CN118101269B - Network security defense method and system based on data analysis - Google Patents

Abstract

The invention discloses a network security defense system based on data analysis, and relates to the technical field of network security; the invention comprises: a database, a data encryption module, a communication authentication module and an encryption update module; by performing complex and random encryption on data and performing dynamic display and dynamic update, the same piece of data has obvious differences in the final ciphertext obtained after being encrypted twice, thereby improving the concealment and security of data in the database and the intelligent management of encryption update; by performing security authentication on the visiting IP address, potential security threats can be effectively identified and prevented, and the probability of security accidents can be reduced; and security risk verification is performed on the visiting IP address in the authenticated state, so that the access rights of the visiting IP address can be restricted and managed, so as to avoid adverse effects and damages on the enterprise network system, realize the authentication and security risk management of the visiting IP address, and further ensure the security of the enterprise network system and the confidentiality of data.

Description

Network security defense method and system based on data analysis

Technical Field

The present invention relates to the field of network security technology, and in particular to a network security defense method and system based on data analysis.

Background Art

With the rapid development of Internet technology, people can obtain various information, conduct social activities, shop online, learn online and other activities through the Internet, which has brought great convenience to people's life, study and work; however, the openness and globality of the Internet also bring challenges to network security. There are various security risks on the Internet, including information leakage, hacker attacks, virus transmission, network fraud, etc.; therefore, network security defense is particularly important for the Internet;

Traditional defense methods are mainly based on specific lists (blacklists or whitelists) or rule engines for network security defense. With the development of artificial intelligence, the technology of network attackers is becoming more and more powerful and complex. For example, they bypass traditional defense measures by disguising IPs and committing credit fraud to obtain network authorization, maliciously obtain or maliciously tamper with corporate network data, causing the company to suffer serious information leakage and other network security risks.

Summary of the invention

The main purpose of the present invention is to provide a network security defense method and system based on data analysis to overcome the problems mentioned in the above background technology.

To achieve the above object, according to one aspect of the present invention, a network security defense system based on data analysis is provided, the system comprising: a database, a data encryption module, a communication management module and an encryption update module;

The data encryption module encrypts the data and dynamically displays and updates it. The specific steps are as follows:

Step 1: Classify the data in the database according to categories to obtain several data strips with timestamps, compare the characters in the data strips with timestamps with all set characters to match the corresponding values, and sort the values in the order of the characters in the corresponding data strips with timestamps to obtain a character sequence with timestamps, identify the salt position and fill the salt value into the salt position to obtain the first-level ciphertext with timestamps;

Step 2: converting the primary ciphertext with the timestamp into a graph to obtain a secondary encrypted graph with the timestamp;

Step 3: Dynamically display the secondary ciphertext graphic with the timestamp to obtain the final ciphertext. The specific steps of display are as follows:

Get the length of the line between the endpoints of two adjacent rays, compare the line length with all the set colors to match the corresponding color, and fill the closed part composed of the corresponding two adjacent rays and the line composed of their endpoints with the matched color to obtain a color-filled encrypted graphic with a timestamp; calculate the area of each closed part, and perform difference calculation on the closed areas of two adjacent closed parts to obtain the adjacent difference; compare and analyze the adjacent difference with the set difference interval to divide the adjacent difference into high difference, medium difference and low difference, and record them as C1, C2 and C3 respectively; count the number of high difference, medium difference and low difference respectively, and sum the high difference, medium difference and low difference respectively to obtain the high difference value, medium difference value and low difference value, and record them as D1, D2 and D3 respectively; substitute C1, C2, C3, D1, D2 and D3 into the set formula Calculate to obtain the rotation angle σ, wherein a1, a2, a3, a4 and a5 are respectively set proportional coefficients, and λ is a set angle conversion coefficient; convert the timestamp of the color-filled encrypted figure into a series of binary numbers, and record the series as a password series; control the dynamic display of the color-filled encrypted figure according to the password series; wherein the control step is specifically as follows: determine the first number in the password series, when the number in the password series is 0, control the color-filled encrypted figure to rotate clockwise according to the rotation angle, when the number in the password series is 1, control the filled encrypted figure to rotate counterclockwise according to the rotation angle; until all the numbers in the password series are determined to complete the dynamic display of the color-filled encrypted figure; record the dynamically displayed color-filled encrypted figure as the final ciphertext;

Step 4: Set an update duration, retrieve the generation time of the update instruction closest to the current time, calculate the time difference between the generation time and the current time of the system to get the actual interval duration. When the actual interval duration is equal to the update duration, update the data in the database according to the encryption steps of steps 1 to 3.

Furthermore, the specific steps of identifying the salt position and filling the salt value into the salt position to obtain the first-level ciphertext with a timestamp are:

Identify the zeros in the character sequence with a timestamp, and obtain the number of zeros and the position number of each zero in the character sequence with a timestamp, set 9 random salts of numbers 1-9 as Y, where Y = 1 or 2 or 3 or 4 or 5 or 6 or 7 or 8 or 9, and record the position of each zero in the character sequence with a timestamp as the salt position, thereby obtaining the total salt positions in the character sequence with a timestamp and the zero position number corresponding to each salt position as B ⁿ _m , where n = 1, 2, 3 ... N, m and N are positive integers, N represents the total number of zeros in the character sequence with a timestamp, and n represents the sequence number of any zero in the character sequence with a timestamp; randomly select three random salts Y and substitute them with the position number B ⁿ _m into the set formula Calculate to obtain the filling salt value T _m ⁿ of the salt position, where α1 and α2 are the set weight coefficients respectively, and fill the filling salt value into the corresponding salt position in the character sequence with the timestamp to obtain the first-level ciphertext with the timestamp

Furthermore, the first-level ciphertext with the timestamp is converted into a graph to obtain a second-level encrypted graph with the timestamp. The specific steps of the conversion are:

Count the number of digits in the first-level ciphertext with a timestamp, draw a circle according to the parity of the number of digits, and divide the digits in the first-level ciphertext with a timestamp into several groups of values, draw several rays evenly on the arc, and the length of the rays is equal to the values of the corresponding group, among which the length of the vertically upward ray is equal to the first group of values, and the clockwise direction of the ray with the same length as the first group of values is the ray with the same length as the second group of values; connect the adjacent ray endpoints in sequence to obtain a second-level encrypted graph with a timestamp.

