A network security early warning system and method based on big data

Abstract

The application relates to the technical field of network security, and discloses a network security early warning system and method based on big data, which comprises the following modules: a data acquisition module, which is used for acquiring various associated data of a database in a real-time enterprise data backup process; a data processing module, which is used for performing real-time preprocessing on the acquired various associated data; a data analysis module, which is used for performing abnormality analysis and data leakage analysis on enterprise data according to the preprocessed various associated data, and performing abnormality risk judgment and leakage risk judgment according to analysis results; and an early warning processing module, which is used for acquiring a risk level of an enterprise data backup behavior according to the abnormality risk judgment result and the leakage risk judgment result, and making a quick response treatment according to the risk level. The abnormality risk value and the leakage risk value are acquired by collecting various associated data in a backup process, and whether abnormality risk and data leakage exist in the backup process of enterprise data is judged.

Description

Technical Field

[0001] This invention relates to the field of network security technology, specifically to a network security early warning system and method based on big data. Background Technology

[0002] In the process of enterprise digital transformation, core data relies on backup to ensure security. However, the backup process involves the entire chain of data reading, transmission, and storage, which is extremely vulnerable to attacks. Unauthorized IPs may access sensitive data without authorization, abnormal transmission rates may indicate that bandwidth has been illegally seized, and sensitive data may also be illegally transmitted across regions. If such risks are not dealt with in time, they may lead to data leakage and compliance penalties. In the traditional model, enterprises mostly remedy the situation after the risk occurs, but the loss is already irreversible. Therefore, network security early warning is needed. By monitoring key backup indicators in real time, we can detect risk signs in advance, buy time for handling, and nip the risk in the bud. However, existing backup security alerts have certain shortcomings. The existing monitoring dimensions are relatively simple, ignore multiple risk indicators, and rely heavily on experience-based judgment, resulting in a high rate of false alarms and missed alarms. This leads to a delay in risk alerts and makes it difficult to protect enterprise data security in a timely and effective manner. Summary of the Invention

[0003] The purpose of this invention is to provide a network security early warning system and method based on big data, so as to solve the problems faced in the above-mentioned background technology.

[0004] The objective of this invention can be achieved through the following technical solutions: A big data-based network security early warning system includes the following modules: The data acquisition module is used to acquire various related data from the database in real time during the enterprise data backup process; The data processing module performs real-time preprocessing on the acquired related data. The data analysis module performs anomaly and data leakage analysis on enterprise data based on the preprocessed related data, and makes anomaly and leakage risk assessments based on the analysis results. The early warning and processing module obtains the risk level of the enterprise's data backup behavior based on the results of the abnormal risk assessment and the leakage risk assessment, and makes rapid response actions based on the risk level.

[0005] Preferably, the associated data includes: the standard deviation of the transmission rate per second during the backup process, the number of accesses to sensitive data, the number of unauthorized IP accesses, and the amount of data transferred across regions during the backup process. The data analysis module operates as follows: Based on the historical data and big data of the normal backup of the enterprise data, the baseline values ​​and fluctuation thresholds of the various related data are preset. The baseline values ​​include the standard deviation of transmission rate, the number of accesses to sensitive data, the number of accesses to unauthorized IP addresses, and the amount of data transmitted across regions. Based on the aforementioned correlation data, the baseline values ​​of the aforementioned correlation data, and the fluctuation threshold, feature data is calculated and obtained in real time. The feature data includes the slope of the change in the standard deviation of the transmission rate and the correlation between unauthorized IPs and sensitive data. The abnormal risk value and leakage risk value in the enterprise data backup process are calculated and obtained based on the aforementioned related data and feature data. The obtained abnormal risk value is compared with the abnormal judgment threshold to determine whether the database is abnormal during the enterprise data backup process. The obtained leakage risk value is compared with the leakage judgment threshold to determine whether there is sensitive data leakage during the enterprise data backup process.

