A method and system for network security data detection

Abstract

This invention relates to the field of network security detection technology, and discloses a network security data detection method and system, comprising the following steps: Step 1: A data reader reads data from a network target; Step 2: The network target obtains data reading anomaly values ​​based on various data points during data reading, and determines whether a verification test needs to be triggered on the data reader based on the anomaly values; Step 3: The network target protection system obtains various data points when the data reader performs the triggered verification test; Step 4: Based on the various data points of the verification test, the system obtains the comprehensive threat value of the data reader, and freezes the access permissions of the data reader based on the comprehensive threat value. By simulating a data reader reading network target data, anomaly values ​​are calculated based on the various data points of the data reader. If the anomaly exceeds a threshold, human-machine verification and information verification are triggered.

Description

Technical Field

[0001] This invention relates to the field of network security detection technology, specifically to a network security data detection method and system. Background Technology

[0002] With the widespread adoption of digital technologies, network data protection has become a core issue in ensuring the stable operation of the digital economy. Its core is to protect network systems, terminal devices, and stored data from threats such as unauthorized access, tampering, leakage, and damage through technical and management means, and to ensure the confidentiality, integrity, and availability of data, covering multiple dimensions such as data transmission security, access control, attack detection and defense, and emergency response. As technology advances, various types of WANGLUO1 attacks are constantly emerging, necessitating the identification of different types of attacks and the implementation of specialized countermeasures. However, existing network security data detection technologies often rely on acquiring various data from network behavior logs to detect network security protection systems. This approach is relatively simplistic and makes it difficult to determine, based solely on behavior logs, whether a browser or hacker has leaked sensitive information through low-risk operations involving multiple steps, or whether the network security protection system is effectively identifying human-machine attack types. Therefore, this invention proposes a network security data detection method and system to address the shortcomings of existing technologies. Summary of the Invention

[0003] The purpose of this invention is to provide a network security data detection method and system to address the shortcomings mentioned in the background art.

[0004] The objective of this invention can be achieved through the following technical solutions: A method for detecting network security data includes the following steps: Step 1: Simulate the data reader to read data from the network target; Step 2: The network target obtains data reading anomaly values ​​based on various data during data reading, and determines whether a verification test needs to be launched for the data reader based on the data reading anomaly values; Step 3: The network target protection system acquires various data from the data reader when performing the verification test that pops up; Step 4: Obtain the comprehensive threat value of the data reader based on the verification test data, and freeze the access permissions of the data reader based on the comprehensive threat value; Step 5: Repeat steps 1 to 4 multiple times to obtain the success rate of the network target protection system, and determine the security level of the network target based on the success rate of the network target protection system.

[0005] Preferably, the method for performing step two is as follows: Obtain the IP address of the data reader, compare the IP address with the IP address database recorded when the network target is accessed to obtain the IP identifier value. If no IP address matches, the IP identifier value is 0; if an IP address matches, the IP identifier value is 1. The system acquires the reading information, reading duration, and reading operation behavior of the data reader during the data reading process. It analyzes the reading information to determine whether there is sensitive information in the reading information. If there is sensitive information, it acquires the ratio of the reading duration of the sensitive information to the total reading duration of the data reader. The importance of the sensitive information is used as a weighting coefficient. The sensitive reading degradation value is obtained by combining the duration ratio and the weighting coefficient. Assign operation risk weights to different read operations, statistically analyze the read operations performed by the reader during the current process, and calculate the operation risk value by weighting and summing the number of each read operation with the corresponding operation based on the statistical results. Data reading anomalies are calculated by combining IP identification values, sensitive read degradation values, and operational risk values. The acquired abnormal data reading values ​​are compared with a preset threshold. If the abnormal data reading value is greater than the threshold, the data reading method is verified and tested.

