CN113111359A - Big data resource sharing method and resource sharing system based on information security - Google Patents

Abstract

According to the big data resource sharing method and the resource sharing system based on information security, user privacy evaluation can be conducted on interactive service resource information in a big data resource project in a sharing activation state from a resource sharing requirement level of a resource sharing object and a privacy information security level of a shared party. In addition, after resource sharing request items of a plurality of interactive service resource information and request item mutual authentication results of the resource sharing request items of the interactive service resource information are determined, big data resource sharing can be carried out by combining privacy security evaluation results of preset resource sharing request items and privacy security evaluation results of preset user privacy evaluation, balance between data sharing and privacy security is sought, big data resource sharing is realized by combining service resource authentication items, big data resource sharing is realized on the premise of meeting privacy protection and data security, and a large number of data isolated islands are prevented from being formed in a big data era.

Description

Big data resource sharing method and resource sharing system based on information security

Technical Field

The application relates to the technical field of big data sharing and information security, in particular to a big data resource sharing method and a resource sharing system based on information security.

Background

With the development of society and the progress of times, the development of the internet has reached a prosperous period. With the proposal of the internet plus, the development trend of the internet is promoted, and big data is gradually known in the development process of the internet. Big data (big data), which refers to a data set that cannot be captured, managed and processed by a conventional software tool within an affordable time range, is an information asset that needs a new processing mode to have stronger decision-making power, insight discovery power and flow optimization capability to adapt to a large amount, high growth rate and diversification. IBM proposes 5 characteristics of big data, namely 5V characteristics, which are Volume (large Volume), Velocity (high speed), Variety (diverse), Value (Value), and Veracity (authenticity), respectively.

Depending on the continuous development of big data, the data sharing technology is also continuously developed, and by carrying out data sharing, the efficiency of cloud service cooperation can be improved, unnecessary development cost and operation cost are reduced, and the maximization of the circulation value of data is realized.

However, with the heightened awareness of data security and emphasis and privacy protection, previous large-scale data sharing techniques were challenged, forcing individual data owners to revert back to the previous state of data islanding. At the same time, it is also more difficult for internet companies to collect and utilize private data of users, which further causes data islanding to be a normal state. Therefore, if better utilization of data is desired, appropriate data sharing must be performed between different organizations, companies, and users on the premise that privacy protection and data security are satisfied, but in the related art, when data sharing is performed, although privacy protection and data security can be satisfied, it is difficult to satisfy the related data sharing requirements.

Disclosure of Invention

One of the embodiments of the present application provides a big data resource sharing method based on information security, which is applied to a resource sharing system, where the resource sharing system is in communication connection with a plurality of resource sharing objects, and the method includes: obtaining service wind control resource information obtained after user privacy evaluation is carried out on interactive service resource information in a big data resource project in a shared activation state and service resource authentication items of the service wind control resource information, and determining resource sharing request items of a plurality of interactive service resource information and request item mutual-evidence results of the resource sharing request items of the interactive service resource information based on a preset interactive service resource information analysis model; wherein, the request item mutual authentication result is a mutual authentication result among the plurality of resource sharing objects; and carrying out big data resource sharing according to the privacy safety evaluation result of the preset resource sharing request item of the interactive service resource information, the privacy safety evaluation result of the preset user privacy evaluation corresponding to the resource sharing request item of the interactive service resource information, and the service resource authentication item.

One of the embodiments of the present application provides a resource sharing system, which includes a processing engine, a network module and a memory; the processing engine and the memory communicate through the network module, and the processing engine reads the computer program from the memory and operates to perform the above-described method.

In the description that follows, additional features will be set forth, in part, in the description. These features will be in part apparent to those skilled in the art upon examination of the following and the accompanying drawings, or may be learned by production or use. The features of the present application may be realized and attained by practice or use of various aspects of the methodologies, instrumentalities and combinations particularly pointed out in the detailed examples that follow.

Drawings

The present application will be further explained by way of exemplary embodiments, which will be described in detail by way of the accompanying drawings. These embodiments are not intended to be limiting, and in these embodiments like numerals are used to indicate like structures, wherein:

FIG. 1 is a flow diagram illustrating an exemplary information security-based big data resource sharing method and/or process, according to some embodiments of the invention;

FIG. 2 is a block diagram of a communication architecture corresponding to an exemplary method for sharing big data resources based on information security according to some embodiments of the present invention;

FIG. 3 is a block diagram of an exemplary big data resource sharing device based on information security, according to some embodiments of the invention, an

FIG. 4 is a diagram illustrating the hardware and software components of an exemplary resource sharing system, according to some embodiments of the invention.

Detailed Description

In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings used in the description of the embodiments will be briefly introduced below. It is obvious that the drawings in the following description are only examples or embodiments of the application, from which the application can also be applied to other similar scenarios without inventive effort for a person skilled in the art. Unless otherwise apparent from the context, or otherwise indicated, like reference numbers in the figures refer to the same structure or operation.

It should be understood that "system", "device", "unit" and/or "module" as used herein is a method for distinguishing different components, elements, parts, portions or assemblies at different levels. However, other words may be substituted by other expressions if they accomplish the same purpose.

As used in this application and the appended claims, the terms "a," "an," "the," and/or "the" are not intended to be inclusive in the singular, but rather are intended to be inclusive in the plural unless the context clearly dictates otherwise. In general, the terms "comprises" and "comprising" merely indicate that steps and elements are included which are explicitly identified, that the steps and elements do not form an exclusive list, and that a method or apparatus may include other steps or elements.

Flow charts are used herein to illustrate operations performed by systems according to embodiments of the present application. It should be understood that the preceding or following operations are not necessarily performed in the exact order in which they are performed. Rather, the various steps may be processed in reverse order or simultaneously. Meanwhile, other operations may be added to the processes, or a certain step or several steps of operations may be removed from the processes.

In order to realize large data resource sharing to meet related data sharing requirements on the premise of meeting privacy protection and data security and avoid forming a large number of data islands in a large data era, the inventor purposefully provides a large data resource sharing method and a resource sharing system based on information security.

Referring to fig. 1, which is a flowchart illustrating an exemplary method and/or process for sharing big data resources based on information security according to some embodiments of the present invention, the method for sharing big data resources based on information security may be applied to a resource sharing system, and the resource sharing system is communicatively connected to a plurality of resource sharing objects, and further, the method may include the following technical solutions described in step S100 and step S200.

S100: the method comprises the steps of obtaining business wind control resource information obtained after user privacy evaluation is carried out on interactive service resource information in a big data resource project in a shared activation state and service resource authentication items of the business wind control resource information, and determining resource sharing request items of a plurality of interactive service resource information and request item mutual-evidence results of the resource sharing request items of the interactive service resource information based on a preset interactive service resource information analysis model.

Illustratively, the big data resource item in the sharing activation state is stored in the resource sharing system, and the sharing activation state can be updated according to the sharing request sent by the resource sharing object, for example, the resource sharing object D sends a sharing request q1 to the resource sharing system to request to share the big data resource item X1, then the resource sharing system can activate the usage state of the big data resource item X1 to obtain the big data resource item X1 in the sharing activation state. The interaction service resource information can be understood as related resource information for performing business interaction, including but not limited to text, voice, image or hyperlink, etc. And the user privacy evaluation is used for ensuring the safety of the related user privacy in the interactive service resource information, and correspondingly, after the user privacy evaluation is carried out, the service wind control resource information can be obtained. The service wind control resource information may carry a related privacy evaluation indication, and further, the service resource authentication item is used to represent an authentication condition of the related service resource, such as validity authentication, privacy attribute authentication, user identity authentication, and the like, which is not limited herein. Further, the preset interactive service resource information analysis model can be obtained by training according to the relevant samples, and since model training is the prior art, further description is not provided herein. In addition, the resource sharing request transaction may be initiated by some resource sharing object to the resource sharing system, or may be initiated by the resource sharing system to some resource sharing object, which is not limited herein. Further, the request transaction mutual authentication result is a mutual authentication result between the plurality of resource sharing objects, so that the reliability of the request transaction mutual authentication result can be ensured as much as possible. In related embodiments, the application scenarios related to the large data resource project include, but are not limited to, blockchain payment, cross-border payment, online office, online education, government and enterprise business handling, smart city management, smart factory scheduling, and the like.

