CN117640407B - User data analysis and identification system and method based on 5G communication technology - Google Patents

User data analysis and identification system and method based on 5G communication technology Download PDF

Info

Publication number
CN117640407B
CN117640407B CN202311608917.5A CN202311608917A CN117640407B CN 117640407 B CN117640407 B CN 117640407B CN 202311608917 A CN202311608917 A CN 202311608917A CN 117640407 B CN117640407 B CN 117640407B
Authority
CN
China
Prior art keywords
behavior
internet
things
association
processes
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
CN202311608917.5A
Other languages
Chinese (zh)
Other versions
CN117640407A (en
Inventor
肖莉
黄兆宇
谢明明
张罡
彭露
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
China Unicom Jiangsu Industrial Internet Co Ltd
Original Assignee
China Unicom Jiangsu Industrial Internet Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by China Unicom Jiangsu Industrial Internet Co Ltd filed Critical China Unicom Jiangsu Industrial Internet Co Ltd
Priority to CN202311608917.5A priority Critical patent/CN117640407B/en
Publication of CN117640407A publication Critical patent/CN117640407A/en
Application granted granted Critical
Publication of CN117640407B publication Critical patent/CN117640407B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/14—Network analysis or design
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/14—Network analysis or design
    • H04L41/145—Network analysis or design involving simulating, designing, planning or modelling of a network
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/101—Access control lists [ACL]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/12—Protocols specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computing Systems (AREA)
  • Computer Hardware Design (AREA)
  • Computer Security & Cryptography (AREA)
  • General Engineering & Computer Science (AREA)
  • Health & Medical Sciences (AREA)
  • General Health & Medical Sciences (AREA)
  • Medical Informatics (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

The invention discloses a user data analysis and identification system and method based on a 5G communication technology, and belongs to the technical field of data analysis. Establishing an Internet of things virtual cloud database, recording and storing sub-cloud operation data corresponding to an Internet of things end, establishing an operation archive, and classifying and counting processes of sub-cloud execution, an isolation space allocated by the Internet of things virtual cloud and a network isolation layer created by the Internet of things virtual cloud; the architecture operates an associated behavior chain identification model, records the behavior of each process for controlling access to an isolation space by means of a network isolation layer, and adds a time tag to the operation associated behavior chain to generate a behavior association group; the reliability of the process in the behavior association group is calculated by analyzing behavior characteristics of different data behaviors in the same time segment and under different time cycle periods, and the safety limit value of the same network isolation layer in the same time segment is conveniently calculated by cleaning abnormal data behaviors, so that safety early warning can be carried out on user behaviors in real time or periodically.

Description

User data analysis and identification system and method based on 5G communication technology
Technical Field
The invention relates to the technical field of data analysis, in particular to a system and a method for analyzing and identifying user data based on a 5G communication technology.
Background
With the rapid development of the internet, the problems of network attack and data leakage are increasingly prominent, the demands on network security are also becoming urgent, and the virtualized security isolation technology is being widely applied to various industries as an advanced network security protection means;
in the field of multi-scene fusion of a everything interconnection architecture, different users, applications or services can realize isolation and safe access of resources based on virtualized environments, and can realize multifunctional synchronous operation in a mutually noninterfere mode, so that not only the mutually noninterfere of program processes is needed to be considered, but also the resources are prevented from being attacked and maliciously occupied, and the process execution cannot be completed.
Disclosure of Invention
The invention aims to provide a system and a method for analyzing and identifying user data based on a 5G communication technology, so as to solve the problems in the background technology.
In order to solve the technical problems, the invention provides the following technical scheme:
A 5G communication technology based user data analysis and identification system, the system comprising: the system comprises an Internet of things virtual cloud module, a data processing module, a data analysis module and a behavior early warning module;
The virtual cloud module of the Internet of things is used for establishing a virtual cloud database of the Internet of things and recording and storing sub-cloud operation data corresponding to the end of the Internet of things; establishing an operation archive, and classifying and counting processes executed by the sub-cloud, an isolation space allocated by the virtual cloud of the Internet of things and a network isolation layer created by the virtual cloud of the Internet of things;
The data processing module is used for constructing an operation association behavior chain identification model, recording the behavior of each process for controlling access to the isolation space by means of the network isolation layer, and attaching a time tag to the operation association behavior chain; classifying and identifying the operation association behavior chains according to the time labels to generate a behavior association group;
The data analysis module calculates the credibility of the process in the behavior association group according to the classification and identification result; data cleaning and updating are carried out on the behavior association group;
The behavior early warning module calculates the safety limit value of the network isolation layer in the time segment according to the data cleaning result; and sends out an early warning prompt.
