Computer network security control method and system

Abstract

The invention discloses a computer network security control method and system, and relates to the technical field of network security, and the system comprises the following steps: collecting time sequence input, space trajectory, time attribute data and static equipment information of a user; performing denoising, normalization, feature extraction and K-means clustering on the data to generate behavior map structure data; encrypting and packaging the behavior graph structure, the equipment information and the timestamp by using an RSA algorithm to generate verification information; a watermark and a timestamp chain are embedded after the file and the verification information are packaged, the file and the verification information are transmitted through a secure channel, a transmission security coefficient is calculated, and transmission security is evaluated; a receiving end unpacks the file, monitors the identity and behavior of the user, and verifies the identity consistency through a multi-modal matching coefficient; a verification rule is locally optimized by using deep learning, a global model is updated through federated learning, and a chained log is recorded to ensure the integrity and traceability of data.

Description

Technical Field

[0001] This invention relates to the field of network security technology, specifically to a computer network security control method and system. Background Technology

[0002] Computer network security is a crucial research area in the current information age. With the widespread application of networks, the risks of network attacks and data breaches are also increasing. In traditional computer security systems, firewalls and encryption technologies are common security measures. However, these methods primarily focus on data transmission and external access control, often lacking in-depth monitoring and analysis of user behavior and internal / external authentication processes. This leaves network systems vulnerable to attacks or data breaches in certain situations.

[0003] Especially in email and file transfers, despite basic firewall protection, file security and user authentication during transmission are often insufficiently guaranteed. In such cases, malicious attackers may exploit network vulnerabilities to steal data or forge identities for unauthorized access, posing significant risks to user privacy and corporate security. Therefore, ensuring data security, user identity authenticity, and traceability of actions during file transfers has become a pressing issue. Summary of the Invention

[0004] In view of the shortcomings of the prior art, the present invention provides a computer network security control method and system to solve the problems mentioned in the background art.

[0005] To achieve the above objectives, the present invention is implemented through the following technical solution: a computer network security control system, comprising a user behavior data acquisition module, a data processing module, a verification information generation module, a transmitter graph driver encapsulation module, a receiver multimodal verification module, and a dynamic update tracing module; The user behavior data acquisition module is used to monitor user multi-source devices and collect user time-series input data, spatial trajectory data, user time attribute data and user static device information; The data processing module is used to denoise and normalize time-series data, spatial trajectory data, and time attribute data using methods such as moving average, median filtering, threshold removal, and Z-score normalization to obtain behavioral signal sequences; it uses the sliding window method to extract mean and variance statistical features to generate a set of feature vectors; it uses the K-means algorithm to classify the feature vectors to obtain behavioral category labels; it uses TF-IDF to transform the feature vectors and labels into a unified structure to form user behavior graph vectors; and it constructs a behavior graph structure from the behavior labels and graph vectors to obtain behavior graph structure data. The verification information generation module is used to encrypt and package user behavior graph structure data, static device information and timestamp information using the asymmetric encryption algorithm RSA, and integrate and encapsulate them to generate complete verification information. The sending end graph-driven encapsulation module is used to package the original file and verification information, embed a steganographic watermark and timestamp chain, encrypt and segment the file, and bind a unique decryption factor to each segment; send the file through a secure channel, calculate the transmission security coefficient Scx, and compare it with the first threshold Q1 to determine whether the transmission is secure; if it is not secure, a strategy is applied. The receiving end multimodal verification module is used to receive and unpack files encapsulated with encrypted and verification information, extract verification information, watermark features and timestamp chains, and monitor the user's multimodal identity data and operation behavior; calculate the multimodal matching coefficient MBSX and compare it with the threshold Q2 to determine whether the receiving end identity matches; if it does not match, a strategy is applied. The dynamic update traceability module is used to train the user behavior data locally using the deep learning initial model, optimize the verification rules, and upload the optimized model to the central platform through federated learning for global updates and distribution to various terminal devices; all data related to file access, verification and processing are recorded in a chain log to form a timestamp chain to ensure the traceability of operations and the integrity of data, and to prevent tampering or forgery.

[0006] Preferably, the user behavior data acquisition module is used to monitor keyboard input devices and collect user temporal input data, including: input rhythm, key duration, and keystroke interval behavioral characteristic data; monitor mouse input devices and collect user spatial trajectory data, including: mouse trajectory, click frequency, swipe speed, and pause position behavioral characteristic data; monitor screen monitoring and collect user time attribute data, including: page dwell time, switching behavior, and focus window recording behavioral characteristic data; and monitor information extraction devices and collect user static device information, including: device ID, operating system version, and resolution identity information.