In the actual implementation process, in order to obtain evaluation information and processing information for a privacy level and a data security level as much as possible, the above steps "obtain service wind control resource information obtained after performing user privacy evaluation on interactive service resource information in a large data resource project in a shared activation state and service resource authentication items of the service wind control resource information, and determine resource sharing request items of a plurality of interactive service resource information and request item mutual authentication results of the resource sharing request items of the interactive service resource information based on a preset interactive service resource information analysis model", may further be implemented by: obtaining service wind control resource information obtained after user privacy evaluation is carried out on interactive service resource information in a big data resource project in a shared activation state and service resource authentication items of the service wind control resource information, wherein the big data resource project in the shared activation state comprises a plurality of big data resource blocks, and the service resource authentication items comprise resource distribution conditions of the service wind control resource information in the big data resource blocks, classification labels of the big data resource blocks, privacy evaluation levels of the interactive service resource information and resource sharing compatible information of the service wind control resource information in the big data resource blocks; obtaining resource sharing request items of a plurality of interactive service resource information obtained by analyzing the big data resource items in the sharing activation state by a preset interactive service resource information analysis model and request item mutual-evidence results of the resource sharing request items of the interactive service resource information, wherein the request item mutual-evidence results comprise classification labels of big data resource blocks where the resource sharing request items of the interactive service resource information are located and resource distribution conditions of the big data resource blocks where the resource sharing request items of the interactive service resource information are located. For example, the large data resource block may be a local integration result of related resource information, and the resource distribution condition is used to characterize the proportion condition and the association condition of different types of resource information. The classification labels are used for distinguishing the big data resource blocks, the privacy evaluation grade is used for representing the privacy importance degree of the interactive service resource information, and the privacy evaluation grade is usually inversely related to the data sharing tendency. The resource sharing compatibility information is used to characterize the interplay between privacy security and the degree of data sharing. Therefore, the evaluation information and the processing information aiming at the privacy level and the data security level can be obtained as much as possible, so that the large data resource sharing is realized on the premise of meeting the privacy protection and the data security based on the related evaluation information and the processing information aiming at the privacy level and the data security level, and the formation of a large number of data islands in the large data era is avoided.

S200: and carrying out big data resource sharing according to the privacy safety evaluation result of the preset resource sharing request item of the interactive service resource information, the privacy safety evaluation result of the preset user privacy evaluation corresponding to the resource sharing request item of the interactive service resource information, and the service resource authentication item.

Illustratively, a mutual confrontation relationship exists between the privacy security evaluation result of the preset resource sharing request item and the privacy security evaluation result of the preset user privacy evaluation, that is, by analyzing the privacy security evaluation result of the preset resource sharing request item and the privacy security evaluation result of the preset user privacy evaluation, a balance can be found between data sharing and privacy security, and big data resource sharing is realized by combining the service resource authentication item, so that big data resource sharing is realized on the premise of meeting privacy protection and data security, and a large number of data islands are prevented from being formed in a big data era. Based on this, the above step "performing big data resource sharing according to the privacy security evaluation result of the preset resource sharing request item of the interactive service resource information, the privacy security evaluation result of the preset user privacy evaluation corresponding to the resource sharing request item of the interactive service resource information, and the service resource authentication item" may further include the following steps: determining whether the resource sharing request items of the interactive service resource information are matched with the service wind control resource information in the big data resource block in which the resource sharing request items of the interactive service resource information are positioned according to the correlation between the privacy safety evaluation result of the preset resource sharing request items of the interactive service resource information and the privacy safety evaluation result of the preset user privacy evaluation of the service wind control resource information in the big data resource block in which the resource sharing request items of the interactive service resource information are positioned; and when the resource sharing request item of the interactive service resource information is matched with the service wind control resource information in the big data resource block where the resource sharing request item of the interactive service resource information is located, sharing at least part of the big data resource blocks in the interactive service resource information in the big data resource item in the sharing activation state based on the resource distribution condition of the service wind control resource information in the big data resource block, the classification label of the big data resource block, the privacy evaluation grade of the interactive service resource information and the resource sharing compatible information of the service wind control resource information in the big data resource block. In a related embodiment, a correlation between the privacy security evaluation result of the preset resource sharing request item of the interactive service resource information and the privacy security evaluation result of the preset user privacy evaluation of the service wind control resource information in the big data resource block where the resource sharing request item of the interactive service resource information is located may be expressed by a correlation coefficient, such as a pearson correlation coefficient (pearman correlation coefficient), a spearman correlation coefficient (spearman correlation coefficient), or a kendale correlation coefficient (kendale correlation coefficient). When the resource sharing request item of the interactive service resource information is matched with the service wind control resource information in the big data resource block where the resource sharing request item of the interactive service resource information is located, it indicates that a compatible state or a balanced state between data sharing and privacy security has been determined, and on this basis, at least a part of the big data resource blocks in the interactive service resource information in the big data resource item in the sharing activation state can be shared based on the resource distribution condition of the service wind control resource information in the big data resource block, the classification label of the big data resource block where the resource sharing request item is located, the privacy evaluation grade of the interactive service resource information, and the resource sharing compatible information of the service wind control resource information in the big data resource block. When data resources are shared, the pertinence of data resource sharing can be improved by considering the resource distribution condition, the efficiency of data resource sharing can be improved by considering the classification label, and the privacy information of the shared party can be protected as far as possible on the premise of meeting the data resource sharing requirement by considering the privacy evaluation grade and the resource sharing compatible information. Therefore, large data resource sharing is realized on the premise of meeting privacy protection and data safety, and a large amount of data isolated islands are prevented from being formed in a large data era.

On the basis of the above, the step "determining whether the resource sharing request item of the interactive service resource information matches the service wind control resource information in the big data resource block where the resource sharing request item of the interactive service resource information is located according to the correlation between the privacy security evaluation result of the preset resource sharing request item of the interactive service resource information and the privacy security evaluation result of the preset user privacy evaluation of the service wind control resource information in the big data resource block where the resource sharing request item of the interactive service resource information is located", may further include the following: judging the correlation between the privacy safety evaluation result of the preset resource sharing request item of the interactive service resource information and the privacy safety evaluation result of the preset user privacy evaluation of the service wind control resource information in the same big data resource block, and the correlation between the resource sharing compatible information and the preset resource abuse factor; if the correlation between the privacy safety evaluation result of the preset resource sharing request item of the interactive service resource information and the privacy safety evaluation result of the preset user privacy evaluation of the service wind control resource information in the same big data resource block is less than or equal to the correlation between the resource sharing compatible information of the service wind control resource information and a preset resource abuse factor, determining that the resource sharing request item of the interactive service resource information is matched with the service wind control resource information; and if the correlation between the privacy safety evaluation result of the preset resource sharing request item of the interactive service resource information and the privacy safety evaluation result of the preset user privacy evaluation of the service wind control resource information in the same big data resource block is greater than the correlation between the resource sharing compatible information of the service wind control resource information and a preset resource abuse factor, determining that the resource sharing request item of the interactive service resource information is not matched with the service wind control resource information. For example, the preset resource abuse factor may be used to represent an evaluation probability of different resource sharing objects abusing shared resources, and the preset resource abuse factor may be determined according to a statistical result of events of resource abuse occurring in a history sharing record, and in general, a value range of the resource abuse factor may be 0 to 1. It can be understood that the association between the resource sharing compatibility information of the service wind control resource information and the preset resource abuse factor can also be expressed by a correlation coefficient, such as a pearson correlation coefficient (Pearson correlation coefficient), a spearman correlation coefficient (spearman correlation coefficient), or a Kendall correlation coefficient (Kendall correlation coefficient). By means of the design, the correlation between the privacy safety evaluation result of the preset resource sharing request item of the interactive service resource information and the privacy safety evaluation result of the preset user privacy evaluation of the service wind control resource information in the same big data resource block and the correlation between the resource sharing compatible information and the preset resource abuse factor can be considered, and therefore whether the resource sharing request item of the interactive service resource information is matched with the service wind control resource information or not can be judged accurately and reliably.

After the resource sharing is completed, the related sharing dimension evaluation information may be determined, so as to verify whether the decision result of the resource sharing is reliable based on the sharing dimension evaluation information, and to achieve this, on the basis of the above steps S100 and S200, the following step S300 may be further included.

S300: and determining at least one sharing dimension evaluation information of the interaction service resource information analysis model aiming at the resource interaction heat, the resource interaction trust degree, the resource tampering probability and the resource scene matching degree of the interaction service resource information in the big data resource project in the sharing activation state according to the number of resource sharing request items of the interaction service resource information matched with the business wind control resource information in all the big data resource blocks. By means of the design, whether the decision result of resource sharing is reliable or not can be verified reversely on the basis of the resource interaction heat degree, the resource mutual trust degree, the resource tampering probability and the resource scene matching degree by determining the resource interaction heat degree, the resource mutual trust degree, the resource tampering probability and the resource scene matching degree. Further, a further determination manner regarding the above-described shared dimension evaluation information may be as follows.