[0006] Preferably, the verification test includes human-computer verification and information verification; the human-computer verification involves displaying a calculator page and calculation questions to the data reader; the information verification involves displaying an information collection page to the data reader; the method for performing step three is as follows: If the data reader fails to perform the calculation on the calculator page, the data reader's access permissions will be frozen, and an emergency warning will be sent to the administrator. If the data reader performs calculations on the calculator page, then obtain the click position when each button on the calculator page is clicked, and calculate the total time the calculator page and the calculation questions exist after they pop up, as well as the total time the calculator page is used. If the human-machine verification is successful, an information collection page will pop up, and the information provided by the data reader on the information collection page will be obtained.

[0007] Preferably, the method for performing step four is as follows: Divide each button on the calculator page into multiple grid cells of the same size, obtain the geometric center of each button, and expand a grid outward from the grid cell where the geometric center is located to form the core grid; If the button click location is outside the core grid, the button click deviation value is obtained based on the straight-line distance between the button click location and the core grid location; If the button click location is within the core grid, the button click deviation value is 1; The calculator page uses key click deviation values ​​for each button to obtain a comprehensive deviation value. A key click threshold is set based on the number of button clicks required, and the obtained comprehensive deviation value is compared with the key click threshold. If the overall deviation value is greater than the button click threshold, the network access permission of the data reader will not be frozen temporarily, and it will be considered as passing the human-machine verification. If the overall deviation value is not greater than the case click threshold, then the network access permissions of the data reader will be frozen.

[0008] Preferably, the information obtained from the data reader is compared with a known information database: If the comparison result is no match, then freeze the current account's network access permissions; If the comparison result is a match, then the judgment is made based on the IP identifier value: If the comparison result is a match and the IP identifier value is 1, then temporary access restrictions will be imposed on the current simulated data reader, allowing only the reading of non-sensitive information, and a behavior verification warning will be sent to the administrator; If the comparison result is a match and the IP identifier value is 0, then the network access permissions of the current account will be frozen.

[0009] Preferably, the method for performing step five is as follows: Repeat the detection process from step one to step four multiple times; The success rate of data reading anomaly detection is obtained by statistically analyzing the number of times the data reader attempts to read sensitive data of the network target and the number of times the network target protection system successfully detects the anomaly. The success rate of human-machine verification is obtained by statistically analyzing the types of human-machine verification performed by the data reader, the number of times each type of verification is performed, and the number of times the network target protection system successfully judges the verification. The number of times the combination of verification information performed by the data reader and the network target protection system successfully judged the information verification judgment was counted, and the information verification judgment success rate was obtained. The success rate of reading anomaly detection, human-machine verification, and information verification is combined to obtain the success rate of the protection system.

[0010] Preferably, the security level is determined by comparing the obtained success rate of the protection system with the set success rate threshold. When the success rate of the protection system is less than the first success rate threshold, the security level is determined to be low security. When the success rate of the protection system is greater than or equal to the first success rate threshold and less than the second success rate threshold, the security level is determined to be medium security. When the protection system determines that the success rate is greater than or equal to the second success rate threshold, it is classified as an advanced security level.

[0011] A network security data detection system, applicable to the aforementioned network security data detection method, includes the following modules: The simulated attack module is used to read data from network targets and complete verification tests. The data acquisition module is used to collect various data from network targets when they are read by the data reader. The data analysis module identifies and reads outliers based on the acquired data and determines whether verification testing is required. The verification test module performs verification tests on the data reader and obtains various data from the verification test. Based on the data, it determines whether it is necessary to freeze the data reader's access permissions. The comprehensive evaluation module performs a comprehensive evaluation of the network target protection system based on the success rate of multiple simulated data readings and freezes.

[0012] The beneficial effects of this invention are: 1. This invention simulates a data reader reading network target data, calculates data reading anomaly values ​​based on various data from the data reader, and triggers human-machine verification and information verification when the anomaly exceeds the threshold. Access permissions are then controlled based on the verification data. By comprehensively considering the success rate of anomaly reading, human-machine verification, and information verification during multiple simulated attacks, the security level of the network target is determined. This enables a scientific assessment of the network target's security protection capabilities and solves the problem of the lack of comprehensive assessment of human-machine attacks by the protection system in existing network security data detection.

