Big data security supervision system and method based on computer

Abstract

The invention discloses a big data security supervision system and method based on a computer, and belongs to the technical field of data security. The system comprises a data acquisition module, a data processing module, an operation management module and a data storage module, the data acquisition module is used for acquiring transmission information and historical records; the data processing module is used for classifying target objects in the transmission information, searching whether the target objects exist in historical records or not, if yes, calculating the similarity between transmission files corresponding to the target objects and historical transmission files corresponding to the historical records, and substituting the similarity into a formula to obtain the accuracy rate of the transmission behavior; the operation management module is used for carrying out early warning on transmission behaviors of which the accuracy is smaller than an accuracy threshold and the target object does not exist in historical records, prompting a user to carry out selection again, and determining a transmission mode according to a user selection result; and the data storage module stores the transmission information of each time into a historical record to provide data support for subsequent transmission judgment.

Description

Technical Field

[0001] This invention relates to the field of data security technology, specifically to a computer-based big data security monitoring system and method. Background Technology

[0002] Data security refers to the technologies, policies, and measures that protect data from unauthorized access, use, modification, damage, or disclosure. Data transmission is required at every stage of data collection, analysis, processing, and storage. Therefore, data transmission security is a crucial aspect of ensuring overall data security.

[0003] Currently, security measures for data transmission primarily rely on data encryption, firewalls, and intrusion detection systems to prevent tampering or leakage during transmission. While these techniques offer some protection for data transmission over networks, they are far from sufficient to address complex real-world scenarios. For instance, the flow and ownership of most data are decided manually, and human error can lead to data leaks and security risks due to various reasons. Current technologies often struggle to accurately predict these human-induced data breaches. Therefore, a method is needed to effectively prevent data from being mistakenly transmitted to the wrong recipient, thereby improving data transmission security and reducing the probability of human error. Summary of the Invention

[0004] The purpose of this invention is to provide a computer-based big data security monitoring system and method to solve the problems mentioned in the background art.

[0005] To address the aforementioned technical problems, the present invention provides the following technical solution: a computer-based big data security monitoring system, which includes a data acquisition module, a data processing module, an operation management module, and a data storage module.

[0006] The data acquisition module is used to collect transmission information and historical records; the data processing module is used to classify target objects in the transmission information, search for the existence of target objects in the historical records, and if they exist, calculate the similarity between the transmission file corresponding to the target object and the corresponding historical transmission file in the historical records, and substitute it into a formula to obtain the accuracy of the current transmission behavior; the operation management module is used to issue warnings for transmission behaviors with an accuracy rate lower than the accuracy threshold or where the target object does not exist in the historical records, prompting the user to reselect, and determining the transmission method based on the user's selection result; the data storage module stores the transmission information of each transmission in the historical records to provide data support for subsequent transmission judgments.

[0007] The data acquisition unit includes a transmission information acquisition unit and a historical record acquisition unit.

[0008] The transmission information acquisition unit is used to collect the selection duration, target object, and transmission file for this transmission. The selection duration refers to the time consumed by the user from the start of selecting the target object to the confirmation of the target object. The target object includes the transmission address, and the transmission file includes the name and content.

[0009] The historical record collection unit is used to collect all historical transmission records. Each historical transmission record includes the historical target object and the historical transmission file.

[0010] The data processing module includes a type classification unit and a behavior analysis unit.

[0011] The type classification unit is used to classify the target object selected by the user. It searches the historical transmission records to see if a target object with the same transmission address exists; if it does, it is classified as a recorded target object; otherwise, it is classified as an unrecorded target object.

[0012] The historical transfer records indicate that the user has previously transferred files with the target object once or multiple times, suggesting no error in the transfer address and a low probability of risk. The absence of historical transfer records indicates that the user has not previously transferred files with the target object, potentially indicating an incorrect transfer address and a higher probability of risk.

