CN112583804B - Monitoring management system capable of tracking and evidence obtaining of network illegal behaviors in real time - Google Patents
Monitoring management system capable of tracking and evidence obtaining of network illegal behaviors in real time Download PDFInfo
- Publication number
- CN112583804B CN112583804B CN202011408471.8A CN202011408471A CN112583804B CN 112583804 B CN112583804 B CN 112583804B CN 202011408471 A CN202011408471 A CN 202011408471A CN 112583804 B CN112583804 B CN 112583804B
- Authority
- CN
- China
- Prior art keywords
- user
- information
- module
- behavior
- transaction
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
- H04L63/1416—Event detection, e.g. attack signature detection
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/34—Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment
- G06F11/3438—Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment monitoring of user actions
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q10/00—Administration; Management
- G06Q10/06—Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
- G06Q10/063—Operations research, analysis or management
- G06Q10/0635—Risk analysis of enterprise or organisation activities
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q50/00—Systems or methods specially adapted for specific business sectors, e.g. utilities or tourism
- G06Q50/10—Services
- G06Q50/26—Government or public services
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06V—IMAGE OR VIDEO RECOGNITION OR UNDERSTANDING
- G06V10/00—Arrangements for image or video recognition or understanding
- G06V10/40—Extraction of image or video features
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
- H04L63/1425—Traffic logging, e.g. anomaly detection
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/30—Network architectures or network communication protocols for network security for supporting lawful interception, monitoring or retaining of communications or communication related information
- H04L63/302—Network architectures or network communication protocols for network security for supporting lawful interception, monitoring or retaining of communications or communication related information gathering intelligence information for situation awareness or reconnaissance
Abstract
The invention discloses a monitoring management system capable of tracking and collecting evidence of network illegal activities in real time, is used for solving the problem that the prior art can not track and collect evidence of network illegal behaviors in real time, comprises a data acquisition module, a data storage module, a data extraction module, a server, a behavior judgment module, a user login module and a tracking early warning module, the user login information and the user network operation process are collected in real time through the data collection module, the collected information is stored in the storage module, the user online behavior is analyzed through the data extraction module to obtain the user online behavior type, the behavior on the user online is compared and judged through the behavior judgment module, therefore, the corresponding behavior characteristic value is obtained, the illegal crime characteristic value is further obtained through calculation of the behavior characteristic value, and finally the tracking and locking of the user with the crime are carried out through the tracking and early warning module.
Description
Technical Field
The invention relates to the technical field of network security, in particular to a monitoring management system capable of tracking and obtaining evidence of network illegal behaviors in real time.
Background
The popularity of networking and networking technologies has led to an increasing number of sensitive information, including personal privacy, business data, confidential documents, important instructions, etc., being stored and processed in computer systems connected to public networks; the network illegal crime is a general term for an agent to attack the system or information thereof by means of a network by using a computer technology, destroy or utilize the network to perform other crimes. The system comprises a crime implemented by an agent on a network by using programming, encryption and decoding technologies or tools of the agent, a crime implemented by the agent interactively inside and outside the network by using software instructions, network systems or product encryption and other technologies and legal provisions, and a crime implemented by the agent on the network system by means of residing at a specific position of a network service provider or other methods, but the network illegal criminal behavior is usually difficult to track and obtain evidence.