Further, the internet of things virtual cloud module further comprises a database unit and an archive unit;
The system comprises a database unit, an Internet of things virtual cloud database, a network isolation layer and a network mapping unit, wherein the database unit is used for establishing an Internet of things virtual cloud database, the Internet of things virtual cloud database stores operation data corresponding to sub-clouds connected through 5G communication, the sub-clouds are connected with each other in an interactive mode based on ports of an Internet of things terminal, the operation data comprise isolation spaces occupied by processes in the execution process of each sub-cloud and network isolation layers called by the processes in the execution process of each sub-cloud, the isolation spaces are independent memory spaces with the same size and distributed by the Internet of things virtual cloud, the network isolation layers are virtual connection mapping channels which are created by the Internet of things virtual cloud and are used for providing the sub-clouds with the execution process, and the mapping refers to corresponding software service functions which are converted into the Internet of things virtual cloud based on each hardware service function of the Internet of things terminal; one sub cloud corresponds to one Internet of things terminal;
The archive unit is used for establishing an operation archive, wherein the operation archive comprises a process item set, a space pointer set and a channel medium set; the process item set comprises processes executed by all sub-clouds, and is recorded as PP= { P a |a epsilon [1, A ] }, wherein P a represents an a-th process, and A represents the total number of processes; the space pointer set comprises isolation spaces distributed by virtual clouds of the Internet of things, and is recorded as SP= { LS b |b epsilon [1, B ] }, wherein LS b represents the B-th isolation space, and B represents the total number of the isolation spaces; the channel medium set comprises a network isolation layer created by the virtual cloud of the Internet of things, and is recorded as CM= { IL d |d epsilon [1, D ] }, wherein IL d represents the D-th network isolation layer, and D represents the total number of the network isolation layers.
Further, the data processing module further comprises a behavior chain recording unit and a classification and identification unit;
the behavior chain recording unit is used for constructing an operation association behavior chain identification model, wherein the operation association behavior chain refers to the behavior that each process accesses an isolation space by means of a network isolation layer control in the process of executing each sub-cloud execution process; dividing the time in one day into k continuous time slices by taking the day as a time cycle period, and marking any one time slice as T c, wherein c represents the sequence number of the time slice; adding a time tag to an operation association action chain, recording the occurrence time range of the operation association action chain, and recording any operation association action chain as P a→ILd→LSb, wherein the added time tag of the operation association action chain is recorded as T c(t):Pa→ILd→LSb, the time tag T c (T) indicates that the operation association action chain P a→ILd→LSb occurs in a time segment T c in the T-th time cycle period, and the operation association action chain P a→ILd→LSb indicates that the process P a accesses an isolation space LS b and occupies the isolation space LS b under the control of a network isolation layer IL d;
The classification and identification unit performs classification and identification on the operation association behavior chain according to the time segment and the network isolation layer, and the classification and identification mode is as follows:
Under the time label T c (T), all processes and all isolation spaces for controlling interaction between the processes and the isolation spaces by means of the network isolation layer are acquired, and a behavior association group is generated and is recorded as R [ T c(t)|ILd]：PP[Tc(t)|ILd]→LL[Tc(t)|ILd ], wherein R [ T c(t)|ILd ] represents a behavior association group for controlling interaction process in a time segment T c in a T-th time cycle period, PP [ T c(t)|ILd ] represents a process identification set formed by all processes in the behavior association group R [ T c(t)|ILd ], LL [ T c(t)|ILd ] represents a space identification set formed by all isolation spaces in the behavior association group R [ T c(t)|ILd ], and PP [ T c(t)|ILd]∈PP,LL[Tc(t)|ILd ] epsilon SP.
Further, the data analysis module further comprises a credibility analysis unit and a data cleaning unit;
The credibility analysis unit is used for comprehensively planning corresponding behavior association groups under the same network isolation layer according to the classification and identification results, generating a database to be cleaned and marking the database as Q; the process P a is obtained in the process item set, any behavior association group R [ T c(t)|ILd ] is obtained in the database Q to be cleaned, if P a∈PP[Tc(t)|ILd ], the behavior association group R [ T c(t)|ILd ] is extracted, the credibility of the process P a in the behavior association group R [ T c(t)|ILd ] is calculated, and the specific calculation formula is as follows:
Where RL { P a→R[Tc(t)|ILd ] } represents the credibility of the process P a in the behavior association group R [ T c(t)|ILd ], PP [ T c(s)|ILd ] represents a process identification set composed of all processes in the behavior association group R [ T c(s)|ILd ], NUM { PP [ T c(t)|ILd]∩PP[Tc(s)|ILd ] } represents the total number of processes contained in the intersection of the process identification set PP [ T c(t)|ILd ] and the process identification set PP [ T c(s)|ILd ], NUM { PP [ T c(t)|ILd ] } represents the total number of processes contained in the process identification set PP [ T c(t)|ILd ], and T represents the total number of time cycle periods;
If it is NUM { PP [ T c(t)|ILd]∩PP[Tc(s)|ILd ] } =0 if/>And/>Letting NUM { PP [ T c(t)|ILd]∩PP[Tc(s)|ILd ] } =0;
The data cleaning unit is configured to perform data cleaning on the behavior association group, preset a reliability threshold, and if the reliability of the process P a in the behavior association group R [ T c(t)|ILd ] is less than or equal to the reliability threshold, clean the process P a from the process identification set PP [ T c(t)|ILd ], and clean the isolation space LS b occupied by the process P a from the space identification set LL [ T c(t)|ILd ] and update the behavior association group R [ T c(t)|ILd ];
Acquiring another process in the process project set, returning to step S301, and performing cleaning iteration until all processes in the process project set participate in completing the updating of the behavior association group R [ T c(t)|ILd ], and stopping cleaning iteration;
The finally updated behavior association group R [ T c(t)|ILd]：PP[Tc(t)|ILd]→LL[Tc(t)|ILd ] is denoted as R [ T c(t)|ILd]：P[Tc(t)|ILd]→L[Tc(t)|ILd ], wherein P [ T c(t)|ILd ] represents a process identification set formed by all processes in the behavior association group R [ T c(t)|ILd ], L [ T c(t)|ILd ] represents a space identification set formed by all isolation spaces in the behavior association group R [ T c(t)|ILd ], and P[Tc(t)|ILd]∈PP[Tc(t)|ILd],L[Tc(t)|ILd]∈LL[Tc(t)|ILd].