Furthermore, it also includes a communication management module and an encryption update module;

The communication management module authenticates the visiting IP and regulates the access rights of the authenticated visiting IP.

The encryption update module analyzes the authentication failure of the IP accessing the enterprise network to obtain the update duration and sends it to the data encryption module.

Furthermore, the specific process of authentication is as follows:

Identify the visiting IP state. If the visiting IP state is unauthenticated, perform security authentication on it. Specifically:

Retrieve the attribution information of the visiting IP and convert it into an attribution numerical sequence, identify zero in the attribution numerical sequence, obtain the position of zero and record it as a discontinuous node, divide the attribution numerical sequence into several segments according to the discontinuous nodes, take a horizontal line, draw the circle or concentric circles of each segment in a tangential manner and in the order of the segments in the attribution numerical sequence; cut according to the node type before the segment to obtain a comparison graph and a filling graph, integrate the filling graph into a verification request and send it to the IP corresponding to the attribution information, when receiving the filling graph sent by the visiting IP, overlap and compare it with the corresponding comparison graph, if the overlap and comparison are successful, the authentication is successful, and the access permission is specified; otherwise, the authentication fails, and an authentication failure instruction is generated, and the visiting IP is not allowed to enter and access, and the number of authentication failures of the visiting IP increases by one.

Furthermore, the cutting method is:

Retrieve the type of discontinuous node to obtain the number of discontinuous node position zeros, and record it as G1; obtain the largest value in the two number segments before and after the discontinuous node, and record them as G2 and G3 respectively; use the set formula group Calculation is performed to obtain the cutting parameters of each discontinuous node, where Gz1 is the cutting line width, Gz2 is the cutting line length, μ1 and μ2 are the set line width and line length conversion coefficients respectively; δ1, δ2, δ3, and δ4 are the set proportional coefficients respectively; the cutting area of the discontinuous node is obtained based on the cutting line width and the cutting line length, where the center point of the cutting area coincides with the tangent point of the graphics corresponding to the several segments before and after the discontinuous node, and cutting is performed based on the cutting area to obtain the comparison map and the filling map.

Furthermore, the specific steps of access rights specification are as follows:

When the state of the visiting IP is authenticated, a security risk check is performed on it to regulate the access rights of the visiting IP; the access records of the authenticated visiting IP are obtained, wherein the browsing records include the number of times and the start and end times of each visit, and the time difference between the start and end times of the visit is calculated to obtain the duration of this visit, thereby obtaining the duration of each visit and recording it as Wq, wherein q = 1, 2, 3 ... Q, Q is a positive integer, Q represents the total number of visits, and q is any one of the visits; the start time of the visit is taken as the time of this visit, thereby obtaining the time of each visit;

Take time as the horizontal axis and access duration as the vertical axis to get the access record change line graph; calculate the time difference between two adjacent access times to get the access interval, and calculate the slope of the line segment between two adjacent points and record it as Substitute it into the set formula Calculate to get the browsing fluctuation value Az, where is the mean of all slopes;

Set a standard access time and a standard access interval for each different identity of the visiting IP, obtain the identity of the visiting IP, and compare it with all the set identities to match the corresponding standard access time and standard access interval, and mark them as H1 and H2;

Get the number of authentication failures T of the visiting IP, and substitute the browsing fluctuation value Az, the number of authentication failures T, the standard access time H1 and the standard access interval H2 into the set formula Calculation is performed to obtain the access risk index FH, where f1, f2, f3, and f4 are respectively set proportional coefficients;

The process of regulating the access rights of visiting IPs is as follows: setting three security risk thresholds: security risk threshold 1 and security risk threshold 2, and security risk threshold 1>security risk threshold 2;

When the access risk index is greater than the set security risk threshold of one, the visiting IP is prohibited from entering;

When the access risk index is less than the set security risk threshold of two and greater than the security risk threshold of one, the visiting IP is restricted from operating the data in the database.

Furthermore, the update duration calculation process is:

The collection time is used as the horizontal axis, and the total number of authentication failures is used as the horizontal axis to obtain a curve chart of the total number of authentication failures in the enterprise network system changing with time; a tangent line is drawn at the position of the authentication point to obtain a tangent expression, and the derivative of the authentication point is obtained by derivative operation and recorded as Vj, where j = 1, 2, 3 ... J, J is a positive integer, J represents the total number of collection times, and j represents any one of the collection times. The derivatives greater than zero are summed to obtain the risk increase degree and recorded as P1, and the derivatives less than zero are summed and calculated and the absolute value is taken to obtain the risk reduction degree and recorded as P2;

Substitute the derivative Vj, risk increase P1 and risk reduction P2 into the set formula Calculate to get the update time Ps, where c1 and c2 are the set proportional coefficients. is the mean of all derivatives.

To achieve the above object, according to another aspect of the present invention, a network security defense method based on data analysis is provided, the method comprising the following steps:

S1: Classify the data in the database according to categories, each category has several data strips with timestamps, compare the characters in the data strips with timestamps with all set characters to match the corresponding values, and sort the values in the order of the characters in the corresponding data strips with timestamps to obtain a character sequence with timestamps; remove zeros and fill the character sequence with random salt values to obtain a first-level ciphertext with timestamps;

S2: converting the primary ciphertext with the timestamp into a graph to obtain a secondary encrypted graph with the timestamp;

S3: Dynamically display the secondary ciphertext graphics with timestamps: obtain the length of the line between the endpoints of two adjacent rays, compare the length of the line with all set colors to match the corresponding color, fill the closed part composed of the corresponding two adjacent rays and the line composed of their endpoints with the matched color to obtain a color-filled encrypted graphic with a timestamp; calculate the area of each closed part, and conduct in-depth analysis based on it to obtain the rotation angle; convert the timestamp of the color-filled encrypted graphic into a binary sequence, and record the sequence as a password sequence; control the dynamic display of the color-filled encrypted graphic according to the password sequence and the rotation angle;

