erroneous attribute included in each initial traffic flow, includes: determining the classification skewness of each erroneous attribute included in each initial traffic flow to each category based on the overall relevance of each erroneous attribute included in each initial traffic flow to each category, where the classification skewness of an erroneous attribute to a category is used to characterize the degree to which the attribute value of the erroneous attribute is biased towards its category; determining the deviation concentration of each initial traffic flow to each category based on the classification skewness of each erroneous attribute included in each initial traffic flow to each category, where the deviation concentration of an initial traffic flow to a category is used to characterize the degree to which the initial traffic flow is biased towards that category; determining the overall deviation concentration of each initial traffic flow based on the deviation concentration of each initial traffic flow to each category; and determining the spoofing probability of each initial traffic flow based on the overall deviation concentration of each initial traffic flow.

[0011] Optionally, determining the spoofing probability of each initial traffic flow based on the overall deviation concentration of each initial traffic flow includes: determining the basic risk probability of each initial traffic flow based on the difference between the classification error probability of the misclassification cluster corresponding to each initial traffic flow and the classification error probability of the correct classification cluster, wherein the classification error probability of a classification cluster is the average of the classification error probabilities of each attribute in the classification cluster; and determining the spoofing probability of each initial traffic flow based on the overall deviation concentration of each initial traffic flow and the basic risk probability of each initial traffic flow.

[0012] Optionally, determining the overall deviation concentration of each initial traffic flow based on the deviation concentration of each initial traffic flow to each category includes: determining the maximum value among the deviation concentrations of each initial traffic flow to multiple categories as the overall deviation concentration of each initial traffic flow.

[0013] Optionally, the above-mentioned method of dividing the initial traffic included in the initial traffic set into normal traffic and spoofed traffic based on the spoofing probability of each initial traffic flow includes: arranging all the initial traffic flows in the initial traffic set in ascending order of spoofing probability to obtain an initial traffic sequence; determining the degree of change of each initial traffic flow based on the difference in spoofing probability between each initial traffic flow in the initial traffic sequence and the previous initial traffic flow; determining the initial traffic flow with the largest degree of change as the boundary traffic flow; determining the initial traffic flow with a spoofing probability greater than that of the boundary traffic flow as spoofed traffic flow, and determining the initial traffic flow with a spoofing probability less than or equal to that of the boundary traffic flow as normal traffic flow.

[0014] This invention also provides a privacy data security protection system for a business information platform. The system includes a traffic acquisition module, a reference traffic determination module, a traffic analysis module, a traffic classification module, and a traffic processing module. The traffic acquisition module acquires an initial traffic set and a historical traffic set, where each traffic item includes attribute values ​​of multiple attributes and at least one labeled category. The reference traffic determination module determines a reference traffic for each initial traffic item from the historical traffic set, where the attributes of the reference traffic for each initial traffic item include one or more attributes of the initial traffic item. The traffic analysis module is used to analyze each initial traffic item against its corresponding... The similarity of attribute values ​​between the attribute values ​​of each reference traffic item with the same attribute is used to determine the classification error probability of each attribute included in each initial traffic item. The classification error probability of an attribute of an initial traffic item is used to characterize the degree to which the attribute included in the initial traffic item does not match the labeled category of the initial traffic item. The traffic classification module is used to divide the initial traffic included in the initial traffic set into normal traffic and fake traffic based on the classification error probability of each attribute included in each initial traffic item. The traffic processing module is used to isolate the fake traffic item when the resource occupancy rate of the fake traffic item is greater than the resource occupancy rate threshold.

[0015] This invention also provides a computer storage medium storing instructions that, when executed by a computer, enable the implementation of the steps of the above-described privacy data security protection method for business information platforms.

[0016] The present invention has the following beneficial effects:

[0017] In this embodiment of the invention, a reference traffic is selected from the historical traffic for each initial traffic, and the initial traffic and the reference traffic are compared on the attribute value of the same attribute to obtain the classification error probability of each attribute included in each initial traffic. This can more accurately determine whether the attribute value is abnormal. When the attribute value differs from the attribute value under normal circumstances, it indicates that the attribute value contradicts the category labeled by the initial traffic. Based on the classification error probability (i.e., the degree of contradiction), the initial traffic included in the initial traffic set is divided into normal traffic and disguised traffic. This can analyze and identify disguised traffic that is deeply hidden in the initial traffic and difficult to distinguish by conventional means. Furthermore, if the resource occupancy rate of the disguised traffic is greater than a preset resource occupancy rate threshold, the disguised traffic is centrally isolated, which can improve the security of network protection. Attached Figure Description

[0018] To more clearly illustrate the technical solutions and advantages in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 A flowchart illustrating a privacy data security protection method for a business information platform, provided as an embodiment of the present invention;

[0020] Figure 2 A flowchart illustrating another method for protecting privacy data security in a business information platform, as provided in an embodiment of the present invention;

[0021] Figure 3 This is a structural diagram of a privacy data security protection system for a business information platform, provided as an embodiment of the present invention. Detailed Implementation

[0022] To further illustrate the technical means and effects adopted by the present invention to achieve its intended purpose, the following, in conjunction with the accompanying drawings and preferred embodiments, details the specific implementation, structure, features, and effects of a privacy data security protection method, system, and medium for business information platforms proposed according to the present invention. In the following description, different "one embodiment" or "another embodiment" do not necessarily refer to the same embodiment. Furthermore, specific features, structures, or characteristics in one or more embodiments can be combined in any suitable form.