Disclosure of Invention
The invention aims to provide a monitoring management system capable of tracking and evidence-obtaining network illegal behaviors in real time, which is used for analyzing network behaviors of users and comparing and judging various network operation behaviors of the users through a behavior judgment module to obtain corresponding matching values, correspondingly classifying the users through the matching values, tracking and locking the users with highly suspected criminal behaviors, providing reference for network security management personnel and tracking and evidence-obtaining the criminal behaviors on the network in real time;
the purpose of the invention can be realized by the following technical scheme: a monitoring management system capable of tracking and evidence obtaining of network illegal behaviors in real time comprises a data acquisition module, a data storage module, a data extraction module, a server, a behavior judgment module, a user login module and a tracking and early warning module;
the data acquisition module is used for acquiring user login information and a user network operation process in real time and storing the acquired information in the storage module, and the specific acquisition steps are as follows:
the method comprises the following steps: acquiring user uploading information, and marking the user uploading information as Ai;
step two: acquiring user downloading information, and marking the user downloading information as Bi;
step three: acquiring user network transaction information, and marking the user transaction information as Ci;
step four: acquiring user access information of a user to an accessed website, and marking the user access information as Di;
step five: transmitting the obtained user uploading information Ai, user downloading information Bi, user transaction information Ci and user access information Di to a data extraction module;
the data extraction module reads the obtained customer use information and respectively analyzes the user behaviors, and the specific analysis steps are as follows:
step S1: respectively marking character information, picture information, video information and audio information in the user uploading information Ai as AiW, AiT, AiS and AiY;
step S2: respectively marking character information, picture information, video information and audio information in the user download information Bi as BiW, BiT, BiS and BiY;
step S3: respectively marking the transaction type, the transaction amount, the transaction times and the transaction time in the user transaction information Ci as CiL, CiJ, CiS and CiT;
step S4: marking the access type, the access entry, the access times and the access time in the user access information Ci as DiL, DiR, DiS and DiT respectively;
and transmitting the data obtained by analyzing the data in the steps S1 to S4 to a behavior judgment module, carrying out illegal judgment through the behavior judgment module, and obtaining an illegal criminal characteristic value Fi through the behavior judgment module.
Further, the user login module is used for submitting user information for registration through terminal equipment by a user, and sending the user information with successful registration to the information base for storage, wherein the user information comprises a name, an identification number and a mobile phone number of real-name authentication, and the terminal equipment comprises a mobile phone, a computer and a tablet computer.
Furthermore, the behavior judgment module comprises a character feature comparison unit, a picture feature comparison unit, a video feature comparison unit and an audio feature comparison unit, and is further provided with a transaction judgment unit and an access judgment unit.
Further, the behavior determination module is configured to determine whether the user network behavior belongs to an illegal behavior, and includes the following specific steps:
step P1: respectively comparing AiW, AiT, AiS and AiY in the user uploading information Ai with character feature comparison unit, picture feature comparison unit, video feature comparison unit and audio feature comparison unit in the behavior judgment module, and respectively obtaining corresponding matching values QiWA, QiTA, QiSA and QiYA,
obtaining an upload behavior characteristic value AiQ through a formula AiQ ═ δ (α × QiWA + β × QiTA + γ × QiSA + ∈ QiYA), wherein δ, α, β, γ, and ∈ are all preset proportionality coefficients;
step P2: comparing BiW, BiT, BiS and BiY in the user download information Bi with the character feature comparison unit, the picture feature comparison unit, the video feature comparison unit and the audio feature comparison unit in the behavior judgment module respectively, and obtaining corresponding matching values QiWB, QiTB, QiSB and QiYB respectively, and obtaining a download behavior feature value BiQ through a formula BiQ ═ δ (α ═ QiWB + β ═ QiTB + γ × sb + epsilon ∈ QiYB); the specific matching process is as follows:
the character feature comparison unit comprises the following comparison processes: the word information is matched with the sensitive word bank in the word characteristic comparison unit, and the matching value is higher when the number is larger by matching the same number of the word information with the sensitive words in the sensitive word bank;
the comparison process of the picture characteristic comparison unit is as follows: the image information identifies the sensitive information in the image and the video through an image identification technology based on deep learning, and the more the sensitive information in the image and the video is, the higher the corresponding matching value is;
the comparison process of the audio characteristic comparison unit is as follows: converting the language in the audio information into corresponding text information, matching the text information with a sensitive word bank box in a sensitive word bank, wherein the matching value is higher when the number is larger by matching the same number of the text information with the sensitive words in the sensitive word bank;
step P3: comparing CiL, CiJ, CiS and CiT in the user transaction information Ci with a transaction judgment unit in a behavior judgment module respectively, and obtaining corresponding risk values QiLC, QiJC, QiSC and QiTC respectively, and obtaining a transaction behavior characteristic value CiQ through a formula CiQ ═ delta (alpha × QiLC + beta × QiSC + gamma × QiSC + epsilon × QiTC);
step P4: comparing DiL, DiR, DiS and DiT in the user access information Di with the access determination unit in the behavior determination module, respectively, and obtaining corresponding risk values QiLD, QiRD, QiSD and QiTD, respectively, and obtaining a user access behavior characteristic value DiQ through a formula DiQ ═ δ (α × QiLD + β × QiRD + γ × QiSD + ε × QiTD);
step P5: and substituting AiQ, BiQ, CiQ and DiQ obtained from P1-P4 into a formula Fi lambda (AiQ + BiQ + CiQ + DiQ) to obtain an illegal crime characteristic value Fi, wherein lambda is a correction factor and takes a value of 0.0452673, and comparing the obtained Fi characteristic value with the Mi set by the system.