[0006] Preferably, the method for obtaining the abnormal risk value is as follows: The transmission rate ratio is calculated based on the standard deviation of the transmission rate per second during the current backup process and the baseline value of the standard deviation of the transmission rate per second; then, the standard deviation of the transmission rate per second during the current backup process is compared with the transmission rate fluctuation threshold. If the standard deviation of the transfer rate per second during the current backup process is greater than the transfer rate fluctuation threshold, the difference between the standard deviation of the transfer rate per second during the current backup process and the transfer rate fluctuation threshold is compared with the benchmark value to obtain the transfer rate ratio coefficient. The transfer rate ratio coefficient is used as the exponent of the natural constant, and the transfer rate ratio is combined to obtain the abnormal contribution value of the transfer rate fluctuation. The difference in access counts is calculated based on the number of accesses to sensitive data during the backup process of the enterprise data and the baseline value of access counts to sensitive data. The difference in access counts is compared with the baseline value of access counts to sensitive data to obtain the sensitive data access ratio coefficient. The slope of the change in the standard deviation of the transmission rate is used as the exponent of the natural constant. The abnormal contribution value of sensitive data access frequency is calculated by combining the sensitive data access ratio coefficient. Based on the number of unauthorized IP accesses during the backup process of the enterprise data and the correlation between unauthorized IPs and sensitive data, the unauthorized IP access anomaly value is obtained. The number of unauthorized IP accesses is used as the exponent of the natural constant to calculate the unauthorized IP access anomaly contribution value. The compliance anomaly contribution value for cross-regional transmission is obtained based on the cross-regional transmission data volume and the benchmark value of cross-regional transmission data volume. The abnormal risk value is calculated by combining the abnormal contribution values ​​of transmission rate fluctuations, sensitive data access frequency, unauthorized IP access, and compliance of cross-regional transmission.

[0007] Preferably, the method for obtaining the leakage risk value is as follows: Set the risk monitoring time period based on the acquisition time of each related data, and obtain the total number of accesses to sensitive data and the number of unauthorized IPs accessing the database within the risk monitoring time period. The sensitive data access multiple per second is calculated based on the risk monitoring period and the average number of accesses to sensitive data per second. The instantaneous risk value per second is calculated based on the sensitive data access multiple per second and the number of unauthorized IP accesses to the database per second. The total risk for the risk monitoring period is obtained based on the instantaneous risk per second. The average risk is obtained based on the total risk within the risk monitoring period and the total duration of the risk monitoring period. The risk value of cross-regional transmission is obtained by comparing the cross-regional data transmission volume during the backup process with the baseline value of cross-regional data transmission volume. The risk value of unauthorized access to sensitive data is obtained by comparing the product of the total number of accesses by unauthorized IPs and the total number of accesses to sensitive data during the backup process with the baseline value of accesses to sensitive data. The risk value of unauthorized access to sensitive data is used as an index of a natural constant. The ratio of cross-regional transmission is obtained by combining the cross-regional transmission data volume with the baseline value of cross-regional transmission data volume. The cross-domain unauthorized sensitive risk value is calculated by calculating the temporal distribution entropy of sensitive data access. The leakage risk value is calculated based on the cross-domain unauthorized sensitive risk value and the average risk value.

[0008] Preferably, the method for obtaining the correlation between the unauthorized IP and the sensitive data is as follows: The sensitive data range of the enterprise data is obtained based on the enterprise's predefined sensitive data, and the unauthorized IP range is determined based on the authorized IP of the enterprise's record backup; Obtain the operations that accessed the database IP from the database logs; Get whether the IP address accessing the database matches the range of unauthorized IP addresses. If they match, further check whether the unauthorized IP address's actions involve accessing sensitive data. If the unauthorized IP operation involves accessing sensitive data, then obtain the operation type, access frequency, and access duration of the unauthorized IP accessing sensitive data; The operation type, access frequency, and access duration for obtaining sensitive data from unauthorized IPs are normalized, and the correlation between unauthorized IPs and sensitive data is calculated comprehensively.

[0009] Preferably, the anomaly detection result and the leakage detection result include: Low-level risk: The abnormal risk value is less than or equal to the first judgment threshold for abnormal risk, and the leakage risk value is less than or equal to the first judgment threshold for leakage risk; Intermediate risk: The abnormal risk value is greater than the first abnormal risk judgment threshold and less than or equal to the second abnormal risk judgment threshold, or the leakage risk value is greater than the first leakage risk judgment threshold and less than or equal to the second leakage risk judgment threshold; High risk: The abnormal risk value is greater than the second judgment threshold for abnormal risk or the leakage risk value is greater than the second judgment threshold for leakage risk.