[0013] The behavior analysis unit is used to analyze the transmission behavior between the user and the recorded target object and calculate the accuracy. First, the time difference between when the user starts selecting the target object and when the user confirms the target object is calculated as the selection time. Then, the historical transmission files and the current transmission file in all historical transmission records corresponding to the target object are obtained. A similarity algorithm is used to calculate the name and content similarity of the transmission files, and the maximum value is selected and substituted into the formula to calculate the accuracy.

[0014] The selection duration represents the time spent selecting the target object during the file transfer process. If the selection time is too short, it may be a subconscious decision, which carries a higher probability of risk.

[0015] The operation management module includes an early warning and reminder unit and a transmission management unit.

[0016] The early warning unit is used to issue early warnings for transmission behavior. First, it determines whether the target object type is an unrecorded target object. If the result is yes, an early warning is issued; if the result is no, it then determines whether the accuracy rate is less than the accuracy rate threshold. If the result is yes, an early warning is issued; if the result is no, the file transmission begins.

[0017] The alert is a pop-up window that prompts the user to verify the transmission address information and provides two options: confirm and cancel. Confirmation means confirming the transmission behavior, and cancellation means canceling the transmission behavior. When the user selects the confirm option, the alert result is set to TRUE, and the time difference between the pop-up window time and the confirmation option time is calculated as the verification time. When the user selects the cancel option, the alert result is set to FALSE.

[0018] The warning information provides address verification, which can reduce erroneous transmissions caused by negligence or haste, and improve the accuracy and reliability of file transmission.

[0019] The transmission management unit is used to control file transmission. If the warning result is FALSE, the file transmission is terminated; if the warning result is TRUE, it is determined whether the verification time exceeds the time threshold. If the result is yes, the file transmission begins; if the result is no, the file transmission is delayed.

[0020] Delaying file transfers gives users time to consider the security of the file transfer. During the delay, users can reconfirm the security of the destination address, avoiding sending files to insecure locations.

[0021] The data storage module is used to store each transmission information into the history record. When the user transmits again, the history record is automatically retrieved for judgment.

[0022] A computer-based big data security supervision method, comprising the following steps: S1. When the user selects to transfer a file, the transfer information and history are collected; S2. When the user clicks the transfer button, intercept and analyze the user's transfer behavior; S3. Calculate the accuracy of this transmission behavior and determine whether to issue a warning; S4. Control the transmission operation based on the accuracy or warning results.

[0023] In S1, the transmission information refers to the user's selection duration, target object, and transmission file for this transmission. The selection duration refers to the time consumed from the user initially selecting the target object to confirming it. The target object includes the transmission address, and the transmission file includes its name and content. The history record refers to all of the user's historical transmission records. Each historical transmission record includes the historical target object and the historical transmission file.

[0024] The target object refers to the entity or receiver being transferred during file or data transfer. The transferred file refers to the specific file to be moved from one location to another. The transfer address of the target object is the destination address of the file transfer. All historical transfer records contain the names and contents of files exchanged between the user and each target object.

[0025] In S2, the specific steps are as follows: S201. When the user clicks the transmit button, the transmit behavior is immediately intercepted.

[0026] S202. Obtain the transmission address of the target object in the transmission information, search in the historical transmission records, and determine whether there is a historical target object with the same transmission address.

[0027] S203. If the same transmission address exists, it means that the user and the target object have previously transferred files, and the target object is determined to have a record; if the same transmission address does not exist, it means that the user and the target object have never transferred files, and the target object is determined to have no record.

[0028] In S3, the specific steps are as follows: S301. When the target object is determined to have no records, proceed to step S307. When the target object is determined to have records, retrieve all historical transmission files from the corresponding historical transmission records.

[0029] S302. The names of all historically transferred files are placed in a name information set, which includes... Where k represents the number of historically transferred files, This represents the name of the k-th historical file.

[0030] S303. The contents of all historically transmitted files are placed in a content information set, which includes... , This represents the content of the k-th historical file.