[0007] Preferably, the data processing module includes a signal preprocessing unit, a feature extraction unit, a clustering analysis unit, a vectorization coding unit, and a map construction unit; The signal preprocessing unit is used to perform noise reduction processing on time-series input data, spatial trajectory data, and time attribute data using moving average, median filtering, and threshold removal methods, and to remove extreme values ​​and sensing error data. The data is normalized using the Z-score normalization method; after processing, behavioral signal sequence data is obtained. The feature extraction unit is used to extract the mean, variance, skewness, kurtosis, and frequent operation sequences from the cleaned standard behavioral signal sequence data using the sliding window method within a fixed window, performing statistical feature extraction; and obtaining a set of feature vectors. The clustering analysis unit is used to classify the feature vector set by behavioral features using the unsupervised clustering algorithm K-means, and obtain clustering behavior category labels. The vectorized encoding unit is used to use the TF-IDF encoding technique to transform the feature vector set and clustering behavior category labels into a unified structure to obtain user behavior graph vectors. The graph construction unit is used to construct a behavior graph structure by using clustered behavior category labels and user behavior graph vectors, with nodes representing operation behaviors and edges representing logical dependencies between behaviors, and to obtain behavior graph structure data.

[0008] Preferably, the verification information generation module is used to use the asymmetric encryption algorithm RSA to encrypt, package, integrate, and encapsulate user behavior graph structure data, user static device information, and timestamp information, and generate complete verification information.

[0009] Preferably, the transmitting end map-driven encapsulation module includes a packaging unit, a first calculation unit, and a first analysis unit; The packaging unit is used to package the original file and verification information, embed the user behavior graph structure data into the steganographic watermark and initial timestamp chain, encrypt the file and process it into segments, and bind each segment to a unique decryption factor. The first calculation unit is used to send the packaged file to the receiving end through a secure channel and perform real-time monitoring. Combining this with user behavior graph structure data, after dimensionless processing, it calculates and obtains the transmission security coefficient Scx, as shown in the following formula: ; In the formula, WC represents the watermark matching value, TS represents the time chain continuity, HS represents the encryption structure integrity, RE represents the retransmission anomaly rate, CE represents the channel stability, and w1, w2, w3, w4, and w5 represent weighting coefficients.

[0010] Preferably, the first analysis unit is used to preset a first threshold Q1, and compare and analyze the transmission security factor Scx with the first threshold Q1 to obtain a first evaluation result, including: When the transmission security coefficient Scx ≥ the first threshold Q1, it indicates that the transmission security performance is qualified, the file is decrypted normally, and continuous monitoring continues. When the transmission security coefficient Scx is less than the first threshold Q1, it indicates that the transmission security performance is unqualified, triggering the first warning instruction, generating the first strategy: blocking transmission, and popping up a security reminder.

[0011] Preferably, the receiver multimodal verification module includes an unpacking unit, a second calculation unit, and a second analysis unit; The unpacking unit is used by the receiving end to unpack the file structure through a preset decryption path after receiving the file that has been encapsulated with encrypted and verified information, extract the verification information, watermark features and timestamp chain, and monitor the current user's multimodal identity data and operation behavior, including device ID, input rhythm and mouse trajectory. The second calculation unit is used to monitor the current user's multimodal identity data and operational behavior, and perform feature vector similarity and structure matching with the original graph encapsulated by the sending end. After dimensionless processing, the multimodal matching coefficient MBSX is calculated and obtained, as shown in the following formula: ; In the formula, Di represents device similarity, Ks represents keyboard behavior similarity, Mt represents mouse trajectory similarity, Hb represents historical behavior similarity, Gs represents graph structure similarity, and a1, a2, a3, a4, and a5 represent weight coefficients.

[0012] Preferably, the second analysis unit is used to pre-set a second threshold Q2, and compare the multimodal matching coefficient MBSX with the second threshold Q2 to obtain a second evaluation result, including: When the multimodal matching coefficient MBSX ≥ the second threshold Q2, it indicates that the identity and behavior of the receiver are consistent with those of the sender within a safe range, and continuous monitoring is required. When the multimodal matching coefficient MBSX < the second threshold Q2, it indicates that the identity and behavior of the receiver do not conform to the security range of the sender, triggering the second warning instruction and generating the second strategy: deny access and return to the original path; interrupt the user's access request and record detailed logs, issue a security alarm, and make the behavior traceable; take protective measures and perform reverse source tracing analysis.

[0013] Preferably, the dynamic update traceability module includes an intelligent optimization model unit and an audit traceability unit; The intelligent optimization model unit is used to train the user's behavior data locally using the deep learning initial model to adapt to the performance limitations of the terminal device. The training data covers the user's identity verification process, behavior patterns, and device feature information. The verification rules are continuously adjusted and optimized through intelligent algorithms. After training, these optimized model parameters are uploaded to the central control platform through federated learning technology. The central platform will summarize the training results of each terminal device, optimize and update the global model, and distribute the improved model as the intelligent optimization model to each terminal device. Each device adjusts its local verification logic according to the updated verification rules and model to maintain the effectiveness and timeliness of the verification mechanism. The audit tracing unit records all data related to file access, verification, and processing in detail and writes it to a chain log. This log data includes timestamp information and covers the specific details of each operation, forming an audit timestamp chain. The timestamp chain is used to trace the occurrence time, operator, operation content, and related verification data of each operation, and to verify the integrity of the operation, preventing data tampering or forgery.