(1) The determination method of the interactive heat of the resource comprises the following steps: on the basis of obtaining the accumulated resource sharing object corresponding to the big data resource item in the shared activation state according to the number of different interactive service resource information in the service wind control resource information, and determining the resource interaction heat of the interactive service resource information in the big data resource item in the shared activation state by the interactive service resource information analysis model according to the number of resource sharing request items of the interactive service resource information matched with the service wind control resource information in all big data resource blocks comprises the following steps: determining an accumulated resource sharing object analyzed by the interactive service resource information analysis model according to the number of resource sharing request items of the interactive service resource information matched with the service wind control resource information in all big data resource blocks; and determining the proportion statistical result of the accumulated resource sharing objects analyzed by the interactive service resource information analysis model and the accumulated resource sharing objects corresponding to the big data resource items in the sharing activation state to obtain the resource interaction heat of the interactive service resource information analysis model. The resource interaction heat is used for representing the use heat condition of the shared resource, and whether the shared resource item meets the actual service requirement or not can be judged through the resource interaction heat. Based on this, the step "determining the accumulated resource sharing object analyzed by the interactive service resource information analysis model according to the number of resource sharing request items of the interactive service resource information matched with the service wind control resource information in all the big data resource blocks" may further include the following contents: if the number of resource sharing request items of the interactive service resource information matched with the service wind control resource information in all the big data resource blocks is zero, determining that the service wind control resource information is not successfully analyzed by the interactive service resource information analysis model; if the number of resource sharing request items of the interactive service resource information matched with the service wind control resource information in all the big data resource blocks is not zero, determining that the service wind control resource information is analyzed by the interactive service resource information analysis model; and determining the accumulated result of the number of all the business wind control resource information analyzed by the interactive service resource information analysis model to obtain an accumulated resource sharing object analyzed by the interactive service resource information analysis model. And judging whether the interactive service resource information analysis model successfully analyzes the interactive service resource information by judging whether an analysis result corresponding to the service wind control resource information exists or not. In this way, different interactive service resource information can be analyzed independently, and accuracy of accumulating resource sharing objects is ensured.

(2) And determining the mutual confidence degree of the resources. In this embodiment, the step of determining, according to the number of resource sharing request items of the interaction service resource information matched with the service wind control resource information in all big data resource blocks, a resource mutual trust degree of the interaction service resource information analysis model for the big data resource items in the shared activation state for the interaction service resource information includes: and determining the ratio statistical result of the number of the resource sharing request items of the interactive service resource information with the mutual trust labels in all the big data resource blocks and the number of the resource sharing request items of the interactive service resource information to obtain the mutual trust degree of the resources. The mutual trust label may be added after a certain number of mutual authentications are passed, for example, 10 shared resource objects exist, and if the interactive service resource information passes 5 mutual authentications, the mutual trust label may be added to the corresponding interactive service resource information. By the design, the reliability of the mutual trust degree of the resources can be ensured based on a few majority-compliant mechanisms.

(3) The determination method of the resource tampering probability. In this embodiment, the step of determining, according to the number of resource sharing request items of the interaction service resource information matched with the service wind control resource information in all big data resource blocks, a resource tampering probability of the interaction service resource information analysis model for the big data resource items in the shared activation state includes: determining the comparison result of the number of the resource sharing request items of the interactive service resource information and the number of the resource sharing request items of the interactive service resource information matched with the service wind control resource information, and obtaining the number of the resource sharing request items of the interactive service resource information with tampering marks, which is identified by the interactive service resource information analysis model; and determining the number of the resource sharing request items of the interactive service resource information with the tampering trace identified by the interactive service resource information analysis model and the ratio statistical result of the number of the resource sharing request items of the interactive service resource information to obtain the resource tampering probability corresponding to the interactive service resource information analysis model. The resource tampering probability can be understood as the incidence rate corresponding to specific abuse behaviors under the resource abuse level. The tamper trace may include, without limitation, associated operational behavior data or a service operation log. Therefore, the resource tampering probability can be accurately determined, and the legality of the related resource sharing object can be determined through the resource tampering probability.

(4) And determining the resource scene matching degree. In this embodiment, the step of determining the resource scene matching degree of the interactive service resource information analysis model for the interactive service resource information in the large data resource item in the shared activation state according to the number of resource sharing request items of the interactive service resource information matched with the service wind control resource information in all the large data resource blocks includes: determining the scene quantity of different big data service scenes in the resource sharing request items of the interactive service resource information and the proportion statistical result of the accumulated resource sharing object corresponding to the big data resource item in the sharing activation state, and obtaining the resource scene matching degree of the interactive service resource information analysis model aiming at the interactive service resource information in the big data resource item in the sharing activation state. The resource scene matching degree is used for representing the scene adaptation capacity of the big data resource block corresponding to the big data resource item, the larger the resource scene matching degree is, the stronger the scene adaptation capacity of the big data resource block is, the smaller the resource scene matching degree is, the weaker the scene adaptation capacity of the big data resource block is, so that the scene adaptation capacity of the big data resource block in a sharing state can be accurately determined through the content, and a scene-level decision basis is provided for subsequent resource sharing. Further, in this embodiment, the step of "determining the number of scenes of the big data traffic scene which are different in the resource sharing request transaction of the interaction service resource information" may include the following steps: determining the privacy evaluation grade of the interactive service resource information of the business wind control resource information matched with the resource sharing request items of the interactive service resource information according to the resource distribution condition of the big data resource block where the resource sharing request items of the interactive service resource information are located; if the number of the resource sharing request items of the interactive service resource information matched with the service wind control resource information is not zero and the privacy evaluation grade of the interactive service resource information of the service wind control resource information matched with the resource sharing request items of the interactive service resource information is greater than or equal to a preset evaluation grade, determining that the service wind control resource information has corresponding different big data service scenes; if the number of the resource sharing request items of the interactive service resource information matched with the service wind control resource information is zero, or the privacy evaluation grade of the interactive service resource information of the service wind control resource information matched with the resource sharing request items of the interactive service resource information is less than a preset evaluation grade, determining that the service wind control resource information does not have corresponding different big data service scenes; and determining the number of the service wind control resource information with the corresponding different big data service scenes in the service wind control resource information to obtain the scene number of the different big data service scenes in the resource sharing request items of the interactive service resource information. By the design, the scene quantity of different big data service scenes can be accurately determined.

On the basis of the above, in order to ensure confidentiality, integrity and availability of information resources in the data resource sharing process, besides a mutual trust mechanism, real-time intrusion behavior detection needs to be performed, and on the basis of the above steps, the following contents are included: determining a network resource interaction state for carrying out big data resource sharing; according to a first group of resource processing behaviors and a second group of resource processing behaviors in a network resource interaction state, determining first behavior intention heat distribution and first behavior intention description change of the first group of resource processing behaviors, and obtaining a first abnormal behavior detection result of the first group of resource processing behaviors relative to an intrusion detection response event; wherein the network resource interaction state is an interaction state between the resource sharing object and the resource sharing system; determining a first abnormal behavior monitoring strategy through a first behavior intention heat distribution, a first behavior intention description change and a first abnormal behavior detection result of the first group of resource processing behaviors; and judging whether the interaction state corresponding to the first abnormal behavior monitoring strategy has network resource intrusion behavior or not based on a pre-trained network resource intrusion detection model.

Further, regarding the above step, "according to the first and second sets of resource processing behaviors in the network resource interaction state, determining a first behavior intention heat distribution and a first behavior intention description change of the first set of resource processing behaviors, and obtaining a first abnormal behavior detection result of the first set of resource processing behaviors relative to the intrusion detection response event; wherein the network resource interaction state is an interaction state between the resource sharing object and the resource sharing system; determining a first abnormal behavior monitoring strategy through a first behavior intention heat distribution, a first behavior intention description change and a first abnormal behavior detection result of the first group of resource processing behaviors; a further explanation of determining whether the interaction state corresponding to the first abnormal behavior monitoring policy has the network resource intrusion behavior "based on the pre-trained network resource intrusion detection model may be as follows.

S410: according to a first group of resource processing behaviors and a second group of resource processing behaviors in a network resource interaction state, determining first behavior intention heat distribution and first behavior intention description change of the first group of resource processing behaviors, and obtaining a first abnormal behavior detection result of the first group of resource processing behaviors relative to an intrusion detection response event.