[0010] Preferably, the rapid response process based on the risk level includes: If the enterprise's data backup behavior is considered low-risk, then data backup will not be stopped; only a risk log will be recorded. If the enterprise's data backup behavior is classified as medium risk, then the backup of the relevant sensitive data will be suspended, unauthorized IPs will be blocked, and an alert will be sent to a human. If the enterprise's data backup behavior is deemed high-risk, immediately cut off the cross-regional data transmission channel, terminate the full backup task, and trigger the database read-only mode.

[0011] A big data-based network security early warning method, implemented through a big data-based network security early warning system, includes the following steps: Step 1: Obtain all related data from the database during the enterprise data backup process in real time; Step 2: Perform real-time preprocessing on the acquired related data; Step 3: Based on the preprocessed related data, perform anomaly analysis and data leakage analysis on the enterprise data, and assess the anomaly risk and leakage risk based on the analysis results; Step 4: Based on the results of the anomaly risk assessment and the leakage risk assessment, obtain the risk level of the enterprise's data backup behavior, and take rapid response actions according to the risk level.

[0012] The beneficial effects of this invention are: 1. This invention collects various data during the backup process, including the standard deviation of the transmission rate per second, the number of accesses to sensitive data, the number of accesses to unauthorized IP addresses, and the amount of data transmitted across regions, to obtain anomaly risk values ​​and leakage risk values. These anomaly risk values ​​and leakage risk values ​​are then compared with the set anomaly judgment thresholds to determine whether there are any anomalies or data leaks in the enterprise data during the backup process. The early warning processing module then executes a tiered automatic response and manual collaborative handling, and the strategy is dynamically adjusted based on the review and optimization mechanism.

[0013] Of course, any product implementing this invention does not necessarily need to achieve all of the advantages described above at the same time. Attached Figure Description

[0014] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0015] Figure 1 This is a system module block diagram of the present invention.

[0016] Figure 2 This is a flowchart of the early warning method of the present invention. Detailed Implementation