Further, the behavior early warning module further comprises a safety limit value analysis unit and an early warning prompt unit;
the safety limit value analysis unit calculates the safety limit value of the network isolation layer in the time segment according to the data cleaning result, and the specific calculation formula is as follows:
Wherein SLV (IL d) represents the security threshold of the network isolation layer IL d within the time segment T c, NUM { L [ T c(t)|ILd ] } represents the total number of isolation spaces contained in the space identification set L [ T c(t)|ILd ], NUM { P [ T c(t)|ILd ] } represents the total number of processes contained in the process identification set P [ T c(t)|ILd ];
the early warning prompt unit is used for presetting a safety limit value threshold, and sending out early warning prompt if the safety limit value SLV (IL d|Tc) is larger than or equal to the safety limit value threshold.
A user data analysis and identification method based on 5G communication technology includes the following steps:
step S100: establishing an Internet of things virtual cloud database, and recording and storing sub-cloud operation data corresponding to an Internet of things terminal; establishing an operation archive, and classifying and counting processes executed by the sub-cloud, an isolation space allocated by the virtual cloud of the Internet of things and a network isolation layer created by the virtual cloud of the Internet of things;
Step S200: the architecture runs an associated behavior chain identification model, records the behavior of each process for controlling access to an isolation space by means of a network isolation layer, and attaches a time tag to the running associated behavior chain; classifying and identifying the operation association behavior chains according to the time labels to generate a behavior association group;
step S300: calculating the credibility of the process in the behavior association group according to the classification and identification result; data cleaning and updating are carried out on the behavior association group;
step S400: according to the data cleaning result, calculating the safety limit value of the network isolation layer in the time segment; and sends out an early warning prompt.
Further, the specific implementation process of the step S100 includes:
Step S101: establishing an Internet of things virtual cloud database, wherein operation data corresponding to sub-clouds connected through 5G communication are stored in the Internet of things virtual cloud database, the sub-clouds are connected with each other in an interactive mode based on ports of an Internet of things terminal, the operation data comprise isolation spaces occupied by processes in the process of executing each sub-cloud and network isolation layers called by the processes in the process of executing each sub-cloud, the isolation spaces are independent memory spaces with the same size and distributed by the Internet of things virtual cloud, the network isolation layers are virtual connection mapping channels which are created by the Internet of things virtual cloud and are used for providing the sub-clouds with the process of executing each sub-cloud, and mapping refers to corresponding software service functions which are realized in the Internet of things virtual cloud based on conversion of hardware service functions of the Internet of things terminal; one sub cloud corresponds to one Internet of things terminal;
step S102: establishing an operation archive, wherein the operation archive comprises a process item set, a space pointer set and a channel medium set; the process item set comprises processes executed by all sub-clouds, and is recorded as PP= { P a |a epsilon [1, A ] }, wherein P a represents an a-th process, and A represents the total number of processes; the space pointer set comprises isolation spaces distributed by virtual clouds of the Internet of things, and is recorded as SP= { LS b |b epsilon [1, B ] }, wherein LS b represents the B-th isolation space, and B represents the total number of the isolation spaces; the channel medium set comprises a network isolation layer created by the virtual cloud of the Internet of things, and is recorded as CM= { IL d |d epsilon [1, D ] }, wherein IL d represents the D-th network isolation layer, and D represents the total number of the network isolation layers.
According to the method, in the field of multi-scenario fusion based on the everything interconnection architecture, the multi-internet-of-things terminal can realize interactive access between the processes and the memory resources through the allocation interface protocol, wherein synchronous call of the multi-processes is realized through the network isolation layer, however, although the operation of each process can be effectively isolated through the network isolation layer as the middle layer, access paths of other processes still exist to be attacked or modified through implantation of malicious programs from the source, so that the execution efficiency of the processes is affected, and the use experience of everything interconnection cannot meet the user requirements; according to the application, the virtual space is established, so that the operation data of each port connected through the 5G communication is stored, and meanwhile, the independent storage spaces of a plurality of units, namely the isolation spaces, are divided, so that when the system is attacked, enough intact spaces can be ensured to be still utilized to the maximum extent.