Further, the tracking and early warning module compares the obtained illegal crime characteristic value Fi with a system setting value Mi, and the specific comparison steps are as follows:
the first step is as follows: when the Fi is less than Mi, the tracking early warning module automatically judges that illegal criminal behaviors do not exist;
the second step is that: when the Fi is larger than or equal to Mi and is not larger than the Fi < ATi, the tracking early warning module sends early warning information to the management center, pushes the matching values of AiQ, BiQ, CiQ and DiQ of the user to the management center, marks the user as a class A user, and marks ATi as a system preset threshold value and ATi is larger than Mi;
the third step: when ATi Fi is less than or equal to BTi, the tracking early warning module sends early warning information to a management center, pushes various matching values of AiQ, BiQ, CiQ and DiQ of the user to the management center, marks the user as a class B user, and sends a warning to the user;
the fourth step: when Fi is larger than BTi, the tracking early warning module sends out early warning information to a management center, and pushes matching values of AiQ, BiQ, CiQ and DiQ of the user to the management center, and simultaneously marks the user as a C-type user, pushes all personal information of the user to the management center, and simultaneously locks an IP address of the user.
Compared with the prior art, the invention has the beneficial effects that:
1. the method comprises the steps that relevant operation contents of a user on the network are screened and classified through a data extraction module, the behavior of the user is judged through a behavior judgment module, the behavior judgment module comprises a character feature comparison unit, a picture feature comparison unit, a video feature comparison unit and an audio feature comparison unit, the behavior judgment module is further provided with a transaction judgment unit and an access judgment unit, the behavior of the user is matched through sub-units in the behavior judgment module, so that corresponding behavior feature values are obtained, all the behavior feature values are calculated through a specific formula, further corresponding illegal crime feature values are obtained, and finally, the illegal crime feature values are compared with feature values set by a system to judge whether the user has illegal crime behaviors;
2. according to the method, the tracking early warning module is arranged, after the behavior of the user is judged through the behavior judging module, various users suspected of containing illegal crime behaviors are classified by the tracking early warning module through the illegal crime characteristic values obtained by the behavior judging module, different supervision measures are executed for the users in different classifications, and the management of network management personnel on the user behaviors on the network can be facilitated.
Drawings
In order to facilitate understanding for those skilled in the art, the present invention will be further described with reference to the accompanying drawings.
FIG. 1 is a schematic block diagram of a monitoring management system for tracking and evidence-taking illegal network behaviors in real time according to the present invention;
fig. 2 is a block diagram of a behavior determination module of a monitoring management system capable of tracking and collecting evidence of network illegal behaviors in real time according to the present invention.
Detailed Description
The technical solutions of the present invention will be described clearly and completely with reference to the following embodiments, and it should be understood that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.
Referring to fig. 1, a monitoring and management system capable of tracking and collecting evidence of network illegal activities in real time includes a data acquisition module, a data storage module, a data extraction module, a server, an activity determination module, a user login module, and a tracking and early warning module;
the data acquisition module is used for acquiring user login information and a user network operation process in real time and storing the acquired information in the storage module, and the specific acquisition steps are as follows:
the method comprises the following steps: acquiring user uploading information, and marking the user uploading information as Ai;
step two: acquiring user downloading information, and marking the user downloading information as Bi;
step three: acquiring user network transaction information, and marking the user transaction information as Ci;
step four: acquiring user access information of a user to an accessed website, and marking the user access information as Di;
step five: transmitting the obtained user uploading information Ai, user downloading information Bi, user transaction information Ci and user access information Di to a data extraction module;
the data extraction module reads the obtained customer use information and respectively analyzes the user behaviors, and the specific analysis steps are as follows:
step S1: respectively marking character information, picture information, video information and audio information in the user uploading information Ai as AiW, AiT, AiS and AiY;
step S2: respectively marking character information, picture information, video information and audio information in the user download information Bi as BiW, BiT, BiS and BiY;
step S3: respectively marking the transaction type, the transaction amount, the transaction times and the transaction time in the user transaction information Ci as CiL, CiJ, CiS and CiT;
step S4: marking the access type, the access entry, the access times and the access time in the user access information Ci as DiL, DiR, DiS and DiT respectively;
and transmitting the data obtained by analyzing the data in the steps S1 to S4 to a behavior judgment module, carrying out illegal judgment through the behavior judgment module, and obtaining an illegal criminal characteristic value Fi through the behavior judgment module.