[0014] Preferably, a computer network security control method includes the following steps: Step 1: Monitor user's multi-source devices and collect user time-series input data, spatial trajectory data, user time attribute data, and user static device information; Step 2: Denoising and normalizing time-series data, spatial trajectory data, and temporal attribute data using methods such as moving average, median filtering, threshold removal, and Z-score normalization to obtain behavioral signal sequences; extracting mean and variance statistical features using the sliding window method to generate a set of feature vectors; classifying the feature vectors using the K-means algorithm to obtain behavioral category labels; transforming the feature vectors and labels into a unified structure using TF-IDF to form user behavior graph vectors; and constructing a behavioral graph structure from the behavioral labels and graph vectors to obtain behavioral graph structure data. Step 3: Use the asymmetric encryption algorithm RSA to encrypt and package the user behavior graph structure data, static device information, and timestamp information, and integrate and encapsulate them to generate complete verification information; Step 4: Package the original file and verification information, embed a steganographic watermark and timestamp chain, encrypt and segment the file, and bind a unique decryption factor to each segment; send the file through a secure channel, calculate the transmission security coefficient Scx, and compare it with the first threshold Q1 to determine whether the transmission is secure. If it is not secure, a strategy is applied. Step 5: Receive and unpack the file encapsulated with encrypted and verified information, extract the verification information, watermark features and timestamp chain, and monitor the user's multimodal identity data and operation behavior; calculate the multimodal matching coefficient MBSX and compare it with the threshold Q2 to determine whether the receiver's identity matches; if not, apply a strategy. Step Six: Use the initial deep learning model to train the user behavior data locally, optimize the verification rules, and upload the optimized model to the central platform through federated learning for global updates and distribution to each terminal device; record all relevant data of file access, verification and processing in a chain log to form a timestamp chain to ensure the traceability of operations and the integrity of data, and prevent tampering or forgery.

[0015] This invention provides a computer network security control method and system. It has the following beneficial effects: (1) This computer network security control method and system, through the embedding of encryption technology, steganographic watermark and timestamp chain, ensures that the file is not tampered with or forged during transmission, thereby enhancing data security. By combining the evaluation of the transmission security coefficient Scx with the threshold comparison, the system can monitor the security of file transmission in real time and trigger security policies when potential risks are detected, thereby ensuring the integrity and confidentiality of the file.

[0016] (2) This computer network security control method and system achieves in-depth verification of user identity through the monitoring and analysis of multimodal data. The system uses behavioral graph analysis and multimodal matching coefficient MBSX for real-time comparison, which can effectively prevent malicious attackers from making unauthorized access by forging identities and ensure the authenticity of user identities.

[0017] (3) This computer network security control method and system utilizes a deep learning model to train user behavior data locally and combines federated learning technology to optimize the global model, thereby continuously improving authentication rules to adapt to changes in terminal device performance and dynamic changes in user behavior. This dynamic update mechanism enables the system to maintain efficient and accurate security protection capabilities at all times.

[0018] (4) In this computer network security control method and system, all file access, verification and processing processes are recorded in detail in a chain log and form a timestamp chain to ensure the traceability of each operation. Through the timestamp chain and audit tracing mechanism, any data tampering or forgery can be detected and tracked in a timely manner, which greatly enhances the integrity of data and the transparency of operations and prevents illegal operations from occurring. Attached Figure Description

[0019] Figure 1 This is a block diagram and flowchart of a computer network security control system according to the present invention; Figure 2 This is a schematic diagram illustrating the steps of a computer network security control method according to the present invention. Detailed Implementation

[0020] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0021] Example 1 Please see Figure 1This invention provides a computer network security control method and system, including a user behavior data acquisition module, a data processing module, a verification information generation module, a sending end graph driver encapsulation module, a receiving end multimodal verification module, and a dynamic update tracing module; The user behavior data acquisition module is used to monitor user multi-source devices and collect user time-series input data, spatial trajectory data, user time attribute data and user static device information; The data processing module is used to denoise and normalize time-series data, spatial trajectory data, and time attribute data using methods such as moving average, median filtering, threshold removal, and Z-score normalization to obtain behavioral signal sequences; it uses the sliding window method to extract mean and variance statistical features to generate a set of feature vectors; it uses the K-means algorithm to classify the feature vectors to obtain behavioral category labels; it uses TF-IDF to transform the feature vectors and labels into a unified structure to form user behavior graph vectors; and it constructs a behavior graph structure from the behavior labels and graph vectors to obtain behavior graph structure data. The verification information generation module is used to encrypt and package user behavior graph structure data, static device information and timestamp information using the asymmetric encryption algorithm RSA, and integrate and encapsulate them to generate complete verification information. The sending end graph-driven encapsulation module is used to package the original file and verification information, embed a steganographic watermark and timestamp chain, encrypt and segment the file, and bind a unique decryption factor to each segment; send the file through a secure channel, calculate the transmission security coefficient Scx, and compare it with the first threshold Q1 to determine whether the transmission is secure; if it is not secure, a strategy is applied. The receiving end multimodal verification module is used to receive and unpack files encapsulated with encrypted and verification information, extract verification information, watermark features and timestamp chains, and monitor the user's multimodal identity data and operation behavior; calculate the multimodal matching coefficient MBSX and compare it with the threshold Q2 to determine whether the receiving end identity matches; if it does not match, a strategy is applied. The dynamic update traceability module is used to train the user behavior data locally using the deep learning initial model, optimize the verification rules, and upload the optimized model to the central platform through federated learning for global updates and distribution to various terminal devices; all data related to file access, verification and processing are recorded in a chain log to form a timestamp chain to ensure the traceability of operations and the integrity of data, and to prevent tampering or forgery.