In this embodiment, the network resource interaction state is an interaction state between the resource sharing object and the resource sharing system. Referring to fig. 2, the resource sharing system 100 and the resource sharing object 200 may be communicatively connected through a wireless network or a wired network, and the network resource interaction state may be understood as a state in which the resource sharing object 200 obtains and uses a corresponding network resource from the resource sharing system 100, that is, there is an interaction behavior between the resource sharing object 200 and the resource sharing system 100. In this embodiment, the network resource may include data information such as text information, image information, sound information, and the like, and the field to which the network resource relates may include online payment, online office, online education, cloud game service, internet of things control, smart city monitoring, smart medical treatment, and government and enterprise business handling, and is not limited herein. Further, there is time sequence continuity between the first set of resource processing behaviors and the second set of resource processing behaviors, and the first set of resource processing behaviors can be understood as network resource usage triggering behaviors corresponding to the resource sharing object 200, and are resource processing behaviors capable of reflecting the real behavior intention of the resource sharing object 200 more accurately. The resource processing behavior includes, but is not limited to, resource invocation, resource access, resource modification, and the like. On the basis of the above, the behavior intention heat distribution can be used for describing the heat comparison condition of the behavior intention information of various types of behaviors of the resource sharing object 200, the action intention heat may be understood as the probability that the resource sharing object 200 performs the action corresponding to the intention, the higher the action intention heat, the higher the probability that the resource sharing object 200 performs the action corresponding to the intention is indicated to be, the behavior intention heat distribution can be expressed in the form of a chart, for example, the behavior intention distribution can be [ interaction-1-r 20, interaction-2-r 60, and interaction-x-r 40], wherein, x is a positive integer, the intent-1-r 20 can represent the heat of the intent-entry 1 as 20, the intent-2-r 60 can represent the heat of the intent-entry 2 as 60, and the intent-x-r 20 can represent the heat of the intent-entry x as 40. For example, the action intention interaction 1 may be "hyperlink to tamper with payment page", the action intention interaction 2 may be "access private information of service user a", and the like, which is not limited herein. Accordingly, the behavior intention description change can be used to characterize the change situation of the unified behavior intention in different interaction states or different time periods, and the behavior intention description change can be represented in the form of a curve or a list, which is not limited herein. In addition, the intrusion detection response event may be a series of service events corresponding to the resource sharing object 200, which are identified by the resource sharing system according to the previous intrusion detection result, such as a service event 1 (multiple requests for accessing the network resource), a service event 2 (there is a behavior event exceeding the access right of itself), and the like. The abnormal behavior detection result can be used for carrying out initial screening of intrusion detection on the first group of resource processing behaviors, so that the detection efficiency of the intrusion behaviors can be improved in a staged intrusion detection mode, and meanwhile, unnecessary data processing pressure of a resource sharing system is reduced.

In a related embodiment, in order to ensure the time-series continuity of the first behavior intention heat distribution and the first behavior intention description change so as to ensure the reliability of the subsequent intrusion behavior detection, the step "determining the first behavior intention heat distribution and the first behavior intention description change of the first group of resource processing behaviors according to the first group of resource processing behaviors and the second group of resource processing behaviors in the network resource interaction state" may be implemented by: the following processes are carried out on a first group of resource processing behaviors and a second group of resource processing behaviors which are uninterrupted in the network resource interaction state: for each first behavior data node information in the first group of resource processing behaviors and the second group of resource processing behaviors, according to node behavior transmission information of each first behavior data node information in the first group of resource processing behaviors and the second group of resource processing behaviors and a first resource attribute modification record corresponding to the network resource interaction state, determining a first behavior intention label corresponding to each first behavior data node information, and determining a first behavior intention label description of each first behavior data node information and a first behavior intention heat distribution of the first group of resource processing behaviors; and determining the first behavior intention description change of the first group of resource processing behaviors according to the mapping of the first behavior intention label description of each first behavior data node information to the corresponding service state of the preset service state directory. For example, the behavior data node information is used for performing nodularization processing on continuous resource processing behaviors, so that the script processing of user behaviors can be realized, namely, corresponding behavior intents are determined through the conduction relations and the transfer relations among different behavior data nodes, so that the first behavior intention heat distribution and the time sequence continuity of the description change of the first behavior intention can be ensured based on the risk conduction thought from the whole, and the reliability of the subsequent intrusion behavior detection is ensured. Further, the node behavior transfer information may be association information between different pieces of behavior data node information, taking the behavior data node information m1 and the behavior data node information m2 as an example, if the behavior data node information m1 is a user login node and the behavior data node information m2 is a user authentication node, then the node behavior transfer information between the behavior data node information m1 and the behavior data node information m2 may be logical association information related to a login password service. In addition, the first resource attribute modification record corresponding to the network resource interaction state may be a record reserved after the resource sharing system modifies the network resource based on a legal modification request. Based on the above, the first behavior intention tag of each first behavior data node information is used to distinguish different behavior intents, and the behavior intention tag may be a numerical tag or a tag in other forms, which is not limited herein. Based on the above, the service status directory may be generated according to the received service subscription request, and "mapping the first behavior intention tag description according to each first behavior data node information to the service status corresponding to the preset service status directory, and determining the first behavior intention description change of the first set of resource processing behaviors" may be understood as determining the change information of the behavior intention tag description in different service statuses, so that the first behavior intention description change of the first set of resource processing behaviors can be determined based on the change information, wherein the behavior intention tag description may characterize the behavior intention tag in multiple dimensions. In light of the above teachings, those skilled in the art can readily ascertain the first action intended to describe the changes and variations from the foregoing description to the related art.

In some possible embodiments, the determining the first behavioral intent heat distribution for the first set of resource processing behaviors includes: according to the first behavior intention label corresponding to each piece of first behavior data node information, obtaining first behavior intention heat corresponding to each piece of first behavior data node information, screening the first behavior intention heat meeting a preset second condition, and according to the screened first behavior intention heat, determining first behavior intention heat distribution of the first group of resource processing behaviors. The first behavior intention degree corresponding to each first behavior data node information can be determined through the label description value corresponding to the first behavior intention label, and the preset second condition can be that the related behavior intention degree is greater than the set intention degree. When determining the first behavior intention heat distribution of the first group of resource processing behaviors, the heat distribution map or the heat distribution list may be selected for determination according to actual situations, which is not limited herein.

In a related embodiment, the step of mapping the first behavior intention tag description of each first behavior data node information to a preset service state directory, and determining the first behavior intention description change of the first set of resource processing behaviors may be implemented by: acquiring first behavior intention heat corresponding to each first behavior data node information, wherein the corresponding first behavior intention heat meets each target first behavior data node information of a preset third condition; and mapping the first behavior intention label description of each target first behavior data node information to a preset service state directory, and determining the first behavior intention description change of the first group of resource processing behaviors according to the corresponding service state. Correspondingly, the preset third condition may also be a condition for determining the magnitude of the activity intention heat, and compared with the preset second condition, the third condition may be adaptively adjusted according to the number of resource sharing objects in different interaction states. In general, different business states may correspond to different behavioral intent descriptions, and thus, determining a first behavioral intent description change for the first set of resource processing behaviors from the corresponding business state can ensure a high degree of matching of the first behavioral intent description change to the business state.

In a related embodiment, the step of "obtaining a first abnormal behavior detection result of the first set of resource processing behaviors with respect to the intrusion detection response event" may include the following: and determining a first abnormal behavior detection result of the first group of resource processing behaviors relative to the intrusion detection response event according to the quantity of the intrusion detection service states corresponding to the intrusion detection response event mapped by the global node behavior characteristics of each first behavior data node information in the resource security protection state. For example, the resource security protection state may be a specific interaction state that is adjusted by the resource sharing system when detecting that there may be an intrusion risk, and the global node behavior feature is used to represent a key behavior and a substantial behavior of each first behavior data node information in the resource security protection state, and whether the global node behavior feature is mapped to an intrusion detection service state corresponding to an intrusion detection response event may be determined, depending on a behavior change condition of the first behavior data node information in the resource security protection state, if the first behavior data node information is almost not changed in the resource security protection state, the corresponding global node behavior feature may be mapped to the intrusion detection service state corresponding to the intrusion detection response event, and thus, it may be determined that the global node behavior feature of each first behavior data node information in the resource security protection state is mapped to the intrusion detection service state, and thus, it may be determined that the global node behavior feature of each first behavior data node information in the resource security protection state is mapped And detecting the number of the intrusion detection service states corresponding to the response event, and further determining a first abnormal behavior detection result of the first group of resource processing behaviors relative to the intrusion detection response event. On the basis of the above contents, the step "determining a first abnormal behavior detection result of the first group of resource processing behaviors relative to the intrusion detection response event according to the number of the intrusion detection service states corresponding to the intrusion detection service states mapped by the global node behavior characteristics of each first behavior data node information in the resource security protection state" may include the following contents: according to the first behavior data node information of each target, respectively obtaining a seventh global node behavior characteristic and an eighth global node behavior characteristic of the first behavior data node information of each target in a resource safety protection state, mapping the seventh global node behavior characteristic and the eighth global node behavior characteristic of the first behavior data node information of each target to an intrusion detection response event, and according to the number of intrusion detection service states corresponding to the seventh global node behavior characteristic and the eighth global node behavior characteristic, determining a first abnormal behavior detection result of the first group of resource processing behaviors relative to the intrusion detection response event. It can be understood that "according to the first behavior data node information of each target, respectively obtaining a seventh global node behavior feature and an eighth global node behavior feature of the first behavior data node information of each target in the resource security protection state, mapping the seventh global node behavior feature and the eighth global node behavior feature of the first behavior data node information of each target to the intrusion detection response event", and according to the number of intrusion detection service states corresponding to each seventh global node behavior feature and the eighth global node behavior feature, determining that "for each first group of resource processing behaviors, which may be described in S420, the first behavior intention heat distribution, the first behavior intention description change, and the first abnormal behavior detection result of the first group of resource processing behaviors satisfy the corresponding preset first conditions or not, if so, setting the first group of resource processing behaviors as a first target resource processing behavior; and determining the implementation on the basis of each first abnormal behavior monitoring strategy according to the set uninterrupted first target resource processing behaviors. In this embodiment, the first, second, third, etc. are only used to distinguish different technical features, and are not limited to importance or order.