[0017] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0018] Please see Figure 1 As shown, this invention is a network security early warning system based on big data, including a data acquisition module, a data processing module, a data analysis module, and an early warning processing module. The data acquisition module is mainly used to acquire various related data of the database during the enterprise data backup process in real time. These related data include: the standard deviation of the transmission rate per second during the backup process, the number of accesses to sensitive data, the number of accesses to unauthorized IPs, and the amount of data transmitted across regions during the backup process. The standard deviation of the transmission rate per second can capture abnormal transmission fluctuations in real time, such as bandwidth contention caused by illegal data copying. The number of accesses to sensitive data can monitor whether the frequency of core data being touched deviates from the normal baseline to avoid targeted theft. The number of accesses to unauthorized IPs can block illegal access by unregistered entities and block the acquisition of data outside of authorized permissions. The amount of data transmitted across regions can control whether data is illegally flowing to non-preset regions. The data processing module is mainly used to perform real-time preprocessing on the standard deviation of the transmission rate per second, the number of accesses to sensitive data, the number of accesses to unauthorized IPs, and the amount of data transmitted across regions during the backup process. This includes unifying the format and unit of various data, such as unifying the transmission rate unit to MB / s, and using linear interpolation to supplement missing data during the acquisition process. These are all mature existing technologies. The data analysis module is mainly used to perform database anomaly analysis and data leakage analysis on enterprise data backup behavior based on the preprocessed related data, and to obtain anomaly judgment results and leakage judgment results. Based on historical data and big data from normal backups of enterprise data, preset baseline values ​​and fluctuation thresholds for various related data. The baseline values ​​include the standard deviation of transmission rate, the number of accesses to sensitive data, the number of accesses to unauthorized IP addresses, and the amount of data transmitted across regions. Based on various related data, the baseline values ​​of various related data, and the fluctuation threshold, characteristic data is calculated and obtained in real time. The characteristic data includes the slope of the change in the standard deviation of the transmission rate and the correlation between unauthorized IPs and sensitive data. Based on various related and characteristic data, calculate and obtain the abnormal risk value and leakage risk value during the enterprise data backup process; The method for obtaining abnormal risk values ​​is as follows: Calculate the ratio of the transfer rate to the standard deviation of the transfer rate per second during the current backup process, and then compare the standard deviation of the transfer rate per second during the current backup process with the transfer rate fluctuation threshold. If the standard deviation of the transfer rate per second during the current backup process is greater than the transfer rate fluctuation threshold, the difference between the standard deviation of the transfer rate per second during the current backup process and the transfer rate fluctuation threshold is compared with the benchmark value to obtain the transfer rate ratio coefficient. The ratio is used as the exponent of the natural constant. The abnormal contribution value of the transfer rate fluctuation is obtained by combining the standard deviation of the transfer rate per second during the current backup process and the transfer rate ratio coefficient. The difference in access frequency is calculated by comparing the number of accesses to sensitive data during the backup process with the baseline value of sensitive data access frequency. The difference in access frequency is then compared with the baseline value of sensitive data access frequency to obtain the sensitive data access ratio coefficient. The slope of the change in the standard deviation of the transmission rate is used as the exponent of the natural constant. The sensitive data access ratio coefficient is then used to calculate the abnormal contribution value of sensitive data access frequency. The abnormal value of unauthorized IP access is obtained by comparing the number of unauthorized IP accesses during the backup process with the correlation between unauthorized IPs and sensitive data. The abnormal contribution value of unauthorized IP access is calculated by taking the number of unauthorized IP accesses as the exponent of the natural constant and combining the abnormal value of unauthorized IP access. The compliance anomaly contribution value for cross-regional transmission is obtained based on the cross-regional transmission data volume and the benchmark value of cross-regional transmission data volume. The abnormal risk value is calculated by combining the abnormal contribution values ​​of transmission rate fluctuations, sensitive data access frequency, unauthorized IP access, and compliance issues in cross-regional transmission, using the following formula: ; in, This is an abnormal risk value. The contribution value to abnormal transmission rate fluctuations. This is the ratio of transmission rates. The standard deviation of the transfer rate per second during the current backup process. This is the baseline value for the standard deviation of the transmission rate. For fluctuation threshold, This is the transmission rate scaling factor. For the judgment function, when hour, ,when hour, , The abnormally high frequency of access to sensitive data contributed to the value. The difference in the number of visits. This is a sensitive data access ratio coefficient. For the first The number of times sensitive data is accessed in the current backup. This serves as a baseline value for the number of times sensitive data is accessed. The slope of the change in the standard deviation of the transmission rate. Contribute value to unauthorized IP access anomalies. Number of unauthorized IP accesses. To determine the correlation between unauthorized IP addresses and sensitive data, This is an abnormal value indicating unauthorized IP access. Used to distinguish whether unauthorized IPs have accessed sensitive data. This item is 1, meaning the risk of unauthorized IP access is determined solely by the number of access attempts. The contribution value for compliance anomalies in cross-regional transmission. To account for the amount of data transferred across regions during the backup process, This serves as a benchmark for the amount of data transmitted across regions. , , , The weighting coefficients and ; slope of change of transmission rate standard deviation The acquisition method involves collecting the standard deviation of transmission rate in fixed time windows, with each window set to 1 minute. This means the standard deviation of transmission rate within that window is calculated every minute, creating a time series of time and transmission rate standard deviation. The most recent consecutive windows are selected as the analysis samples. Multiple coordinate points are formed by using the window number as the x-axis and the corresponding standard deviation of transmission rate as the y-axis. Linear least squares is then used to fit straight lines to these points, yielding the fitted equation. The slope of the change in the standard deviation of the transmission rate is obtained based on the fitted equation, where, The standard deviation of the transmission rate, The slope of the change in the standard deviation of the transmission rate. For window number, This is the intercept.

[0019] Assuming a company is currently performing a full database backup, the following metrics and baseline data are included: current transfer rate standard deviation. MB / s, historical baseline MB / s, normal fluctuation threshold MB / s, slope of the standard deviation of transmission rate The number of visits were respectively Second-rate, Second-rate, Second, historical baseline Number of unauthorized IP accesses Second, correlation with sensitive data Cross-regional data transmission volume GB, historical baseline GB, , , , ; The contribution value of abnormal transmission rate fluctuations is: ; The contribution value of abnormal access frequency to sensitive data is: ; The contribution value of unauthorized IP access anomalies is: ; The contribution value for compliance anomalies in cross-regional transmission is: ; The abnormal risk value is: .