S4: Set an update duration, retrieve the generation time of the update instruction closest to the current time, calculate the time difference between the generation time and the current time of the system to obtain the actual interval duration, and when the actual interval duration is equal to the update duration, update the data in the database according to the encryption steps of steps S1-S3;

S5: Authentication and access rights specification for all visiting IPs, specifically:

S51: Identify the visiting IP state. If the visiting IP state is authenticated, execute step S53; otherwise, execute step S52;

S52: Authenticate the unauthenticated visiting IP, and the authentication method is as follows: retrieve the attribution information of the visiting IP, and convert the attribution information into an attribution numerical sequence; identify zero in the attribution numerical sequence, and obtain the position of zero as a discontinuous node, and divide the attribution numerical sequence into several segments according to the discontinuous nodes; take a horizontal line, and draw the circle or concentric circles of each segment in a tangential manner and in the order of the segments in the attribution numerical sequence; cut according to the node type before the segment to obtain a comparison map and a filling map, integrate the filling map into a verification request and send it to the IP corresponding to the attribution information, when receiving the filling map sent by the visiting IP, it is overlapped and compared with the corresponding comparison map, if the overlap comparison is successful, the authentication is successful, and S53 is executed; otherwise, the authentication fails, and S6 is executed;

S53: Perform security verification analysis on the authenticated visiting IP to obtain the security risk index of each authenticated visiting IP;

S55: regulating the access rights of the authenticated visiting IP according to the security risk level; the regulation process is: setting three security risk thresholds: security risk threshold 1 and security risk threshold 2, and security risk threshold 1>security risk threshold 2;

When the access risk index is greater than the set security risk threshold of one, the visiting IP is prohibited from entering;

When the access risk index is less than the set security risk threshold of two and greater than the security risk threshold of one, the visiting IP is restricted from operating the data in the database, where the data operation is specifically data adjustment, including data modification, data deletion or data addition;

S6: Generate an authentication failure instruction and do not allow the visiting IP to enter and access. The number of authentication failures of the visiting IP increases by one.

S7: By collecting the total number of authentication failures corresponding to different times in the enterprise network system, and performing detailed analysis to obtain the update duration, the update duration is sent to S4.

Beneficial effects of the present invention:

(1) By performing character matching, sorting, zeroing and salt filling operations on the data in the database, the data is converted into a first-level ciphertext character sequence with a timestamp, and then converted into a second-level encrypted graphic with a timestamp. The second-level encrypted graphic with a timestamp is color-filled and quantitatively analyzed to obtain the rotation angle; the timestamp is converted to obtain a password series, and the dynamic display of the color-filled encrypted graphic is controlled according to the password series and the rotation angle to obtain the final ciphertext; at the same time, by setting the update time, when the actual interval time is equal to the set update time, the data in the database is encrypted and updated; through multiple encryption and updates, each update will generate a different ciphertext, so that attackers cannot identify the data content by comparing historical ciphertexts, greatly reducing the risk of data leakage and unauthorized access, realizing automatic management of the data encryption process, and improving data security.

(2) By authenticating the visiting IPs for security authentication, potential security threats can be effectively identified and prevented, reducing the probability of security accidents. By then performing security risk verification on the authenticated visiting IPs, the access rights of the visiting IPs can be restricted and managed, avoiding adverse effects and damages to the enterprise network system, achieving authentication and security risk management of the visiting IPs, and further ensuring the security of the enterprise network system and the confidentiality of data.

In summary, the present invention can effectively protect the data security and privacy of the database through complex, random encryption processes and intelligent management, reducing the risks of data leakage, tampering and unauthorized access.

BRIEF DESCRIPTION OF THE DRAWINGS

The accompanying drawings constituting a part of the present invention are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the accompanying drawings:

FIG1 is a schematic diagram of system module connections of the present invention;

FIG2 is a diagram of a graphical transformation of data encryption according to the present invention;

FIG3 is a cutting method of the authentication pattern of the present invention;

FIG4 is a line graph of access changes of the present invention;

FIG. 5 is a flow chart of the communication management steps of the present invention.

DETAILED DESCRIPTION

It should be noted that, in the absence of conflict, the embodiments of the present invention and the features in the embodiments can be combined with each other. The present invention will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so as to describe the embodiments of the present invention described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

In order to make the objects and advantages of the present invention more clearly understood, the present invention is further described below in conjunction with embodiments; it should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

According to an embodiment of the present application, a network security defense system based on data analysis is provided, as shown in FIG1 , the system includes: a database, a data encryption module, a communication authentication module and an encryption update module;

The database contains the company's business data, privacy data and other data that need to be protected;

The data encryption module encrypts and saves the data in the database, specifically:

Step 1: Classify the data in the database according to categories. Each category has several data strips with timestamps. Set the existence of several characters, each character corresponds to a numerical value, compare the characters in the data strips with timestamps with all the set characters to match the corresponding numerical values, and sort the numerical values in the order of the characters in the corresponding data strips with timestamps to obtain a character sequence with timestamps; remove the character sequence with timestamps: identify the zeros in the character sequence with timestamps, and obtain the number of zeros and the position number of each zero in the character sequence with timestamps. It should be noted that the position number refers to the number counted from the first number in the character sequence with timestamps to the zero position; the serial number of zero in the character sequence with timestamps is recorded as n, and the position number of each zero is recorded as Where n = 1, 2, 3 ... N, m and N are positive integers, N represents the total number of zeros in the character sequence with timestamp, and n represents the sequence number of any zero in the character sequence with timestamp; specifically, if there is a character sequence of 510647014470, the number of zeros in the character sequence is 3, and the position number of each zero can be recorded as Where n = 1, 2, 3; m = 3, 7, 12; This means that the position number of the first zero in the character sequence with the timestamp is 3; This means that the position number of the second zero in the character sequence with the timestamp is 7; It means that the position of the third zero in the character sequence with timestamp is numbered 12; set 9 random salts of numbers 1-9 as Y, where Y = 1 or 2 or 3 or 4 or 5 or 6 or 7 or 8 or 9; record the position of each zero in the character sequence with timestamp as salt position, thus there are N salt positions in the character sequence with timestamp, and the zero position corresponding to each salt position is numbered Randomly select three random salts according to the set formula Calculate the fill salt value for this salt position Where α1 and α2 are respectively the set weight coefficients; the filling salt value is filled into the corresponding salt position in the character sequence with the timestamp to obtain the first-level ciphertext with the timestamp; it should be noted that in cryptography, salt is a random value used to increase the complexity of the password; % is the modulus operation; this formula uses the random number through power operation and sum operation, and then takes the modulus of 9 and adds 1 to obtain the final result. Not only does it have obvious randomness but also does not contain zero. Therefore, the obtained first-level ciphertext character sequence with the timestamp is de-zeroed and the randomness of the first-level ciphertext with the timestamp is increased. Even the same character sequence will be significantly different after being filled with the filling salt value;