[0023] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0024] The Business Investment Information Platform is a digital service system that integrates investment information, intelligent analysis, resource matching, and risk management. Through multi-source data collection and multi-level asset classification management, it presents market dynamics, industry trends, and investment and financing opportunities in real time. Relying on big data and intelligent recommendation technology, the platform achieves precise matching between project owners and investors, and provides value-added services such as policy and regulations information and expert consultations. This helps users efficiently obtain reliable information, reduce investment risks, improve decision-making efficiency, and create a safe, transparent, and trustworthy business investment ecosystem.

[0025] Business investment information platforms carry a large amount of sensitive data involving enterprise projects, fund flows, investment intentions, and user identities. Once this data is tampered with, it will not only directly lead to economic losses for investors and enterprises, but also seriously damage the platform's credibility and industry position. Therefore, it is necessary to establish a sound privacy data security protection system, and ensure the confidentiality, integrity, and availability of data through measures such as encrypted transmission, hierarchical access control, operation logging, and anomaly monitoring, thereby maintaining the platform's credibility and users' trust.

[0026] Currently, when the business information platform receives information publishing request traffic, it uses Web Application Firewall and DDoS protection services to filter the traffic. However, some disguised traffic can still penetrate the filtering mechanism. The attack traffic appears compliant at the protocol level, but it gradually injects abnormal parameters by using legitimate business accounts. For example, it tampers with the logical relationship between project categories and attributes, thus avoiding detection based on static rule bases. When the disguised traffic is processed on the cloud server, it causes the business data to be distorted.

[0027] The following description, in conjunction with the accompanying drawings, details a specific solution for a privacy data security protection method, system, and medium for business information platforms provided by this invention.

[0028] Please see Figure 1 The diagram illustrates a method flowchart for privacy data security protection of a business information platform according to an embodiment of the present invention.

[0029] like Figure 1 As shown, the privacy data security protection method for business information platforms includes S101-S105.

[0030] S101. Obtain the initial traffic set and the historical traffic set.

[0031] The initial traffic set includes multiple initial traffic streams, the historical traffic set includes multiple historical traffic streams, and each traffic stream (either an initial traffic stream or a historical traffic stream) includes attribute values ​​of multiple attributes and at least one labeled category.

[0032] In this embodiment of the invention, the multiple initial traffic streams are traffic received by the business information platform but not yet distributed. These multiple initial traffic streams are grouped together to obtain the initial traffic set. The historical traffic set is the set of all traffic received by the business information platform and distributed within a historical time period.

[0033] Optionally, the historical period can be one year.

[0034] In this embodiment of the application, a traffic flow can be understood as a business information publishing request. The business publishing request includes the project to be published, the category to which the project belongs, and the attribute values ​​of the project in multiple attributes.

[0035] Optionally, a project can correspond to multiple levels of categories; therefore, the labeled category can also be a category with multiple labeled levels.

[0036] It should be understood that the multiple attributes included in a traffic request represent project information for the project published in that traffic request across multiple dimensions.

[0037] For example, the business information platform can be a business investment information platform, which is used to publish investment information. In this business investment information platform, a project that needs to be published in a traffic stream can be an investment promotion project. The categories to which the investment promotion project belongs, in descending order of level, can be "industrial investment", "infrastructure construction", "transportation construction" and "high-speed railway". When the project is a high-speed railway corresponding to the investment promotion project, the multiple attributes can be "investment scale", "construction period", "line length", "technical standards", "operation mode", "supporting facilities", "funding source", "cooperation method", "implementation stage", "regional location", "environmental protection requirements" and "risk assessment".

[0038] For example, the attribute value for the line length is 80 kilometers.

[0039] Optionally, a traffic entry may also include the identifier of the business party.

[0040] Optionally, after obtaining the initial traffic set from the business information platform, the Web Application Firewall can be used to identify and block attacks against Web applications, and malicious traffic that can be identified can be filtered out based on the DDoS protection service.

[0041] Understandably, by performing the aforementioned preprocessing on the received traffic based on Web Application Firewall and DDoS Protection services, most of the coarse-grained attack traffic can be eliminated, allowing for a faster focus on hidden anomalies in the remaining initial traffic, reducing false positive rates and improving the detection efficiency of complex attacks.

[0042] S102. Determine the reference flow for each initial flow from the historical flow set.

[0043] The attributes of a reference flow for an initial flow include one or more attributes of that initial flow.

[0044] For example, assuming that the attributes included in the initial flow 1 are "investment scale" and "construction period", then when the historical flow 1 also includes "investment scale" and / or "construction period", the historical flow 1 can be determined as the reference flow of the initial flow 1.

[0045] S103. Based on the similarity of attribute values ​​between each initial traffic and each corresponding reference traffic in the same attribute, determine the classification error probability of each attribute included in each initial traffic.