The user login module is used for submitting user information for registration through terminal equipment by a user, and sending the user information which is successfully registered to the information base for storage, wherein the user information comprises a name, an identity card number and a mobile phone number authenticated by a real name, the user information and a user process operation trace are temporarily stored in the data storage module, and the terminal equipment comprises a mobile phone, a computer and a tablet computer.
The behavior judging module comprises a character feature comparing unit, a picture feature comparing unit, a video feature comparing unit and an audio feature comparing unit, the behavior judging module is also provided with a transaction judging unit and an access judging unit, a corresponding sensitive word bank is arranged in the character feature comparing unit, the uploaded or downloaded character information of a user is matched with the sensitive word bank, corresponding comparing features are arranged in the picture feature comparing unit, the video feature comparing unit and the audio feature comparing unit, and corresponding matching values are obtained by comparing whether the character information, the picture information, the video information and the audio information in the user operation contain sensitive information of illegal crimes such as violence, pornography, and crime education and the like; for the transaction behaviors of the user, calculating corresponding user transaction characteristic values for the transaction types, transaction amounts, transaction times and transaction time of the user through a transaction judgment unit, and judging whether illegal criminal behaviors such as illegal transactions or phishing exist in the values; for the access behavior of the user, the access judging unit judges whether the access is normal access or not according to the access type, the access entry, the access times and the access time of the user, for example, if the user does not enter an access page through a normally open access entry during access, the user is judged to be illegal access; the behavior judgment module is used for judging whether the user network behavior belongs to illegal behaviors, and the method specifically comprises the following steps:
step P1: respectively comparing AiW, AiT, AiS and AiY in the user uploading information Ai with character feature comparison units, picture feature comparison units, video feature comparison units and audio feature comparison units in a behavior judgment module, and respectively obtaining corresponding matching values QiWA, QiTA, QiSA and QiYA, and obtaining an uploading behavior feature value AiQ through a formula AiQ ═ δ (α × QiWA + β ═ QiTA + γ × QiSA + ε · QiYA), wherein δ, α, β, γ and ε are all preset proportionality coefficients;
step P2: comparing BiW, BiT, BiS and BiY in the user download information Bi with the character feature comparison unit, the picture feature comparison unit, the video feature comparison unit and the audio feature comparison unit in the behavior judgment module respectively, and obtaining corresponding matching values QiWB, QiTB, QiSB and QiYB respectively, and obtaining a download behavior feature value BiQ through a formula BiQ ═ δ (α ═ QiWB + β ═ QiTB + γ × sb + epsilon ∈ QiYB); the character feature comparison unit comprises the following comparison processes: the word information is matched with the sensitive word bank in the word characteristic comparison unit, and the matching value is higher when the number is larger by matching the same number of the word information with the sensitive words in the sensitive word bank; the specific matching process is as follows:
the comparison process of the picture characteristic comparison unit is as follows: the image information identifies the sensitive information in the image and the video through an image identification technology based on deep learning, and the more the sensitive information in the image and the video is, the higher the corresponding matching value is;
the comparison process of the audio characteristic comparison unit is as follows: converting the language in the audio information into corresponding text information, matching the text information with a sensitive word bank box in a sensitive word bank, wherein the matching value is higher when the number is larger by matching the same number of the text information with the sensitive words in the sensitive word bank;
step P3: comparing CiL, CiJ, CiS and CiT in the user transaction information Ci with a transaction judgment unit in a behavior judgment module respectively, and obtaining corresponding risk values QiLC, QiJC, QiSC and QiTC respectively, and obtaining a transaction behavior characteristic value CiQ through a formula CiQ ═ delta (alpha × QiLC + beta × QiSC + gamma × QiSC + epsilon × QiTC);
step P4: comparing DiL, DiR, DiS and DiT in the user access information Di with the access determination unit in the behavior determination module, respectively, and obtaining corresponding risk values QiLD, QiRD, QiSD and QiTD, respectively, and obtaining a user access behavior characteristic value DiQ through a formula DiQ ═ δ (α × QiLD + β × QiRD + γ × QiSD + ε × QiTD);
step P5: and substituting AiQ, BiQ, CiQ and DiQ obtained from P1-P4 into a formula Fi lambda (AiQ + BiQ + CiQ + DiQ) to obtain an illegal crime characteristic value Fi, wherein lambda is a correction factor and takes a value of 0.0452673, and comparing the obtained Fi characteristic value with the Mi set by the system.