[0020] The method for obtaining the leakage risk value is as follows: Set the risk monitoring time period based on the acquisition time of each related data, and obtain the total number of accesses to sensitive data and the number of unauthorized IPs accessing the database within the risk monitoring time period. The sensitive data access multiple per second is calculated based on the risk monitoring period and the average number of accesses to sensitive data per second. The instantaneous risk value per second is calculated based on the sensitive data access multiple per second and the number of unauthorized IP accesses to the database per second. The total risk for the risk monitoring period is obtained based on the instantaneous risk per second. The average risk is obtained based on the total risk within the risk monitoring period and the total duration of the risk monitoring period. The risk value of cross-regional transmission is obtained by comparing the cross-regional data transmission volume during the backup process with the baseline value of cross-regional data transmission volume. The risk value of unauthorized access to sensitive data is obtained by comparing the product of the total number of accesses by unauthorized IPs and the total number of accesses to sensitive data during the backup process with the baseline value of accesses to sensitive data. Using the risk value of unauthorized access to sensitive data as an exponent of a natural constant, the cross-regional transmission risk value is obtained by combining the cross-regional data transmission volume during the backup process with the baseline value of cross-regional data transmission volume, and by calculating the temporal distribution entropy of sensitive data access. The leakage risk value is then calculated based on this cross-regional unauthorized access risk value and the average risk value, using the formula: ; in, This represents the leakage risk value. For the risk monitoring period, This is the starting point for risk monitoring. This is the end point for risk monitoring. for Time-sensitive data access frequency This represents the average number of accesses to sensitive data per second. In order to be in The number of times an unauthorized IP address accesses the database at any given moment. To access risk values, This is the average risk value. This represents the total number of accesses from unauthorized IPs during the backup process. This represents the total number of accesses to sensitive data during normal historical backups. This represents the total number of accesses to sensitive data during the backup process. This is a cross-domain unauthorized sensitive risk value. This represents a risk value for unauthorized access to sensitive data. Risk monitoring period Number of sub-time periods to be split For the first The percentage of sensitive accesses in a given time period out of the total number of accesses. The temporal distribution entropy for accessing sensitive data. This represents the maximum historical value for unauthorized cross-domain sensitive risks. , The weighting coefficients and ;

[0021] Continuing with the example of outliers mentioned above, the risk monitoring period... Within the specified timeframe, during this risk monitoring period, unauthorized IP access and sensitive data access occurred simultaneously for 30 seconds; no such access occurred during the remaining time. The number of sensitive data accesses per second during these 30 seconds is also recorded. Number of times unauthorized IP addresses accessed the database. =1 time, average number of sensitive data accesses per second Number of times sensitive data was accessed Number of times sensitive data was accessed during normal historical backups Next, the entropy of the time distribution of sensitive data access The maximum value for unauthorized cross-domain sensitive risks is 1000.

[0022] The access risk value is: The total risk during the risk monitoring period is then... The average risk is ; The risk value for unauthorized access to sensitive data is: The cross-domain unauthorized sensitive risk value is: ; Leakage risk value: ; Sensitive data access time distribution entropy middle, The number of sub-time periods divided into a risk monitoring period, where the number of sub-time periods is equal. It is the first The proportion of sensitive accesses in a given time period to the total number of accesses, and the temporal distribution entropy, are mature existing technologies, which will not be discussed in detail here; The obtained abnormal risk values ​​are compared with the abnormal judgment threshold to determine whether the database is abnormal during the enterprise data backup process. The obtained leakage risk value is compared with the leakage judgment threshold to determine whether there is sensitive data leakage during the enterprise data backup process; The results of anomaly assessment and leakage assessment include: Low-level risk: The abnormal risk value is less than or equal to the first judgment threshold for abnormal risk, and the leakage risk value is less than or equal to the first judgment threshold for leakage risk; Intermediate risk: The abnormal risk value is greater than the first abnormal risk judgment threshold and less than or equal to the second abnormal risk judgment threshold, or the leakage risk value is greater than the first leakage risk judgment threshold and less than or equal to the second leakage risk judgment threshold; High risk: The abnormal risk value is greater than the second judgment threshold for abnormal risk or the leakage risk value is greater than the second judgment threshold for leakage risk; Taking the setting of anomaly judgment thresholds, including a first anomaly risk judgment threshold of 30 and a second anomaly risk judgment threshold of 80, as an example, the leakage risk thresholds include a first leakage risk threshold of 0.1 and a second leakage risk judgment threshold of 0.2. Continuing with the previous example, the anomaly risk value is 104.4, which is greater than the second judgment threshold, and the leakage risk value is 0.2576, which is also greater than the second judgment threshold. At this point, the current enterprise data backup is classified as high-risk. The early warning and handling module determines the risk level of the enterprise's data backup behavior based on the anomaly and leakage assessment results, and then takes rapid response actions according to the risk level. If the enterprise's data backup behavior is considered low-risk, then data backup will not be stopped; only a risk log will be recorded. If the enterprise's data backup behavior is classified as medium risk, then the backup of the relevant sensitive data will be suspended, unauthorized IPs will be blocked, and an alert will be sent to a human. If the enterprise's data backup behavior is deemed high-risk, immediately cut off the cross-regional data transmission channel, terminate the full backup task, and trigger the database read-only mode.