[0046] Among them, the classification error probability of an attribute of an initial traffic flow is used to characterize the degree to which the attribute included in the initial traffic flow does not match the labeled category of the initial traffic flow.

[0047] It should be understood that attack traffic typically disguises itself as normal traffic, distributing information as legitimate projects. It submits seemingly compliant but actually contradictory information through legitimate forms, exploiting isolated vulnerabilities in the system's single-field review to bypass detection. For example, a project might be categorized as "educational projects" but include "gambling-related content" as an attribute. These advanced threat-carrying initial traffic attacks primarily exhibit contradictions among the project's multi-dimensional attributes. Therefore, analyzing the consistency between the attribute values ​​of the initial traffic and the categorized project can be beneficial.

[0048] In one implementation of this invention, when the first attribute included in the first initial flow is a numerical type, the similarity of attribute values ​​between the first initial attribute value and the first reference attribute value is determined based on the difference between the first initial attribute value and the first reference attribute value.

[0049] Wherein, the first initial attribute value is the attribute value of the first attribute included in the first initial flow, the first reference attribute value is the attribute value of the first attribute included in the first reference flow of the first initial flow, the first initial flow is one of the initial flow sets, the first attribute is one of the multiple attributes of the first initial flow, and the first reference flow is one of the multiple reference flows of the first initial flow.

[0050] Optionally, the absolute value of the difference between the first initial attribute value and the first reference attribute value can be taken, and then inversely normalized. The result of the inverse normalization can be determined as the attribute value similarity between the first initial attribute value and the first reference attribute value.

[0051] In another implementation of this invention, when the first attribute included in the first initial traffic is of text type, the word vectors of the keywords in the first initial attribute value and the word vectors of the keywords in the first reference attribute value can be obtained, and the attribute value similarity between the first initial attribute value and the first reference attribute value can be determined based on the cosine similarity between the word vectors of the keywords in the first initial attribute value and the word vectors of the keywords in the first reference attribute value.

[0052] Optionally, the Bert word vectors in the first initial attribute value and the first reference attribute value can be obtained based on the bidirectional encoder representations from transformers (BERT) algorithm.

[0053] Optionally, if there are multiple keywords for a single attribute value, the word vectors of all keywords can be averaged to obtain a global text vector.

[0054] Optionally, the cosine similarity between the keywords in the first initial attribute value and the keywords in the first reference attribute value can be linearly normalized, and then the linear normalization result can be determined as the attribute value similarity between the first initial attribute value and the first reference attribute value.

[0055] It should be understood that normalizing the cosine similarity can ensure that the similarity scale of text type attribute values ​​and numerical type attribute values ​​is consistent, making them comparable.

[0056] It is understandable that since the attribute values ​​of different attributes are of different types, but the attribute values ​​of the same attribute are of the same type, using different methods to determine the similarity of attribute values ​​for different attribute value types can more accurately obtain the similarity of attribute values ​​between the attribute values ​​of the same attribute.

[0057] In one implementation of this invention, at least one labeled category included in an initial traffic flow corresponds to a grade number. Taking the first attribute included in the first initial traffic flow as an example, the similarity of attribute values ​​corresponding to each labeled category included in the first initial traffic flow can be determined from the similarity of attribute values ​​between the first initial traffic flow and each corresponding reference traffic flow. Then, based on the similarity of attribute values ​​corresponding to each labeled category, the overall correlation between the first attribute and each labeled category is determined. Finally, based on the overall correlation between the first attribute and each labeled category, and the grade number of each labeled category, the classification error probability of the first attribute included in the first initial traffic flow is determined.

[0058] It should be understood that the grade number of a category is used to characterize the degree of detail of that category. The higher the grade number of a category, the greater the degree of detail of that category.

[0059] Optionally, the level numbers can be set in descending order of level, with the level number being smaller for higher levels.

[0060] For example, assuming that the at least one category is ranked from highest to lowest as "industrial investment", "infrastructure construction", "transportation construction" and "high-speed rail", then the grade number corresponding to "industrial investment" is 1, the grade number corresponding to "infrastructure construction" is 2, the grade number corresponding to "transportation construction" is 3, and the grade number corresponding to "high-speed rail" is 4.

[0061] Based on the above examples, it should be understood that "high-speed rail" is the most detailed category, meaning that the "transportation construction" category includes other categories besides "high-speed rail".

[0062] It is understandable that both the initial traffic and the reference traffic include labeled categories. Therefore, the reference traffic that includes each labeled category can be determined. Then, the similarity of the attribute values ​​between the initial traffic and the reference traffic in the first attribute is determined as the similarity of the attribute values ​​corresponding to each labeled category included in the first initial traffic.

[0063] It should be understood that there may be multiple similarity values ​​for the attribute values ​​corresponding to each labeled category.

[0064] Optionally, the mean of the similarity of attribute values ​​corresponding to each labeled category can be determined as the overall relevance between the first attribute and each labeled category.