Comparing the acquired illegal crime characteristic value Fi with a system set value Mi in a tracking and early warning module, wherein the specific comparison steps are as follows:
the first step is as follows: when the Fi is less than Mi, the tracking early warning module automatically judges that illegal criminal behaviors do not exist;
the second step is that: when the Fi is larger than or equal to Mi and is not larger than the Fi < ATi, the tracking early warning module sends early warning information to the management center, pushes the matching values of AiQ, BiQ, CiQ and DiQ of the user to the management center, marks the user as a class A user, and marks ATi as a system preset threshold value and ATi is larger than Mi;
the third step: when ATi Fi is less than or equal to BTi, the tracking early warning module sends early warning information to a management center, pushes various matching values of AiQ, BiQ, CiQ and DiQ of the user to the management center, marks the user as a class B user, and sends a warning to the user;
the fourth step: when Fi is larger than BTi, the tracking early warning module sends out early warning information to a management center, and pushes matching values of AiQ, BiQ, CiQ and DiQ of the user to the management center, and simultaneously marks the user as a C-type user, pushes all personal information of the user to the management center, and simultaneously locks an IP address of the user.
The working principle of the invention is as follows: the user login module registers user information, sends the user information which is successfully registered to the information base for storage, simultaneously, an IP address and an online operation trace under the user information are temporarily stored in the data storage module, the online operation behavior of a user can be acquired by the data acquisition module, the operation content of the user is preliminarily classified into uploading information, downloading information, transaction information and access information which are respectively marked as Ai, Bi, Ci and Di, then, the operation content of the user is transmitted to the data extraction module, the operation content of the user is further screened, and therefore character information, picture information, video information and audio information in the uploading information of the user are obtained and are respectively marked as AiW, AiT, AiS and AiY; respectively marking character information, picture information, video information and audio information in the user downloading information as BiW, BiT, BiS and BiY; respectively marking the transaction type, the transaction amount, the transaction times and the transaction time in the user transaction information as CiL, CiJ, CiS and CiT; respectively marking the access type, the access entrance, the access times and the access time in the user access information as DiL, DiR, DiS and DiT, then judging the data obtained in the data extraction module through a behavior judgment module, respectively substituting the data into a formula, further obtaining a user uploading behavior characteristic value AiQ, a user downloading behavior characteristic value BiQ, a user transaction behavior characteristic value CiQ and a user access behavior characteristic value DiQ, substituting the obtained values into a formula Fi lambda (AiQ + BiQ + CiQ + DiQ) to obtain an illegal criminal characteristic value Fi, finally comparing the illegal criminal characteristic value Fi with a system preset value Mi, and when the Fi < Mi, automatically judging that no illegal acts exist through a tracking early warning module; when the Fi is larger than or equal to Mi and is not larger than the Fi < ATi, the tracking early warning module sends early warning information to the management center, pushes the matching values of AiQ, BiQ, CiQ and DiQ of the user to the management center, marks the user as a class A user, and marks ATi as a system preset threshold value and ATi is larger than Mi; when ATi Fi is less than or equal to BTi, the tracking early warning module sends early warning information to a management center, pushes various matching values of AiQ, BiQ, CiQ and DiQ of the user to the management center, marks the user as a class B user, and sends a warning to the user; when Fi is larger than BTi, the tracking early warning module sends out early warning information to the management center, and pushes various matching values of AiQ, BiQ, CiQ and DiQ of the user to the management center, meanwhile, the user is marked as a C-class user, all personal information of the user is pushed to the management center, and meanwhile, an IP address of the user is locked, so that tracking and evidence obtaining of network illegal criminal behaviors are achieved.
The preferred embodiments of the invention disclosed above are intended to be illustrative only. The preferred embodiments are not intended to be exhaustive or to limit the invention to the precise forms disclosed. Obviously, many modifications and variations are possible in light of the above teaching. The embodiments were chosen and described in order to best explain the principles of the invention and the practical application, to thereby enable others skilled in the art to best utilize the invention. The invention is limited only by the claims and their full scope and equivalents.