[0013] Of course, any product implementing this invention does not necessarily need to achieve all of the advantages described above at the same time. Attached Figure Description

[0014] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0015] Figure 1 This is a block diagram of a network security data detection system according to the present invention.

[0016] Figure 2 This is a flowchart illustrating the steps of a network security data detection method according to the present invention. Detailed Implementation

[0017] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0018] Please see Figure 1 As shown, this invention is a network security data detection system. This system is used to detect network security data and assess network security levels. It includes the following modules: a simulated attack module, a data acquisition module, a data analysis module, a verification testing module, and a comprehensive evaluation module. The simulated attack module is used to read data from network targets and complete verification tests. Specifically, the simulated attack module simulates reading data stored by the network target, constructing a scenario where the network target's data is being read. Furthermore, the simulated attack module accesses sensitive data stored by the network target, thereby facilitating the assessment of the network target's security protection functions and their effectiveness in protecting data and recognizing reading actions. When the network target activates a series of security protection measures, the simulated attack module also responds to these measures, thus facilitating the acquisition of security data from the network target's security protection system.

[0019] The data acquisition module is used to collect various data when the network target is read by the data reader. Specifically, when the simulated attack module reads the data stored on the network target, it obtains relevant data such as the data reader's reading information, reading duration, reading operations, and the IP address of the data reader during the data process.

[0020] The data analysis module is used to calculate and obtain data reading anomaly values ​​based on the various data acquired by the data acquisition module. Specifically, after the data acquisition module collects various data during the data reading process, the network target security protection system can obtain data reading anomaly values ​​based on these data. These anomaly values ​​quantify the abnormal behavior of the data reader during the data reading process. By comparing the data reading anomaly values ​​with a set threshold, if the data reading anomaly value is greater than or equal to the set threshold, it is determined that the current data reader has engaged in abnormal reading behavior, and the security of the network target is potentially threatened. In this case, a verification test needs to be performed on the data reader to determine its identity. If the data reading anomaly value is less than the set threshold, it means that the security of the network target is not currently under potential threat, and therefore a verification test is not required for the time being.

[0021] The verification test module pops up on the page where the data reader reads data after the data analysis module determines that a verification test is needed. The verification includes human-machine verification and information verification. Human-machine verification is mainly used to distinguish whether the data reader is a real person or an AI. A special calculator is used to solve a math problem to distinguish them. If the data reader passes the human-machine verification, the information verification will pop up, requiring the data reader to provide their own information. After the data reader provides the data information, the provided data information is compared with the information stored in the information database to further determine the identity of the data reader.

[0022] The comprehensive evaluation module, after conducting multiple simulated data reading and data reader access permission freezing tests, can comprehensively evaluate the network target security protection system based on the number of data readings and the success rate of access permission freezing.