[0065] Optionally, the classification error probability of an attribute included in a traffic flow satisfies the following formula:

[0066]

[0067] in, Indicates initial flow The attributes included The probability of classification error, Indicates initial flow The number of grades included in the labeled categories, Indicates initial flow The grade number of the labeled product category is included. Indicates initial flow The attributes included Compared with the labeled category Overall correlation This represents an inverse proportional normalization function with the natural constant as its base, where the normalized object is the initial flow rate. The attributes included With initial flow The overall relevance of all labeled categories included in the document. This represents the weight normalization function, where the normalized object is the initial flow. The grade number of all labeled categories included in the list.

[0068] For example, assuming that the labeled categories included in the first initial traffic are "industrial investment", "infrastructure construction", "transportation construction projects" and "high-speed railway projects", then the number of levels of the labeled categories included in the first initial traffic is 4.

[0069] Based on the above formula, it should be understood that when the flow rate... The attributes included Compared with the labeled category The lower the overall relevance, the more traffic... The attributes included The higher the probability of classification error, the more likely the product category will be to be labeled. A higher grade number indicates a higher category. The lower the grade, the more important the product category. The more accurate, the better the attribute. Compared with the labeled category The greater the proportion of overall relevance, the higher the traffic. The attributes included Given a high probability of classification errors, if the product category is labeled... The higher the category level, the more traffic. The attributes included Compared with the labeled category The overall correlation is low, indicating that traffic The attributes included Compared with the labeled category The high overall correlation among the following category levels is not universally applicable. Furthermore, if the category is labeled... If any of the following product category levels exists, traffic... The attributes included The high correlation with the overall category indicates that the attributes... From the perspective of traffic The more likely the item is to belong to that category.

[0070] Taking a high-speed railway project as an example, if the project category is incorrectly classified in the traffic flow of the project, then the "technical standards" of the project will have a low correlation with the "technical standards" of other projects under the "transportation construction projects" category, except for the "high-speed railway project". However, the "technical standards" of the project will have a high correlation with the "technical standards" of other projects under the "high-speed railway project" category. This indicates that in terms of the "technical standards" attribute, the project is more likely to belong to the "high-speed railway project" category.

[0071] It is understandable that when a piece of traffic is fake traffic, the attributes included in that traffic have little correlation with the labeled categories included in that traffic. Therefore, the lower the correlation between an attribute of a piece of traffic and the overall labeled category, the less likely that the traffic is to belong to that labeled category from the perspective of that attribute, that is, the more likely that the traffic is fake traffic.

[0072] S104. Based on the classification error probability of each attribute included in each initial traffic, the initial traffic included in the initial traffic set is divided into normal traffic and spoofed traffic.

[0073] In one alternative implementation, the sum of the classification error probabilities of each attribute of an initial traffic stream can be used to determine the classification error probability of that initial traffic stream. Then, based on the classification error probability of each initial traffic stream, the initial traffic streams included in the initial traffic stream set can be divided into normal traffic streams and spoofed traffic streams.

[0074] Optionally, a classification error probability threshold can be set, and initial traffic that is greater than or equal to the classification error probability threshold can be identified as spoofed traffic, while initial traffic that is less than the classification error probability threshold can be identified as normal traffic.

[0075] For example, the classification error probability threshold can be 0.7.

[0076] S105. If the resource occupancy rate of the spoofed traffic exceeds the preset resource occupancy rate threshold, the spoofed traffic shall be isolated.

[0077] In this embodiment of the invention, in order to reduce the impact of spoofed traffic on normal business resources, container instances can be used to process normal traffic and spoofed traffic in different ways.

[0078] In one alternative implementation, a containerized deployment scheme can be adopted, in which containers are distributed across several geographical regions. Normal traffic can be distributed using load balancing, while spoofed traffic can be isolated.

[0079] Optionally, the container instance used to store the spoofed traffic is denoted as the spoofed container instance. The spoofed traffic is placed into the spoofed container instance, and the resource utilization rate of the spoofed container instance is obtained at the same time. If the resource utilization rate of the spoofed traffic is greater than the preset resource utilization rate threshold, the spoofed traffic is isolated.

[0080] Optionally, if the resource utilization of the spoofed traffic exceeds a preset resource utilization threshold, a new spoofing container instance can be created, and the spoofed traffic can be placed into the new spoofing container instance.

[0081] Optionally, for normal traffic, a normal traffic container instance is created, and normal traffic is sequentially placed into the created normal traffic container instance. At the same time, the resource utilization rate of the normal traffic container instance is obtained. When the resource utilization rate reaches the preset resource utilization rate threshold, a new normal traffic container instance is created, and the remaining normal traffic is sequentially placed into the new normal traffic container instance. The resource utilization rate is then judged again.

[0082] Alternatively, resource utilization can be central processing unit (CPU) utilization or memory utilization.

[0083] The preset resource utilization threshold can be 70%.

[0084] In this embodiment of the invention, a reference traffic is selected from the historical traffic for each initial traffic, and the initial traffic and the reference traffic are compared on the attribute value of the same attribute to obtain the classification error probability of each attribute included in each initial traffic. This can more accurately determine whether the attribute value is abnormal. When the attribute value differs from the attribute value under normal circumstances, it indicates that the attribute value contradicts the category labeled by the initial traffic. Based on the classification error probability (i.e., the degree of contradiction), the initial traffic included in the initial traffic set is divided into normal traffic and disguised traffic. This can analyze and identify disguised traffic that is deeply hidden in the initial traffic and difficult to distinguish by conventional means. Furthermore, if the resource occupancy rate of the disguised traffic is greater than a preset resource occupancy rate threshold, the disguised traffic is centrally isolated, which can improve the security of network protection.

