A protection method and system of an internet big data server

Abstract

The application discloses a kind of protection method and system of internet big data server, belong to protection method and system equipment technical field of internet big data server, including data acquisition module, data processing module, threat assessment module, dynamic processing module, resource isolation module and release module.The application uses multidimensional risk perception model to monitor abnormal behavior, determine whether external attack or internal behavior, and carry out preliminary analysis and processing;Abnormal detection model is used to process external attack situation in stages, introduce hierarchical cleaning strategy and abnormal type linkage, avoid using the same set of brute force flow limiting strategy to all attacks, protect normal user experience;Dynamic quota limit of CPU and memory, according to attack mode distribution server resource, prevent being exhausted directly overall server resource.

Description

Technical Field

[0001] This invention relates to a protection method and system for Internet big data servers, belonging to the technical field of protection methods and systems for Internet big data servers. Background Technology

[0002] In the current era of rapid development of the Industrial Internet, big data servers, as the core hub for data storage, processing, and interaction, are crucial to the stable operation of the entire industrial production system. However, industrial internet big data servers currently face numerous severe security challenges.

[0003] From an external attack perspective, hackers' attack methods are becoming increasingly complex and diverse. Distributed Denial-of-Service (DDoS) attacks can overwhelm servers with massive amounts of fake traffic in a short period of time, preventing them from responding to legitimate requests. SQL injection and cross-site scripting attacks attempt to bypass server security verification mechanisms to steal or tamper with sensitive data. Existing protection measures, such as traditional firewalls, are mostly based on rule matching and have limited ability to identify and block new and variant attacks, making it difficult to cope with the ever-evolving attack landscape.

[0004] In terms of internal management, the industrial internet environment has a large number of personnel and complex permissions, which can easily lead to problems such as unauthorized access and misoperation.

[0005] Therefore, the present invention proposes a new solution. Summary of the Invention

[0006] The main objective of this invention is to address the shortcomings of existing technologies by providing a method and system for protecting Internet big data servers.

[0007] The objective of this invention can be achieved by adopting the following technical solution:

[0008] A method for protecting an internet big data server includes the following steps:

[0009] Step S1: Collect multi-dimensional operational data of the big data server in real time. The multi-dimensional operational data includes at least the server's system logs, network traffic characteristics, user operation behavior data, industrial equipment operation data, CPU utilization, and memory access frequency.

[0010] Step S2: Input the multidimensional operational data into the pre-established multidimensional risk perception model, and use big data analysis technology to identify the safety risk level. When the risk level is medium or low, issue an early warning.

[0011] Step S3: When the risk level is high, input the multidimensional running data into the pre-trained anomaly detection model based on the temporal convolutional network to calculate the global threat index T and anomaly type vector V at the current moment;

[0012] Step S4: When T exceeds the first preset threshold, a hierarchical cleaning strategy is dynamically generated based on the anomaly type vector V. The hierarchical cleaning strategy includes at least the first level of traffic cleaning and the second level of temporary blocking of source IPs.

[0013] Step S5: While executing the hierarchical cleaning strategy, calculate the resource isolation coefficient R based on the value of T, and dynamically adjust the computing resource quota and memory resource quota allocated to the normal service process according to the resource isolation coefficient R.

[0014] Step S6: After the attack is mitigated, continuously monitor the descent gradient of T. When T is lower than the first preset threshold and continues to exceed the first duration, release the graded cleaning strategy in a step-by-step manner and restore the resource quota.

[0015] Preferably, in step S2, the multidimensional risk perception model includes:

[0016] High-risk levels include DDoS attacks and brute-force attacks.

[0017] Medium-level risk: including unauthorized access;

[0018] Low-level risk: including server vulnerabilities.

[0019] Preferably, the early warning process includes:

[0020] For medium-level risks, conduct timely investigations and verifications, and adjust permission settings accordingly;

[0021] For low-risk areas, scheduled repairs will be arranged.

[0022] Preferably, the anomaly detection model is jointly trained offline using historical normal traffic and three types of labeled DDoS, brute-force, and DDoS+brute-force samples.

[0023] Preferably, in step S3, dynamically generating the hierarchical cleaning strategy further includes:

[0024] If V indicates a DDoS attack type, then perform the first level of traffic scrubbing;

[0025] If V indicates a brute-force attack type, then a third-level temporary source IP block will be executed;

[0026] If V indicates a DDoS attack + brute-force attack type, then the first level of traffic scrubbing and the second level of temporary blocking of the source IP will be executed simultaneously.