[0023] Please see Figure 2 As shown, a network security data detection method, implemented through the aforementioned network security data detection system, includes the following steps: Step 1: Simulate the data reader to read data from the network target; Step 2: The network target obtains data reading anomaly values ​​based on various data during data reading, and determines whether a verification test needs to be launched against the data reader based on the data reading anomaly values. Specifically, the IP address of the data reader is obtained, and the IP address is compared with the IP address database recorded by the network target to obtain the IP identifier value. If the IP address of the current access has a historical access record, the IP identifier value is 1; if the IP address of the current access does not have a historical access record, the IP identifier value is 0. The system acquires the reading information, reading duration, and reading operation behavior of the data reader during the data reading process. It analyzes the reading information to determine whether there is sensitive information. If sensitive information is found, the system obtains the ratio of the reading duration of the sensitive information to the total reading duration of the data reader. The importance of the sensitive information is used as a weighting coefficient. The system combines the duration ratio and the weighting coefficient to obtain the sensitive reading degradation value. The sensitive information, as important information stored by the network target, mainly includes the main business and scientific research content. When this information is continuously read and acquired for a long time, there is a certain risk of leakage. Therefore, it is necessary to quantify the behavior of reading this sensitive information as the basis for calculating the data reading anomaly value. Operational risk weights are assigned to different read operations. The read operations performed by the data reader during the current process are statistically analyzed. Based on the statistical results, the number of each read operation is weighted and summed with the corresponding operation to obtain the operational risk value. Read operations refer to actions performed by the data reader when reading data, including copying, screenshotting, tampering, downloading, etc. Different weight coefficients are assigned to these operations of different degrees. For example, tampering is the most serious, followed by downloading, while copying is slightly more serious than screenshotting. Therefore, tampering is assigned a weight coefficient of 0.35, downloading a weight coefficient of 0.3, copying a weight coefficient of 0.2, and screenshotting a weight coefficient of 0.15. The weighted summation is then performed based on the assigned weight coefficients and the number of operations to quantify the impact of dangerous behaviors by the data reader during the data reading process, further serving as the basis for calculating data read anomalies. The abnormal data reading value is obtained by weighted summation of IP identification value, sensitive reading degradation value, and operational risk value. The acquired abnormal data reading values ​​are compared with a preset threshold. If the abnormal data reading value is greater than the threshold, a verification test is popped up for the data reader. The verification test includes human-computer verification and information verification. The human-computer verification is to pop up a calculator page and calculation questions for the data reader, and the information verification is to pop up an information collection page for the data reader.

[0024] Step 3: The network target protection system acquires various data when the data reader performs the pop-up verification test. Specifically, during the verification test, the system first acquires whether the data reader performs the calculation on the calculator page. If the data reader does not perform the calculation on the pop-up calculator page, the system directly freezes the data reader's access permissions. If the data reader performs the calculation on the pop-up calculator page, the system acquires the click position of each button on the calculator page and calculates the total time the calculator page and the calculation questions have existed since the pop-up, as well as the total usage time of the calculator page. If the data reader passes the human-machine verification, the system further pops up an information collection page to request the data reader's identity information.

[0025] Step 4: Obtain the comprehensive threat value of the data reader based on the verification test data. Freeze access permissions for the data reader based on the comprehensive threat value. Specifically, based on the size of each button on the pop-up calculator page, divide each button on the calculator page into multiple 1×1 grid units. The geometric center of each button on the calculator page can be obtained from these grid units. After obtaining the geometric center of each button, expand a core grid in all directions outward from the grid unit containing the geometric center. If the data reader clicks a button outside the core grid while using the calculator, then access permissions are frozen based on the button click position. The button click deviation value is obtained by calculating the straight-line distance from the core grid position. Using the point closest to the button click position in the core grid as a reference, the straight-line distance is calculated using the Pythagorean theorem based on the number of grid cells between the button click position and the reference point in the core grid. The button click position is referenced to the tip of the mouse cursor on the screen. If the button click position is within the core grid, the button click deviation value is 1. The button click deviation value for each button on the calculator page is counted to obtain the overall deviation value. A button click threshold is set according to the required number of button clicks. The distance within one grid cell of the button click position near the core grid is set as the click threshold. The diagonal length of a 1×1 grid is... Then multiply the number of buttons that need to be clicked by . This is the key click threshold for this calculator page. The obtained comprehensive deviation value is compared with the key click threshold: If the overall deviation value is greater than the button click threshold, the network access permission of the data reader will not be frozen temporarily, and it will be considered as passing the human-machine verification. If the overall deviation value is not greater than the case click threshold, the network access permission of the data reader is frozen. When a real person clicks the calculator button on the calculator page, the click position of each button will have different degrees of deviation, and it is also difficult to accurately click the geometric center of the button. Therefore, this method is a relatively effective way to determine whether the data reader is a real person.