[0031] S304. Obtain the name and content of the transmitted file, and calculate the similarity between each element and the name information set and the content information set. Add the resulting similarities in ascending order to the similarity sets. The similarity algorithm steps for name and content are the same. The name similarity calculation steps are as follows: S304-1. Perform word segmentation on the file name, converting each name into a list of words.

[0032] S304-2. Remove duplicate words from each word list to obtain two different word sets.

[0033] S304-3. Merge two different sets of words to obtain the total set of words.

[0034] S304-4. Construct a vector for each word in the total word set, and substitute it into the formula to calculate the similarity between two names. The formula is as follows: In the formula, For file name similarity, This represents the magnitude of vector a. This represents the magnitude of vector b. This represents the dot product of vectors a and b.

[0035] S305. Obtain the maximum value in the similarity set and substitute it into the formula to calculate the accuracy of this transmission behavior. The formula is as follows: In the formula, For accuracy, To select the duration influence coefficient, It is a constant. To select the duration, For transmission frequency influence coefficient, This represents the total number of historically transferred files in the corresponding historical transfer record. This represents the total number of historically transferred files in all historical transfer records. The similarity influence coefficient. It represents the maximum value in the similarity set.

[0036] S306. Determine if the accuracy rate is less than the accuracy rate threshold. If yes, initiate an alert and proceed to step S307. If no, terminate the interception operation and begin file transfer.

[0037] S307. A pop-up window prompts the user to verify the transfer address, providing two options: Confirm and Cancel. Confirmation means confirming the transfer action, and Cancel means canceling the transfer action. When the user selects the Confirm option, the warning result is set to TRUE, and the time difference between the pop-up window time and the Confirm option time is calculated as the verification duration. When the user selects the Cancel option, the warning result is set to FALSE, and the file transfer is terminated.

[0038] In S4, the control of the transmission operation is based on the case where the warning result is TRUE; it checks whether the verification time is greater than the time threshold. If the result is yes, the interception operation is terminated and the file transmission begins; if the result is no, the interception operation is terminated and the file transmission is delayed.

[0039] The delay duration is set by the user or administrator, primarily to prevent data leaks caused by user error or negligence, and to give users sufficient time to react and revert. Files will not be transferred within the delay duration; after the delay, files will be transferred automatically.

[0040] Compared with the prior art, the beneficial effects achieved by the present invention are: 1. This invention calculates the similarity between the name and content of the transmitted file and the name and content of the transmitted file in the historical record, and then substitutes the results into a formula to obtain the accuracy of the current transmission behavior, which can more accurately evaluate the accuracy of the transmission behavior.

[0041] 2. This invention issues a warning message to prompt the user to verify the transmission address, preventing incorrect input. After the warning message is sent, the verification time is assessed to determine whether to delay or immediately send the transmission, thereby improving the security and controllability of the transmission.

[0042] 3. This invention analyzes transmission addresses to determine if identical transmission addresses exist in historical records, thereby distinguishing between unfamiliar and familiar transmission addresses. Unfamiliar transmission addresses trigger immediate warnings, prompting users to verify their data and enabling early detection of potential data transmission errors.

[0043] In summary, by analyzing the target object, this invention can effectively prevent data from being mistakenly transmitted to the wrong recipient, improve the security of data transmission, and reduce the probability of human error. Attached Figure Description

[0044] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings: Figure 1 This is a schematic diagram of the structure of a computer-based big data security monitoring system according to the present invention; Figure 2 This is a flowchart illustrating a computer-based big data security supervision method according to the present invention. Detailed Implementation

[0045] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0046] Please see Figure 1 The present invention provides a computer-based big data security monitoring system, which includes a data acquisition module, a data processing module, an operation management module and a data storage module.

[0047] The data acquisition module collects transmission information and historical records; the data processing module classifies target objects in the transmission information, searches the historical records for the existence of target objects, and if they exist, calculates the similarity between the transmission file corresponding to the target object and the corresponding historical transmission file in the historical records, and substitutes it into a formula to obtain the accuracy of the current transmission behavior; the operation management module issues warnings for transmission behaviors with an accuracy rate lower than the accuracy threshold or where the target object does not exist in the historical records, prompting the user to reselect, and determines the transmission method based on the user's selection; the data storage module stores each transmission information in the historical records to provide data support for subsequent transmission judgments.