Claims (1)
1. A monitoring management system capable of tracking and obtaining evidence of network illegal behaviors in real time is characterized by comprising a data acquisition module, a data storage module, a data extraction module, a server, a behavior judgment module, a user login module and a tracking early warning module;
the data acquisition module is used for acquiring user login information and a user network operation process in real time and storing the acquired information in the storage module, and the specific acquisition steps are as follows:
the method comprises the following steps: acquiring user uploading information, and marking the user uploading information as Ai;
step two: acquiring user downloading information, and marking the user downloading information as Bi;
step three: acquiring user network transaction information, and marking the user transaction information as Ci;
step four: acquiring user access information of a user to an accessed website, and marking the user access information as Di;
step five: transmitting the obtained user uploading information Ai, user downloading information Bi, user transaction information Ci and user access information Di to a data extraction module;
the data extraction module reads the obtained customer use information and respectively extracts the information of the user behavior, and the specific analysis steps are as follows:
step S1: respectively marking character information, picture information, video information and audio information in the user uploading information Ai as AiW, AiT, AiS and AiY;
step S2: respectively marking character information, picture information, video information and audio information in the user download information Bi as BiW, BiT, BiS and BiY;
step S3: respectively marking the transaction type, the transaction amount, the transaction times and the transaction time in the user transaction information Ci as CiL, CiJ, CiS and CiT;
step S4: marking the access type, the access entry, the access times and the access time in the user access information Ci as DiL, DiR, DiS and DiT respectively;
transmitting the data analyzed and obtained in the steps S1-S4 in the data extraction module to a behavior judgment module, carrying out illegal judgment through the behavior judgment module, and obtaining an illegal criminal characteristic value Fi through the behavior judgment module; the user login module is used for submitting user information for registration through terminal equipment by a user, and sending the user information which is successfully registered to an information base for storage, wherein the user information comprises a name, an identity card number and a mobile phone number of real-name authentication, and the terminal equipment comprises a mobile phone, a computer and a tablet personal computer; the behavior judging module comprises a character characteristic comparing unit, a picture characteristic comparing unit, a video characteristic comparing unit and an audio characteristic comparing unit, and is also provided with a transaction judging unit and an access judging unit; the behavior judgment module is used for judging whether the user network behavior belongs to illegal behaviors, and specifically comprises the following steps:
step P1: respectively comparing AiW, AiT, AiS and AiY in the user uploading information Ai with character feature comparison units, picture feature comparison units, video feature comparison units and audio feature comparison units in a behavior judgment module, and respectively obtaining corresponding matching values QiWA, QiTA, QiSA and QiYA, and obtaining an uploading behavior feature value AiQ through a formula AiQ ═ δ (α × QiWA + β ═ QiTA + γ × QiSA + ε · QiYA), wherein δ, α, β, γ and ε are all preset proportionality coefficients;
step P2: comparing BiW, BiT, BiS and BiY in the user download information Bi with the character feature comparison unit, the picture feature comparison unit, the video feature comparison unit and the audio feature comparison unit in the behavior judgment module respectively, and obtaining corresponding matching values QiWB, QiTB, QiSB and QiYB respectively, and obtaining a download behavior feature value BiQ through a formula BiQ ═ δ (α ═ QiWB + β ═ QiTB + γ × sb + epsilon ∈ QiYB); the specific matching process is as follows:
the character feature comparison unit comprises the following comparison processes: the word information is matched with the sensitive word bank in the word characteristic comparison unit, and the matching value is higher when the number is larger by matching the same number of the word information with the sensitive words in the sensitive word bank;
the comparison process of the picture characteristic comparison unit is as follows: the image information identifies the sensitive information in the image and the video through an image identification technology based on deep learning, and the more the sensitive information in the image and the video is, the higher the corresponding matching value is;