[0022] In this embodiment, a multi-layered security protection system is established by integrating multiple modules, including user behavior data collection, graph construction, encryption encapsulation, transmission monitoring, and multimodal verification at the receiving end. The system not only improves the accuracy of identity verification through real-time monitoring and analysis of user behavior, but also continuously optimizes verification rules through deep learning and federated learning. This allows the system to adapt to changes in different user behavior patterns and device environments, ensuring efficient and accurate security in various scenarios. Furthermore, the recording and traceability functions of the timestamp chain make every step of the operation process traceable, preventing data tampering and forgery, and providing strong protection for the overall security and trustworthiness of the system.

[0023] Example 2 This embodiment is an explanation based on Embodiment 1. Specifically, the user behavior data acquisition module is used to monitor keyboard input devices and collect user temporal input data, including: input rhythm, key duration, and keystroke interval behavioral characteristic data; monitor mouse input devices and collect user spatial trajectory data, including: mouse trajectory, click frequency, swipe speed, and pause position behavioral characteristic data; monitor screen monitoring and collect user time attribute data, including: page dwell time, switching behavior, and focus window recording behavioral characteristic data; and monitor information extraction devices and collect user static device information, including: device ID, operating system version, and resolution identity information.

[0024] In this embodiment, comprehensive monitoring of multiple devices meticulously collects user keyboard input, mouse movements, screen activity, and static device information, enabling accurate identification of user behavior patterns. Through real-time analysis of behavioral characteristic data such as user input rhythm, keystroke duration, and mouse movements, the system can establish a unique behavioral profile for each user, thereby providing more personalized identity verification and security measures. This behavior-based security system effectively identifies abnormal behavior and potential identity forgery, significantly improving the system's ability to prevent unauthorized intrusion or access.

[0025] Example 3 This embodiment is an explanation of Embodiment 2. Specifically, the data processing module includes a signal preprocessing unit, a feature extraction unit, a clustering analysis unit, a vectorization coding unit, and a map construction unit. The signal preprocessing unit is used to perform noise reduction processing on time-series input data, spatial trajectory data, and time attribute data using moving average, median filtering, and threshold removal methods, and to remove extreme values ​​and sensing error data. The data is normalized using the Z-score normalization method; after processing, behavioral signal sequence data is obtained. The feature extraction unit is used to extract the mean, variance, skewness, kurtosis, and frequent operation sequences from the cleaned standard behavioral signal sequence data using the sliding window method within a fixed window, performing statistical feature extraction; and obtaining a set of feature vectors. The clustering analysis unit is used to classify the feature vector set by behavioral features using the unsupervised clustering algorithm K-means, and obtain clustering behavior category labels. The vectorized encoding unit is used to use the TF-IDF encoding technique to transform the feature vector set and clustering behavior category labels into a unified structure to obtain user behavior graph vectors. The graph construction unit is used to construct a behavior graph structure by using clustered behavior category labels and user behavior graph vectors, with nodes representing operation behaviors and edges representing logical dependencies between behaviors, and to obtain behavior graph structure data.

[0026] In this embodiment, through multi-level processing including signal preprocessing, feature extraction, and cluster analysis, noise is effectively removed and accurate behavioral feature data is extracted. The behavioral features are unsupervisedly classified using the K-means clustering algorithm, combined with TF-IDF encoding technology, transforming user behavior patterns into unified behavioral graph vectors. The graph construction unit further organizes these features into a behavioral graph structure with logical dependencies, thus providing an accurate foundation for subsequent identity verification and behavioral analysis. This processing method not only improves the accuracy of user behavior recognition.

[0027] Example 4 This embodiment is an explanation based on embodiment 3. Specifically, the verification information generation module is used to use the asymmetric encryption algorithm RSA to encrypt, package, integrate, and encapsulate user behavior graph structure data, user static device information, and timestamp information, and generate complete verification information.

[0028] In this embodiment, the user behavior graph structure data, static device information, and timestamp information are encrypted and packaged using the asymmetric encryption algorithm RSA to ensure the confidentiality and integrity of the verification information during transmission. This encryption and encapsulation effectively prevents information from being tampered with or forged during transmission, ensuring the authenticity and reliability of the data.