In some possible embodiments, to ensure information integrity of the first behavioral data node information, the method may further include the following before the step of determining that each first behavioral data node information conveys information in a node behavior of the first set of resource processing behaviors and the second set of resource processing behaviors described in the above step. And acquiring service behavior difference data corresponding to the first group of resource processing behaviors according to a third active service behavior and a third passive service behavior of the first group of resource processing behaviors. For example, the active service and the passive service may be determined by the order of the request behaviors of the resource sharing system and the resource sharing object, for example, if the request behavior of the resource sharing object is prior to the request behavior of the resource sharing system, the active service behavior may be determined, and if the request behavior of the resource sharing object is later than the request behavior of the resource sharing system, the passive service behavior may be determined. For each first behavioural data node information in the set of first behavioural data node information, determining each second pending behavioural data node information associated with the first behavioural data node information in the third active traffic behaviour. The first set of behavioral data node information may be used to aggregate different first behavioral data node information. And loading each piece of second to-be-processed behavior data node information into the to-be-processed information set. And for each second to-be-processed behavior data node information in the to-be-processed information set, according to the service behavior difference data, determining a fourth behavior data feature segment corresponding to the second to-be-processed behavior data node information in a third passive service behavior, and determining a fifth behavior data feature segment and a sixth behavior data feature segment corresponding to the second to-be-processed behavior data node information in a fourth active service behavior and a fourth passive service behavior of the second group of resource processing behaviors. For example, the behavior data feature fragment may be split according to the correlation between the behavior data features, so that the data information processing pressure of the resource sharing system can be effectively reduced on the premise of not changing the content expressed by the behavior data features, and the information integrity of the first behavior data node information is further ensured. And determining a third behavior data feature set containing the fifth behavior data feature segment in a fourth active business behavior, determining a fourth behavior data feature set containing a sixth behavior data feature segment in a fourth passive business behavior, and determining a third target behavior data feature segment and a fourth target behavior data feature segment which are matched with the second to-be-processed behavior data node information and the fourth behavior data feature segment in the third behavior data feature set and the fourth behavior data feature set respectively. Determining service behavior transfer indexes of second to-be-processed behavior data node information, a fourth behavior data feature segment, a third target behavior data feature segment and a fourth target behavior data feature segment, judging whether the service behavior transfer indexes are larger than a preset behavior transfer index, if so, determining that the second to-be-processed behavior data node information, the fourth behavior data feature segment, the third target behavior data feature segment and the fourth target behavior data feature segment are first target behavior data node information, removing the first behavior data node information from a first behavior data node information set, updating the first target behavior data node information into first behavior data node information, and loading the first behavior data node information into the first behavior data node information set. For example, the service behavior transfer index is used for representing the loss condition of information transfer between behavior data node information, the larger the service behavior transfer index is, the smaller the loss rate of information transfer between behavior data node information is, which indicates that the relevance and continuity between behavior data node information are stronger.

S420: and determining a first abnormal behavior monitoring strategy through the first behavior intention heat distribution, the first behavior intention description change and the first abnormal behavior detection result of the first group of resource processing behaviors.

For example, the abnormal behavior snooping policy is used to indicate which behavior events of the resource processing behavior are snooped in order to quickly determine whether the resource processing behavior is an abnormal behavior. Based on this, in order to ensure the credibility of the first abnormal behavior monitoring policy, the step "determine the first abnormal behavior monitoring policy by processing the first behavior intention heat distribution, the first behavior intention description change and the first abnormal behavior detection result of the behavior through the first set of resources" may include the following: for each first group of resource processing behaviors, judging whether the first behavior intention heat distribution, the first behavior intention description change and the first abnormal behavior detection result of the first group of resource processing behaviors all meet corresponding preset first conditions, and if so, setting the first group of resource processing behaviors as first target resource processing behaviors; and determining each first abnormal behavior monitoring strategy according to the set uninterrupted first target resource processing behaviors. In general, the preset first condition corresponding to the first behavior intention heat distribution may be a concentration of the behavior intention heat distribution, the preset first condition corresponding to the first behavior intention description change may be a change rate of the intention feature, and the preset first condition corresponding to the first abnormal behavior detection result may be a time effectiveness index of the detection result. Accordingly, whether the first behavior intention heat distribution, the first behavior intention description change and the first abnormal behavior detection result all meet the corresponding preset first conditions, it can be understood that whether the concentration of the behavior intention heat distribution reaches the set concentration, whether the change rate of the intention characteristics reaches the set change rate, whether the timeliness index of the detection result is more than the set number, on the premise that the first behavior intention heat distribution, the first behavior intention description change and the first abnormal behavior detection result of the first group of resource processing behaviors all meet corresponding preset first conditions, a first target resource processing behavior can be determined, the first target resource processing behavior may be a resource processing behavior with a behavior monitoring identifier, that is, a resource processing behavior judged by the resource sharing system side and possibly having an intrusion risk.

S430: and judging whether the interaction state corresponding to the first abnormal behavior monitoring strategy has network resource intrusion behavior or not based on a pre-trained network resource intrusion detection model.

In this embodiment, the network resource intrusion detection model may be a machine learning model, and the network resource intrusion behavior may be understood as a behavior of destroying a network resource in the resource sharing system, and on the basis of S410 and S420, the step "based on a pre-trained network resource intrusion detection model, determining whether the interaction state corresponding to the first abnormal behavior monitoring policy has the network resource intrusion behavior", may include the following contents: aiming at each first abnormal behavior monitoring strategy, determining the heat distribution of the intention of the first target behavior, the description change of the intention of the first target behavior and the detection result of the abnormal behavior of the first target according to each first target resource processing behavior corresponding to the first abnormal behavior monitoring strategy; and determining whether the interaction state corresponding to the first abnormal behavior monitoring strategy has the network resource intrusion behavior according to a pre-trained network resource intrusion detection model, the heat distribution of the first target behavior intention, the description change of the first target behavior intention, the detection result of the first target abnormal behavior and the first abnormal behavior monitoring strategy. It is understood that the first target behavior intention heat distribution, the first target behavior intention description change, and the first target abnormal behavior detection result correspond to the first target resource processing behavior, and the first target behavior intention heat distribution, the first target behavior intention description change, and the first target abnormal behavior detection result may be the behavior intention heat distribution, the behavior intention description change, and the abnormal behavior detection result to which the abnormality detection tag is added by the resource sharing system for the first target resource processing behavior, that is, the first target behavior intention heat distribution, the first target behavior intention description change, and the first target abnormal behavior detection result have higher abnormality detection sensitivity with respect to the first target behavior intention heat distribution, the first behavior intention description change, and the first abnormal behavior detection result due to the first target behavior intention heat distribution, the first target behavior description change, and the first target abnormal behavior detection result, The first target behavior intention description change and the first target abnormal behavior detection result correspond to a first target resource processing behavior, and the first target behavior intention heat distribution, the first target behavior intention description change and the first target abnormal behavior detection result are determined on the basis of the first behavior intention heat distribution, the first behavior intention description change and the first abnormal behavior detection result, so that the detection reliability of the network resource intrusion behavior can be improved on the premise of not significantly increasing the intrusion detection pressure of the resource sharing system. Further, the step "determining whether there is a network resource intrusion behavior in the interaction state corresponding to the first abnormal behavior monitoring policy according to a pre-trained network resource intrusion detection model, the first target behavior intention heat distribution, the first target behavior intention description change, the first target abnormal behavior detection result, and the first abnormal behavior monitoring policy" may be exemplarily implemented in the following manner.

The method comprises the following steps of firstly, determining input information corresponding to the first target behavior intention heat distribution, the first target behavior intention description change, the first target abnormal behavior detection result and the first abnormal behavior monitoring strategy.

And secondly, inputting input information corresponding to the first target behavior intention heat distribution, the first target behavior intention description change, the first target abnormal behavior detection result and the first abnormal behavior monitoring strategy into a pre-trained network resource intrusion detection model, outputting the detection result at least through a feature extraction layer, a feature combination layer and a feature identification layer in the network resource intrusion detection model, and determining whether the network resource intrusion behavior exists in the interaction state corresponding to the first abnormal behavior monitoring strategy or not through the detection result.

For example, the detection result may include intrusion behavior risk rates in the interaction states corresponding to different first abnormal behavior monitoring policies, and the higher the intrusion behavior risk rate is, the higher the probability that the network resource intrusion behavior exists in the interaction state corresponding to the first abnormal behavior monitoring policy is, so that, based on the detection result, a corresponding network resource security measure may be implemented for the interaction states corresponding to the different first abnormal behavior monitoring policies, thereby ensuring the security of the network resource.

In a related embodiment, the network resource intrusion behavior includes, but is not limited to, protocol vulnerability attacks such as a flooding attack (SYN flood), a Smurf attack, and a teardrop attack (teardrop). The damage of the network resource intrusion behavior to the network resource can be embodied in tampering, embezzlement, stealing, traffic attack, denial of service (DDOS), and the like.