[0027] Preferably, while performing a temporary blocking of the third-level source IP, the login service container is isolated and the server login verification mechanism is checked and optimized.

[0028] Preferably, the formula for calculating the resource isolation coefficient R is: R = min(0.8, α·(T / Tmax) + β·(1- )), where α, β, and γ are preset coefficients, Tmax is the historical maximum threat index, and Δt is the duration of the attack.

[0029] Preferably, in step S5, the step-by-step release of the hierarchical cleaning strategy specifically includes: first, releasing the temporary blocking of the second-level source IP; and if, after a second duration, T is still lower than the first preset threshold, then releasing the first-level traffic cleaning.

[0030] The second duration is no less than the first duration.

[0031] Preferably, in step S5, the "restore resource quota" is executed according to the following step function: after each recovery cycle τ, the current resource quota is increased to min(original quota, current quota × (1 + δ·(1-T))), where δ is the recovery rate coefficient, τ is 30 seconds, and when the resource quota reaches more than 90% of the original quota, it is considered to be fully restored.

[0032] A protection system for internet big data servers includes:

[0033] Data acquisition module: configured to collect system logs, network traffic characteristics, user operation behavior data, industrial equipment operation data, CPU utilization, and memory access frequency of the big data server in real time;

[0034] Data processing module: Includes a multi-dimensional risk perception model, used to initially classify risk levels based on collected data and perform tiered processing;

[0035] Threat assessment module: Includes an anomaly detection model based on a temporal convolutional network, used to calculate the global threat index T and anomaly type vector V based on the collected data;

[0036] Dynamic processing module: Connected to the threat assessment module, it is used to dynamically execute a graded cleaning strategy based on V when T exceeds the first preset threshold;

[0037] Resource isolation module: used to calculate the resource isolation coefficient R based on T, and dynamically adjust the computing and memory resource quotas allocated to normal service processes;

[0038] Release module: Used to gradually release the protection measures after T is lower than the first preset threshold and has been stable for more than the first time period.

[0039] The beneficial technical effects of this invention are as follows: According to the Internet big data server protection method and system of this invention, a multi-dimensional risk perception model is used to monitor abnormal behavior, determine whether it is an external attack or an internal behavior, and perform preliminary analysis and processing; an anomaly detection model is used to classify and process external attack situations, and a graded cleaning strategy is introduced in conjunction with the anomaly type to avoid using the same brute-force rate limiting strategy for all attacks, thus protecting the normal user experience; dynamic quota limits are imposed on CPU and memory, and server resources are allocated according to the attack mode to prevent the overall server resources from being exhausted directly. Attached Figure Description

[0040] Fig. 1 This is a schematic diagram of a method according to a preferred embodiment of the present invention;

[0041] Fig. 2 This is a system flowchart according to a preferred embodiment of the present invention. Detailed Implementation

[0042] To enable those skilled in the art to understand the technical solution of the present invention more clearly, the present invention will be further described in detail below with reference to the embodiments and accompanying drawings, but the embodiments of the present invention are not limited thereto.

[0043] like Figs. 1-2 As shown, the method for protecting an Internet big data server provided in this embodiment includes the following steps:

[0044] Step S1: Collect multi-dimensional operational data of the big data server in real time. The multi-dimensional operational data includes at least the server's system logs, network traffic characteristics, user operation behavior data, industrial equipment operation data, CPU utilization, and memory access frequency.

[0045] Step S2: Input the multidimensional operational data into the pre-established multidimensional risk perception model, and use big data analysis technology to identify the safety risk level. When the risk level is medium or low, issue an early warning.

[0046] Step S3: When the risk level is high, input the multidimensional running data into the pre-trained anomaly detection model based on the temporal convolutional network to calculate the global threat index T and anomaly type vector V at the current moment;

[0047] Step S4: When T exceeds the first preset threshold, a hierarchical cleaning strategy is dynamically generated based on the anomaly type vector V. The hierarchical cleaning strategy includes at least the first level of traffic cleaning and the second level of temporary blocking of source IPs.

[0048] Step S5: While executing the hierarchical cleaning strategy, calculate the resource isolation coefficient R based on the value of T, and dynamically adjust the computing resource quota and memory resource quota allocated to the normal service process according to the resource isolation coefficient R.

[0049] Step S6: After the attack is mitigated, continuously monitor the descent gradient of T. When T is lower than the first preset threshold and continues to exceed the first duration, release the graded cleaning strategy in a step-by-step manner and restore the resource quota.