[0085] Combination Figure 1 ,like Figure 2 As shown, in one implementation of this invention, the initial traffic included in the initial traffic set is divided into normal traffic and spoofed traffic based on the classification error probability of each attribute included in each initial traffic, which can be specifically implemented through S201-S204.

[0086] S201. Based on the classification error probability of each attribute included in each initial traffic, cluster the attributes included in each initial traffic to obtain the misclassification cluster and the correct classification cluster corresponding to each initial traffic.

[0087] It should be understood that fake traffic generally does not maliciously modify attribute values ​​in the basic attributes to make it easier to pass the basic review. However, it will implant related features of other categories in the key attributes. In order to select categories that have a strong correlation with the labeled category in terms of consumption scenarios but have large differences in regulatory rules, and to target categories with weak risk control on the platform, the implanted features are usually concentrated in a specific high-risk category. Therefore, the initial traffic will show that the probability of classification error of some attributes is low, while the probability of classification error of some attributes is high and the high classification bias is concentrated in a certain category.

[0088] In one alternative implementation, the K-Means algorithm with K=2 can be used to cluster the attributes of each initial traffic. Then, the mean of the classification error probability of all attributes in each cluster is recorded as the error degree of that cluster. The cluster with the highest error degree is recorded as the misclassified cluster, and the cluster with the lowest error degree is recorded as the correctly classified cluster.

[0089] S202. Determine the overall relevance of each error attribute included in each initial traffic stream to each category across all categories.

[0090] Among them, the error attributes included in an initial traffic flow are the attributes included in the error classification cluster corresponding to that initial traffic flow.

[0091] It should be understood that "all categories" includes categories of all levels, and "all categories" includes multiple groups of categories, with at least one category among them having a hierarchical relationship.

[0092] Optionally, all categories can be the labeled categories included in all initial traffic and the labeled categories included in all historical traffic.

[0093] In this embodiment of the invention, the method for determining the overall correlation between each error attribute and each category is the same as or similar to the method for determining the overall correlation between each attribute and each labeled category as described above. Specifically, the historical traffic under each category is determined from the reference traffic of each initial traffic, and then the classification error probability of each error attribute under each category is determined to obtain the overall correlation between each error attribute and each category.

[0094] S203. Based on the overall relevance of each erroneous attribute included in each initial traffic to each category, and the classification error probability of each erroneous attribute included in each initial traffic, determine the spoofing probability of each initial traffic.

[0095] In one implementation of this invention, the classification skewness of each erroneous attribute in each initial traffic flow to each category can be determined based on the overall relevance of each erroneous attribute in each initial traffic flow to each category and the classification error probability of each erroneous attribute in each initial traffic flow; then, based on the classification skewness of each erroneous attribute in each initial traffic flow to each category, the deviation concentration of each initial traffic flow to each category can be determined; based on the deviation concentration of each initial traffic flow to each category, the overall deviation concentration of each initial traffic flow can be determined; finally, based on the overall deviation concentration of each initial traffic flow, the spoofing probability of each initial traffic flow can be determined.

[0096] In one alternative implementation, for any category (e.g., "high-speed rail"), the overall relevance of each erroneous attribute to categories of a higher level than "high-speed rail" (i.e., "industrial investment", "infrastructure construction", "transportation construction projects") can be determined. Then, the mean of the overall relevance of each erroneous attribute to categories of a higher level than "high-speed rail" is inversely normalized to obtain the upper-level locality of the category for each erroneous attribute. The product of the overall relevance of each erroneous attribute to the category and the upper-level locality is then used to determine the degree of belonging of each erroneous attribute to the category. The product of the classification error probability of each erroneous attribute and the degree of belonging of each erroneous attribute to the category is recorded as the classification skewness of each erroneous attribute included in the initial traffic within the category.

[0097] Optionally, if there is no category with a higher level than this category, the higher locality of this category for each erroneous attribute is set to 1.

[0098] Optionally, the sum of the classification skewness of each erroneous attribute included in an initial traffic stream for each category can be determined as the deviation concentration of that initial traffic stream for each category.

[0099] Optionally, the classification skewness of each category in a set of categories can be determined, and then the maximum classification skewness in each set of categories can be determined. Based on the maximum classification skewness of each erroneous attribute included in each initial traffic to each set of categories, and the classification error probability of each erroneous attribute, the deviation concentration of each initial traffic to each category can be determined.

[0100] It should be understood that the classification skewness of an erroneous attribute to a category is used to characterize the degree to which the attribute value of the erroneous attribute is biased towards the category. The maximum classification skewness of each category corresponding to an erroneous attribute indicates the degree to which the erroneous attribute is biased towards that category.