[0048] The data acquisition unit includes a transmission information acquisition unit and a historical record acquisition unit.

[0049] The transmission information acquisition unit is used to collect the selection duration, target object, and transmission file for this transmission. The selection duration refers to the time consumed from the user's initial selection of the target object to its confirmation. The target object includes the transmission address, and the transmission file includes its name and content.

[0050] The historical record collection unit is used to collect all historical transmission records. Each historical transmission record includes the historical target object and the historical transmission file.

[0051] The data processing module includes a type classification unit and a behavior analysis unit.

[0052] The type classification unit is used to classify the target object selected by the user. It searches the historical transmission records to see if a target object with the same transmission address exists; if it does, it is classified as a recorded target object; otherwise, it is classified as an unrecorded target object.

[0053] The historical transfer records indicate that the user has previously transferred files with the target object once or multiple times, suggesting no error in the transfer address and a low probability of risk. The absence of historical transfer records indicates that the user has not previously transferred files with the target object, potentially indicating an incorrect transfer address and a higher probability of risk.

[0054] The behavior analysis unit analyzes the transmission behavior between the user and the recorded target object and calculates the accuracy. First, it calculates the time difference between when the user selects the target object and when the target object is confirmed, as the selection duration. Then, it retrieves the historical transmission files and the current transmission file from all historical transmission records corresponding to the target object. A similarity algorithm is used to calculate the name and content similarity of the transmission files, and the maximum value is substituted into the formula to calculate the accuracy.

[0055] The selection duration represents the time spent selecting the target object during the file transfer process. If the selection time is too short, it may be a subconscious decision, which carries a higher probability of risk.

[0056] The operation management module includes an early warning and reminder unit and a transmission management unit.

[0057] The early warning unit is used to issue warnings for transmission behavior. First, it determines whether the target object type is an unrecorded target object. If the result is yes, an early warning is issued; if the result is no, it then determines whether the accuracy rate is less than the accuracy rate threshold. If the result is yes, an early warning is issued; if the result is no, the file transmission begins.

[0058] The alert is a pop-up window that prompts the user to verify the transmission address information and provides two options: confirm and cancel. Confirmation means confirming the transmission behavior, and cancellation means canceling the transmission behavior. When the user selects the confirm option, the alert result is set to TRUE, and the time difference between the pop-up window time and the confirmation option time is calculated as the verification time. When the user selects the cancel option, the alert result is set to FALSE.

[0059] The warning information provides address verification, which can reduce erroneous transmissions caused by negligence or haste, and improve the accuracy and reliability of file transmission.

[0060] The transmission management unit is used to control file transmission. If the warning result is FALSE, the file transmission is terminated; if the warning result is TRUE, it checks whether the verification time exceeds the time threshold. If the result is yes, the file transmission begins; if the result is no, the file transmission is delayed.

[0061] Delaying file transfers gives users time to consider the security of the file transfer. During the delay, users can reconfirm the security of the destination address, avoiding sending files to insecure locations.

[0062] The data storage module stores each transmission information into the history record. When the user transmits again, the history record is automatically retrieved for judgment.

[0063] Please see Figure 2 This invention provides a computer-based big data security supervision method, which includes the following steps: S1. When the user selects to transfer a file, the transfer information and history are collected; S2. When the user clicks the transfer button, intercept and analyze the user's transfer behavior; S3. Calculate the accuracy of this transmission behavior and determine whether to issue a warning; S4. Control the transmission operation based on the accuracy or warning results.

[0064] In S1, the transmission information refers to the user's selection duration, target object, and transmission file for this transmission. The selection duration refers to the time consumed from the user initially selecting the target object to confirming it. The target object includes the transmission address, and the transmission file includes its name and content. The history record refers to all of the user's historical transmission records. Each historical transmission record includes the historical target object and the historical transmission file.

