Edge big data-based regional terminal data security and protection management system and method

Abstract

The application discloses an edge big data-based regional terminal data security and protection management system and method, and relates to the technical field of terminal security management; the application collects behavior data and interaction data of edge terminal nodes; behavior factors are extracted according to the behavior data, and real-time state scores are analyzed; a behavior matrix of the edge terminal nodes is constructed, and the influence weights of each behavior factor are calculated; the behavior volatility of each behavior factor in a preset period is analyzed according to the state scores of the behavior factors, and the behavior abnormality degrees of each behavior factor are determined based on the analysis data; the instantaneous interaction trust degree is analyzed based on the interaction data of the edge terminal nodes at each moment, and the comprehensive interaction trust degree of the edge terminal nodes at the current moment is determined; the current risk abnormality degree of the edge terminal nodes is analyzed according to the comprehensive interaction trust degree and the behavior abnormality degrees of each behavior factor, and the abnormal edge terminal nodes are located; the application improves the accuracy and efficiency of regional terminal anomaly monitoring.

Description

Technical Field

[0001] This invention relates to the field of terminal security management technology, specifically to a regional terminal data security control system and method based on edge big data. Background Technology

[0002] With the deep integration of edge computing and IoT technologies, massive edge terminal nodes deployed in regional environments are undertaking increasingly core data collection and processing tasks. These terminal nodes typically operate continuously for long periods of time, and their physical environments are complex and changeable. Therefore, the stability and reliability of their own operating status are directly related to the integrity of regional data collection and the accuracy of the decision-making system. Currently, most methods for monitoring operational anomalies in edge terminal nodes are static monitoring methods such as fixed-value alarms or simple statistics. While these methods can quickly and easily identify abnormal terminals, they do not consider the temporal fluctuations and periodicity of edge terminal behavior patterns under normal operating conditions. As a result, their false alarm and false negative rates are high, leading to low accuracy in monitoring terminal anomalies. On the other hand, current monitoring methods cannot extract the state information contained in the multi-dimensional behavioral data generated by terminal nodes during operation and the interaction data between them and other nodes. This results in insufficient comprehensive judgment of the overall operation of the terminal and a lack of effective perception of potential slow-onset anomalies, leading to low anomaly monitoring accuracy and low operation and maintenance efficiency. Summary of the Invention

[0003] The purpose of this invention is to provide a regional terminal data security management and control system and method based on edge big data, so as to solve the problems raised in the prior art.

[0004] To achieve the above objectives, the present invention provides the following technical solution: A regional terminal data security management and control method based on edge big data, the method includes the following steps: Identify the edge terminal nodes in the target area and collect the behavioral and interaction data of the edge terminal nodes within a preset period; Behavioral factors are extracted from the behavioral data, and real-time status scores are given to the behavioral factors; a behavioral matrix of edge terminal nodes is constructed, and the influence weight of each behavioral factor is calculated based on the behavioral matrix; The behavioral volatility of each behavioral factor within a preset period is analyzed based on the status score of the behavioral factors, and the degree of behavioral abnormality of each behavioral factor is determined based on the analysis data. Based on the interaction data of edge terminal nodes at various times within a preset period, the instantaneous interaction trust level is analyzed, and the comprehensive interaction trust level of the edge terminal node at the current time is determined according to the instantaneous interaction trust level. Based on the comprehensive interaction trust level and the behavioral anomaly degree of each behavioral factor, the current risk anomaly degree of the edge terminal node is analyzed, and the abnormal edge terminal node is located based on the risk anomaly degree. Furthermore, the target area is selected based on the monitoring platform, and the edge terminal nodes in the target area are located; according to the preset period, the real-time behavior data and interaction data of each edge terminal node are collected, and a terminal database is built to store the collected data.

[0005] The behavioral data refers to the operational data of the edge terminal nodes, which is used to determine the operational status of the terminals. The interaction data refers to the number of interactions between the edge terminal node and other terminals or upstream ports, etc., and is used to determine the data interaction status of the terminal node.

[0006] Furthermore, based on the behavioral data types contained in the behavioral data of the edge terminal nodes, behavioral factors are extracted and constructed; and based on the collected behavioral data corresponding to each behavioral factor, the real-time status score D of the behavioral factor is evaluated. ij The calculation is as follows: ; in, The real-time status score of the behavior factor j for edge terminal node number i; d ij The j-th order of edge terminal node number i is the factor value; d ij,b [d1, d2] represents the reference value of the behavior factor value of the i-th edge terminal node, j; [d1, d2] represents the normal range of the behavior factor value of the i-th edge terminal node, j.