[0101] Optionally, the deviation concentration of an initial traffic flow from a category satisfies the following formula:

[0102]

[0103] in, Indicates initial flow For categories Deviation from concentration Indicates initial flow The number of error attributes included. Indicates initial flow The first included The probability of classification error for each erroneous attribute. Indicates initial flow The first included The error attribute is for the first The maximum value of the classification skewness for each category. This represents the weight normalization function, where the normalized object is the initial flow. The classification error probability of all erroneous attributes included in the data.

[0104] Based on the above formula, it should be understood that the first... The classification error probability of the nth erroneous attribute can be understood as the nth The weight of the classification skewness corresponding to the nth erroneous attribute, when the nth erroneous attribute is... The higher the classification error probability of the first erroneous attribute, the higher the probability of the second erroneous attribute. The larger the weight of the classification skewness corresponding to the first erroneous attribute, the better the classification skewness will be. The erroneous attribute affects the product category. The larger the maximum value of the classification skewness, the more the attribute value of the erroneous attribute is biased towards the category. It belongs to a set of categories.

[0105] In one alternative implementation, the maximum value of the deviation concentration of each initial traffic flow from multiple categories can be determined as the overall deviation concentration of each initial traffic flow.

[0106] In one alternative implementation, the overall deviation concentration of each initial traffic stream can be used to determine the spoofing probability of each initial traffic stream.

[0107] In another alternative implementation, the basic probability of risk for each initial traffic can be determined based on the difference between the classification error probability of the misclassification cluster corresponding to each initial traffic and the classification error probability of the correct classification cluster. Then, the spoofing probability of each initial traffic can be determined based on the overall deviation concentration of each initial traffic and the basic probability of risk for each initial traffic.

[0108] It should be understood that the classification error probability of a classification cluster is the mean of the classification error probabilities of each attribute in that cluster. Specifically, the classification error probability of a misclassified cluster is the mean of the classification error probabilities of each attribute in that misclassified cluster, and the classification error probability of a correctly classified cluster is the mean of the classification error probabilities of each attribute in that correctly classified cluster.

[0109] It should be understood that the risk basis probability of the initial traffic reflects the degree of abnormality of the initial traffic as a whole.

[0110] Optionally, the absolute value of the difference between the classification error probability of the misclassified cluster corresponding to the initial traffic and the classification error probability of the correct classified cluster can be determined as the basic probability of risk for the initial traffic.

[0111] Optionally, the spoofing probability of each initial flow can be determined by multiplying the overall deviation concentration of each initial flow and the risk basis probability of each initial flow.

[0112] Understandably, classification skewness quantifies the degree to which erroneous attributes are biased towards a specific category, while deviation concentration can further analyze whether these anomalies are concentrated in the same or a few categories. Therefore, based on this deviation concentration, we can identify the categories that spoofed traffic is attempting to spoof or intends to attack, thus effectively distinguishing between attack behavior and ordinary business noise.

[0113] S204. Based on the spoofing probability of each initial traffic, the initial traffic included in the initial traffic set is divided into normal traffic and spoofed traffic.

[0114] It should be understood that spoofed traffic is attack traffic disguised as normal traffic.

[0115] In one alternative implementation, a spoofing probability threshold can be set. Initial traffic with a spoofing probability greater than the threshold is identified as spoofed traffic, while initial traffic with a spoofing probability less than or equal to the threshold is identified as normal traffic.

[0116] For example, the spoofing probability threshold can be 0.8.

[0117] In another alternative implementation, all initial flows in the initial flow set can be arranged in ascending order of spoofing probability to obtain an initial flow sequence. Based on the difference in spoofing probability between each initial flow and the previous initial flow in the initial flow sequence, the degree of change of each initial flow is determined. The initial flow with the largest degree of change is determined as the boundary flow. The initial flow with a spoofing probability greater than that of the boundary flow is determined as spoofed flow, and the initial flow with a spoofing probability less than or equal to that of the boundary flow is determined as normal flow.

[0118] Optionally, the degree of change of the first initial traffic (i.e. the initial traffic with the lowest spoofing probability) can be recorded as 0.

[0119] In one alternative implementation, the resource utilization threshold can be adjusted based on the spoofing probability of spoofed traffic in the spoofed container instance.

[0120] Optionally, the adjusted resource utilization threshold satisfies the following formula:

[0121]

[0122] Where G represents the adjusted resource utilization threshold, H represents the preset resource utilization threshold, and K is the average spoofing probability of all spoofed traffic within the spoofed container instance.

[0123] Optionally, if the adjusted resource utilization threshold exceeds the alarm threshold, an alarm can be issued and the creation of new fake container instances can be stopped.

[0124] For example, the alarm threshold can be 95%.

[0125] Understandably, adjusting the resource utilization threshold based on the spoofing probability of spoofed traffic in a spoofed container instance, and stopping the creation of new spoofed container instances when the adjusted resource utilization threshold exceeds the alarm threshold, can better isolate spoofed traffic when the attack is severe, thereby reducing the possibility of mistakenly killing normal traffic when dealing with spoofed traffic.