Further, the specific implementation process of the step S200 includes:
Step S201: the method comprises the steps of constructing an operation association behavior chain identification model, wherein the operation association behavior chain refers to the behavior that each process accesses an isolation space by means of a network isolation layer control in the process of executing each sub-cloud; dividing the time in one day into k continuous time slices by taking the day as a time cycle period, and marking any one time slice as T c, wherein c represents the sequence number of the time slice; adding a time tag to an operation association action chain, recording the occurrence time range of the operation association action chain, and recording any operation association action chain as P a→ILd→LSb, wherein the added time tag of the operation association action chain is recorded as T c(t):Pa→ILd→LSb, the time tag T c (T) indicates that the operation association action chain P a→ILd→LSb occurs in a time segment T c in the T-th time cycle period, and the operation association action chain P a→ILd→LSb indicates that the process P a accesses an isolation space LS b and occupies the isolation space LS b under the control of a network isolation layer IL d;
Step S202: and carrying out classification and identification on the operation association behavior chain according to the time segment and the network isolation layer, wherein the classification and identification mode is as follows:
Under the time label T c (T), all processes and all isolation spaces for controlling interaction between the processes and the isolation spaces by means of the network isolation layer are acquired, and a behavior association group is generated and is recorded as R [ T c(t)|ILd]：PP[Tc(t)|ILd]→LL[Tc(t)|ILd ], wherein R [ T c(t)|ILd ] represents a behavior association group for controlling interaction process in a time segment T c in a T-th time cycle period, PP [ T c(t)|ILd ] represents a process identification set formed by all processes in the behavior association group R [ T c(t)|ILd ], LL [ T c(t)|ILd ] represents a space identification set formed by all isolation spaces in the behavior association group R [ T c(t)|ILd ], and PP [ T c(t)|ILd]∈PP,LL[Tc(t)|ILd ] epsilon SP.
According to the method, the process controls access to the isolation space by means of the network isolation layer, a behavior chain is generated in the process, meanwhile, the advantage of dividing continuous time slices is that a large number of behavior chains can be subjected to micro-quantitative segment analysis, in a everything interconnection scene, behavior habits of users in one day are inevitably irregular to a great extent, and the micro-quantitative time segment analysis can grasp the behavior rules of the users from details.
Further, the implementation process of the step S300 includes:
Step S301: according to the classification and identification result, corresponding behavior association groups under the same network isolation layer are comprehensively organized, a database to be cleaned is generated, and the database is marked as Q; the process P a is obtained in the process item set, any behavior association group R [ T c(t)|ILd ] is obtained in the database Q to be cleaned, if P a∈PP[Tc(t)|ILd ], the behavior association group R [ T c(t)|ILd ] is extracted, the credibility of the process P a in the behavior association group R [ T c(t)|ILd ] is calculated, and the specific calculation formula is as follows:
Where RL { P a→R[Tc(t)|ILd ] } represents the credibility of the process P a in the behavior association group R [ T c(t)|ILd ], PP [ T c(s)|ILd ] represents a process identification set composed of all processes in the behavior association group R [ T c(s)|ILd ], NUM { PP [ T c(t)|ILd]∩PP[Tc(s)|ILd ] } represents the total number of processes contained in the intersection of the process identification set PP [ T c(t)|ILd ] and the process identification set PP [ T c(s)|ILd ], NUM { PP [ T c(t)|ILd ] } represents the total number of processes contained in the process identification set PP [ T c(t)|ILd ], and T represents the total number of time cycle periods;
If it is NUM { PP [ T c(t)|ILd]∩PP[Tc(s)|ILd ] } =0 if/>And/>Letting NUM { PP [ T c(t)|ILd]∩PP[Tc(s)|ILd ] } =0;
Step S302: carrying out data cleaning on the behavior association group, presetting a credibility threshold, if the credibility of the process P a in the behavior association group R [ T c(t)|ILd ] is smaller than or equal to the credibility threshold, clearing the process P a from a process identification set PP [ T c(t)|ILd ], clearing an isolation space LS b occupied by the process P a from a space identification set LL [ T c(t)|ILd ], and updating the behavior association group R [ T c(t)|ILd ];
Acquiring another process in the process project set, returning to step S301, and performing cleaning iteration until all processes in the process project set participate in completing the updating of the behavior association group R [ T c(t)|ILd ], and stopping cleaning iteration;
The finally updated behavior association group R [ T c(t)|ILd]：PP[Tc(t)|ILd]→LL[Tc(t)|ILd ] is denoted as R [ T c(t)|ILd]：P[Tc(t)|ILd]→L[Tc(t)|ILd ], wherein P [ T c(t)|ILd ] represents a process identification set formed by all processes in the behavior association group R [ T c(t)|ILd ], L [ T c(t)|ILd ] represents a space identification set formed by all isolation spaces in the behavior association group R [ T c(t)|ILd ], and P[Tc(t)|ILd]∈PP[Tc(t)|ILd],L[Tc(t)|ILd]∈LL[Tc(t)|ILd].
According to the method, a large amount of behavior data are accumulated in different time cycle periods in the same time segment, the running rule of a process in the same time segment is obtained through quantitative analysis, namely the reliability is obtained, meanwhile, the reliability is obtained based on pairwise comparison analysis of the same time segment in different time cycle periods, long-term behavior habit data analysis is convenient for finding out regularity characteristics, for one process, if the process is simultaneously present in the same time segment in two different time cycle periods, a plurality of processes in the same time segment can be mutually supervised, so that the greater the reliability is, the fact that a certain process is approved by most processes in the same time segment is obtained, namely the process is mutually familiar, namely the process is normal by means of resource access behavior of the process by a network isolation layer, otherwise, the process is extremely likely to be an abnormal malicious process; the effect of the data cleaning is then to clean up the operational data of these abnormal processes so that subsequent digital analysis can be quantified under normal circumstances.