[0065] The target object refers to the entity or receiver being transferred during file or data transfer. The transferred file refers to the specific file to be moved from one location to another. The transfer address of the target object is the destination address of the file transfer. All historical transfer records contain the names and contents of files exchanged between the user and each target object.

[0066] In S2, the specific steps are as follows: S201. When the user clicks the transmit button, the transmit behavior is immediately intercepted.

[0067] S202. Obtain the transmission address of the target object in the transmission information, search in the historical transmission records, and determine whether there is a historical target object with the same transmission address.

[0068] S203. If the same transmission address exists, it means that the user and the target object have previously transferred files, and the target object is determined to have a record; if the same transmission address does not exist, it means that the user and the target object have never transferred files, and the target object is determined to have no record.

[0069] In S3, the specific steps are as follows: S301. When the target object is determined to have no records, proceed to step S307. When the target object is determined to have records, retrieve all historical transmission files from the corresponding historical transmission records.

[0070] S302. The names of all historically transferred files are placed in a name information set, which includes... Where k represents the number of historically transferred files, This represents the name of the k-th historical file.

[0071] S303. The contents of all historically transmitted files are placed in a content information set, which includes... , This represents the content of the k-th historical file.

[0072] S304. Obtain the name and content of the transmitted file, and calculate the similarity between each element and the name information set and the content information set. Add the resulting similarities in ascending order to the similarity sets. The similarity algorithm steps for name and content are the same. The name similarity calculation steps are as follows: S304-1. Perform word segmentation on the file name, converting each name into a list of words.

[0073] S304-2. Remove duplicate words from each word list to obtain two different word sets.

[0074] S304-3. Merge two different sets of words to obtain the total set of words.

[0075] S304-4. Construct a vector for each word in the total word set, and substitute it into the formula to calculate the similarity between two names. The formula is as follows: In the formula, For file name similarity, This represents the magnitude of vector a. This represents the magnitude of vector b. This represents the dot product of vectors a and b.

[0076] S305. Obtain the maximum value in the similarity set and substitute it into the formula to calculate the accuracy of this transmission behavior. The formula is as follows: In the formula, For accuracy, To select the duration influence coefficient, It is a constant. To select the duration, For transmission frequency influence coefficient, This represents the total number of historically transferred files in the corresponding historical transfer record. This represents the total number of historically transferred files in all historical transfer records. The similarity influence coefficient. It represents the maximum value in the similarity set.

[0077] S306. Determine if the accuracy rate is less than the accuracy rate threshold. If yes, initiate an alert and proceed to step S307. If no, terminate the interception operation and begin file transfer.

[0078] S307. A pop-up window prompts the user to verify the transfer address, providing two options: Confirm and Cancel. Confirmation means confirming the transfer action, and Cancel means canceling the transfer action. When the user selects the Confirm option, the warning result is set to TRUE, and the time difference between the pop-up window time and the Confirm option time is calculated as the verification duration. When the user selects the Cancel option, the warning result is set to FALSE, and the file transfer is terminated.

[0079] In S4, the control of the transmission operation is based on the case where the warning result is TRUE; it checks whether the verification time is greater than the time threshold. If the result is yes, the interception operation is terminated and the file transmission begins; if the result is no, the interception operation is terminated and the file transmission is delayed.

[0080] The delay duration is set by the user or administrator, primarily to prevent data leaks caused by user error or negligence, and to give users sufficient time to react and revert. Files will not be transferred within the delay duration; after the delay, files will be transferred automatically.