[0007] Wherein, the interval [d1, d2] represents the normal operating range value of the behavior factor of the edge terminal node; and d ij,b ∈[d1,d2]; It should be noted that |d ij -d ij,b | / d ij,b The value range is [0,1]. Based on the reference value of the actual terminal behavior parameter, the value of the behavior parameter deviates from the reference value during the actual operation of the terminal. Therefore, the deviation of the value of the behavior parameter from the reference value is often within [0,1]. If there is a value greater than 1, it means that the actual operating value of the behavior parameter is seriously deviated, the corresponding terminal is a faulty terminal, and the administrator will be notified.

[0008] Based on the real-time status scores of each behavioral factor, construct behavioral matrix A. j×j,i ; The steps for the behavior matrix are as follows: S1. Construct a j-order matrix based on the number of behavioral factor numbers j; S2. In the matrix, perform a full traversal and combination based on the number of each behavioral factor, and mark the matrix elements according to the traversal order of the generated behavioral factor number combinations. S3. Based on the combination of behavioral factor numbers marked by each matrix element in the matrix, calculate the real-time status score ratio of the corresponding behavioral factor in the number combination and fill it into the corresponding matrix element position. S4. Fill all elements in the matrix and output a matrix. It should be noted that performing a full traversal combination of the behavioral factor numbers may result in repeated traversals, but the meanings of the generated number combinations will differ. Among them, the full traversal retrieval needs to sort each behavioral factor according to its number and then perform a full traversal according to the sorting order. It should also be noted that when marking matrix elements, the matrix elements are marked sequentially according to the traversal order; and when filling the marked positions of the matrix, the ratio of the real-time status score of the previous behavior factor to the real-time status score of the subsequent behavior factor is calculated based on the combination of the behavior factor numbers of the marked positions.

[0009] Based on the behavior matrix of the edge terminal nodes, analyze the influence weight vector w of each behavior factor. i The calculation is as follows: ; Among them, A j×j,i The behavior matrix for edge terminal node number i; w i w is the influence weight vector of the behavioral factors of edge terminal node i. ij λ represents the influence weight of the factor with behavior number j in the influence weight vector corresponding to edge terminal node number i; max w is the largest eigenvalue of the behavior matrix; m is the number of behavior factors; where w ij ∈w i .

[0010] Furthermore, based on the real-time status scores of each behavioral factor corresponding to the edge terminal node, the probability distribution statistics of the behavioral factor status scores at each time point within a preset period are performed to obtain the distribution probability p(D) of the real-time status scores of each behavioral factor within the period. ij ) t ; Based on the probability distribution p(D) of real-time state scores within each behavioral factor cycle ij ) t Analyze the periodic behavior volatility index H(D) of each behavioral factor. ij Its calculation is as follows: ; Among them, H(D) ij ) is the periodic behavior volatility index of the behavior factor of edge terminal node number j with number i; p(Dij ) t Let t be the probability distribution of the real-time status score of the behavior factor j of edge terminal node i at time t within a preset period; t is the time number; T is the preset period.

[0011] It should be noted that the probability distribution analysis of the real-time status scores within the behavioral factor cycle is performed by dividing the real-time status scores of each behavioral factor into intervals and calculating the probability based on the frequency of the interval in which the real-time status scores of the corresponding behavioral factors are located at each time point within the cycle.

[0012] Based on the periodic behavior volatility index of each behavioral factor corresponding to the edge terminal node within a preset period, combined with the preset volatility index benchmark value V(D) ij ), analyze the behavioral abnormality degree Abf of each behavioral factor. ij The calculation is as follows: ; Among them, Abf ij The behavior anomaly degree of edge terminal node number j within a preset period is set for the behavior factor of edge terminal node number i.

[0013] Furthermore, based on the interaction data of edge terminal nodes within a preset period, the number of data interactions at each time point is considered to determine the instantaneous interaction trust level (San) of the edge terminal nodes. i,t ; and by iteratively analyzing the instantaneous interaction trust levels at consecutive moments within a preset period, the comprehensive interaction trust level Can of the edge terminal node at the current moment within the preset period is obtained. i The calculation is as follows: ; Among them, San i,t Ns represents the instantaneous interaction trust level of edge terminal node i at time t within a preset period; i,t and Na i,t These represent the number of successful data interactions and the total number of interactions for edge terminal node i at time t within a preset period, respectively; Can i San represents the overall interactive trust level of edge terminal node i at the current moment; α is the time decay factor; k is the time step within a preset period; i,t-k Let be the instantaneous interaction trust level of edge terminal node number i at time tk within a preset period; T is the preset period.