[0026] After the data reader passes the human verification, an information verification message pops up, requesting relevant information from the data reader, such as name, employee ID, job title, department, and age. The information obtained from the data reader is then compared with a known database. If the comparison result is no match, and the current data reader is an unknown person, then the current account's network access permissions will be frozen directly. If the comparison result is a match, then further judgment is made based on the previously obtained IP identifier value: If the comparison result is a match and the IP identifier value is 1, it indicates that the current data reader is a person related to the network target using a commonly used device to read data, but there is a certain reading risk. Therefore, temporary access restrictions are imposed on the current simulated data reader, allowing only the reading of non-sensitive information, and a behavior verification warning is sent to the administrator. If the comparison result is a match and the IP identifier value is 0, it indicates that the current data reader is an individual related to the network target using an uncommon device to read data, which poses a high security risk. Therefore, it is necessary to freeze the network access permissions of the current account and send an alert to the administrator.

[0027] Step 5: Execute the detection process from Step 1 to Step 4 multiple times. Count the number of times the data reader attempts to read sensitive data from the network target and the number of times the network target protection system successfully determines the data read anomaly. Obtain the data read anomaly detection success rate. Count the types of human-machine verification performed by the data reader and the number of times each type of verification is performed, and the number of times the network target protection system successfully determines the data read anomaly. Obtain the human-machine verification success rate. Count the combinations of verification information performed by the data reader and the number of times the network target protection system successfully determines the information verification success rate. Combine the above data read anomaly detection success rate, human-machine verification success rate, and information verification success rate to obtain the protection system's success rate.

[0028] The security level is determined by comparing the obtained success rate of the protection system with the set success rate threshold. When the success rate of the protection system is less than the first success rate threshold, the security level is determined to be low security. When the success rate of the protection system is greater than or equal to the first success rate threshold and less than the second success rate threshold, the security level is determined to be medium security. When the protection system determines that the success rate is greater than or equal to the second success rate threshold, it is classified as an advanced security level.

[0029] The above description is merely an example and illustration of the concept of the present invention. Those skilled in the art can make various modifications or additions to the specific embodiments described or use similar methods to replace them, as long as they do not deviate from the concept of the invention or exceed the scope defined in the claims, they should all fall within the protection scope of the present invention.

Claims

1. A method for detecting network security data, characterized in that, Includes the following steps: Step 1: Simulate the data reader to read data from the network target; Step 2: The network target obtains abnormal data reading values ​​based on various data during data reading, and determines whether a verification test needs to be launched for the data reader based on the abnormal data reading values; Step 3: The network target protection system acquires various data when the data reader verifies the pop-up verification test; Step 4: Obtain the comprehensive threat value of the data reader based on the verification test data, and freeze the access permissions of the data reader based on the comprehensive threat value; Step 5: Repeat steps 1 to 4 multiple times to obtain the success rate of the network target protection system, and determine the security level of the network target based on the success rate of the network target protection system.

2. The network security data detection method according to claim 1, characterized in that, The method for performing step two is as follows: Obtain the IP address of the data reader, compare the IP address with the IP address database recorded when the network target is accessed to obtain the IP identifier value. If no IP address matches, the IP identifier value is 0; if an IP address matches, the IP identifier value is 1. The system acquires the reading information, reading duration, and reading operation behavior of the data reader during the data reading process. It analyzes the reading information to determine whether there is sensitive information in the reading information. If there is sensitive information, it acquires the ratio of the reading duration of the sensitive information to the total reading duration of the data reader. The importance of the sensitive information is used as a weighting coefficient. The sensitive reading degradation value is obtained by combining the duration ratio and the weighting coefficient. Assign operation risk weights to different read operations, statistically analyze the read operations performed by the reader during the current process, and calculate the operation risk value by weighting and summing the number of each read operation with the corresponding operation based on the statistical results. Data reading anomalies are calculated by combining IP identification values, sensitive read degradation values, and operational risk values. The abnormal data reading values ​​are compared with a preset threshold. If the abnormal data reading value is greater than the threshold, the data reading method is verified and tested.