[0050] A multi-dimensional risk perception model is used to monitor abnormal behavior, determine whether it is an external attack or an internal behavior, and perform preliminary analysis and processing; an anomaly detection model is used to classify and process external attacks, and a graded cleaning strategy is introduced in conjunction with the anomaly type to avoid using the same brute-force rate limiting strategy for all attacks and protect the normal user experience; dynamic quota limits are set for CPU and memory, and server resources are allocated according to the attack mode to prevent the overall server resources from being exhausted directly.

[0051] As an optional embodiment, in step S2, the multidimensional risk perception model includes:

[0052] High-risk levels include DDoS attacks and brute-force attacks.

[0053] Medium-level risk: including unauthorized access;

[0054] Low-level risk: including server vulnerabilities.

[0055] As an optional embodiment, the warning processing includes:

[0056] For medium-level risks, conduct timely investigations and verifications, and adjust permission settings accordingly;

[0057] For low-risk areas, scheduled repairs will be arranged.

[0058] By setting three risk levels, with medium and low risks being internal risks, when a high-level risk is detected, such as an ongoing large-scale DDoS attack, the data is immediately fed into the anomaly detection model, and resources are allocated for processing. When a medium-level risk is detected, such as suspected unauthorized access by internal personnel, an investigation and verification are conducted in a timely manner, and permission settings are adjusted. When a low-level risk is detected, such as minor vulnerabilities in individual devices, regular patching is arranged.

[0059] As an optional implementation, the anomaly detection model is jointly trained offline using historical normal traffic and three types of labeled DDoS, brute-force, and DDoS+brute-force samples.

[0060] As an optional embodiment, in step S3, dynamically generating the hierarchical cleaning strategy further includes:

[0061] If V indicates a DDoS attack type, then perform the first level of traffic scrubbing;

[0062] If V indicates a brute-force attack type, then a third-level temporary source IP block will be executed;

[0063] If V indicates a DDoS attack + brute-force attack type, then the first level of traffic scrubbing and the second level of temporary blocking of the source IP will be executed simultaneously.

[0064] As an optional implementation, while performing a temporary blocking of the third-level source IP, the login service container is isolated and the server login verification mechanism is checked and optimized.

[0065] As an optional embodiment, the resource isolation coefficient R is calculated using the formula: R = min(0.8, α·(T / Tmax) + β·(1- )), where α, β, and γ are preset coefficients, Tmax is the historical maximum threat index, and Δt is the duration of the attack.

[0066] As an optional embodiment, in step S5, the step-by-step release of the hierarchical cleaning strategy specifically includes: first releasing the temporary blocking of the second-level source IP, and if T is still lower than the first preset threshold after a second period of time, then releasing the first-level traffic cleaning;

[0067] The second duration is no less than the first duration.

[0068] As an optional embodiment, in step S5, "restoring resource quota" is executed according to the following step function: after each recovery cycle τ, the current resource quota is increased to min(original quota, current quota × (1 + δ·(1-T))), where δ is the recovery rate coefficient, τ is 30 seconds, and when the resource quota reaches more than 90% of the original quota, it is considered to be fully restored.

[0069] A protection system for internet big data servers includes:

[0070] Data acquisition module: configured to collect system logs, network traffic characteristics, user operation behavior data, industrial equipment operation data, CPU utilization, and memory access frequency of the big data server in real time;

[0071] Data processing module: Includes a multi-dimensional risk perception model, used to initially classify risk levels based on collected data and perform tiered processing;

[0072] Threat assessment module: Includes an anomaly detection model based on a temporal convolutional network, used to calculate the global threat index T and anomaly type vector V based on the collected data;

[0073] Dynamic processing module: Connected to the threat assessment module, it is used to dynamically execute a graded cleaning strategy based on V when T exceeds the first preset threshold;

[0074] Resource isolation module: used to calculate the resource isolation coefficient R based on T, and dynamically adjust the computing and memory resource quotas allocated to normal service processes;

[0075] Release module: Used to gradually release the protection measures after T is lower than the first preset threshold and has been stable for more than the first time period.

[0076] Contents not described in detail in this specification are existing technologies known to those skilled in the art. Standard parts used in this invention can be purchased commercially, and irregularly shaped parts can be custom-made according to the description and drawings. The specific connection methods for each part all employ conventional methods such as bolts, rivets, and welding, which are already mature technologies. The machinery, parts, and equipment all use conventional models from the prior art, and the circuit connections also employ conventional connection methods from the prior art, which will not be detailed here.