the comparison process of the audio characteristic comparison unit is as follows: converting the language in the audio information into corresponding text information, matching the text information with a sensitive word bank box in a sensitive word bank, wherein the matching value is higher when the number is larger by matching the same number of the text information with the sensitive words in the sensitive word bank;
step P3: comparing CiL, CiJ, CiS and CiT in the user transaction information Ci with a transaction judgment unit in a behavior judgment module respectively, and obtaining corresponding risk values QiLC, QiJC, QiSC and QiTC respectively, and obtaining a transaction behavior characteristic value CiQ through a formula CiQ ═ delta (alpha × QiLC + beta × QiSC + gamma × QiSC + epsilon × QiTC);
step P4: comparing DiL, DiR, DiS and DiT in the user access information Di with the access determination unit in the behavior determination module, respectively, and obtaining corresponding risk values QiLD, QiRD, QiSD and QiTD, respectively, and obtaining a user access behavior characteristic value DiQ through a formula DiQ ═ δ (α × QiLD + β × QiRD + γ × QiSD + ε × QiTD);
step P5: substituting AiQ, BiQ, CiQ and DiQ obtained from P1-P4 into a formula Fi lambda (AiQ + BiQ + CiQ + DiQ) to obtain an illegal crime characteristic value Fi, wherein lambda is a correction factor and takes a value of 0.0452673, and comparing the obtained Fi characteristic value with a system set to Mi; the tracking early warning module compares the acquired illegal crime characteristic value Fi with a system set value Mi, and the specific comparison steps are as follows:
the first step is as follows: when the Fi is smaller than the Mi, the tracking early warning module automatically judges that illegal criminal behaviors do not exist;
the second step is that: when the Fi is not less than Mi and is not more than Fi less than ATi, the tracking early warning module sends early warning information to the management center, pushes various matching values of AiQ, BiQ, CiQ and DiQ of the user to the management center, marks the user as a class A user, and marks ATi as a system preset threshold value and ATi is more than Mi;
the third step: when the Fi is more than ATi and less than or equal to BTi, the tracking early warning module sends early warning information to a management center, pushes various matching values of AiQ, BiQ, CiQ and DiQ of the user to the management center, marks the user as a class B user and sends a warning to the user;
the fourth step: when Fi is larger than BTi, the tracking early warning module sends out early warning information to a management center, and pushes matching values of AiQ, BiQ, CiQ and DiQ of the user to the management center, and simultaneously marks the user as a C-type user, pushes all personal information of the user to the management center, and simultaneously locks an IP address of the user.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202011408471.8A CN112583804B (en) | 2020-12-05 | 2020-12-05 | Monitoring management system capable of tracking and evidence obtaining of network illegal behaviors in real time |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202011408471.8A CN112583804B (en) | 2020-12-05 | 2020-12-05 | Monitoring management system capable of tracking and evidence obtaining of network illegal behaviors in real time |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN112583804A CN112583804A (en) | 2021-03-30 |
| CN112583804B true CN112583804B (en) | 2022-02-25 |
Family
ID=75127290
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202011408471.8A Active CN112583804B (en) | 2020-12-05 | 2020-12-05 | Monitoring management system capable of tracking and evidence obtaining of network illegal behaviors in real time |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN112583804B (en) |
Families Citing this family (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN113872972B (en) * | 2021-09-28 | 2022-08-30 | 深圳市众云网科技有限公司 | Intelligent network safety monitoring system |
| CN117130862B (en) * | 2023-08-29 | 2024-05-03 | 北京景安云信科技有限公司 | Audit recording system for user access operation |
Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102014295A (en) * | 2010-11-19 | 2011-04-13 | 嘉兴学院 | Network sensitive video detection method |
| CN203206395U (en) * | 2013-04-19 | 2013-09-18 | 福建亿榕信息技术有限公司 | Intelligent system for monitoring crimes |
| CN106453061A (en) * | 2016-11-22 | 2017-02-22 | 北京锐安科技有限公司 | Method and system for recognizing internet fraud behavior |
| CN206628004U (en) * | 2017-04-06 | 2017-11-10 | 中国人民公安大学 | A kind of Network Warning System based on network behavior |
| CN111683157A (en) * | 2020-08-11 | 2020-09-18 | 杭州优云科技有限公司 | Network security protection method for Internet of things equipment |