3. The network security data detection method according to claim 2, characterized in that, The verification test includes human-computer verification and information verification; the human-computer verification involves displaying a calculator page and calculation questions to the data reader; the information verification involves displaying an information collection page to the data reader; the method for performing step three is as follows: If the data reader fails to perform the calculation on the calculator page, the data reader's access permissions will be frozen, and an emergency warning will be sent to the administrator. If the data reader performs calculations on the calculator page, then obtain the click position when each button on the calculator page is clicked, and calculate the total time the calculator page and the calculation questions exist after they pop up, as well as the total time the calculator page is used. If the human-machine verification is successful, an information collection page will pop up, and the information provided by the data reader on the information collection page will be obtained.

4. The network security data detection method according to claim 3, characterized in that, The method for performing step four is as follows: Divide each button on the calculator page into multiple grid cells of the same size, obtain the geometric center of each button, and expand a grid outward from the grid cell where the geometric center is located to form the core grid; If the button click location is outside the core grid, the button click deviation value is obtained based on the straight-line distance between the button click location and the core grid location; If the button click location is within the core grid, the button click deviation value is 1; The calculator page uses key click deviation values ​​for each button to obtain a comprehensive deviation value. A key click threshold is set based on the number of button clicks required, and the obtained comprehensive deviation value is compared with the key click threshold. If the overall deviation value is greater than the button click threshold, the network access permission of the data reader will not be frozen temporarily, and it will be considered as passing the human-machine verification. If the overall deviation value is not greater than the case click threshold, then the network access permissions of the data reader will be frozen.

5. A network security data detection method according to claim 3, characterized in that, The information obtained from the data reader is compared with known information databases: If the comparison result is no match, then freeze the current account's network access permissions; If the comparison result is a match, then the judgment is made based on the IP identifier value: If the comparison result is a match and the IP identifier value is 1, then temporary access restrictions will be imposed on the current simulated data reader, allowing only the reading of non-sensitive information, and a behavior verification warning will be sent to the administrator; If the comparison result is a match and the IP identifier value is 0, then the network access permissions of the current account will be frozen.

6. The network security data detection method according to claim 1, characterized in that, The method for performing step five is as follows: Repeat the detection process from step one to step four multiple times; The success rate of data reading anomaly detection is obtained by statistically analyzing the number of times the data reader attempts to read sensitive data of the network target and the number of times the network target protection system successfully detects the anomaly. The success rate of human-machine verification is obtained by statistically analyzing the types of human-machine verification performed by the data reader, the number of times each type of verification is performed, and the number of times the network target protection system successfully judges the verification. The number of times the combination of verification information performed by the data reader and the network target protection system successfully judged the information verification judgment was counted, and the information verification judgment success rate was obtained. The success rate of reading anomaly detection, human-machine verification, and information verification is combined to obtain the success rate of the protection system.

7. A network security data detection method according to claim 6, characterized in that, The security level is determined by comparing the obtained success rate of the protection system with the set success rate threshold. When the success rate of the protection system is less than the first success rate threshold, the security level is determined to be low security. When the success rate of the protection system is greater than or equal to the first success rate threshold and less than the second success rate threshold, the security level is determined to be medium security. When the protection system determines that the success rate is greater than or equal to the second success rate threshold, it is classified as an advanced security level.

8. A network security data detection system, applicable to the network security data detection method according to claims 1-7, characterized in that, Includes the following modules: The simulated attack module is used to read data from network targets and complete verification tests. The data acquisition module is used to collect various data from network targets when they are read by the data reader. The data analysis module identifies and reads outliers based on the acquired data and determines whether verification testing is required. The verification test module performs verification tests on the data reader and obtains various data from the verification test. Based on the data, it determines whether to freeze the data reader's access permissions. The comprehensive evaluation module performs a comprehensive evaluation of the network target protection system based on the success rate of multiple simulated data readings and freezes.

Images