[0014] It should be noted that the time decay factor is a preset coefficient. The time step k is used to represent the k times from the current time within a preset period.

[0015] Furthermore, based on the comprehensive interaction trust level of the edge terminal nodes at the current moment, combined with the behavioral anomaly degree of each behavioral factor, the current risk anomaly degree Rg of the edge terminal nodes is analyzed.i The calculation is as follows: ; Among them, Rg i The current risk anomaly level of edge terminal node number i; m is the number of behavioral factors; w ij For edge terminal node i, the influence weight of the factor with behavior j in the influence weight vector is given; Abf ij For edge terminal node number i, set the behavior anomaly degree within a preset period for behavior factor j within the specified edge terminal node; Can i Let i be the overall interactive trust level of the edge terminal node at the current moment.

[0016] Based on the risk anomaly analysis results of edge terminal nodes, the results are sorted in descending order of magnitude and compared with a preset risk anomaly threshold Rg. max Compare and determine the degree of risk abnormality Rg i Greater than or equal to Rg max The edge terminal nodes will provide anomaly alerts; and a fluctuation tolerance ∆g will be preset, with the risk anomaly level Rg... i In [Rg max -∆g,Rg max The edge terminal nodes are given an alert indicating the presence of abnormal risks; the level of risk (Rg) is then assigned. i Less than Rg max -Δg's edge terminal nodes are treated as normal nodes; Based on the anomaly assessment results of the edge terminal nodes, a risk anomaly report for the regional edge terminal nodes is generated and fed back to the management end.

[0017] It should be noted that the risk anomaly report is used to record edge terminal nodes that already have anomalies and have anomaly risks within the target area; this includes analytical data such as edge terminal node number, behavioral factor anomaly degree, and risk anomaly degree.

[0018] Regional terminal data security management and control system based on edge big data: The system includes a terminal information integration unit, a terminal status evaluation unit, a factor anomaly analysis unit, a terminal trust evaluation unit, a terminal anomaly location unit, and a port feedback unit. Furthermore, the terminal information integration unit selects a target area and locates the edge terminal nodes within the target area; according to a preset period, it collects real-time behavioral data and interaction data of each edge terminal node; Furthermore, the terminal status assessment unit extracts and constructs behavioral factors based on the behavioral data types contained in the behavioral data of the edge terminal nodes; evaluates the real-time status score of each behavioral factor based on the collected behavioral data corresponding to each behavioral factor; constructs a behavioral matrix based on the real-time status score of each behavioral factor; and analyzes the influence weight vector of each behavioral factor based on the behavioral matrix of the edge terminal nodes. Furthermore, the factor anomaly analysis unit performs probability distribution statistics on the status scores of behavioral factors at each moment within a preset period to obtain the distribution probability of the real-time status scores of each behavioral factor within the period; analyzes the periodic behavioral volatility index of each behavioral factor; and analyzes the behavioral anomaly degree of each behavioral factor in conjunction with the preset volatility index benchmark value. Furthermore, the terminal trust assessment unit determines the instantaneous interaction trust level of the edge terminal node based on the interaction data of the edge terminal node within a preset period; and obtains the comprehensive interaction trust level of the edge terminal node at the current moment within the preset period by iteratively analyzing the instantaneous interaction trust level at consecutive moments within the preset period. Furthermore, the terminal anomaly localization unit analyzes the current risk anomaly degree of the edge terminal node based on the comprehensive interaction trust level of the edge terminal node at the current moment and the behavioral anomaly degree of each behavioral factor. Furthermore, the port feedback unit performs risk anomaly analysis on the edge terminal nodes, sorts them from highest to lowest, and compares them with a preset risk anomaly threshold to determine the anomaly status of the edge terminal nodes; based on the anomaly judgment results of the edge terminal nodes, it generates a regional edge terminal node risk anomaly report and feeds it back to the management terminal.