[0081] Example 1: Assume a user performs file transfers on three target objects: A1, A2, and A3. A1 and A2 have records in the file transfer history, while A3 does not. Then: A3 performs an early warning operation, while A1 and A2 calculate the accuracy rate. Assuming the influence coefficient of duration is 0.03, the constant is 1.2, the influence coefficient of transmission frequency is 0.3, the total number of historical transmission files in all historical transmission records is 100, and the influence coefficient of similarity is 0.7; A1 selects a duration of 5 seconds, the total number of historically transmitted files in the corresponding historical transmission records is 25, and the maximum value in the similarity set is 65%; A2 selects a duration of 2 seconds, the total number of historically transmitted files in the corresponding historical transmission records is 12, and the maximum value in the similarity set is 20%; then the accuracy rates of A1 and A2 are: A1: 0.7948 A2: 0.2901 Assuming the accuracy threshold is 0.5, file A1 begins transmission, and file A2 issues an alert. Assuming the time threshold is 5 seconds, the verification time for A2 is 3 seconds, and the verification time for A3 is 6 seconds; then: File A2 will be transmitted with a delay, while file A3 will begin transmission.

[0082] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus.

[0083] Finally, it should be noted that the above descriptions are merely preferred embodiments of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing embodiments or make equivalent substitutions for some of the technical features. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A computer-based big data security monitoring system, characterized in that: The system includes a data acquisition module, a data processing module, an operation management module, and a data storage module; The data acquisition module is used to collect transmission information and historical records; the data processing module is used to classify the target objects in the transmission information, search the historical records to see if the target objects exist, and if they exist, calculate the similarity between the transmission file corresponding to the target object and the corresponding historical transmission file in the historical records, and substitute it into the formula to obtain the accuracy of the current transmission behavior. The operation management module is used to issue warnings for transmission behaviors with an accuracy rate lower than the accuracy threshold or where the target object does not exist in the historical records, prompting the user to make a new selection and determining the transmission method based on the user's selection result; The data storage module stores the transmission information of each transmission in the history record, providing data support for subsequent transmission judgments.

2. The computer-based big data security monitoring system according to claim 1, characterized in that: The data acquisition unit includes a transmission information acquisition unit and a historical record acquisition unit; The transmission information acquisition unit is used to acquire the selection duration, target object, and transmission file for this transmission; the selection duration refers to the time consumed by the user from the start of selecting the target object to the confirmation of the target object, the target object includes the transmission address, and the transmission file includes the name and content; The historical record collection unit is used to collect all historical transmission records. Each historical transmission record includes the historical target object and the historical transmission file.

3. The computer-based big data security monitoring system according to claim 1, characterized in that: The data processing module includes a type classification unit and a behavior analysis unit; The type classification unit is used to classify the target object selected by the user into types; it searches the historical transmission records to see if there is a target object with the same transmission address. If it exists, it is classified as a recorded target object; if it does not exist, it is classified as an unrecorded target object. The behavior analysis unit is used to analyze the transmission behavior between the user and the recorded target object and calculate the accuracy. First, it calculates the time difference between when the user starts selecting the target object and when the user confirms the target object, as the selection time. Secondly, obtain the historical transmission files and the current transmission file from all historical transmission records corresponding to the target object, use a similarity algorithm to calculate the name and content similarity of the transmission files, and select the maximum value to substitute into the formula to calculate the accuracy.

4. The computer-based big data security monitoring system according to claim 1, characterized in that: The operation management module includes an early warning and reminder unit and a transmission management unit; The early warning unit is used to issue early warnings for transmission behavior; it first determines whether the target object type is a target object without records, and if the result is yes, it issues an early warning; If the result is negative, then check if the accuracy is less than the accuracy threshold. If the result is positive, issue a warning; if the result is negative, the file transfer will begin. The alert is a pop-up window that prompts the user to verify the transmission address information and provides two options: confirm and cancel. Confirmation means confirming the transmission behavior, and cancellation means canceling the transmission behavior. When the user selects the confirm option, the alert result is set to TRUE, and the time difference between the pop-up window time and the confirmation option time is calculated as the verification time. When the user selects the cancel option, the alert result is set to FALSE; The transmission management unit is used to control file transmission; If the warning result is FALSE, the file transfer is terminated; if the warning result is TRUE, it is determined whether the verification time exceeds the time threshold. If the result is yes, the file transfer begins; if the result is no, the file transfer is delayed.