Further, the specific implementation process of the step S400 includes:
step S401: according to the data cleaning result, calculating the safety limit value of the network isolation layer in the time segment, wherein the specific calculation formula is as follows:
Wherein SLV (IL d) represents the security threshold of the network isolation layer IL d within the time segment T c, NUM { L [ T c(t)|ILd ] } represents the total number of isolation spaces contained in the space identification set L [ T c(t)|ILd ], NUM { P [ T c(t)|ILd ] } represents the total number of processes contained in the process identification set P [ T c(t)|ILd ];
step S402: and presetting a safety limit value threshold, and sending out an early warning prompt if the safety limit value SLV (IL d|Tc) is larger than or equal to the safety limit value threshold.
According to the method, the safety limit value is analyzed under normal environment, and the formulaThe method is characterized in that the single process is used for obtaining a process behavior stability value which can be borne by the network isolation layer in the same time segment through carrying out occupied memory volume by the network isolation layer and carrying out long-term time cycle period accumulated calculation, namely, a safety limit value is obtained, and the larger the safety limit value is, the larger the process behavior fluctuation which can be borne by the network isolation layer in the same time segment is, and further the risk is also larger.
Compared with the prior art, the invention has the following beneficial effects: in the user data analysis and identification system and method based on the 5G communication technology, an Internet of things virtual cloud database is established, sub-cloud operation data corresponding to an Internet of things end is recorded and stored, an operation archive is established, and the progress of sub-cloud execution, the isolation space allocated by the Internet of things virtual cloud and the network isolation layer created by the Internet of things virtual cloud are classified and counted; the architecture operates an associated behavior chain identification model, records the behavior of each process for controlling access to an isolation space by means of a network isolation layer, and adds a time tag to the operation associated behavior chain to generate a behavior association group; the reliability of the process in the behavior association group is calculated by analyzing behavior characteristics of different data behaviors in the same time segment and under different time cycle periods, and the safety limit value of the same network isolation layer in the same time segment is conveniently calculated by cleaning abnormal data behaviors, so that safety early warning can be carried out on user behaviors in real time or periodically. .
Drawings
The accompanying drawings are included to provide a further understanding of the invention and are incorporated in and constitute a part of this specification, illustrate the invention and together with the embodiments of the invention, serve to explain the invention. In the drawings:
FIG. 1 is a schematic diagram of a system for analyzing and identifying user data based on 5G communication technology according to the present invention;
fig. 2 is a schematic diagram of steps of a method for analyzing and identifying user data based on a 5G communication technology according to the present invention.
Detailed Description
The following description of the embodiments of the present invention will be made clearly and completely with reference to the accompanying drawings, in which it is apparent that the embodiments described are only some embodiments of the present invention, but not all embodiments. All other embodiments, which can be made by those skilled in the art based on the embodiments of the invention without making any inventive effort, are intended to be within the scope of the invention.
Referring to fig. 1-2, the present invention provides the following technical solutions:
Referring to fig. 1, in a first embodiment: there is provided a 5G communication technology-based user data analysis and identification system, the system comprising: the system comprises an Internet of things virtual cloud module, a data processing module, a data analysis module and a behavior early warning module;
The virtual cloud module of the Internet of things is used for establishing a virtual cloud database of the Internet of things and recording and storing sub-cloud operation data corresponding to the Internet of things terminal; establishing an operation archive, and classifying and counting processes executed by the sub-cloud, an isolation space allocated by the virtual cloud of the Internet of things and a network isolation layer created by the virtual cloud of the Internet of things;
the virtual cloud module of the Internet of things further comprises a database unit and an archive unit;
The system comprises a database unit, a network isolation unit and a network management unit, wherein the database unit is used for establishing an Internet of things virtual cloud database, the Internet of things virtual cloud database stores operation data corresponding to sub-clouds connected through 5G communication, the sub-clouds are used for carrying out the interconnection of the Internet of things virtual clouds based on ports of an Internet of things terminal, the operation data comprises an isolation space occupied by processes in the execution process of each sub-cloud and a network isolation layer called by the processes in the execution process of each sub-cloud, the isolation space is an independent memory space with the same size and distributed by the Internet of things virtual cloud, the network isolation layer is a virtual connection mapping channel which is created by the Internet of things virtual cloud and is used for providing the execution process of each sub-cloud, and mapping refers to conversion of each hardware service function based on the Internet of things terminal into a corresponding software service function realized in the Internet of things virtual cloud; one sub cloud corresponds to one Internet of things terminal;
the archive unit is used for establishing an operation archive, wherein the operation archive comprises a process item set, a space pointer set and a channel medium set; the process item set comprises processes executed by all sub-clouds, and is recorded as PP= { P a |a epsilon [1, A ] }, wherein P a represents an a-th process, and A represents the total number of processes; the space pointer set comprises isolation spaces distributed by virtual clouds of the Internet of things, and the space pointer set is marked as SP= { LS b |b epsilon [1, B ] }, wherein LS b represents the B-th isolation space, and B represents the total number of the isolation spaces; the channel medium set comprises a network isolation layer created by the virtual cloud of the Internet of things, and the channel medium set is recorded as CM= { IL d |d epsilon [1, D ] }, wherein IL d represents the D-th network isolation layer, and D represents the total number of the network isolation layers.