[0029] Example 5 This embodiment is an explanation of embodiment 4. Specifically, the transmitting end map driving encapsulation module includes a packaging unit, a first calculation unit, and a first analysis unit. The packaging unit is used to package the original file and verification information, embed the user behavior graph structure data into the steganographic watermark and initial timestamp chain, encrypt the file and process it into segments, and bind each segment to a unique decryption factor. The first calculation unit is used to send the packaged file to the receiving end through a secure channel and perform real-time monitoring. Combining this with user behavior graph structure data, after dimensionless processing, it calculates and obtains the transmission security coefficient Scx, as shown in the following formula: ; In the formula, WC represents the watermark matching value, TS represents the time chain continuity, HS represents the encryption structure integrity, RE represents the retransmission anomaly rate, CE represents the channel stability, and w1, w2, w3, w4, and w5 represent weighting coefficients. , , , , ,and .

[0030] In this embodiment, by packaging the original file and verification information and embedding a steganographic watermark and timestamp chain, the system ensures that the file's origin and integrity can be traced and verified during transmission. By calculating the transmission security coefficient Scx in real time and combining it with factors such as watermark matching value, time chain continuity, and encryption structure integrity, the system can assess the security of file transmission. If security vulnerabilities or anomalies occur during transmission, the system will promptly implement corresponding strategies to ensure data security and tamper-proof capabilities during file transmission.

[0031] Example 6 This embodiment is an explanation of Embodiment 1. Specifically, the first analysis unit is used to preset a first threshold Q1 and compare the transmission security factor Scx with the first threshold Q1 to obtain a first evaluation result, including: When the transmission security coefficient Scx ≥ the first threshold Q1, it indicates that the transmission security performance is qualified, the file is decrypted normally, and continuous monitoring continues. When the transmission security coefficient Scx is less than the first threshold Q1, it indicates that the transmission security performance is unqualified, triggering the first warning instruction, generating the first strategy: blocking transmission, and popping up a security reminder.

[0032] In this embodiment, by setting a first threshold Q1 for the transmission security coefficient and comparing it with the real-time calculated transmission security coefficient Scx, the security of file transmission can be intelligently assessed. When the transmission security coefficient is lower than the threshold, the system will trigger a security warning and take corresponding measures, such as blocking transmission and popping up a security reminder, thereby effectively avoiding potential security risks and ensuring the data integrity and confidentiality during file transmission, as shown in the table below:

[0033] Example 7 This embodiment is an explanation of embodiment 6. Specifically, the receiver multimodal verification module includes an unpacking unit, a second calculation unit, and a second analysis unit. The unpacking unit is used by the receiving end to unpack the file structure through a preset decryption path after receiving the file that has been encapsulated with encrypted and verified information, extract the verification information, watermark features and timestamp chain, and monitor the current user's multimodal identity data and operation behavior, including device ID, input rhythm and mouse trajectory. The second calculation unit is used to monitor the current user's multimodal identity data and operational behavior, and perform feature vector similarity and structure matching with the original graph encapsulated by the sending end. After dimensionless processing, the multimodal matching coefficient MBSX is calculated and obtained, as shown in the following formula: ; In the formula, Di represents device similarity, Ks represents keyboard behavior similarity, Mt represents mouse trajectory similarity, Hb represents historical behavior similarity, Gs represents graph structure similarity, and a1, a2, a3, a4, and a5 represent weight coefficients. , , , , ,and .

[0034] In this embodiment, by real-time monitoring of the user's multimodal identity data and operational behavior, and performing feature vector matching with the original graph encapsulated at the sending end, the multimodal matching coefficient (MBSX) is calculated. This effectively assesses the authenticity and consistency of the receiver's identity. In this way, it is possible to accurately determine whether the receiver is a legitimate user, thereby significantly improving the security of identity verification and preventing unauthorized access and data leakage.

[0035] Example 8 This embodiment is an explanation of embodiment 7. Specifically, the second analysis unit is used to preset a second threshold Q2 and compare the multimodal matching coefficient MBSX with the second threshold Q2 to obtain a second evaluation result, including: When the multimodal matching coefficient MBSX ≥ the second threshold Q2, it indicates that the identity and behavior of the receiver are consistent with those of the sender within a safe range, and continuous monitoring is required. When the multimodal matching coefficient MBSX < the second threshold Q2, it indicates that the identity and behavior of the receiver do not conform to the security range of the sender, triggering the second warning instruction and generating the second strategy: deny access and return to the original path; interrupt the user's access request and record detailed logs, issue a security alarm, and make the behavior traceable; take protective measures and perform reverse source tracing analysis.