[0019] Compared with the prior art, the beneficial effects of the present invention are: 1. This invention extracts behavioral factors from edge terminal nodes and scores their status in real time. Based on this, a behavioral matrix is ​​constructed to quantify the influence weight of the behavioral factors. The volatility analysis of the status scores of behavioral factors within a preset period enables dynamic scoring and volatility analysis of multi-dimensional behavioral factors, significantly improving the accuracy of edge terminal anomaly monitoring and early perception capabilities. 2. Based on the analysis of abnormal behavior factors, this invention introduces instantaneous interaction trust assessment, and through iterative analysis of the comprehensive interaction trust at the current moment, integrates the correlation determination mechanism between behavioral anomaly and comprehensive interaction trust, to achieve accurate positioning and efficient operation and maintenance of abnormal edge terminal nodes. Attached Figure Description

[0020] Figure 1 This is a flowchart illustrating the regional terminal data security management method based on edge big data according to the present invention. Detailed Implementation

[0021] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0022] Example 1: As Figure 1 As shown, the present invention provides a technical solution: A regional terminal data security management and control method based on edge big data, the method includes the following steps: Identify the edge terminal nodes in the target area and collect the behavioral and interaction data of the edge terminal nodes within a preset period; Behavioral factors are extracted from the behavioral data, and real-time status scores are given to the behavioral factors; a behavioral matrix of edge terminal nodes is constructed, and the influence weight of each behavioral factor is calculated based on the behavioral matrix; The behavioral volatility of each behavioral factor within a preset period is analyzed based on the status score of the behavioral factors, and the degree of behavioral abnormality of each behavioral factor is determined based on the analysis data. Based on the interaction data of edge terminal nodes at various times within a preset period, the instantaneous interaction trust level is analyzed, and the comprehensive interaction trust level of the edge terminal node at the current time is determined according to the instantaneous interaction trust level. Based on the comprehensive interaction trust level and the behavioral anomaly degree of each behavioral factor, the current risk anomaly degree of the edge terminal node is analyzed, and the abnormal edge terminal node is located based on the risk anomaly degree. Furthermore, the target area is selected based on the monitoring platform, and the edge terminal nodes in the target area are located; according to the preset period, the real-time behavior data and interaction data of each edge terminal node are collected, and a terminal database is built to store the collected data.

[0023] The behavioral data refers to the operational data of the edge terminal nodes, which is used to determine the operational status of the terminals. The interaction data refers to the number of interactions between the edge terminal node and other terminals or upstream ports, etc., and is used to determine the data interaction status of the terminal node.

[0024] In this embodiment, the behavioral data of the edge terminal node includes, but is not limited to, uplink traffic, number of port connections, CPU utilization, and file access frequency. The interaction behavior data of edge terminal nodes includes the total number of interactions between the current edge terminal node and other edge terminal nodes within a preset period and the number of successful interactions; In this embodiment, a terminal node status directory is constructed in the terminal database to record the behavior data and interaction data of each edge terminal node at each moment.

[0025] Furthermore, based on the behavioral data types contained in the behavioral data of the edge terminal nodes, behavioral factors are extracted and constructed; and based on the collected behavioral data corresponding to each behavioral factor, the real-time status score D of the behavioral factor is evaluated. ij The calculation is as follows: ; in, The real-time status score of the behavior factor j for edge terminal node number i; d ij The j-th order of edge terminal node number i is the factor value; d ij,b [d1, d2] represents the reference value of the behavior factor value of the i-th edge terminal node, j; [d1, d2] represents the normal range of the behavior factor value of the i-th edge terminal node, j.

[0026] Wherein, the interval [d1, d2] represents the normal operating range value of the behavior factor of the edge terminal node; and d ij,b ∈[d1,d2]; It should be noted that |d ij -d ij,b | / d ij,b The value range is [0,1]. Based on the reference value of the actual terminal behavior parameter, the value of the behavior parameter deviates from the reference value during the actual operation of the terminal. Therefore, the deviation of the value of the behavior parameter from the reference value is often within [0,1]. If there is a value greater than 1, it means that the actual operating value of the behavior parameter is seriously deviated, the corresponding terminal is a faulty terminal, and the administrator will be notified.

[0027] In this embodiment, the reference value for the behavioral factor is set manually by the operator based on big data analysis and experience data.

[0028] Based on the real-time status scores of each behavioral factor, construct behavioral matrix A. j×j,i ; The steps for the behavior matrix are as follows: S1. Construct a j-order matrix based on the number of behavioral factor numbers j; S2. In the matrix, perform a full traversal combination based on the number of each behavioral factor, and mark the matrix elements according to the traversal order of the generated behavioral factor number combinations. S3. Based on the combination of behavioral factor numbers marked by each matrix element in the matrix, calculate the real-time status score ratio of the corresponding behavioral factor in the number combination and fill it into the corresponding matrix element position. S4. Fill all elements in the matrix and output a matrix. It should be noted that performing a full traversal combination of the behavioral factor numbers may result in repeated traversals, but the meanings of the generated number combinations will differ. Among them, the full traversal retrieval needs to sort each behavioral factor according to its number and then perform a full traversal according to the sorting order. It should also be noted that when marking matrix elements, the matrix elements are marked sequentially according to the traversal order; and when filling the marked positions of the matrix, the ratio of the real-time status score of the previous behavior factor to the real-time status score of the subsequent behavior factor is calculated based on the combination of the behavior factor numbers of the marked positions.