In related embodiments, the behavioral intention may be an intention of the resource sharing object itself or an intention of an intruder after the resource sharing object is intruded, and generally, in order to ensure security of network resources, the intention of the resource sharing object itself or the intention of the intruder is not further subdivided, that is, the behavioral intention is directly detected and analyzed.

Generally, behavioral data node information of the same event or similar events may be integrated to obtain a set of behavioral data node information. By performing the nodularization processing on the continuous behavior data, the efficiency of behavior analysis can be improved. And through node processing, further user behavior analysis can be realized by means of input and output of a behavior function and a calling function, so that decision basis is provided for intrusion detection and subsequent updating of security measures.

In practical implementation, the training process of the network resource intrusion detection model may include the following steps: for each uninterrupted first and second set of sample resource handling behaviors in the sample network resource interaction state, performing the following: for each second behavior data node information in the first group of sample resource processing behaviors and the second group of sample resource processing behaviors, according to node behavior transfer information of each second behavior data node information in the first group of sample resource processing behaviors and the second group of sample resource processing behaviors and a second resource attribute modification record corresponding to the interaction state of the sample network resource, determining a second behavior intention label corresponding to each second behavior data node information, and determining a second behavior intention label description of each second behavior data node information and a second behavior intention heat distribution of the first group of sample resource processing behaviors, the method specifically includes: acquiring a second behavior intention heat corresponding to each piece of second behavior data node information according to a second behavior intention label corresponding to each piece of second behavior data node information; screening each second behavior intention heat degree meeting a preset second condition, and determining second behavior intention heat degree distribution of the first group of sample resource processing behaviors according to the screened each second behavior intention heat degree; determining a second behavior intention description change of the first group of sample resource processing behaviors according to the mapping of the second behavior intention label description of each second behavior data node information to the corresponding service state of the preset service state directory, specifically comprising: acquiring second behavior intention heat corresponding to each second behavior data node information, wherein the second behavior intention heat meets each target second behavior data node information of a preset third condition; mapping the second behavior intention label description of each target second behavior data node information to a preset service state directory, and determining the second behavior intention description change of the first group of sample resource processing behaviors according to the corresponding service state; determining a second abnormal behavior detection result of the first group of sample resource processing behaviors relative to the intrusion detection response event according to the quantity of the intrusion detection service states corresponding to the intrusion detection response event mapped by the global node behavior characteristics of each second behavior data node information in the resource security protection state, specifically comprising: respectively acquiring a third global node behavior characteristic and a fourth global node behavior characteristic of each target second behavior data node information in a resource security protection state according to each target second behavior data node information, mapping the third global node behavior characteristic and the fourth global node behavior characteristic of each target second behavior data node information to an intrusion detection response event, and determining a second abnormal behavior detection result of the first group of sample resource processing behaviors relative to the intrusion detection response event according to the number of intrusion detection service states corresponding to each third global node behavior characteristic and the fourth global node behavior characteristic; for each first group of sample resource processing behaviors, judging whether a second behavior intention heat distribution, a second behavior intention description change and a second abnormal behavior detection result of the first group of sample resource processing behaviors meet corresponding preset second conditions, and if so, setting the first group of sample resource processing behaviors as second target resource processing behaviors; determining each second abnormal behavior monitoring strategy according to the set uninterrupted second target resource processing behaviors; and aiming at each second abnormal behavior monitoring strategy, determining second target behavior intention heat distribution, second target behavior intention description change and a second target abnormal behavior detection result according to each second target resource processing behavior corresponding to the second abnormal behavior monitoring strategy, and training the network resource intrusion detection model according to the second target behavior intention heat distribution, the second target behavior intention description change, the second target abnormal behavior detection result, the second abnormal behavior monitoring strategy and the detection mark information of whether each group of resource processing behaviors in the sample network resource interaction state have network resource intrusion behaviors.

In the training process, the detection mark information is compared with the preset mark information, so that the model parameters of the network resource intrusion detection model are adjusted according to the comparison result, iterative training of the network resource intrusion detection model is further realized, and meanwhile, the network resource intrusion detection model can be continuously learned, so that the stability and generalization capability of a subsequent model in use are improved. For example, the detection flag information and the preset flag information may be both mapped to numerical values, and then the model parameters may be adjusted according to the comparison result of the numerical value difference until the difference between the numerical value corresponding to the detection flag information and the numerical value corresponding to the preset flag information is smaller than a set value, so as to complete the training of the model. Of course, in the process of training the model, whether to terminate the model training may also be determined by other training conditions, which is not limited herein. Further, based on the above, determining that each second behavior data node information is prior to the node behavior passing information in the first set of sample resource processing behaviors and the second set of sample resource processing behaviors, the method further comprises: acquiring service behavior difference data corresponding to the first group of sample resource processing behaviors according to a first active service behavior and a first passive service behavior of the first group of sample resource processing behaviors; determining, for each second behavior data node information in the second behavior data node information set, each first to-be-processed behavior data node information associated with the second behavior data node information in the first active traffic behavior; loading each first behavior to be processed data node information into an information set to be processed; for each first to-be-processed behavior data node information in the to-be-processed information set, according to the service behavior difference data, determining a first behavior data feature segment corresponding to the first to-be-processed behavior data node information in a first passive service behavior, and determining a second behavior data feature segment and a third behavior data feature segment corresponding to the first to-be-processed behavior data node information in a second active service behavior and a second passive service behavior of a second group of sample resource processing behaviors; determining a first behavior data feature set containing a second behavior data feature fragment in a second active business behavior, determining a second behavior data feature set containing a third behavior data feature fragment in a second passive business behavior, and determining a first target behavior data feature fragment and a second target behavior data feature fragment which are matched with first to-be-processed behavior data node information and the first behavior data feature fragment in the first behavior data feature set and the second behavior data feature set respectively; and judging whether the service behavior transmission indexes of the first to-be-processed behavior data node information, the first behavior data feature segment, the first target behavior data feature segment and the second target behavior data feature segment are larger than a preset behavior transmission index, if so, determining that the first to-be-processed behavior data node information, the first behavior data feature segment, the first target behavior data feature segment and the second target behavior data feature segment are second target behavior data node information, removing the second behavior data node information from a second behavior data node information set, updating the second target behavior data node information into second behavior data node information, and loading the second behavior data node information into the second behavior data node information set. It can be understood that, for the description of the relevant content in the model training process, reference may be made to the description of the method shown in fig. 1, which is not described herein again.

Therefore, when the intrusion detection scheme in the shared state is applied, the continuous first group of resource processing behaviors and the continuous second group of resource processing behaviors in the network resource interaction state can be analyzed, so that the heat distribution of the first behavior intention, the description change of the first behavior intention and the detection result of the first abnormal behavior are determined, the monitoring strategy of the first abnormal behavior is further determined, and whether the network resource intrusion behavior exists in the interaction state corresponding to the monitoring strategy of the first abnormal behavior can be judged based on a pre-trained network resource intrusion detection model. Because the behavior intention heat and the behavior intention change are considered when the network resource intrusion behavior is detected, and the scene matching analysis can be carried out by combining the interaction state corresponding to the abnormal behavior monitoring strategy, the intrusion behavior detection can be carried out from the global level of the network resource interaction state based on the risk conduction thought of continuous resource processing behaviors, the intrusion detection reliability can be improved, the real-time performance of the intrusion detection can be improved, the accurate and reliable intrusion detection of the network resources is realized, and the behaviors which try to destroy the confidentiality, the integrity and the usability of the information resources are quickly determined.

In summary, when the scheme provided in this embodiment is applied, a resource sharing requirement level of a resource sharing object and a privacy information security level of a shared party can be set as starting points, so that user privacy evaluation is performed on interactive service resource information in a big data resource project in a shared activation state, and thus, service wind control resource information and service resource authentication items of the service wind control resource information can be obtained. On the basis, after resource sharing request items of a plurality of interactive service resource information and request item mutual authentication results of the resource sharing request items of the interactive service resource information are determined, big data resource sharing can be carried out by combining privacy security evaluation results of preset resource sharing request items and privacy security evaluation results of preset user privacy evaluation, and therefore balance between data sharing and privacy security can be sought, big data resource sharing is achieved by combining service resource authentication items, big data resource sharing is achieved on the premise that privacy protection and data security are met, and formation of a large number of data isolated islands in a big data era is avoided.

For the above big data resource sharing method based on information security, an embodiment of the present invention further provides an exemplary big data resource sharing device based on information security, and as shown in fig. 3, the big data resource sharing device 300 based on information security may include the following functional modules.

An obtaining module 310, configured to obtain service wind control resource information obtained after user privacy evaluation is performed on interaction service resource information in a big data resource project in a shared activation state and service resource authentication items of the service wind control resource information, and determine resource sharing request items of a plurality of interaction service resource information and request item mutual authentication results of the resource sharing request items of the interaction service resource information based on a preset interaction service resource information analysis model; wherein, the request transaction mutual authentication result is a mutual authentication result among the plurality of resource sharing objects.