[0023] In one embodiment, a big data-based network security early warning method, such as Figure 2 As shown, the method includes the following steps: Step 1: Obtain all related data from the database during the enterprise data backup process in real time; Step 2: Perform real-time preprocessing on the acquired related data; Step 3: Based on the preprocessed related data, perform anomaly analysis and data leakage analysis on the enterprise data, and assess the anomaly risk and leakage risk based on the analysis results; Step 4: Based on the results of the anomaly risk assessment and the leakage risk assessment, obtain the risk level of the enterprise's data backup behavior, and take rapid response actions according to the risk level.

[0024] The above description is merely an example and illustration of the concept of the present invention. Those skilled in the art can make various modifications or additions to the specific embodiments described or use similar methods to replace them, as long as they do not deviate from the concept of the invention or exceed the scope defined in the claims, they should all fall within the protection scope of the present invention.

Claims

1. A network security early warning system based on big data, characterized in that, Includes the following modules: The data acquisition module is used to acquire various related data from the database in real time during the enterprise data backup process; The associated data includes: the standard deviation of the transfer rate per second during the backup process, the number of accesses to sensitive data, the number of accesses from unauthorized IP addresses, and the amount of data transferred across regions during the backup process; The data processing module performs real-time preprocessing on the acquired related data. The data analysis module performs anomaly and data leakage analysis on enterprise data based on the preprocessed related data, and makes anomaly and leakage risk assessments based on the analysis results. The data analysis module operates as follows: Based on the historical data and big data of the normal backup of the enterprise data, the baseline values ​​and fluctuation thresholds of the various related data are preset. The baseline values ​​include the standard deviation of transmission rate, the number of accesses to sensitive data, the number of accesses to unauthorized IP addresses, and the amount of data transmitted across regions. Based on the aforementioned correlation data, the baseline values ​​of the aforementioned correlation data, and the fluctuation threshold, feature data is calculated and obtained in real time. The feature data includes the slope of the change in the standard deviation of the transmission rate and the correlation between unauthorized IPs and sensitive data. Based on the aforementioned related data and feature data, calculate and obtain the abnormal risk value and leakage risk value during the enterprise data backup process; The obtained abnormal risk value is compared with the abnormal judgment threshold to determine whether the database is abnormal during the enterprise data backup process. The obtained leakage risk value is compared with the leakage judgment threshold to determine whether there is sensitive data leakage during the enterprise data backup process; The method for obtaining the abnormal risk value is as follows: The transmission rate ratio is calculated based on the standard deviation of the transmission rate per second during the current backup process and the baseline value of the standard deviation of the transmission rate; then, the standard deviation of the transmission rate per second during the current backup process is compared with the transmission rate fluctuation threshold. If the standard deviation of the transfer rate per second during the current backup process is greater than the transfer rate fluctuation threshold, the difference between the standard deviation of the transfer rate per second during the current backup process and the transfer rate fluctuation threshold is compared with the benchmark value to obtain the transfer rate ratio coefficient. The transfer rate ratio coefficient is used as the exponent of the natural constant, and the transfer rate ratio is combined to obtain the abnormal contribution value of the transfer rate fluctuation. The difference in access counts is calculated based on the number of accesses to sensitive data during the backup process of the enterprise data and the baseline value of access counts to sensitive data. The difference in access counts is compared with the baseline value of access counts to sensitive data to obtain the sensitive data access ratio coefficient. The slope of the change in the standard deviation of the transmission rate is used as the exponent of the natural constant. The abnormal contribution value of sensitive data access frequency is calculated by combining the sensitive data access ratio coefficient. Based on the number of unauthorized IP accesses during the backup process of the enterprise data and the correlation between unauthorized IPs and sensitive data, the unauthorized IP access anomaly value is obtained. The number of unauthorized IP accesses is used as the exponent of the natural constant to calculate the unauthorized IP access anomaly contribution value. The compliance anomaly contribution value for cross-regional transmission is obtained based on the cross-regional transmission data volume and the benchmark value of cross-regional transmission data volume. The abnormal risk value is calculated by combining the abnormal contribution values ​​of transmission