The data processing module is used for constructing an operation association behavior chain identification model, recording the behavior of each process for controlling access to the isolation space by means of the network isolation layer, and attaching a time tag to the operation association behavior chain; classifying and identifying the operation association behavior chains according to the time labels to generate a behavior association group;
the data processing module further comprises a behavior chain recording unit and a classification and identification unit;
The behavior chain recording unit is used for constructing an operation association behavior chain identification model, wherein the operation association behavior chain refers to the behavior of each process for controlling access to an isolation space by means of a network isolation layer in the process of executing each sub-cloud; dividing the time in one day into k continuous time slices by taking the day as a time cycle period, and marking any one time slice as T c, wherein c represents the sequence number of the time slice; adding a time tag to an operation association action chain, recording the occurrence time range of the operation association action chain, and recording any operation association action chain as P a→ILd→LSb, wherein the added time tag of the operation association action chain is recorded as T c(t):Pa→ILd→LSb, the time tag T c (T) indicates that the operation association action chain P a→ILd→LSb occurs in a time segment T c in the T-th time cycle period, and the operation association action chain P a→ILd→LSb indicates that the process P a accesses an isolation space LS b and occupies the isolation space LS b under the control of a network isolation layer IL d;
The classification and identification unit performs classification and identification on the operation association behavior chain according to the time segment and the network isolation layer, and the classification and identification mode is as follows:
Under the time label T c (T), all processes and all isolation spaces for controlling interaction between the processes and the isolation spaces by means of the network isolation layer are acquired, and a behavior association group is generated and is recorded as R [ T c(t)|ILd]：PP[Tc(t)|ILd]→LL[Tc(t)|ILd ], wherein R [ T c(t)|ILd ] represents a behavior association group for controlling interaction process in a time segment T c in a T-th time cycle period, PP [ T c(t)|ILd ] represents a process identification set formed by all processes in the behavior association group R [ T c(t)|ILd ], LL [ T c(t)|ILd ] represents a space identification set formed by all isolation spaces in the behavior association group R [ T c(t)|ILd ], and PP [ T c(t)|ILd]∈PP,LL[Tc(t)|ILd ] epsilon SP.
The data analysis module is used for calculating the credibility of the process in the behavior association group according to the classification and identification results; data cleaning and updating are carried out on the behavior association group;
the data analysis module further comprises a credibility analysis unit and a data cleaning unit;
The credibility analysis unit is used for comprehensively planning a corresponding behavior association group under the same network isolation layer according to the classification and identification result, generating a database to be cleaned and marking the database as Q; the process P a is obtained in the process item set, any behavior association group R [ T c(t)|ILd ] is obtained in the database Q to be cleaned, if P a∈PP[Tc(t)|ILd ], the behavior association group R [ T c(t)|ILd ] is extracted, the credibility of the process P a in the behavior association group R [ T c(t)|ILd ] is calculated, and the specific calculation formula is as follows:
Where RL { P a→R[Tc(t)|ILd ] } represents the credibility of the process P a in the behavior association group R [ T c(t)|ILd ], PP [ T c(s)|ILd ] represents a process identification set composed of all processes in the behavior association group R [ T c(s)|ILd ], NUM { PP [ T c(t)|ILd]∩PP[Tc(s)|ILd ] } represents the total number of processes contained in the intersection of the process identification set PP [ T c(t)|ILd ] and the process identification set PP [ T c(s)|ILd ], NUM { PP [ T c(t)|ILd ] } represents the total number of processes contained in the process identification set PP [ T c(t)|ILd ], and T represents the total number of time cycle periods;
If it is NUM { PP [ T c(t)|ILd]∩PP[Tc(s)|ILd ] } =0 if/>And/>Letting NUM { PP [ T c(t)|ILd]∩PP[Tc(s)|ILd ] } =0;
the data cleaning unit is used for cleaning data of the behavior association group, presetting a reliability threshold, if the reliability of the process P a in the behavior association group R [ T c(T)|ILd ] is smaller than or equal to the reliability threshold, cleaning the process P a from the process identification set PP [ T c(t)|ILd ], cleaning an isolation space LS b occupied by the process P a from the space identification set LL [ T c(t)|ILd ], and updating the behavior association group R [ T c(t)|ILd ];
Acquiring another process in the process project set, returning to step S301, and performing cleaning iteration until all processes in the process project set participate in completing the updating of the behavior association group R [ T c(t)|ILd ], and stopping cleaning iteration;
The finally updated behavior association group R [ T c(t)|ILd]：PP[Tc(t)|ILd]→LL[Tc(t)|ILd ] is denoted as R [ T c(t)|ILd]：P[Tc(t)|ILd]→L[Tc(t)|ILd ], wherein P [ T c(t)|ILd ] represents a process identification set formed by all processes in the behavior association group R [ T c(t)|ILd ], L [ T c(t)|ILd ] represents a space identification set formed by all isolation spaces in the behavior association group R [ T c(t)|ILd ], and P[Tc(t)|ILd]∈PP[Tc(t)|ILd],L[Tc(t)|ILd]∈LL[Tc(t)|ILd].