The sharing module 320 is configured to perform big data resource sharing according to the privacy security evaluation result of the preset resource sharing request item of the interactive service resource information, the privacy security evaluation result of the preset user privacy evaluation corresponding to the resource sharing request item of the interactive service resource information, and the service resource authentication item.

It is understood that the above further description of the obtaining module 310 and the sharing module 320 may refer to the description of the method shown in fig. 1, and will not be described herein again.

Further, referring to fig. 4, the resource sharing system 100 may include a processing engine 110, a network module 120, and a memory 130, wherein the processing engine 110 and the memory 130 communicate through the network module 120.

Processing engine 110 may process the relevant information and/or data to perform one or more of the functions described herein. For example, in some embodiments, processing engine 110 may include at least one processing engine (e.g., a single core processing engine or a multi-core processor). By way of example only, the Processing engine 110 may include a Central Processing Unit (CPU), an Application-Specific Integrated Circuit (ASIC), an Application-Specific Instruction Set Processor (ASIP), a Graphics Processing Unit (GPU), a Physical Processing Unit (PPU), a Digital Signal Processor (DSP), a Field Programmable Gate Array (FPGA), a Programmable Logic Device (PLD), a controller, a microcontroller Unit, a Reduced Instruction Set Computer (RISC), a microprocessor, or the like, or any combination thereof.

Network module 120 may facilitate the exchange of information and/or data. In some embodiments, the network module 120 may be any type of wired or wireless network or combination thereof. Merely by way of example, the Network module 120 may include a cable Network, a wired Network, a fiber optic Network, a telecommunications Network, an intranet, the internet, a Local Area Network (LAN), a Wide Area Network (WAN), a Wireless Local Area Network (WLAN), a Metropolitan Area Network (MAN), a Public Switched Telephone Network (PSTN), a bluetooth Network, a Wireless personal Area Network, a Near Field Communication (NFC) Network, and the like, or any combination thereof. In some embodiments, the network module 120 may include at least one network access point. For example, the network module 120 may include wired or wireless network access points, such as base stations and/or network access points.

The Memory 130 may be, but is not limited to, a Random Access Memory (RAM), a Read Only Memory (ROM), a Programmable Read-Only Memory (PROM), an Erasable Read-Only Memory (EPROM), an electrically Erasable Read-Only Memory (EEPROM), and the like. The memory 130 is used for storing a program, and the processing engine 110 executes the program after receiving the execution instruction.

It will be appreciated that the architecture shown in FIG. 4 is merely illustrative and that the resource sharing system 100 may also include more or fewer components than shown in FIG. 4, or have a different configuration than shown in FIG. 4. The components shown in fig. 4 may be implemented in hardware, software, or a combination thereof.

It should be appreciated that the system and its modules shown above may be implemented in a variety of ways. For example, in some embodiments, the system and its modules may be implemented in hardware, software, or a combination of software and hardware. Wherein the hardware portion may be implemented using dedicated logic; the software portions may be stored in a memory for execution by a suitable instruction execution system, such as a microprocessor or specially designed hardware. Those skilled in the art will appreciate that the methods and systems described above may be implemented using computer executable instructions and/or embodied in processor control code, such code being provided, for example, on a carrier medium such as a diskette, CD-or DVD-ROM, a programmable memory such as read-only memory (firmware), or a data carrier such as an optical or electronic signal carrier. The system and its modules of the present application may be implemented not only by hardware circuits such as very large scale integrated circuits or gate arrays, semiconductors such as logic chips, transistors, or programmable hardware devices such as field programmable gate arrays, programmable logic devices, etc., but also by software executed by various types of processors, for example, or by a combination of the above hardware circuits and software (e.g., firmware).

It is to be noted that different embodiments may produce different advantages, and in different embodiments, any one or combination of the above advantages may be produced, or any other advantages may be obtained.

Having thus described the basic concept, it will be apparent to those skilled in the art that the foregoing detailed disclosure is to be considered merely illustrative and not restrictive of the broad application. Various modifications, improvements and adaptations to the present application may occur to those skilled in the art, although not explicitly described herein. Such modifications, improvements and adaptations are proposed in the present application and thus fall within the spirit and scope of the exemplary embodiments of the present application.

Also, this application uses specific language to describe embodiments of the application. Reference throughout this specification to "one embodiment," "an embodiment," and/or "some embodiments" means that a particular feature, structure, or characteristic described in connection with at least one embodiment of the present application is included in at least one embodiment of the present application. Therefore, it is emphasized and should be appreciated that two or more references to "an embodiment" or "one embodiment" or "an alternative embodiment" in various places throughout this specification are not necessarily all referring to the same embodiment. Furthermore, some features, structures, or characteristics of one or more embodiments of the present application may be combined as appropriate.

Moreover, those skilled in the art will appreciate that aspects of the present application may be illustrated and described in terms of several patentable species or situations, including any new and useful combination of processes, machines, manufacture, or materials, or any new and useful improvement thereon. Accordingly, various aspects of the present application may be embodied entirely in hardware, entirely in software (including firmware, resident software, micro-code, etc.) or in a combination of hardware and software. The above hardware or software may be referred to as "data block," module, "" engine, "" unit, "" component, "or" system. Furthermore, aspects of the present application may be represented as a computer product, including computer readable program code, embodied in one or more computer readable media.

The computer storage medium may comprise a propagated data signal with the computer program code embodied therewith, for example, on baseband or as part of a carrier wave. The propagated signal may take any of a variety of forms, including electromagnetic, optical, etc., or any suitable combination. A computer storage medium may be any computer-readable medium that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device. Program code located on a computer storage medium may be propagated over any suitable medium, including radio, cable, fiber optic cable, RF, or the like, or any combination of the preceding.

Computer program code required for the operation of various portions of the present application may be written in any one or more programming languages, including an object oriented programming language such as Java, Scala, Smalltalk, Eiffel, JADE, Emerald, C + +, C #, VB.NET, Python, and the like, a conventional programming language such as C, Visual Basic, Fortran 2003, Perl, COBOL 2002, PHP, ABAP, a dynamic programming language such as Python, Ruby, and Groovy, or other programming languages, and the like. The program code may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer through any network format, such as a Local Area Network (LAN) or a Wide Area Network (WAN), or the connection may be made to an external computer (for example, through the Internet), or in a cloud computing environment, or as a service, such as a software as a service (SaaS).

Finally, it should be understood that the embodiments described herein are merely illustrative of the principles of the embodiments of the present application. Other variations are also possible within the scope of the present application. Thus, by way of example, and not limitation, alternative configurations of the embodiments of the present application can be viewed as being consistent with the teachings of the present application. Accordingly, the embodiments of the present application are not limited to only those embodiments explicitly described and depicted herein.

Claims (10)

1. A big data resource sharing method based on information security is characterized in that the method is applied to a resource sharing system, the resource sharing system is in communication connection with a plurality of resource sharing objects, and the method comprises the following steps:

obtaining service wind control resource information obtained after user privacy evaluation is carried out on interactive service resource information in a big data resource project in a shared activation state and service resource authentication items of the service wind control resource information, and determining resource sharing request items of a plurality of interactive service resource information and request item mutual-evidence results of the resource sharing request items of the interactive service resource information based on a preset interactive service resource information analysis model; wherein, the request item mutual authentication result is a mutual authentication result among the plurality of resource sharing objects;

and carrying out big data resource sharing according to the privacy safety evaluation result of the preset resource sharing request item of the interactive service resource information, the privacy safety evaluation result of the preset user privacy evaluation corresponding to the resource sharing request item of the interactive service resource information, and the service resource authentication item.

2. The big data resource sharing method based on information security and protection according to claim 1, wherein obtaining service wind control resource information obtained after user privacy evaluation is performed on interaction service resource information in a big data resource project in a shared activation state and service resource authentication items of the service wind control resource information, and determining resource sharing request items of a plurality of interaction service resource information and request item mutual authentication results of the resource sharing request items of the interaction service resource information based on a preset interaction service resource information analysis model, comprises:

obtaining service wind control resource information obtained after user privacy evaluation is carried out on interactive service resource information in a big data resource project in a shared activation state and service resource authentication items of the service wind control resource information, wherein the big data resource project in the shared activation state comprises a plurality of big data resource blocks, and the service resource authentication items comprise resource distribution conditions of the service wind control resource information in the big data resource blocks, classification labels of the big data resource blocks, privacy evaluation levels of the interactive service resource information and resource sharing compatible information of the service wind control resource information in the big data resource blocks;

obtaining resource sharing request items of a plurality of interactive service resource information obtained by analyzing the big data resource items in the sharing activation state by a preset interactive service resource information analysis model and request item mutual-evidence results of the resource sharing request items of the interactive service resource information, wherein the request item mutual-evidence results comprise classification labels of big data resource blocks where the resource sharing request items of the interactive service resource information are located and resource distribution conditions of the big data resource blocks where the resource sharing request items of the interactive service resource information are located.