[0126] Combining the methods described in S201-S204 above, the attributes of the initial traffic are divided into misclassification clusters and normal classification clusters. The attributes in the misclassification clusters are analyzed in a targeted manner. Based on the true category to which the attribute with a high probability of misclassification belongs, the spoofing probability of each initial traffic is obtained. This can accurately capture some anomalies in the initial traffic, which is more in line with the attack patterns of spoofed traffic. Therefore, the spoofed traffic obtained based on this spoofing probability is more accurate.

[0127] This invention also provides a privacy data security protection system for business information platforms. This system can be deployed on a cloud server using a containerized deployment scheme, distributing containers across several geographical regions to achieve the aforementioned privacy data security protection method for business information platforms.

[0128] like Figure 3 As shown, the privacy data security protection system 30 for business information platforms includes a traffic acquisition module 301, a reference traffic determination module 302, a traffic analysis module 303, a traffic classification module 304, and a traffic processing module 305.

[0129] The traffic acquisition module 301 is used to acquire the initial traffic set and the historical traffic set. Each traffic item includes the attribute values ​​of multiple attributes and at least one labeled category.

[0130] The reference flow determination module 302 is used to determine the reference flow for each initial flow from the historical flow set. The attributes of the reference flow for an initial flow include one or more attributes of the initial flow.

[0131] The traffic analysis module 303 is used to determine the classification error probability of each attribute included in each initial traffic based on the similarity of attribute values ​​between each initial traffic and each corresponding reference traffic in the same attribute. The classification error probability of an attribute of an initial traffic is used to characterize the degree to which the attribute included in the initial traffic does not match the labeled category of the initial traffic.

[0132] The traffic classification module 304 is used to classify the initial traffic included in the initial traffic set into normal traffic and spoofed traffic based on the classification error probability of each attribute included in each initial traffic.

[0133] The traffic processing module 305 is used to isolate the spoofed traffic when the resource utilization rate of the spoofed traffic is greater than the resource utilization rate threshold.

[0134] This invention also provides a computer storage medium storing instructions that, when executed by a computer, enable the implementation of the steps of the above-described privacy data security protection method for business information platforms.

[0135] It should be noted that the order of the above embodiments of the present invention is merely for descriptive purposes and does not represent the superiority or inferiority of the embodiments. The processes depicted in the accompanying drawings do not necessarily require a specific or sequential order to achieve the desired result. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0136] The various embodiments in this specification are described in a progressive manner. The same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on describing the differences from other embodiments.

Claims

1. A method for protecting privacy data security for business information platforms, characterized in that, The method includes: Obtain the initial traffic set and the historical traffic set. Each traffic item includes attribute values ​​of multiple attributes and at least one labeled category. Each initial traffic item includes at least one labeled category, which corresponds to a grade number. Determine a reference traffic for each initial traffic from the historical traffic set, wherein the attributes of the reference traffic for an initial traffic include one or more attributes of the initial traffic; The similarity of attribute values ​​for each labeled category included in the first initial flow is determined from the similarity of attribute values ​​between the first initial flow and each corresponding reference flow in the first attribute. The first initial flow is one of the initial flow sets. Based on the similarity of attribute values ​​corresponding to each labeled category, the overall relevance between the first attribute and each labeled category is determined. Based on the overall correlation between the first attribute and each labeled category, and the grade number of each labeled category, the classification error probability of the first attribute included in the first initial traffic is determined. The classification error probability of an attribute of an initial traffic is used to characterize the degree to which the attribute included in the initial traffic does not match the labeled category of the initial traffic. Based on the classification error probability of each attribute included in each initial traffic, the attributes included in each initial traffic are clustered to obtain the misclassification cluster and the correct classification cluster corresponding to each initial traffic. Determine the overall relevance of each erroneous attribute included in each initial traffic flow to each category in all categories. The erroneous attribute included in an initial traffic flow is the attribute included in the erroneous classification cluster corresponding to the initial traffic flow. Based on the overall relevance of each erroneous attribute included in each initial traffic to each category, and the classification error probability of each erroneous attribute included in each initial traffic, the classification skewness of each erroneous attribute included in each initial traffic to each category is determined. The classification skewness of an erroneous attribute to a category is used to characterize the degree to which the attribute value of the erroneous attribute is biased towards the category. Based on the classification bias of each erroneous attribute included in each initial traffic stream to each category, the deviation concentration of each initial traffic stream to each category is determined. The deviation concentration of an initial traffic stream to a category is used to characterize the degree to which the initial traffic stream is biased towards the category. Based on the deviation concentration of each initial traffic flow for each category, the overall deviation concentration of each initial traffic flow is determined; Based on the overall deviation concentration of each initial traffic flow, the spoofing probability of each initial traffic flow is determined; Based on the spoofing probability of each initial traffic stream, the initial traffic streams included in the initial traffic stream set are divided into normal traffic streams and spoofed traffic streams. If the resource occupancy rate of the spoofed traffic exceeds the resource occupancy rate threshold, the spoofed traffic will be isolated.