The behavior early warning module calculates the safety limit value of the network isolation layer in the time segment according to the data cleaning result; and sending out an early warning prompt;
The behavior early warning module further comprises a safety limit value analysis unit and an early warning prompt unit;
The safety limit value analysis unit calculates the safety limit value of the network isolation layer in the time segment according to the data cleaning result, and the specific calculation formula is as follows:
Wherein SLV (IL d) represents the security threshold of the network isolation layer IL d within the time segment T c, NUM { L [ T c(t)|ILd ] } represents the total number of isolation spaces contained in the space identification set L [ T c(t)|ILd ], NUM { P [ T c(t)|ILd ] } represents the total number of processes contained in the process identification set P [ T c(t)|ILd ];
The early warning prompt unit is used for presetting a safety limit value threshold, and sending out early warning prompt if the safety limit value SLV (IL d|Tc) is larger than or equal to the safety limit value threshold.
Referring to fig. 2, in the second embodiment: the method for analyzing and identifying the user data based on the 5G communication technology comprises the following steps:
step S100: establishing an Internet of things virtual cloud database, and recording and storing sub-cloud operation data corresponding to an Internet of things terminal; establishing an operation archive, and classifying and counting processes executed by the sub-cloud, an isolation space allocated by the virtual cloud of the Internet of things and a network isolation layer created by the virtual cloud of the Internet of things;
specifically, an Internet of things virtual cloud database is established, operation data corresponding to sub-clouds connected through 5G communication are stored in the Internet of things virtual cloud database, the sub-clouds are connected with each other in an interactive mode based on ports of an Internet of things terminal, the operation data comprise isolation spaces occupied by processes in the process of executing each sub-cloud and network isolation layers called by the processes in the process of executing each sub-cloud, the isolation spaces are independent memory spaces with the same size and distributed by the Internet of things virtual cloud, the network isolation layers are virtual connection mapping channels which are created by the Internet of things virtual cloud and are used for providing the sub-clouds with the process of executing each sub-cloud, and mapping refers to conversion of each hardware service function based on the Internet of things terminal into corresponding software service functions realized in the Internet of things virtual cloud; one sub cloud corresponds to one Internet of things terminal;
Establishing an operation archive, wherein the operation archive comprises a process item set, a space pointer set and a channel medium set; the process item set comprises processes executed by all sub-clouds, and is recorded as PP= { P a |a epsilon [1, A ] }, wherein P a represents an a-th process, and A represents the total number of processes; the space pointer set comprises isolation spaces distributed by virtual clouds of the Internet of things, and the space pointer set is marked as SP= { LS b |b epsilon [1, B ] }, wherein LS b represents the B-th isolation space, and B represents the total number of the isolation spaces; the channel medium set comprises a network isolation layer created by the virtual cloud of the Internet of things, and the channel medium set is recorded as CM= { IL d |d epsilon [1, D ] }, wherein IL d represents the D-th network isolation layer, and D represents the total number of the network isolation layers.
For example, for the case of everything interconnection in the smart home field, each smart home can be allocated a dedicated sub-cloud space docking interaction.
Step S200: the architecture runs an associated behavior chain identification model, records the behavior of each process for controlling access to an isolation space by means of a network isolation layer, and attaches a time tag to the running associated behavior chain; classifying and identifying the operation association behavior chains according to the time labels to generate a behavior association group;
Specifically, the architecture runs an associated behavior chain identification model, and the associated behavior chain is run in the process of executing processes of all sub-clouds, and all processes control the behavior of accessing an isolation space by means of a network isolation layer; dividing the time in one day into k continuous time slices by taking the day as a time cycle period, and marking any one time slice as T c, wherein c represents the sequence number of the time slice; adding a time tag to an operation association action chain, recording the occurrence time range of the operation association action chain, and recording any operation association action chain as P a→ILd→LSb, wherein the added time tag of the operation association action chain is recorded as T c(t):Pa→ILd→LSb, the time tag T c (T) indicates that the operation association action chain P a→ILd→LSb occurs in a time segment T c in the T-th time cycle period, and the operation association action chain P a→ILd→LSb indicates that the process P a accesses an isolation space LS b and occupies the isolation space LS b under the control of a network isolation layer IL d;
And carrying out classification and identification on the operation association behavior chain according to the time segment and the network isolation layer, wherein the classification and identification mode is as follows:
Under the time label T c (T), all processes and all isolation spaces for controlling interaction between the processes and the isolation spaces by means of the network isolation layer are acquired, and a behavior association group is generated and is recorded as R [ T c(t)|ILd]：PP[Tc(t)|ILd]→LL[Tc(t)|ILd ], wherein R [ T c(t)|ILd ] represents a behavior association group for controlling interaction process in a time segment T c in a T-th time cycle period, PP [ T c(t)|ILd ] represents a process identification set formed by all processes in the behavior association group R [ T c(t)|ILd ], LL [ T c(t)|ILd ] represents a space identification set formed by all isolation spaces in the behavior association group R [ T c(t)|ILd ], and PP [ T c(t)|ILd]∈PP,LL[Tc(t)|ILd ] epsilon SP.