[0036] In this embodiment, by comparing the multimodal matching coefficient MBSX with a preset second threshold Q2, the receiver can effectively identify situations where the receiver's identity and behavior are inconsistent with the sender's. When the matching coefficient falls below the security threshold, the system immediately triggers an early warning command, denies access, and implements reverse tracing analysis and security protection measures. This mechanism effectively prevents the risk of unauthorized users impersonating legitimate individuals to launch attacks, as shown in the table below:

[0037] Example 9 This embodiment is an explanation of embodiment 8. Specifically, the dynamic update traceability module includes an intelligent optimization model unit and an audit traceability unit. The intelligent optimization model unit is used to train the user's behavior data locally using the deep learning initial model to adapt to the performance limitations of the terminal device. The training data covers the user's identity verification process, behavior patterns, and device feature information. The verification rules are continuously adjusted and optimized through intelligent algorithms. After training, these optimized model parameters are uploaded to the central control platform through federated learning technology. The central platform will summarize the training results of each terminal device, optimize and update the global model, and distribute the improved model as the intelligent optimization model to each terminal device. Each device adjusts its local verification logic according to the updated verification rules and model to maintain the effectiveness and timeliness of the verification mechanism. The audit tracing unit records all data related to file access, verification, and processing in detail and writes it to a chain log. This log data includes timestamp information and covers the specific details of each operation, forming an audit timestamp chain. The timestamp chain is used to trace the occurrence time, operator, operation content, and related verification data of each operation, and to verify the integrity of the operation, preventing data tampering or forgery.

[0038] In this embodiment, by combining local training and federated learning of the deep learning model, the intelligent optimization model unit can continuously adjust and optimize the verification rules of the terminal device. This allows the system to dynamically adapt to different scenarios and needs based on user behavior and device characteristics, improving the accuracy and efficiency of verification. Simultaneously, the audit and traceability unit ensures the traceability of operations and the integrity of data by recording all relevant data in a chained log, effectively preventing tampering or forgery and enhancing the system's security and reliability.

[0039] Example 10 For a computer network security control method, please refer to [link / reference]. Figure 2 This includes the following steps: Step 1: Monitor user's multi-source devices and collect user time-series input data, spatial trajectory data, user time attribute data, and user static device information; Step 2: Denoising and normalizing time-series data, spatial trajectory data, and temporal attribute data using methods such as moving average, median filtering, threshold removal, and Z-score normalization to obtain behavioral signal sequences; extracting mean and variance statistical features using the sliding window method to generate a set of feature vectors; classifying the feature vectors using the K-means algorithm to obtain behavioral category labels; transforming the feature vectors and labels into a unified structure using TF-IDF to form user behavior graph vectors; and constructing a behavioral graph structure from the behavioral labels and graph vectors to obtain behavioral graph structure data. Step 3: Use the asymmetric encryption algorithm RSA to encrypt and package the user behavior graph structure data, static device information, and timestamp information, and integrate and encapsulate them to generate complete verification information; Step 4: Package the original file and verification information, embed a steganographic watermark and timestamp chain, encrypt and segment the file, and bind a unique decryption factor to each segment; send the file through a secure channel, calculate the transmission security coefficient Scx, and compare it with the first threshold Q1 to determine whether the transmission is secure. If it is not secure, a strategy is applied. Step 5: Receive and unpack the file encapsulated with encrypted and verified information, extract the verification information, watermark features and timestamp chain, and monitor the user's multimodal identity data and operation behavior; calculate the multimodal matching coefficient MBSX and compare it with the threshold Q2 to determine whether the receiver's identity matches; if not, apply a strategy. Step Six: Use the initial deep learning model to train the user behavior data locally, optimize the verification rules, and upload the optimized model to the central platform through federated learning for global updates and distribution to each terminal device; record all relevant data of file access, verification and processing in a chain log to form a timestamp chain to ensure the traceability of operations and the integrity of data, and prevent tampering or forgery.

[0040] In this embodiment, through the collection of user behavior data from multiple sources and continuous optimization of the deep learning model, the entire verification process not only ensures the security of data transmission but also intelligently adapts to changes in terminal devices and the diversity of user behavior. Each operation and verification process is meticulously recorded in a chained log, ensuring data integrity and traceability and preventing tampering or forgery. Furthermore, global optimization using federated learning technology ensures that the verification rules and models remain efficient and up-to-date, enhancing the overall system's security and intelligence.

[0041] The threshold is set to facilitate comparison. The size of the threshold depends on the amount of sample data and the number of bases set by those skilled in the art for each set of sample data; as long as it does not affect the ratio between the parameter and the quantized value, it is acceptable.

[0042] The above formulas are all derived from software simulation using a large amount of data and are selected to be close to the actual values. The coefficients in the formulas are set by those skilled in the art according to the actual situation. The above description is only a preferred embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any equivalent substitutions or changes made by those skilled in the art within the technical scope disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the protection scope of the present invention.