[0029] In this embodiment, the behavior matrix A is used. 3×3,i For example; the number of behavioral factor numbers is 3; The current action matrix is ​​a 3rd order matrix; The output based on the full traversal of the behavior factor numbers is (1,1), (1,2), (1,3); (2,1), (2,2), (2,3); (3,1), (3,2), (3,3); Then, the behavioral factor number combination is marked at the corresponding matrix element position.

[0030] Accordingly, based on the combination of behavioral factor numbers of matrix elements, the real-time state score ratio of the behavioral factors is calculated and filled in, which is... .

[0031] Based on the behavior matrix of the edge terminal nodes, analyze the influence weight vector w of each behavior factor. i The calculation is as follows: ; Among them, A j×j,i The behavior matrix for edge terminal node number i; w i w is the influence weight vector of the behavioral factors of edge terminal node i. ij λ represents the influence weight of the factor with behavior number j in the influence weight vector corresponding to edge terminal node number i; max w is the largest eigenvalue of the behavior matrix; m is the number of behavior factors; where w ij ∈w i .

[0032] In this embodiment, when the influence weight vector w obtained from the original calculation... i The original sum of the influence weights of the behavioral factors contained therein may not be 1; therefore, it is necessary to normalize the original influence weights of each behavioral factor so that the relative proportions of the newly acquired influence weights among the retained indicators meet the requirement that the summation is 1.

[0033] Furthermore, based on the real-time status scores of each behavioral factor corresponding to the edge terminal node, the probability distribution statistics of the behavioral factor status scores at each time point within a preset period are performed to obtain the distribution probability p(D) of the real-time status scores of each behavioral factor within the period. ij ) t ; Based on the probability distribution p(D) of real-time state scores within each behavioral factor cycle ij ) t Analyze the periodic behavior volatility index H(D) of each behavioral factor. ij Its calculation is as follows: ; Among them, H(D) ij ) is the periodic behavior volatility index of the behavior factor of edge terminal node number j with number i; p(D ij ) t Let t be the probability distribution of the real-time status score of the behavior factor j of edge terminal node i at time t within a preset period; t is the time number; T is the preset period.

[0034] It should be noted that the probability distribution analysis of the real-time status scores within the behavioral factor cycle is performed by dividing the real-time status scores of each behavioral factor into intervals and calculating the probability based on the frequency of the interval in which the real-time status scores of the corresponding behavioral factors are located at each time point within the cycle.

[0035] In this embodiment, if the preset period is 1 minute, the CPU utilization rate is used as the behavior factor to determine the real-time status score at each time point within the preset period, and the interval is divided according to the score, such as dividing the interval into [0-0.3], [0.3-0.6], and [0.6-1]. Then, the distribution frequency of the real-time status score of the CPU utilization rate as the behavior factor at each time point within 1 minute within the above interval is counted to obtain the distribution probability.

[0036] Based on the periodic behavior volatility index of each behavioral factor corresponding to the edge terminal node within a preset period, combined with the preset volatility index benchmark value V(D) ij ), analyze the behavioral abnormality degree Abf of each behavioral factor. ij The calculation is as follows: ; Among them, Abf ij The behavior anomaly degree of edge terminal node number j within a preset period is set for the behavior factor of edge terminal node number i.

[0037] In this embodiment, the preset fluctuation index benchmark value is set manually by the operators based on big data analysis and experience data.

[0038] Furthermore, based on the interaction data of edge terminal nodes within a preset period, the number of data interactions at each time point is considered to determine the instantaneous interaction trust level (San) of the edge terminal nodes. i,t ; and by iteratively analyzing the instantaneous interaction trust levels at consecutive moments within a preset period, the comprehensive interaction trust level Can of the edge terminal node at the current moment within the preset period is obtained. i The calculation is as follows: ; Among them, San i,t Ns represents the instantaneous interaction trust level of edge terminal node i at time t within a preset period; i,t and Na i,t These represent the number of successful data interactions and the total number of interactions for edge terminal node i at time t within a preset period, respectively; Can i San represents the overall interactive trust level of edge terminal node i at the current moment; α is the time decay factor; k is the time step within a preset period; i,t-k Let be the instantaneous interaction trust level of edge terminal node number i at time tk within a preset period; T is the preset period.