Step 2: Convert the first-level ciphertext with timestamp into a graphic: Count the number of digits in the first-level ciphertext with timestamp. When the number of digits is an even number, draw a circle with a fixed value as the radius; group the ciphertext with timestamp into adjacent digits, thereby obtaining several groups of values; when the number of digits is an odd number, draw a circle with the last digit in the first-level ciphertext with timestamp as the radius, group the other digits except the last digit into two adjacent values, thereby obtaining several groups of values, as shown in Figure 2, draw several rays evenly on the arc, the length of the rays is equal to the value of the corresponding group, among which the length of the vertical upward ray is equal to the value of the first group, and the clockwise direction of the ray with the same length as the first group is the ray with the same length as the second group; connect the endpoints of adjacent rays in sequence to obtain the second-level encrypted graph with timestamp;

Step 3: Dynamically display the secondary ciphertext graphics with timestamps: obtain the length of the line connecting the endpoints of two adjacent rays, set each number to correspond to a color, compare the length of the line with all the set colors to match the corresponding color, and fill the matched color into the closed part composed of the corresponding two adjacent rays and the line connecting their endpoints, thereby filling each closed part with color to obtain a color-filled encrypted graphic with a timestamp; calculate the area of each closed part, thereby obtaining the closed area of each closed part; calculate the difference between the closed areas of two adjacent closed parts to obtain the adjacent difference; and calculate the adjacent difference. Compare and analyze with the set difference interval. When the adjacent difference is greater than the maximum value in the set difference interval, the difference is recorded as a high difference; when the adjacent difference is within the set difference interval, the difference is recorded as a medium difference; when the adjacent difference is less than the minimum value in the set difference interval, the difference is recorded as a low difference; count the number of high differences, medium differences and low differences respectively, and record them as C1, C2 and C3 respectively; sum the high differences, medium differences and low differences respectively to obtain the high difference value, medium difference value and low difference value, and record them as D1, D2 and D3 respectively; use the set formula Calculation is performed to obtain a rotation angle σ, wherein a1, a2, a3, a4 and a5 are respectively set proportional coefficients, and λ is a set angle conversion coefficient; the timestamp of the color-filled encrypted figure is converted into a binary sequence, and the sequence is recorded as a password sequence; the dynamic display of the color-filled encrypted figure is controlled according to the password sequence; wherein the control step is specifically as follows: the first number in the password sequence is determined, when the number in the password sequence is 0, the color-filled encrypted figure is controlled to rotate clockwise according to the rotation angle, and when the number in the password sequence is 1, the filled encrypted figure is controlled to rotate counterclockwise according to the rotation angle; until all the numbers in the password sequence are determined to complete the dynamic display of the color-filled encrypted figure; the dynamically displayed color-filled encrypted figure is recorded as the final ciphertext; the data obfuscation and encryption are realized through the encryption process from step one to step three, thereby increasing the complexity and randomness of the data;

Step 4: Set an update duration, retrieve the generation time of the update instruction closest to the current time, calculate the time difference between the generation time and the current time of the system to obtain the actual interval duration, and when the actual interval duration is equal to the update duration, update the data in the database according to the encryption steps of steps S1-S3; It can be seen from steps 1 to 3 that the same data has obvious differences in the final ciphertext obtained after two encryptions, thereby improving the confidentiality and security of the data in the database and the intelligent management of encryption updates, realizing data protection, and effectively reducing the risk of data leakage and unauthorized access; According to the operation of dynamically updating the ciphertext, even if the attacker obtains part of the ciphertext, it is impossible to identify the data content by comparing the historical ciphertext, thereby increasing the data protection level.

The communication management module authenticates the visiting IP and manages the communication of the authenticated visiting IP, specifically:

Step 1: Identify the visiting IP status: retrieve the historical visiting IP set from the database, and compare the visiting IP with the historical visiting IP set. If the visiting IP is in the historical visiting IP set and exists within a fixed time from the current time, the visiting IP is in the authenticated state; otherwise, it is in the unauthenticated state; the fixed time is one week, half a month or one month, and the specific time is set by the technician according to the needs;

Step 2: When the visiting IP status is unauthenticated, perform security authentication on it, specifically:

Retrieve the attribution information of the visiting IP, wherein the attribution information includes the operator, the registered address and the IP segment; set these characters to correspond to a numerical value, compare the operator, the registered address and the IP segment with the set characters to match the operator numerical sequence, the registered numerical sequence and the IP segment numerical sequence; arrange the operator numerical sequence, the registered numerical sequence and the IP segment numerical sequence in sequence to obtain the attribution numerical sequence representing the attribution information; identify zeros in the attribution numerical sequence, and obtain the position of zero as a discontinuous node, wherein the discontinuous node is divided into a single node, a double node, a triple node...R node, wherein R is a positive integer, and R represents the total number of zeros at the discontinuous node position; when there is only one zero at the discontinuous node position, the discontinuous node is a single node, when there are two zeros at the discontinuous node position, the discontinuous node is a double node; when there are three zeros at the discontinuous node position, the discontinuous node is a triple node; and so on, when there are R zeros at the discontinuous node position, the discontinuous node is an R node; The belonging numerical sequence is divided into several segments according to the discontinuous nodes, and it can be known that there is no zero in each segment obtained according to the discontinuous method; as shown in Figure 3, a circle is drawn with the value in the segment as the radius to obtain a ring or concentric circles; when there is only one value in the segment or the existing values are equal, a circle is obtained; when there are more than two values in the segment and the values are not equal, a concentric circle is obtained; a horizontal line is taken to draw the circle or concentric circles of each segment in a tangent manner and in the order of the segments in the belonging numerical sequence; according to the node type before the segment, it is cut to obtain a comparison map and a filling map, and the filling map is integrated into a verification request and sent to the IP corresponding to the belonging information. When the filling map sent by the visiting IP is received, it is overlapped and compared with the corresponding comparison map. If the overlap comparison is successful, the authentication is successful and step three is executed; otherwise, the authentication fails and step four is executed;