Claims

1. A computer network security control system, characterized by, The application comprises a user behavior data collection module, a data processing module, a verification information generation module, a sending end graph driving packaging module, a receiving end multi-modal verification module and a dynamic update tracing module. The user behavior data collection module is used for monitoring user multi-source equipment, collecting user time sequence input data, spatial trajectory data, user time attribute data and user static equipment information. The data processing module is used for denoising and normalizing the time sequence data, spatial trajectory data and time attribute data by using sliding average, median filtering, threshold rejection and Z-score standardization method, obtaining behavior signal sequence; using sliding window method to extract mean and variance statistical features, generating a feature vector set; using K-means algorithm to classify the feature vectors, obtaining behavior category labels; using TF-IDF to convert the feature vectors and labels into a unified structure, forming a user behavior graph vector; constructing the behavior labels and graph vectors into a behavior graph structure, obtaining behavior graph structure data. The verification information generation module is used for using an asymmetric encryption algorithm RSA to encrypt and package the user behavior graph structure data, static equipment information and timestamp information, and integrating and packaging to generate complete verification information. The sending end graph driving packaging module is used for packaging the original file and the verification information, embedding steganographic watermark and timestamp chain, encrypting and segmenting the file, binding a unique decryption factor to each segment; sending the file through a secure channel, calculating a transmission safety coefficient Scx, and comparing the transmission safety coefficient Scx with a first threshold Q1 to determine whether the transmission is safe, and giving a strategy if the transmission is not safe. The receiving end multi-modal verification module is used for receiving and unpackaging the file encrypted and packaged with the verification information, extracting the verification information, watermark features and timestamp chain, and monitoring the multi-modal identity data and operation behavior of the user. A multi-modal matching coefficient MBSX is calculated and compared with a threshold Q2 to determine whether the identity of the receiving end matches, and a strategy is given if the identity does not match. The dynamic update tracing module is used for using a deep learning initial model to locally train the user behavior data, optimizing the verification rules, uploading the optimized model to a central platform through federated learning for global update, and issuing the model to each terminal device; recording the related data of all file access, verification and processing processes into a chain log to form a timestamp chain, ensuring the traceability of the operation and the integrity of the data, and preventing tampering or forgery.

2. The computer network security control system of claim 1, wherein, The user behavior data collection module is used for monitoring keyboard input equipment, collecting user time sequence input data including input rhythm, key duration and keystroke interval behavior feature data; monitoring mouse input equipment, collecting user spatial trajectory data including mouse trajectory, click frequency, sliding speed and pause position behavior feature data; monitoring screen monitoring, collecting user time attribute data including page dwell time, switching behavior and focus window record behavior feature data; monitoring information extraction equipment, collecting user static equipment information including device ID, operating system version and resolution identity information.

3. The computer network security control system of claim 2, wherein, The data processing module comprises a signal preprocessing unit, a feature extraction unit, a clustering analysis unit, a vectorization coding unit and a graph construction unit; The signal preprocessing unit is configured to use a sliding average, median filtering and threshold rejection method to perform denoising processing on the time series input data, spatial trajectory data and time attribute data, and to reject extreme value and sensor error data, and to use a Z-score standardization method to normalize the data; and to obtain behavior signal sequence data after processing; The feature extraction unit is configured to use a sliding window method to extract mean, variance, skewness, kurtosis and frequent operation sequence in a fixed window for the cleaning standard behavior signal sequence data, and to perform statistical feature extraction; A feature vector set is obtained; The clustering analysis unit is configured to use an unsupervised clustering algorithm K-means to classify the feature vector set according to behavior features, and to obtain a clustering behavior category label; The vectorization coding unit is configured to use an encoding technology TF-IDF to convert the feature vector set and the clustering behavior category label into a unified structure, and to obtain a user behavior graph vector; The graph construction unit is configured to represent operation behaviors as nodes and logical dependencies between behaviors as edges, to construct a behavior graph structure, and to obtain behavior graph structure data.

4. The computer network security control system of claim 3, wherein, The verification information generation module is configured to use an asymmetric encryption algorithm RSA to encrypt and package the user behavior graph structure data, user static device information and timestamp information, to integrate and package, and to generate complete verification information.

5. The computer network security control system of claim 4, wherein, The sending end graph driving packaging module comprises a packaging unit, a first calculation unit and a first analysis unit; The packaging unit is configured to package the original file and the verification information, to embed the user behavior graph structure data into steganographic watermark and initial timestamp chain, to encrypt and segment the file, and to bind a unique decryption factor to each segment; The first calculation unit is configured to send the packaged file to the receiving end through a secure channel, to perform real-time monitoring, to calculate a transmission safety coefficient Scx after dimensionless processing of the user behavior graph structure data, and to obtain the transmission safety coefficient Scx according to the following formula: ； In the formula, WC represents a watermark matching value, TS represents time chain continuity, HS represents encryption structure integrity, RE represents retransmission abnormality rate, CE represents channel stability, and w1, w2, w3, w4 and w5 represent weight coefficients.