[0039] It should be noted that the time decay factor is a preset coefficient. The time step k is used to represent the k times from the current time within a preset period.

[0040] In this embodiment, if k=0, then San i,t This represents the instantaneous interaction trust level at time t; similarly, when k = 1, 2, 3, etc., then San... i,t-1 San i,t-2 San i,t-3 This represents the instantaneous interaction trust level at 1, 2, and 3 moments before the current time t. It should be noted that the step length must be determined based on the actual time of the preset period.

[0041] Furthermore, based on the comprehensive interaction trust level of the edge terminal nodes at the current moment, combined with the behavioral anomaly degree of each behavioral factor, the current risk anomaly degree Rg of the edge terminal nodes is analyzed. i The calculation is as follows: ; Among them, Rg i The current risk anomaly level of edge terminal node number i; m is the number of behavioral factors; w ij For edge terminal node i, the influence weight of the factor with behavior j in the influence weight vector is given; Abf ij For edge terminal node number i, set the behavior anomaly degree within a preset period for behavior factor j within the specified edge terminal node; Can i Let i be the overall interactive trust level of the edge terminal node at the current moment.

[0042] Based on the risk anomaly analysis results of edge terminal nodes, the results are sorted in descending order of magnitude and compared with a preset risk anomaly threshold Rg. max Compare and determine the degree of risk abnormality Rg i Greater than or equal to Rg max The edge terminal nodes will provide anomaly alerts; and a fluctuation tolerance ∆g will be preset, with the risk anomaly level Rg... i In [Rg max -∆g,Rg max The edge terminal nodes are given an alert indicating the presence of abnormal risks; the level of risk (Rg) is then assigned. i Less than Rg max -Δg's edge terminal nodes are treated as normal nodes; In this embodiment, the preset risk anomaly threshold and fluctuation tolerance are both manually set by the operators based on big data analysis and experience data. Based on the anomaly assessment results of the edge terminal nodes, a risk anomaly report for the regional edge terminal nodes is generated and fed back to the management end.

[0043] It should be noted that the risk anomaly report is used to record edge terminal nodes that already have anomalies and have anomaly risks within the target area; this includes analytical data such as edge terminal node number, behavioral factor anomaly degree, and risk anomaly degree.

[0044] Example 2: The present invention provides another technical solution: Regional terminal data security management and control system based on edge big data: The system includes a terminal information integration unit, a terminal status evaluation unit, a factor anomaly analysis unit, a terminal trust evaluation unit, a terminal anomaly location unit, and a port feedback unit. Furthermore, the terminal information integration unit selects a target area and locates the edge terminal nodes within the target area; according to a preset period, it collects real-time behavioral data and interaction data of each edge terminal node; Furthermore, the terminal status assessment unit extracts and constructs behavioral factors based on the behavioral data types contained in the behavioral data of the edge terminal nodes; evaluates the real-time status score of each behavioral factor based on the collected behavioral data corresponding to each behavioral factor; constructs a behavioral matrix based on the real-time status score of each behavioral factor; and analyzes the influence weight vector of each behavioral factor based on the behavioral matrix of the edge terminal nodes. Furthermore, the factor anomaly analysis unit performs probability distribution statistics on the status scores of behavioral factors at each moment within a preset period to obtain the distribution probability of the real-time status scores of each behavioral factor within the period; analyzes the periodic behavioral volatility index of each behavioral factor; and analyzes the behavioral anomaly degree of each behavioral factor in conjunction with the preset volatility index benchmark value. Furthermore, the terminal trust assessment unit determines the instantaneous interaction trust level of the edge terminal node based on the interaction data of the edge terminal node within a preset period; and obtains the comprehensive interaction trust level of the edge terminal node at the current moment within the preset period by iteratively analyzing the instantaneous interaction trust level at consecutive moments within the preset period. Furthermore, the terminal anomaly localization unit analyzes the current risk anomaly degree of the edge terminal node based on the comprehensive interaction trust level of the edge terminal node at the current moment and the behavioral anomaly degree of each behavioral factor. Furthermore, the port feedback unit performs risk anomaly analysis on the edge terminal nodes, sorts them from highest to lowest, and compares them with a preset risk anomaly threshold to determine the anomaly status of the edge terminal nodes. Based on the anomaly judgment results of the edge terminal nodes, it generates a regional edge terminal node risk anomaly report and feeds it back to the management terminal.