The cutting methods are:

Retrieve the type of discontinuous node to obtain the number of discontinuous node position zeros, and record it as G1; obtain the largest value in the two number segments before and after the discontinuous node, and record them as G2 and G3 respectively; use the set formula group Calculation is performed to obtain the cutting parameters of each discontinuous node, where Gz1 is the cutting line width, Gz2 is the cutting line length, μ1 and μ2 are the set line width and line length conversion coefficients respectively; δ1, δ2, δ3, and δ4 are the set proportional coefficients respectively; the cutting area of the discontinuous node is obtained according to the cutting line width and the cutting line length, where the center point of the cutting area coincides with the tangent point of the graphics corresponding to the previous and next segments of the discontinuous node, and cutting is performed according to the cutting area to obtain the comparison map and the filling map;

Step 3: When the visiting IP is in the authenticated state, a security risk check is performed to regulate the access rights of the visiting IP; specifically:

Perform security checks on the authenticated visiting IPs to obtain the security risk level of each visiting IP that has passed the security check:

Get the access records of the authenticated visiting IP, where the browsing records include the number of times and the start and end times of each visit. Calculate the time difference between the start and end times of the visit to get the duration of this visit, and record the duration of each visit as Wq; take the start time of the visit as the time of this visit, and get the access time of each visit; as shown in Figure 4, construct a two-dimensional rectangular coordinate system with time as the horizontal coordinate and the access time as the vertical coordinate, plot the access time in the coordinate system according to the corresponding access time, and use line segments to connect the points in sequence to get a line graph of the access record changes; calculate the time difference between the access times of two adjacent visits to get the access interval, and record it as Where q = 1, 2, 3 ... Q, Q is a positive integer, Q represents the total number of visits, and q is any one of the visits; the slope of the line segment between two adjacent points is calculated as Using the set formula Calculate to get the browsing fluctuation value Az, where is the mean of all slopes;

Set a standard access time and a standard access interval for each visiting IP with different identities; specifically, when the visiting IP is the corporate management identity, ordinary employee identity and tourist identity, it corresponds to a standard access time and a standard access interval respectively, wherein the standard access time corresponding to the corporate management identity is greater than the standard access time corresponding to the ordinary employee identity and the standard access time corresponding to the tourist identity, and the standard access interval corresponding to the corporate management identity is less than the standard access interval corresponding to the ordinary employee identity and the standard access interval corresponding to the tourist identity; it should be noted that the lower the identity level of the visiting IP, the more frequently it enters the system and the longer the browsing time, the higher the risk of using crawler technology to steal corporate information or attack; obtain the identity of the visiting IP, and compare it with all the set identities to match the corresponding standard access time and standard access interval, and mark them as H1 and H2; obtain the number of authentication failures of the visiting IP and record it as T; use the set formula Calculate to get the access risk index FH, where f1, f2, f3, and f4 are the set proportional coefficients respectively; from the formula, it can be seen that when the access interval of the visiting IP is closer to the corresponding standard access duration and standard access interval, the access risk index is smaller, and vice versa, the access risk index is larger;

The process of regulating the access rights of visiting IPs is as follows: setting three security risk thresholds: security risk threshold 1 and security risk threshold 2, and security risk threshold 1>security risk threshold 2;

When the access risk index is greater than the set security risk threshold of one, the visiting IP is prohibited from entering;

When the access risk index is less than the set security risk threshold of two and greater than the security risk threshold of one, the visiting IP is restricted from operating the data in the database, where the data operation is specifically data adjustment, including data modification, data deletion or data addition;

When the access risk index is less than the set security risk threshold of two, no other operations are performed;

Step 4: Generate an authentication failure instruction and do not allow the visiting IP to enter and access. The number of authentication failures of the visiting IP will increase by one.

By authenticating and verifying the security risks of visiting IPs, it is possible to effectively identify unsafe access requests and deny or restrict their access rights, thereby effectively protecting the security of the system; at the same time, by automatically identifying authenticated and unauthenticated visiting IPs and performing corresponding management and security risk verification on them, it greatly reduces the workload and operation time of operation and maintenance personnel and improves operation and maintenance efficiency.

The encryption update module analyzes the authentication failure of the IP access to the enterprise network to obtain the update time, and sends the update time to the data encryption module; the analysis process is as follows:

By analyzing the total number of authentication failures corresponding to different collection times in the enterprise network system, a two-dimensional rectangular coordinate system is constructed with the collection time as the horizontal coordinate and the total number of authentication failures as the horizontal coordinate. The total number of authentication failures is input into the coordinate system in sequence according to the corresponding collection time, and the position of the total number of authentication failures in the coordinate system is recorded as the authentication point. The authentication points are connected in sequence with a smooth curve to obtain a curve chart of the total number of authentication failures in the enterprise network system over time; a tangent line is drawn at the position of the authentication point to obtain the tangent expression, and the tangent expression is derived to obtain the derivative of the authentication point, which is recorded as Vj, where j = 1, 2, 3...J, J is a positive integer, J represents the total number of collection times, and j represents any one of the collection times; the derivatives greater than zero are summed to obtain the risk increase degree, which is recorded as P1, and the derivatives less than zero are summed and calculated and the absolute value is taken to obtain the risk reduction degree, which is recorded as P2; using the set formula Calculate to get the update time Ps, where c1 and c2 are the set proportional coefficients, is the mean of all derivatives, and the update time is sent to S4; from the formula, it can be seen that when the risk increase degree P1 is larger, it means that the risk of the enterprise network system is greater, and the update time is shorter; when the risk reduction degree P2 is larger, it means that the risk of the enterprise network system is smaller, and the update time is longer.