3. The big data resource sharing method based on information security and protection according to claim 2, wherein the big data resource sharing is performed according to the privacy security evaluation result of the preset resource sharing request item of the interactive service resource information and the privacy security evaluation result of the preset user privacy evaluation corresponding to the resource sharing request item of the interactive service resource information, and the service resource authentication item, and the method comprises:

determining whether the resource sharing request items of the interactive service resource information are matched with the service wind control resource information in the big data resource block in which the resource sharing request items of the interactive service resource information are positioned according to the correlation between the privacy safety evaluation result of the preset resource sharing request items of the interactive service resource information and the privacy safety evaluation result of the preset user privacy evaluation of the service wind control resource information in the big data resource block in which the resource sharing request items of the interactive service resource information are positioned;

and when the resource sharing request item of the interactive service resource information is matched with the service wind control resource information in the big data resource block where the resource sharing request item of the interactive service resource information is located, sharing at least part of the big data resource blocks in the interactive service resource information in the big data resource item in the sharing activation state based on the resource distribution condition of the service wind control resource information in the big data resource block, the classification label of the big data resource block, the privacy evaluation grade of the interactive service resource information and the resource sharing compatible information of the service wind control resource information in the big data resource block.

4. The big data resource sharing method based on information security and protection according to claim 3, wherein the step of determining whether the resource sharing request item of the interactive service resource information matches the service wind control resource information in the big data resource block where the resource sharing request item of the interactive service resource information is located according to the correlation between the privacy security evaluation result of the preset resource sharing request item of the interactive service resource information and the privacy security evaluation result of the preset user privacy evaluation of the service wind control resource information in the big data resource block where the resource sharing request item of the interactive service resource information is located comprises:

judging the correlation between the privacy safety evaluation result of the preset resource sharing request item of the interactive service resource information and the privacy safety evaluation result of the preset user privacy evaluation of the service wind control resource information in the same big data resource block, and the correlation between the resource sharing compatible information and the preset resource abuse factor;

if the correlation between the privacy safety evaluation result of the preset resource sharing request item of the interactive service resource information and the privacy safety evaluation result of the preset user privacy evaluation of the service wind control resource information in the same big data resource block is less than or equal to the correlation between the resource sharing compatible information of the service wind control resource information and a preset resource abuse factor, determining that the resource sharing request item of the interactive service resource information is matched with the service wind control resource information;

and if the correlation between the privacy safety evaluation result of the preset resource sharing request item of the interactive service resource information and the privacy safety evaluation result of the preset user privacy evaluation of the service wind control resource information in the same big data resource block is greater than the correlation between the resource sharing compatible information of the service wind control resource information and a preset resource abuse factor, determining that the resource sharing request item of the interactive service resource information is not matched with the service wind control resource information.

5. The big data resource sharing method based on information security and protection as claimed in claim 3, characterized in that the method further comprises:

and determining at least one sharing dimension evaluation information of the interaction service resource information analysis model aiming at the resource interaction heat, the resource interaction trust degree, the resource tampering probability and the resource scene matching degree of the interaction service resource information in the big data resource project in the sharing activation state according to the number of resource sharing request items of the interaction service resource information matched with the business wind control resource information in all the big data resource blocks.

6. The big data resource sharing method based on information security and protection as claimed in claim 5, characterized in that the method further comprises: obtaining an accumulated resource sharing object corresponding to the big data resource project in the sharing activation state according to the number of different interactive service resource information in the service wind control resource information;

correspondingly, the step of determining the resource interaction heat of the interactive service resource information analysis model for the interactive service resource information in the large data resource item in the shared activation state according to the number of resource sharing request items of the interactive service resource information matched with the service wind control resource information in all the large data resource blocks comprises the following steps:

determining an accumulated resource sharing object analyzed by the interactive service resource information analysis model according to the number of resource sharing request items of the interactive service resource information matched with the service wind control resource information in all big data resource blocks;

determining the proportion statistical result of the accumulated resource sharing objects analyzed by the interactive service resource information analysis model and the accumulated resource sharing objects corresponding to the big data resource items in the sharing activation state to obtain the resource interaction heat of the interactive service resource information analysis model;

the step of determining the accumulated resource sharing object analyzed by the interactive service resource information analysis model according to the number of resource sharing request items of the interactive service resource information matched with the service wind control resource information in all big data resource blocks comprises the following steps:

if the number of resource sharing request items of the interactive service resource information matched with the service wind control resource information in all the big data resource blocks is zero, determining that the service wind control resource information is not successfully analyzed by the interactive service resource information analysis model;

if the number of resource sharing request items of the interactive service resource information matched with the service wind control resource information in all the big data resource blocks is not zero, determining that the service wind control resource information is analyzed by the interactive service resource information analysis model;

and determining the accumulated result of the number of all the business wind control resource information analyzed by the interactive service resource information analysis model to obtain an accumulated resource sharing object analyzed by the interactive service resource information analysis model.

7. The big data resource sharing method based on information security and protection according to claim 5, wherein the step of determining the resource mutual trust degree of the interactive service resource information analysis model for the big data resource items in the shared activation state according to the number of resource sharing request items of the interactive service resource information matched with the business wind control resource information in all big data resource blocks comprises:

and determining the ratio statistical result of the number of the resource sharing request items of the interactive service resource information with the mutual trust labels in all the big data resource blocks and the number of the resource sharing request items of the interactive service resource information to obtain the mutual trust degree of the resources.

8. The big data resource sharing method based on information security and protection according to claim 5, wherein the step of determining the resource tampering probability of the interactive service resource information analysis model for the big data resource items in the shared activation state according to the number of resource sharing request items of the interactive service resource information matched with the business wind control resource information in all big data resource blocks comprises:

determining the comparison result of the number of the resource sharing request items of the interactive service resource information and the number of the resource sharing request items of the interactive service resource information matched with the service wind control resource information, and obtaining the number of the resource sharing request items of the interactive service resource information with tampering marks, which is identified by the interactive service resource information analysis model;

determining the number of the resource sharing request items of the interactive service resource information with tampering marks, which are identified by the interactive service resource information analysis model, and the ratio statistical result of the number of the resource sharing request items of the interactive service resource information to obtain the resource tampering probability corresponding to the interactive service resource information analysis model;

the step of determining the resource scene matching degree of the interactive service resource information analysis model for the interactive service resource information in the large data resource project in the shared activation state according to the number of resource sharing request items of the interactive service resource information matched with the service wind control resource information in all the large data resource blocks comprises the following steps:

determining the scene quantity of different big data service scenes in the resource sharing request items of the interactive service resource information and the proportion statistical result of the accumulated resource sharing object corresponding to the big data resource item in the sharing activation state to obtain the resource scene matching degree of the interactive service resource information analysis model aiming at the interactive service resource information in the big data resource item in the sharing activation state;

the step of determining the scene number of different big data service scenes in the resource sharing request items of the interactive service resource information comprises the following steps:

determining the privacy evaluation grade of the interactive service resource information of the business wind control resource information matched with the resource sharing request items of the interactive service resource information according to the resource distribution condition of the big data resource block where the resource sharing request items of the interactive service resource information are located;

if the number of the resource sharing request items of the interactive service resource information matched with the service wind control resource information is not zero and the privacy evaluation grade of the interactive service resource information of the service wind control resource information matched with the resource sharing request items of the interactive service resource information is greater than or equal to a preset evaluation grade, determining that the service wind control resource information has corresponding different big data service scenes;

if the number of the resource sharing request items of the interactive service resource information matched with the service wind control resource information is zero, or the privacy evaluation grade of the interactive service resource information of the service wind control resource information matched with the resource sharing request items of the interactive service resource information is less than a preset evaluation grade, determining that the service wind control resource information does not have corresponding different big data service scenes;

and determining the number of the service wind control resource information with the corresponding different big data service scenes in the service wind control resource information to obtain the scene number of the different big data service scenes in the resource sharing request items of the interactive service resource information.

9. The big data resource sharing method based on information security and protection as claimed in claim 1, wherein the method further comprises:

determining a network resource interaction state for carrying out big data resource sharing;

according to a first group of resource processing behaviors and a second group of resource processing behaviors in a network resource interaction state, determining first behavior intention heat distribution and first behavior intention description change of the first group of resource processing behaviors, and obtaining a first abnormal behavior detection result of the first group of resource processing behaviors relative to an intrusion detection response event; wherein the network resource interaction state is an interaction state between the resource sharing object and the resource sharing system;

determining a first abnormal behavior monitoring strategy through a first behavior intention heat distribution, a first behavior intention description change and a first abnormal behavior detection result of the first group of resource processing behaviors;

and judging whether the interaction state corresponding to the first abnormal behavior monitoring strategy has network resource intrusion behavior or not based on a pre-trained network resource intrusion detection model.

10. A resource sharing system comprising a processing engine, a network module, and a memory; the processing engine and the memory communicate through the network module, the processing engine reading a computer program from the memory and operating to perform the method of any of claims 1-9.

Images