[0045] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the invention can be implemented in other specific forms without departing from its spirit or essential characteristics. Therefore, the embodiments should be considered in all respects as exemplary and non-limiting, and the scope of the invention is defined by the appended claims rather than the foregoing description. Thus, all variations falling within the meaning and scope of equivalents of the claims are intended to be included within the present invention. No reference numerals in the claims should be construed as limiting the scope of the claims.

Claims

1. A method for regional terminal data security management and control based on edge big data, characterized in that: The method includes the following steps: Identify the edge terminal nodes in the target area and collect the behavioral and interaction data of the edge terminal nodes within a preset period; Behavioral factors are extracted from the behavioral data, and real-time status scores are given to the behavioral factors; a behavioral matrix of edge terminal nodes is constructed, and the influence weight of each behavioral factor is calculated based on the behavioral matrix; The behavioral volatility of each behavioral factor within a preset period is analyzed based on the status score of the behavioral factors, and the degree of behavioral abnormality of each behavioral factor is determined based on the analysis data. Based on the interaction data of edge terminal nodes at various times within a preset period, the instantaneous interaction trust level is analyzed, and the comprehensive interaction trust level of the edge terminal node at the current time is determined according to the instantaneous interaction trust level. Based on the comprehensive interaction trust level and the behavioral anomaly degree of each behavioral factor, the current risk anomaly degree of the edge terminal node is analyzed, and the abnormal edge terminal node is located based on the risk anomaly degree.

2. The regional terminal data security management and control method based on edge big data according to claim 1, characterized in that: Based on the behavioral data contained in the behavioral data of the edge terminal nodes, behavioral factors are extracted and constructed; based on the collected behavioral data corresponding to each behavioral factor, the real-time status score D of the behavioral factor is evaluated. ij The calculation is as follows: ; in, The real-time status score of the behavior factor j for edge terminal node number i; d ij The j-th order of edge terminal node number i is the factor value; d ij,b [d1, d2] represents the reference value of the behavior factor value of the i-th edge terminal node, j; [d1, d2] represents the normal range of the behavior factor value of the i-th edge terminal node, j.

3. The regional terminal data security management and control method based on edge big data according to claim 1, characterized in that: Based on the real-time status scores of each behavioral factor, construct behavioral matrix A. j×j,i ; Based on the behavior matrix of the edge terminal nodes, analyze the influence weight vector w of each behavior factor. i The calculation is as follows: Among them, A j×j,i The behavior matrix for edge terminal node number i; w i w is the influence weight vector of the behavioral factors of edge terminal node i. ij λ represents the influence weight of the factor with behavior number j in the influence weight vector corresponding to edge terminal node number i; max is the largest eigenvalue of the behavior matrix; m is the number of behavior factors.

4. The regional terminal data security management and control method based on edge big data according to claim 1, characterized in that: Based on the real-time status scores of each behavioral factor corresponding to the edge terminal node, the probability distribution statistics of the behavioral factor status scores at each time point within a preset period are performed to obtain the distribution probability p(D) of the real-time status scores of each behavioral factor within the period. ij ) t ; Based on the probability distribution p(D) of real-time state scores within each behavioral factor cycle ij ) t Analyze the periodic behavior volatility index H(D) of each behavioral factor. ij Its calculation is as follows: ; Among them, H(D) ij ) is the periodic behavior volatility index of the behavior factor of edge terminal node number j with number i; p(D ij ) t Let be the distribution probability of the real-time status score of the behavior factor of edge terminal node i at time t within a preset period; t is the time number; T is the preset period. Based on the periodic behavior volatility index of each behavioral factor corresponding to the edge terminal node within a preset period, combined with the preset volatility index benchmark value V(D) ij ), analyze the behavioral abnormality degree Abf of each behavioral factor. ij The calculation is as follows: ; Among them, Abf ij The behavior anomaly degree of edge terminal node number j within a preset period is set for the behavior factor of edge terminal node number i.