As shown in FIG5 , the application embodiment also provides a network security defense method based on data analysis; the method comprises the following steps:

S1: Classify the data in the database according to categories, each category has several data strips with timestamps, set a number of characters, each character corresponds to a numerical value, compare the characters in the data strip with timestamps with all set characters to match the corresponding numerical values, and sort the numerical values in the order of the characters in the corresponding data strip with timestamps to obtain a character sequence with timestamps; remove zeros and fill the character sequence with random salt values to obtain a first-level ciphertext with timestamps;

S2: Convert the first-level ciphertext with timestamp into a graphic: count the number of digits in the first-level ciphertext with timestamp, when the number of digits is an even number, draw a circle with a fixed value as the radius; group the ciphertext with timestamp into adjacent digits, thereby obtaining several groups of values; when the number of digits is an odd number, draw a circle with the last digit in the first-level ciphertext with timestamp as the radius, group the other digits except the last digit into two adjacent values, thereby obtaining several groups of values, as shown in FIG2, draw several rays evenly on the arc, the length of the rays is equal to the value of the corresponding group, wherein the length of the vertically upward ray is equal to the value of the first group, and the clockwise direction of the ray with the same length as the first group is the ray with the same length as the second group; connect the endpoints of adjacent rays in sequence to obtain the second-level encrypted graphic with timestamp;

S3: Dynamically display the secondary ciphertext graphics with timestamps: obtain the length of the line connecting the endpoints of two adjacent rays, set each number to correspond to a color, compare the length of the line with all the set colors to match the corresponding color, fill the closed part composed of the corresponding two adjacent rays and the line connecting their endpoints with the matched color, thereby filling each closed part with color to obtain a color-filled encrypted graphic with a timestamp; calculate the area of each closed part, thereby obtaining the closed area of each closed part, and conduct in-depth analysis based on this to obtain the rotation angle σ; convert the timestamp of the color-filled encrypted graphic into a binary series, and record the series as a password series; control the dynamic display of the color-filled encrypted graphic according to the password series and the rotation angle;

S4: Set an update duration, retrieve the generation time of the update instruction closest to the current time, calculate the time difference between the generation time and the current time of the system to obtain the actual interval duration, and when the actual interval duration is equal to the update duration, update the data in the database according to the encryption steps of steps S1-S3;

S5: Authentication and access rights specification for all visiting IPs, specifically:

S51: Identify the visiting IP state. If the visiting IP state is authenticated, execute step S53; otherwise, execute step S52;

S52: Authenticate the unauthenticated visiting IP, and the authentication method is as follows: retrieve the attribution information of the visiting IP, and convert the attribution information into an attribution numerical sequence; identify zero in the attribution numerical sequence, obtain the position of zero and record it as a discontinuous node, and divide the attribution numerical sequence into several segments according to the discontinuous nodes; take a horizontal line, draw the circle or concentric circles of each segment in a tangent manner and in the order of the segments in the attribution numerical sequence; cut according to the node type before the segment to obtain a comparison map and a filling map, integrate the filling map into a verification request and send it to the IP corresponding to the attribution information, and when the filling map sent by the visiting IP is received, it is overlapped and compared with the corresponding comparison map. If the overlap comparison is successful, the authentication is successful, and S53 is executed; otherwise, the authentication fails, and S6 is executed;

S53: Perform security verification analysis on the authenticated visiting IP to obtain the security risk index of each authenticated visiting IP;

S55: regulating the access rights of the authenticated visiting IP according to the security risk level; the regulation process is: setting three security risk thresholds: security risk threshold 1 and security risk threshold 2, and security risk threshold 1>security risk threshold 2;

When the access risk index is greater than the set security risk threshold of one, the visiting IP is prohibited from entering;

When the access risk index is less than the set security risk threshold of two and greater than the security risk threshold of one, the visiting IP is restricted from operating the data in the database, where the data operation is specifically data adjustment, including data modification, data deletion or data addition;

When the access risk index is less than the set security risk threshold of two, no other operations are performed;

S6: Generate an authentication failure instruction and do not allow the visiting IP to enter and access. The number of authentication failures of the visiting IP increases by one.

S7: By collecting the total number of authentication failures corresponding to different times in the enterprise network system, and performing detailed analysis to obtain the update duration, the update duration is sent to S4.

The above are only embodiments of the present invention and are not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent substitution, improvement, etc. made within the spirit and principle of the present invention should be included in the scope of the claims of the present invention.

Claims (7)

1. A network security defense system based on data analysis, comprising: a data encryption module;

the data encryption module encrypts data, dynamically displays and dynamically updates the data, and comprises the following specific steps:

Step one: classifying data in a database according to categories to obtain a plurality of data bars with time stamps, comparing characters in the data bars with the time stamps with all the set characters to match corresponding numerical values, sequencing the numerical values according to the character sequence in the data bars with the time stamps to obtain a character sequence with the time stamps, identifying salt positions, and filling salt values into the salt positions to obtain a first-stage ciphertext with the time stamps; the method comprises the following steps:

Identifying zeros in the character sequence with the time stamp, obtaining the number of the zeros and the position number of each zero in the character sequence with the time stamp, setting 9 random salts with numbers 1-9, and marking the position of each zero in the character sequence with the time stamp as a salt position, so that the total salt position existing in the character sequence with the time stamp and the zero position number corresponding to each salt position can be obtained; randomly taking three random salts and comprehensively analyzing the three random salts and the position numbers to obtain filling salt values of the salt positions, and filling the filling salt values into corresponding salt positions in a character sequence with a time stamp to obtain a first-stage ciphertext with the time stamp;

Step two: performing graphic transformation on the primary ciphertext with the time stamp to obtain a secondary encryption graphic with the time stamp; the method comprises the following steps:

Counting the number of the first-level secret digits with the time stamp, drawing a circle according to the parity of the number, dividing the number of the first-level secret digits with the time stamp into a plurality of groups of numerical values, uniformly leading out a plurality of rays on an arc, wherein the lengths of the rays are equal to the numerical values of the corresponding groups, and the lengths of the rays in the vertical direction are equal to the numerical values of the first group, and the clockwise direction of the length rays equal to the numerical values of the first group is the length rays equal to the numerical values of the second group; sequentially connecting adjacent ray endpoints to obtain a secondary encryption graph with a time stamp;

step three: the method comprises the following steps of dynamically displaying a secondary ciphertext graph with a time stamp to obtain a final ciphertext, wherein the display steps are as follows:

Obtaining the connection line length of two adjacent ray end points, comparing the connection line length with all the set colors to match the corresponding colors, and filling the matched colors into the closed part formed by the two adjacent rays and the end point connection line thereof to obtain a color filling encryption graph with a time stamp; calculating the area of each closed position, and calculating the difference value of the closed areas of two adjacent closed positions to obtain adjacent difference values; comparing and analyzing the adjacent difference with a set difference interval to divide the adjacent difference into a height difference, a middle difference and a low difference; respectively counting the number of the height differences, the middle height differences and the low height differences, respectively carrying out summation calculation on the height differences, the middle height differences and the low height differences to obtain height differences, middle height differences and low height differences, and carrying out formula calculation analysis on the height differences, the middle height differences and the low height differences to obtain rotation angles; converting the time stamp of the color-filled encryption graph into a string of binary series of numbers, and marking the series of numbers as a password series of numbers; controlling dynamic display of color filling encryption graphics according to the password number column; the control steps are as follows: judging the first digit in the password sequence, when the number in the password sequence is 0, controlling the color filling encryption graph to rotate clockwise according to the rotation angle, and when the number in the password sequence is 1, controlling the filling encryption graph to rotate in the reverse time direction according to the rotation angle; until all numbers in the password number column are judged to be finished, the dynamic display of the color filling encryption graph is completed; recording the dynamically displayed color filling encryption graph as a final ciphertext;

Step four: setting an updating time length, calling the generation time of an updating instruction closest to the current time, calculating a time difference value between the generation time and the current time of the system to obtain an actual interval time length, and updating the data in the database according to the encryption steps from the first step to the third step when the actual interval time length is equal to the updating time length.

2. The data analysis-based network security defense system of claim 1 further comprising a communication management module and an encryption update module;

The communication management module authenticates the visiting ip and standardizes the access authority of the visiting ip which passes the authentication;

The encryption updating module analyzes the authentication failure condition of the enterprise network access ip to obtain the updating duration, and sends the updating duration to the data encryption module.

3. The data analysis-based network security defense system of claim 2 wherein the authentication specific process is:

Identifying a visiting ip state, and carrying out security authentication on the visiting ip state when the visiting ip state is in an unauthorized state, wherein the security authentication is specifically as follows:

The attribution information of the visiting ip is called and converted into attribution value sequences, zeros in the attribution value sequences are identified, positions of the zeros are obtained and recorded as intermittent nodes, the attribution value sequences are divided into a plurality of sections according to the intermittent nodes, a horizontal line is taken, and circles or concentric circles of each section are drawn in a tangential mode according to the sequence of the sections in the attribution value sequences; cutting according to the node types before a plurality of sections to obtain a comparison graph and a filling graph, integrating the filling graph into a verification request, sending the verification request to an ip corresponding to attribution information, carrying out repeated comparison on the filling graph sent by a visiting ip and the corresponding comparison graph when the filling graph is received, and carrying out access authority specification if successful authentication is carried out by repeated comparison; if the authentication is not passed, an authentication non-passing instruction is generated, and the access ip is not allowed to enter and access, and the authentication non-passing times of the access ip are increased once.

4. A network security defense system based on data analysis according to claim 3 wherein the cutting means is:

The type of the intermittent node is called to obtain the zero quantity of the intermittent node point, and the zero quantity is marked as G1; respectively obtaining the maximum numerical value in the front and rear sections of the intermittent node, and respectively marking the maximum numerical value as G2 and G3; using a set of formulas Calculating to obtain cutting parameters of each intermittent node, wherein Gz1 is cutting line width, gz2 is cutting line length, and mu 1 and mu 2 are set line width and line length conversion coefficients respectively; δ1, δ2, δ3, and δ4 are set scaling factors, respectively; and obtaining a cutting area of the intermittent node according to the cutting line width and the cutting line length, wherein the center point of the cutting area coincides with the tangent points of the patterns corresponding to the front and rear sections of the intermittent node, and cutting according to the cutting area to obtain a comparison graph and a filling graph.

5. The network security defense system based on data analysis according to claim 2, wherein the specific steps of the access rights specification are:

When the visiting ip state is an authenticated state, performing security risk verification on the visiting ip state to standardize the access authority of the visiting ip; obtaining access records of access ips passing authentication, wherein the browsing records comprise times, access start time and access end time of each time, and performing time difference calculation on the access start time and the access end time to obtain access duration of the time, so that the access duration of each time of access can be obtained; taking the access starting time as the access time of the time, thereby obtaining the access time of each access;

taking time as an abscissa and access time as an ordinate to obtain an access record change line graph; calculating the time difference value of access moments of two adjacent accesses to obtain access intervals, calculating the slope of a line segment formed between two adjacent points, and carrying out formulated calculation and analysis on the slope to obtain a browsing fluctuation value;

Setting different identities of each visiting ip to correspond to a standard access duration and a standard access interval, acquiring the identity of the visiting ip, comparing the identity with all the set identities to match the corresponding standard access duration and standard access interval, acquiring the authentication non-passing times of the visiting ip, and carrying out formulated calculation analysis on the browsing fluctuation value, the authentication non-passing times, the standard access duration and the standard access interval to obtain an access risk index;

The access authority process of the standard visiting ip is as follows: the two security risk thresholds are set as follows: a first safety risk threshold and a second safety risk threshold, wherein the first safety risk threshold is greater than the second safety risk threshold;

When the visit risk index is larger than a set safety risk threshold value, prohibiting the visit ip from entering;

and when the access risk index is larger than the set second safety risk threshold and smaller than the first safety risk threshold, limiting the access ip to operate the data in the database.