2. The privacy data security protection method for business information platforms according to claim 1, characterized in that, The method further includes: When the first attribute included in the first initial traffic is of a numerical type, the similarity of attribute values ​​between the first initial attribute value and the first reference attribute value is determined based on the difference between the first initial attribute value and the first reference attribute value. The first initial attribute value is the attribute value of the first attribute included in the first initial traffic, the first reference attribute value is the attribute value of the first attribute included in the first reference traffic of the first initial traffic, the first initial traffic is one of the initial traffic set, the first attribute is one of the multiple attributes of the first initial traffic, and the first reference traffic is one of the multiple reference traffic of the first initial traffic. If the first attribute included in the first initial traffic is of text type, the attribute value similarity between the first initial attribute value and the first reference attribute value is determined based on the cosine similarity between the keywords in the first initial attribute value and the keywords in the first reference attribute value.

3. The privacy data security protection method for business information platforms according to claim 1, characterized in that, The determination of the spoofing probability of each initial traffic flow based on the overall deviation concentration of each initial traffic flow includes: Based on the difference between the classification error probability of the misclassification cluster and the classification error probability of the correct classification cluster corresponding to each initial traffic, the basic probability of risk of each initial traffic is determined, and the classification error probability of a classification cluster is the average of the classification error probabilities of each attribute in the classification cluster. The spoofing probability of each initial traffic flow is determined based on the overall deviation concentration of each initial traffic flow and the risk basis probability of each initial traffic flow.

4. The privacy data security protection method for business information platforms according to claim 1, characterized in that, The determination of the overall deviation concentration of each initial traffic flow based on the deviation concentration of each category includes: The maximum value among the deviation concentrations of each initial flow across multiple categories is determined as the overall deviation concentration of each initial flow.

5. The privacy data security protection method for business information platforms according to claim 1, characterized in that, The method of dividing the initial traffic included in the initial traffic set into normal traffic and spoofed traffic based on the spoofing probability of each initial traffic entry includes: Arrange all initial traffic in the initial traffic set in ascending order of spoofing probability to obtain the initial traffic sequence; Based on the difference in spoofing probability between each initial traffic flow and the previous initial traffic flow in the initial traffic sequence, the degree of change of each initial traffic flow is determined; The initial flow rate with the greatest variation is determined as the boundary flow rate; Initial flows with a spoofing probability greater than the boundary flow are defined as spoofed flows, and initial flows with a spoofing probability less than or equal to the boundary flow are defined as normal flows.

6. A privacy data security protection system for a business information platform, characterized in that, The system includes a traffic acquisition module, a reference traffic determination module, a traffic analysis module, a traffic classification module, and a traffic processing module; The traffic acquisition module is used to acquire an initial traffic set and a historical traffic set. Each traffic item includes attribute values ​​of multiple attributes and at least one labeled category. The reference traffic determination module is used to determine the reference traffic for each initial traffic from the historical traffic set, wherein the attributes of the reference traffic for an initial traffic include one or more attributes of the initial traffic. The traffic analysis module is used to determine the similarity of attribute values ​​for each labeled category included in the first initial traffic from the similarity of attribute values ​​between the first initial traffic and each corresponding reference traffic in the first attribute, wherein the first initial traffic is one of the initial traffic sets; The traffic analysis module is also used to determine the overall correlation between the first attribute and each labeled category based on the similarity of the attribute values ​​corresponding to each labeled category; The traffic analysis module is used to determine the classification error probability of the first attribute included in the first initial traffic based on the overall correlation between the first attribute and each labeled category, and the level number of each labeled category. The classification error probability of an attribute in an initial traffic is used to characterize the degree to which the attribute included in the initial traffic does not match the labeled category of the initial traffic. The traffic classification module is used to cluster the attributes included in each initial traffic based on the classification error probability of each attribute included in each initial traffic, so as to obtain the misclassification cluster and the correct classification cluster corresponding to each initial traffic. The traffic classification module is also used to determine the overall correlation between each erroneous attribute included in each initial traffic and each category in all categories, wherein the erroneous attribute included in an initial traffic is the attribute included in the erroneous classification cluster corresponding to the initial traffic; The traffic classification module is further configured to determine the classification skewness of each erroneous attribute included in each initial traffic to each category based on the overall correlation between each erroneous attribute included in each initial traffic and each category, and the classification error probability of each erroneous attribute included in each initial traffic. The classification skewness of an erroneous attribute to a category is used to characterize the degree to which the attribute value of the erroneous attribute is biased towards the category. The traffic classification module is also used to determine the deviation concentration of each initial traffic to each category based on the classification skewness of each category for each erroneous attribute included in each initial traffic. The deviation concentration of an initial traffic to a category is used to characterize the degree to which the initial traffic is biased towards the category. The traffic classification module is also used to determine the overall deviation concentration of each initial traffic based on the deviation concentration of each category for each initial traffic. The traffic classification module is also used to determine the spoofing probability of each initial traffic based on the overall deviation concentration of each initial traffic. The traffic classification module is also used to classify the initial traffic included in the initial traffic set into normal traffic and disguised traffic based on the spoofing probability of each initial traffic. The traffic processing module is used to isolate the spoofed traffic when the resource occupancy rate of the spoofed traffic is greater than the resource occupancy rate threshold.

7. A computer storage medium, characterized in that, The computer storage medium stores instructions that, when executed by the computer, enable the implementation of the steps of the privacy data security protection method for a business information platform as described in any one of claims 1-5.

Images