6. The computer network security control system of claim 5, wherein, The first analysis unit is configured to preset a first threshold Q1, to compare and analyze the transmission safety coefficient Scx with the first threshold Q1, and to obtain a first evaluation result including: When the transmission safety coefficient Scx is greater than or equal to the first threshold Q1, it indicates that the transmission safety performance is qualified, the file is normally decrypted, and continuous monitoring is performed; When the transmission safety coefficient Scx is less than the first threshold Q1, it indicates that the transmission safety performance is unqualified, a first early warning instruction is triggered, and a first strategy of blocking transmission and popping up a security reminder is generated.

7. The computer network security control system of claim 6, wherein, The receiving end multi-modal verification module comprises an unpackaging unit, a second calculation unit and a second analysis unit; The unpacking unit is used for receiving end to receive the file encapsulated by the encrypted and verified information, and to unpack the file structure through a preset decryption path to extract the verification information, watermark features and timestamp chain, and to monitor the multi-modal identity data and operation behavior of the current user, including device ID, input rhythm and mouse trajectory. The second computing unit is used for monitoring the multi-modal identity data and operation behavior of the current user, and performing similarity and structural matching of feature vectors with the original graph encapsulated by the sending end. After dimensionless processing, a multi-modal matching coefficient MBSX is calculated, and the formula is as follows: ; In the formula, Di represents device similarity, Ks represents keyboard behavior similarity, Mt represents mouse trajectory similarity, Hb represents historical behavior similarity, Gs represents atlas structure similarity, and a1, a2, a3, a4 and a5 represent weight coefficients.

8. The computer network security control system of claim 7, wherein, The second analysis unit is used for presetting a second threshold Q2 in advance, and comparing and analyzing the multi-modal matching coefficient MBSX with the second threshold Q2 to obtain a second evaluation result, including: When the multi-modal matching coefficient MBSX is greater than or equal to the second threshold Q2, it indicates that the identity and behavior of the receiving end are consistent with the sending end within the safety range, and continuous monitoring is performed; When the multi-modal matching coefficient MBSX is less than the second threshold Q2, it indicates that the identity and behavior of the receiving end are not consistent with the sending end within the safety range, a second warning instruction is triggered, a second strategy of rejecting access and returning in the original way is generated, the access request of the user is interrupted and detailed logs are recorded, security alarm is performed, the behavior is tracked, protection measures are taken, and reverse source analysis is performed.

9. The computer network security control system of claim 8, wherein, The dynamic update and source tracing module includes an intelligent optimization model unit and an audit source unit. The intelligent optimization model unit is used for using a deep learning initial model to locally train the behavior data of the user to adapt to the performance limitation of the terminal device, the training data covers the identity verification process, behavior mode and device feature information of the user, the verification rules are continuously adjusted and optimized through intelligent algorithms, after the training is completed, the optimized model parameters are uploaded to the central control platform through the federated learning technology, the central platform summarizes the training results of each terminal device, optimizes and updates the global model, and distributes the improved model to each terminal device as the intelligent optimization model, and each device adjusts its local verification logic according to the updated verification rules and model to maintain the effectiveness and timeliness of the verification mechanism; The audit source unit is used for all data related to file access, verification and processing process will be recorded in detail and written into chain logs, these log data include timestamp information and cover the specific details of each operation, constitute the timestamp chain TimestampChain, the timestamp chain is used to trace the occurrence time, operator, operation content and related verification data of each operation, and verify the integrity of the operation to prevent tampering or falsification of data.

10. A computer network security control method, comprising the computer network security control system of any one of claims 1-9, characterized in that, The method comprises the following steps: Step one, monitor the user's multi-source device, collect the user's time sequence input data, spatial trajectory data, user time attribute data and user static device information; Step two, denoise and normalize the time series data, spatial trajectory data and time attribute data by moving average, median filtering, threshold rejection and Z-score standardization method, get the behavior signal sequence; use sliding window method to extract mean and variance statistical features, generate feature vector set; use K-means algorithm to classify feature vectors and get behavior category label; use TF-IDF to convert feature vectors and labels into unified structure, form user behavior graph vector; construct behavior label and graph vector into behavior graph structure, get behavior graph structure data; Step three, use asymmetric encryption algorithm RSA to encrypt and package user behavior graph structure data, static device information and timestamp information, and integrate and package to generate complete verification information; Step four, package the original file with the verification information, embed steganographic watermark and timestamp chain, encrypt and segment the file, and bind a unique decryption factor to each segment; send the file through a secure channel, calculate the transmission security coefficient Scx, and compare it with the first threshold Q1 to determine whether the transmission is safe, and give a strategy if it is not safe; Step five, receive and unpack the file encrypted and packaged with verification information, extract verification information, watermark features and timestamp chain, and monitor the user's multi-modal identity data and operation behavior; Calculate the multi-modal matching coefficient MBSX and compare it with the threshold Q2 to determine whether the receiving end identity matches, and give a strategy if it does not match; Step six, use deep learning initial model to train user behavior data locally, optimize verification rules, and upload the optimized model to the central platform through federated learning for global update and distribution to each terminal device; record all file access, verification and processing related data into chain log to form timestamp chain, ensure the traceability of operation and the integrity of data, and prevent tampering or forgery.

Images