| CN111915468A (en) * | 2020-08-14 | 2020-11-10 | 中国科学院自动化研究所 | Novel anti-fraud active inspection and early warning system for network |
Family Cites Families (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104636408B (en) * | 2014-08-21 | 2017-08-08 | 中国科学院计算技术研究所 | News certification method for early warning and system based on user-generated content |
| CN110535855B (en) * | 2019-08-28 | 2021-07-30 | 北京安御道合科技有限公司 | Network event monitoring and analyzing method and system and information data processing terminal |
| CN111556473A (en) * | 2020-05-08 | 2020-08-18 | 国家计算机网络与信息安全管理中心 | Abnormal access behavior detection method and device |
| CN111666499A (en) * | 2020-06-05 | 2020-09-15 | 镇江傲游网络科技有限公司 | Public opinion monitoring cloud service platform based on big data |
| CN111814890A (en) * | 2020-07-15 | 2020-10-23 | 辽宁大学 | Network live broadcast illegal behavior determination method based on D-S evidence theory |
-
2020
- 2020-12-05 CN CN202011408471.8A patent/CN112583804B/en active Active
Patent Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102014295A (en) * | 2010-11-19 | 2011-04-13 | 嘉兴学院 | Network sensitive video detection method |
| CN203206395U (en) * | 2013-04-19 | 2013-09-18 | 福建亿榕信息技术有限公司 | Intelligent system for monitoring crimes |
| CN106453061A (en) * | 2016-11-22 | 2017-02-22 | 北京锐安科技有限公司 | Method and system for recognizing internet fraud behavior |
| CN206628004U (en) * | 2017-04-06 | 2017-11-10 | 中国人民公安大学 | A kind of Network Warning System based on network behavior |
| CN111683157A (en) * | 2020-08-11 | 2020-09-18 | 杭州优云科技有限公司 | Network security protection method for Internet of things equipment |
| CN111915468A (en) * | 2020-08-14 | 2020-11-10 | 中国科学院自动化研究所 | Novel anti-fraud active inspection and early warning system for network |
Also Published As
| Publication number | Publication date |
|---|---|
| CN112583804A (en) | 2021-03-30 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| Lin et al. | Phishpedia: A hybrid deep learning based approach to visually identify phishing webpages | |
| CN107172022B (en) | APT threat detection method and system based on intrusion path | |
| US20180309772A1 (en) | Method and device for automatically verifying security event | |
| CN112583804B (en) | Monitoring management system capable of tracking and evidence obtaining of network illegal behaviors in real time | |
| CN114172748A (en) | Encrypted malicious traffic detection method | |
| Yang et al. | Security and forensics in the internet of things: Research advances and challenges | |
| CN108023868B (en) | Malicious resource address detection method and device | |
| CN104301180B (en) | A kind of service message processing method and equipment | |
| CN105678193B (en) | A kind of anti-tamper treating method and apparatus | |
| Barra et al. | Fame: face authentication for mobile encounter | |
| KR102060766B1 (en) | System for monitoring crime site in dark web | |
| CN110020161B (en) | Data processing method, log processing method and terminal | |
| CN113111951B (en) | Data processing method and device | |
| CN106790025B (en) | Method and device for detecting link maliciousness | |
| CN110225009B (en) | Proxy user detection method based on communication behavior portrait | |
| CN111209959B (en) | Encrypted webpage flow division point identification method based on data packet time sequence | |
| CN113033404A (en) | Face attack event detection method, device, equipment and storage medium | |
| CN116455623A (en) | Computer information security sharing system and method based on big data identification technology | |
| CN116069607A (en) | Mobile office user abnormal behavior detection method based on graph convolution neural network | |
| CN109871211A (en) | Information displaying method and device | |
| Saha et al. | Mobile device and social media forensic analysis: impacts on cyber-crime | |
| CN116150800B (en) | Big data-based computer information security monitoring system and method | |
| CN117097571A (en) | Method, system, device and medium for detecting network transmission sensitive data | |
| Lee et al. | The method of P2P traffic detecting for P2P harmful contents prevention | |
| CN106650349A (en) | Method for conducting monitoring on use safety of identity card |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| TA01 | Transfer of patent application right | ||
| TA01 | Transfer of patent application right |
Effective date of registration: 20220126 Address after: Room 1901, No. 299, Dongwu North Road, Suzhou, Jiangsu 215000 (1909, 1910, 1911) Applicant after: Suzhou xiaomianao Information Technology Co.,Ltd. Address before: 518000 805p, times building, the intersection of Longcheng Avenue and longfu Road, central city, Longcheng street, Longgang District, Shenzhen City, Guangdong Province Applicant before: Xingji industry (Shenzhen) Co.,Ltd. |
|
| GR01 | Patent grant | ||
| GR01 | Patent grant |