[0077] Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing embodiments or make equivalent substitutions for some of the technical features. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for protecting an Internet big data server, characterized in that, Includes the following steps: Step S1: Collect multi-dimensional operational data of the big data server in real time. The multi-dimensional operational data includes at least the server's system logs, network traffic characteristics, user operation behavior data, industrial equipment operation data, CPU utilization, and memory access frequency. Step S2: Input the multidimensional operational data into the pre-established multidimensional risk perception model, and use big data analysis technology to identify the safety risk level. When the risk level is medium or low, issue an early warning. Step S3: When the risk level is high, input the multidimensional running data into the pre-trained anomaly detection model based on the temporal convolutional network to calculate the global threat index T and anomaly type vector V at the current moment; Step S4: When T exceeds the first preset threshold, a hierarchical cleaning strategy is dynamically generated based on the anomaly type vector V. The hierarchical cleaning strategy includes at least the first level of traffic cleaning and the second level of temporary blocking of source IPs. Step S5: While executing the hierarchical cleaning strategy, calculate the resource isolation coefficient R based on the value of T, and dynamically adjust the computing resource quota and memory resource quota allocated to the normal service process according to the resource isolation coefficient R. Step S6: After the attack is mitigated, continuously monitor the descent gradient of T. When T is lower than the first preset threshold and continues to exceed the first duration, release the graded cleaning strategy in a step-by-step manner and restore the resource quota.

2. A method for protecting an Internet big data server according to claim 1, characterized in that, In step S2, the multidimensional risk perception model includes: High-risk levels include DDoS attacks and brute-force attacks. Medium-level risk: including unauthorized access; Low-level risk: including server vulnerabilities.

3. A method for protecting an Internet big data server according to claim 1, characterized in that, In step S2, the early warning processing includes: For medium-level risks, conduct timely investigations and verifications, and adjust permission settings accordingly; For low-risk areas, scheduled repairs will be arranged.

4. A method for protecting an Internet big data server according to claim 1, characterized in that, The anomaly detection model is jointly trained offline using historical normal traffic and three types of labeled DDoS, brute-force, and DDoS+brute-force samples.

5. A method for protecting an Internet big data server according to claim 1, characterized in that, In step S3, the dynamic generation of the hierarchical cleaning strategy further includes: If V indicates a DDoS attack type, then perform the first level of traffic scrubbing; If V indicates a brute-force attack type, then a third-level temporary source IP block will be executed; If V indicates a DDoS attack + brute-force attack type, then the first level of traffic scrubbing and the second level of temporary blocking of the source IP will be executed simultaneously.

6. A method for protecting an Internet big data server according to claim 5, characterized in that, While implementing the third-level source IP temporary blocking, the login service container is isolated and the server login verification mechanism is checked and optimized.

7. A method for protecting an Internet big data server according to claim 1, characterized in that, The formula for calculating the resource isolation coefficient R is: R = min(0.8, α·(T / Tmax) + β·(1- )), where α, β, and γ are preset coefficients, Tmax is the historical maximum threat index, and Δt is the duration of the attack.

8. A method for protecting an Internet big data server according to claim 1, characterized in that, In step S5, the step-by-step release of the hierarchical cleaning strategy specifically includes: first, releasing the temporary blocking of the second-level source IP; and if, after a second duration, T is still lower than the first preset threshold, then releasing the first-level traffic cleaning. The second duration is no less than the first duration.

9. A method for protecting an Internet big data server according to claim 1, characterized in that, In step S5, "Restore Resource Quota" is executed according to the following step function: after each recovery cycle τ, the current resource quota is increased to min(original quota, current quota × (1 + δ·(1-T))), where δ is the recovery rate coefficient, τ is 30 seconds, and when the resource quota reaches more than 90% of the original quota, it is considered to be fully restored.

10. A protection system for an Internet big data server, characterized in that, include: Data acquisition module: configured to collect system logs, network traffic characteristics, user operation behavior data, industrial equipment operation data, CPU utilization, and memory access frequency of the big data server in real time; Data processing module: Includes a multi-dimensional risk perception model, used to initially classify risk levels based on collected data and perform tiered processing; Threat assessment module: Includes an anomaly detection model based on a temporal convolutional network, used to calculate the global threat index T and anomaly type vector V based on the collected data; Dynamic processing module: Connected to the threat assessment module, it is used to dynamically execute a graded cleaning strategy based on V when T exceeds the first preset threshold; Resource isolation module: used to calculate the resource isolation coefficient R based on T, and dynamically adjust the computing and memory resource quotas allocated to normal service processes; Release module: Used to gradually release the protection measures after T is lower than the first preset threshold and stabilizes.

Images