5. A computer-based big data security monitoring system according to claim 1, characterized in that: The data storage module is used to store each transmission information into the history record. When the user transmits again, the history record is automatically retrieved for judgment.

6. A computer-based big data security supervision method, characterized in that: The method includes the following steps: S1. When the user selects to transfer a file, the transfer information and history are collected; S2. When the user clicks the transfer button, intercept and analyze the user's transfer behavior; S3. Calculate the accuracy of this transmission behavior and determine whether to issue a warning; S4. Control the transmission operation based on the accuracy or warning results.

7. A computer-based big data security supervision method according to claim 6, characterized in that: In S1, the transmission information refers to the user's selection duration, target object, and transmission file for this transmission; the selection duration refers to the time consumed by the user from the start of selecting the target object to the confirmation of the target object, the target object includes the transmission address, and the transmission file includes the name and content; the history refers to all the user's historical transmission records, and each historical transmission record includes the historical target object and the historical transmission file.

8. A computer-based big data security supervision method according to claim 6, characterized in that: In S2, the specific steps are as follows: S201. When the user clicks the transmit button, immediately intercept the transmission behavior; S202. Obtain the transmission address of the target object in the transmission information, search in the historical transmission records, and determine whether there is a historical target object with the same transmission address. S203. If the same transmission address exists, it means that the user and the target object have previously transferred files, and the target object is determined to have a record; if the same transmission address does not exist, it means that the user and the target object have never transferred files, and the target object is determined to have no record.

9. A computer-based big data security supervision method according to claim 6, characterized in that: In S3, the specific steps are as follows: S301. When the target object is determined to have no record, proceed to step S307; when the target object is determined to have a record, obtain all historical transmission files in the corresponding historical transmission record. S302. The names of all historically transferred files are placed in a name information set, which includes... Where k represents the number of historically transferred files, This represents the name of the k-th historical file. S303. The contents of all historically transmitted files are placed in a content information set, which includes... , This represents the content of the k-th historical file. S304. Obtain the name and content of the transmitted file, and calculate the similarity with each element in the name information set and content information set respectively. Add the obtained similarities in ascending order to the similarity set. The similarity algorithm steps for name and content are the same. The name similarity calculation steps are as follows: S304-1. Perform word segmentation on file names, converting each name into a list of words; S304-2. Remove duplicate words from each word list to obtain two different word sets; S304-3. Merge two different sets of words to obtain the total set of words; S304-4. Construct a vector for each word in the total word set, and substitute it into the formula to calculate the similarity between two names. The formula is as follows: In the formula, For file name similarity, This represents the magnitude of vector a. This represents the magnitude of vector b. This represents the dot product of vectors a and b. S305. Obtain the maximum value in the similarity set and substitute it into the formula to calculate the accuracy of this transmission behavior. The formula is as follows: In the formula, ZQD represents the accuracy rate. To select the duration influence coefficient, It is a constant. To select the duration, For transmission frequency influence coefficient, This represents the total number of historically transferred files in the corresponding historical transfer record. This represents the total number of historically transferred files in all historical transfer records. The similarity influence coefficient. The maximum value in the similarity set; S306. Determine if the accuracy rate is less than the accuracy rate threshold. If yes, start the warning operation and proceed to step S307. If no, terminate the interception operation and start file transfer. S307. A pop-up window prompts the user to verify the transfer address, providing two options: Confirm and Cancel. Confirmation means confirming the transfer action, and Cancel means canceling the transfer action. When the user selects the Confirm option, the warning result is set to TRUE, and the time difference between the pop-up window time and the Confirm option time is calculated as the verification duration. When the user selects the Cancel option, the warning result is set to FALSE, and the file transfer is terminated.

10. A computer-based big data security supervision method according to claim 6, characterized in that: In S4, the control of the transmission operation is based on the case where the warning result is TRUE; it checks whether the verification time is greater than the time threshold. If the result is yes, the interception operation is terminated and the file transmission begins. If the result is negative, the interception operation will be terminated and the file transmission will be delayed.

Images