rate fluctuations, sensitive data access frequency, unauthorized IP access, and compliance of cross-regional transmission. The method for obtaining the leakage risk value is as follows: Set the risk monitoring time period based on the acquisition time of each related data, and obtain the total number of accesses to sensitive data and the number of unauthorized IPs accessing the database within the risk monitoring time period. The sensitive data access multiple per second is calculated based on the risk monitoring period and the average number of accesses to sensitive data per second. The instantaneous risk value per second is calculated based on the sensitive data access multiple per second and the number of unauthorized IP accesses to the database per second. The total risk for the risk monitoring period is obtained based on the instantaneous risk per second. The average risk is obtained based on the total risk within the risk monitoring period and the total duration of the risk monitoring period. The risk value of cross-regional transmission is obtained by comparing the cross-regional data transmission volume during the backup process with the baseline value of cross-regional data transmission volume. The risk value of unauthorized access to sensitive data is obtained by comparing the product of the total number of accesses by unauthorized IPs and the total number of accesses to sensitive data during the backup process with the baseline value of accesses to sensitive data. The risk value of unauthorized access to sensitive data is used as an index of a natural constant. The ratio of cross-regional transmission is obtained by combining the cross-regional transmission data volume with the cross-regional transmission data volume benchmark value. The cross-regional unauthorized sensitive risk value is calculated by calculating the temporal distribution entropy of sensitive data access. The leakage risk value is calculated based on the cross-regional unauthorized sensitive risk value and the average risk value. The method for obtaining the correlation between the unauthorized IP address and the sensitive data is as follows: The sensitive data range of the enterprise data is obtained based on the enterprise's predefined sensitive data, and the unauthorized IP range is determined based on the authorized IP of the enterprise's record backup; Obtain the operations that accessed the database IP from the database logs; Get whether the IP address accessing the database matches the range of unauthorized IP addresses. If they match, further check whether the unauthorized IP address's actions involve accessing sensitive data. If the unauthorized IP operation involves accessing sensitive data, then obtain the operation type, access frequency, and access duration of the unauthorized IP accessing sensitive data; Normalize the operation type, access frequency, and access duration for obtaining access to sensitive data from unauthorized IPs, and comprehensively calculate the correlation between unauthorized IPs and sensitive data. The results of anomaly assessment and leakage assessment include: Low-level risk: The abnormal risk value is less than or equal to the first judgment threshold for abnormal risk, and the leakage risk value is less than or equal to the first judgment threshold for leakage risk; Intermediate risk: The abnormal risk value is greater than the first abnormal risk judgment threshold and less than or equal to the second abnormal risk judgment threshold, or the leakage risk value is greater than the first leakage risk judgment threshold and less than or equal to the second leakage risk judgment threshold; High risk: The abnormal risk value is greater than the second judgment threshold for abnormal risk or the leakage risk value is greater than the second judgment threshold for leakage risk; The early warning and processing module obtains the risk level of the enterprise's data backup behavior based on the results of the abnormal risk assessment and the leakage risk assessment, and makes rapid response actions based on the risk level.

2. The network security early warning system based on big data according to claim 1, characterized in that, The rapid response process based on risk level includes: If the enterprise's data backup behavior is considered low-risk, then data backup will not be stopped; only a risk log will be recorded. If the enterprise's data backup behavior is classified as medium risk, then the backup of the relevant sensitive data will be suspended, unauthorized IPs will be blocked, and an alert will be sent to a human. If the enterprise's data backup behavior is deemed high-risk, immediately cut off the cross-regional data transmission channel, terminate the full backup task, and trigger the database read-only mode.

3. A big data-based network security early warning method, wherein the method is controlled and implemented through a big data-based network security early warning system as described in any one of claims 1-2, characterized in that, Includes the following steps: Step 1: Obtain all related data from the database during the enterprise data backup process in real time; Step 2: Perform real-time preprocessing on the acquired related data; Step 3: Based on the preprocessed related data, perform anomaly analysis and data leakage analysis on the enterprise data, and assess the anomaly risk and leakage risk based on the analysis results; Step 4: Based on the results of the anomaly risk assessment and the leakage risk assessment, obtain the risk level of the enterprise's data backup behavior, and take rapid response actions according to the risk level.

Images