5. The regional terminal data security management and control method based on edge big data according to claim 1, characterized in that: Based on the interaction data of edge terminal nodes within a preset period, the instantaneous interaction trust level San of the edge terminal nodes is determined by considering the number of data interactions at each time point. i,t ; and by iteratively analyzing the instantaneous interaction trust levels at consecutive moments within a preset period, the comprehensive interaction trust level Can of the edge terminal node at the current moment within the preset period is obtained. i The calculation is as follows: ; Among them, San i,t Ns represents the instantaneous interaction trust level of edge terminal node i at time t within a preset period; i,t and Na i,t These represent the number of successful data interactions and the total number of interactions for edge terminal node i at time t within a preset period, respectively; Can i San represents the overall interactive trust level of edge terminal node i at the current moment; α is the time decay factor; k is the time step within a preset period; i,t-k Let be the instantaneous interaction trust level of edge terminal node number i at time tk within a preset period; T is the preset period.

6. The regional terminal data security management and control method based on edge big data according to claim 1, characterized in that: Based on the current comprehensive interaction trust level of the edge terminal nodes and the behavioral anomaly degree of each behavioral factor, analyze the current risk anomaly level Rg of the edge terminal nodes. i ; The calculation is as follows: ; Among them, Rg i The current risk anomaly level of edge terminal node number i; m is the number of behavioral factors; w ij The influence weight of the factor with behavior number j in the influence weight vector corresponding to edge terminal node number i; Abf ij For edge terminal node number i, set the behavior anomaly degree within a preset period for behavior factor j within the specified edge terminal node; Can i Let i be the overall interactive trust level of the edge terminal node at the current moment.

7. The regional terminal data security management and control method based on edge big data according to claim 1, characterized in that: Based on the risk anomaly analysis results of edge terminal nodes, the results are sorted in descending order of magnitude and compared with a preset risk anomaly threshold Rg. max Compare and determine the degree of risk abnormality Rg i Greater than or equal to Rg max The edge terminal nodes will display abnormal prompts; And based on the preset fluctuation tolerance ∆g, the degree of risk abnormality Rg is determined. i In [Rg max -∆g,Rg max The edge terminal nodes are alerted to any abnormal risks. The degree of risk abnormality Rg i Less than Rg max -Δg's edge terminal nodes are treated as normal nodes; Based on the anomaly assessment results of the edge terminal nodes, a risk anomaly report for the regional edge terminal nodes is generated and fed back to the management end.

8. The regional terminal data security management and control method based on edge big data according to claim 1, characterized in that: The monitoring platform selects a target area and locates the edge terminal nodes within that area. According to a preset cycle, real-time behavioral and interaction data of each edge terminal node are collected, and a terminal database is constructed to store the collected data.

9. A system for implementing the regional terminal data security management and control method based on edge big data as described in any one of claims 1-8, characterized in that: The system includes a terminal information integration unit, a terminal status evaluation unit, a factor anomaly analysis unit, a terminal trust evaluation unit, a terminal anomaly location unit, and a port feedback unit. The terminal information integration unit selects a target area and locates the edge terminal nodes within the target area; according to a preset period, it collects real-time behavioral data and interaction data of each edge terminal node. The terminal status evaluation unit extracts and constructs behavioral factors based on the behavioral data contained in the behavioral data of the edge terminal nodes; Based on the collected behavioral data corresponding to each behavioral factor, the real-time status score of the behavioral factor is evaluated. A behavior matrix is ​​constructed based on the real-time status scores of each behavior factor; Based on the behavior matrix of the edge terminal nodes, analyze the influence weight vector of each behavior factor.

10. The system according to claim 9, characterized in that: The factor anomaly analysis unit performs probability distribution statistics on the status scores of behavioral factors at each time point within a preset period to obtain the distribution probability of the real-time status scores of each behavioral factor within the period; analyzes the periodic behavioral volatility index of each behavioral factor; and analyzes the behavioral anomaly degree of each behavioral factor in conjunction with the preset volatility index benchmark value. The terminal trust assessment unit determines the instantaneous interaction trust level of the edge terminal node based on the interaction data of the edge terminal node within a preset period; and obtains the comprehensive interaction trust level of the edge terminal node at the current moment within the preset period by iteratively analyzing the instantaneous interaction trust level at consecutive moments within the preset period. The terminal anomaly localization unit analyzes the current risk anomaly level of the edge terminal node based on the comprehensive interaction trust level of the edge terminal node at the current moment and the behavioral anomaly level of each behavioral factor. The port feedback unit performs risk anomaly analysis on the edge terminal nodes, sorts them from highest to lowest, and compares them with a preset risk anomaly threshold to determine the anomaly status of the edge terminal nodes. Based on the anomaly judgment results of the edge terminal nodes, it generates a regional edge terminal node risk anomaly report and feeds it back to the management terminal.

Images