6. The data analysis-based network security defense system of claim 2 wherein the update duration calculation process is:

Taking the acquisition time as an abscissa and the total times of failed authentication as an abscissa to obtain a time-dependent change graph of the total times of failed authentication in the enterprise network system; tangent lines of the curve are made at the positions of the authentication points, tangent line expressions are obtained, derivative of the authentication points is obtained by conducting derivation operation on the tangent line expressions, the derivatives larger than zero are summed to obtain risk increase degree, and the derivatives smaller than zero are summed to obtain absolute value so as to obtain risk reduction degree;

And carrying out formulated calculation analysis on the derivative, the risk increase degree and the risk decrease degree to obtain the update duration.

7. The network security defense method based on data analysis is characterized by comprising the following steps:

S1: classifying the data in the database according to categories, wherein each category is internally provided with a plurality of data bars with time stamps, comparing the characters in the data bars with the time stamps with all the set characters to match the corresponding numerical values, and sequencing the numerical values according to the character sequence in the data bars with the time stamps to obtain a character sequence with the time stamps; performing zero removal and random salt value filling on the character sequence with the time stamp to obtain a primary ciphertext with the time stamp; the method comprises the following steps:

Identifying zeros in the character sequence with the time stamp, obtaining the number of the zeros and the position number of each zero in the character sequence with the time stamp, setting 9 random salts with numbers 1-9, and marking the position of each zero in the character sequence with the time stamp as a salt position, so that the total salt position existing in the character sequence with the time stamp and the zero position number corresponding to each salt position can be obtained; randomly taking three random salts and comprehensively analyzing the three random salts and the position numbers to obtain filling salt values of the salt positions, and filling the filling salt values into corresponding salt positions in a character sequence with a time stamp to obtain a first-stage ciphertext with the time stamp;

S2: performing graphic transformation on the primary ciphertext with the time stamp to obtain a secondary encryption graphic with the time stamp; the method comprises the following steps:

Counting the number of the first-level secret digits with the time stamp, drawing a circle according to the parity of the number, dividing the number of the first-level secret digits with the time stamp into a plurality of groups of numerical values, uniformly leading out a plurality of rays on an arc, wherein the lengths of the rays are equal to the numerical values of the corresponding groups, and the lengths of the rays in the vertical direction are equal to the numerical values of the first group, and the clockwise direction of the length rays equal to the numerical values of the first group is the length rays equal to the numerical values of the second group; sequentially connecting adjacent ray endpoints to obtain a secondary encryption graph with a time stamp;

s3: the method comprises the following steps of dynamically displaying a secondary ciphertext graph with a time stamp to obtain a final ciphertext, wherein the display steps are as follows:

Obtaining the connection line length of two adjacent ray end points, comparing the connection line length with all the set colors to match the corresponding colors, and filling the matched colors into the closed part formed by the two adjacent rays and the end point connection line thereof to obtain a color filling encryption graph with a time stamp; calculating the area of each closed position, and calculating the difference value of the closed areas of two adjacent closed positions to obtain adjacent difference values; comparing and analyzing the adjacent difference with a set difference interval to divide the adjacent difference into a height difference, a middle difference and a low difference; respectively counting the number of the height differences, the middle height differences and the low height differences, respectively carrying out summation calculation on the height differences, the middle height differences and the low height differences to obtain height differences, middle height differences and low height differences, and carrying out formula calculation analysis on the height differences, the middle height differences and the low height differences to obtain rotation angles; converting the time stamp of the color-filled encryption graph into a string of binary series of numbers, and marking the series of numbers as a password series of numbers; controlling dynamic display of color filling encryption graphics according to the password number column; the control steps are as follows: judging the first digit in the password sequence, when the number in the password sequence is 0, controlling the color filling encryption graph to rotate clockwise according to the rotation angle, and when the number in the password sequence is 1, controlling the filling encryption graph to rotate in the reverse time direction according to the rotation angle; until all numbers in the password number column are judged to be finished, the dynamic display of the color filling encryption graph is completed; recording the dynamically displayed color filling encryption graph as a final ciphertext;

S4: setting an updating time length, calling the generation time of an updating instruction closest to the current time, calculating a time difference value between the generation time and the current time of the system to obtain an actual interval time length, and updating the data in the database according to the encryption steps of the steps S1-S3 when the actual interval time length is equal to the updating time length;

s5: authentication and access authority specification are carried out on all visiting ips, specifically:

S51: identifying a visiting ip state, and executing step S53 when the visiting ip state is an authenticated state; otherwise, executing step S52;

S52: the authentication method of the unauthorized visitor ip is as follows: the attribution information of the visiting ip is called, and the attribution information is converted into attribution value sequences; identifying zero in the attribution numerical value sequence, acquiring the position of the zero and marking the position as a discontinuous node, and dividing the attribution numerical value sequence into a plurality of sections according to the discontinuous node; drawing a horizontal line, namely drawing circles or concentric circles of each section in a tangential mode according to the sequence of the sections in the attribution numerical value sequence; cutting according to the node types before a plurality of sections to obtain a comparison graph and a filling graph, integrating the filling graph into a verification request, sending the verification request to an ip corresponding to attribution information, carrying out repeated comparison on the filling graph sent by a visiting ip and the corresponding comparison graph when the filling graph is received, and if the repeated comparison is successful, authenticating successfully, and executing S53; otherwise, the authentication is not passed, and S6 is executed;

s53: carrying out security check analysis on the authenticated visiting ips to obtain security risk indexes of each authenticated visiting ip;

s54: access rights of access ips passing authentication are standardized according to security risk degree; the standard process is as follows: the two security risk thresholds are set as follows: a first safety risk threshold and a second safety risk threshold, wherein the first safety risk threshold is greater than the second safety risk threshold;

When the visit risk index is larger than a set safety risk threshold value, prohibiting the visit ip from entering;

When the access risk index is larger than a second set security risk threshold and smaller than a first security risk threshold, the access ip is limited to operate on data in the database, wherein the data operation specifically comprises data adjustment, including data modification, data deletion or data addition;

s6: generating an authentication failing instruction, and not allowing the visiting ip to enter and visit, wherein the authentication failing times of the visiting ip are increased once;

s7: and acquiring total times of failed authentications corresponding to different moments in the enterprise network system, performing refined analysis to obtain updated time length, and sending the updated time length to S4.