Step S300: calculating the credibility of the process in the behavior association group according to the classification and identification result; data cleaning and updating are carried out on the behavior association group;
Specifically, according to the classification and identification result, corresponding behavior association groups under the same network isolation layer are comprehensively organized, a database to be cleaned is generated, and the database is marked as Q; the process P a is obtained in the process item set, any behavior association group R [ T c(t)|ILd ] is obtained in the database Q to be cleaned, if P a∈PP[Tc(t)|ILd ], the behavior association group R [ T c(t)|ILd ] is extracted, the credibility of the process P a in the behavior association group R [ T c(t)|ILd ] is calculated, and the specific calculation formula is as follows:
Where RL { P a→R[Tc(t)|ILd ] } represents the credibility of the process P a in the behavior association group R [ T c(t)|ILd ], PP [ T c(s)|ILd ] represents a process identification set composed of all processes in the behavior association group R [ T c(s)|ILd ], NUM { PP [ T c(t)|ILd]∩PP[Tc(s)|ILd ] } represents the total number of processes contained in the intersection of the process identification set PP [ T c(t)|ILd ] and the process identification set PP [ T c(s)|ILd ], NUM { PP [ T c(t)|ILd ] } represents the total number of processes contained in the process identification set PP [ T c(t)|ILd ], and T represents the total number of time cycle periods;
If it is NUM { PP [ T c(t)|ILd]∩PP[Tc(s)|ILd ] } =0 if/>And/>Letting NUM { PP [ T c(t)|ILd]∩PP[Tc(s)|ILd ] } =0;
Carrying out data cleaning on the behavior association group, presetting a credibility threshold, if the credibility of the process P a in the behavior association group R [ T c(t)|ILd ] is smaller than or equal to the credibility threshold, clearing the process P a from a process identification set PP [ T c(t)|ILd ], clearing an isolation space LS b occupied by the process P a from a space identification set LL [ T c(t)|ILd ], and updating the behavior association group R [ T c(t)|ILd ];
Acquiring another process in the process project set, returning to step S301, and performing cleaning iteration until all processes in the process project set participate in completing the updating of the behavior association group R [ T c(t)|ILd ], and stopping cleaning iteration;
The finally updated behavior association group R [ T c(t)|ILd]：PP[Tc(t)|ILd]→LL[Tc(t)|ILd ] is denoted as R [ T c(t)|ILd]：P[Tc(t)|ILd]→L[Tc(t)|ILd ], wherein P [ T c(t)|ILd ] represents a process identification set formed by all processes in the behavior association group R [ T c(t)|ILd ], L [ T c(t)|ILd ] represents a space identification set formed by all isolation spaces in the behavior association group R [ T c(t)|ILd ], and P[Tc(t)|ILd]∈PP[Tc(t)|ILd],L[Tc(t)|ILd]∈LL[Tc(t)|ILd].
Step S400: according to the data cleaning result, calculating the safety limit value of the network isolation layer in the time segment; and sending out an early warning prompt;
specifically, according to the data cleaning result, the safety limit value of the network isolation layer in the time segment is calculated, and the specific calculation formula is as follows:
Wherein SLV (IL d) represents the security threshold of the network isolation layer IL d within the time segment T c, NUM { L [ T c(t)|ILd ] } represents the total number of isolation spaces contained in the space identification set L [ T c(t)|ILd ], NUM { P [ T c(t)|ILd ] } represents the total number of processes contained in the process identification set P [ T c(t)|ILd ];
And presetting a safety limit value threshold, and sending out an early warning prompt if the safety limit value SLV (IL d|Tc) is larger than or equal to the safety limit value threshold.
It is noted that relational terms such as first and second, and the like are used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any actual such relationship or order between such entities or actions. Moreover, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus.
Finally, it should be noted that: the foregoing description is only a preferred embodiment of the present invention and is not intended to limit the present invention, but although the present invention has been described in detail with reference to the foregoing embodiments, it will be apparent to those skilled in the art that modifications may be made to the technical solutions described in the foregoing embodiments, or equivalents may be substituted for some of the technical features thereof. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims (2)

1. A 5G communication technology-based user data analysis and identification method, comprising the steps of:
step S100: establishing an Internet of things virtual cloud database, and recording and storing sub-cloud operation data corresponding to an Internet of things terminal; establishing an operation archive, and classifying and counting processes executed by the sub-cloud, an isolation space allocated by the virtual cloud of the Internet of things and a network isolation layer created by the virtual cloud of the Internet of things;
Step S200: the architecture runs an associated behavior chain identification model, records the behavior of each process for controlling access to an isolation space by means of a network isolation layer, and attaches a time tag to the running associated behavior chain; classifying and identifying the operation association behavior chains according to the time labels to generate a behavior association group;
step S300: calculating the credibility of the process in the behavior association group according to the classification and identification result; data cleaning and updating are carried out on the behavior association group;
Step S400: according to the data cleaning result, calculating the safety limit value of the network isolation layer in the time segment; and sending out an early warning prompt;
The specific implementation process of the step S100 includes:
Step S101: establishing an Internet of things virtual cloud database, wherein operation data corresponding to sub-clouds connected through 5G communication are stored in the Internet of things virtual cloud database, the sub-clouds are connected with each other in an interactive mode based on ports of an Internet of things terminal, the operation data comprise isolation spaces occupied by processes in the process of executing each sub-cloud and network isolation layers called by the processes in the process of executing each sub-cloud, the isolation spaces are independent memory spaces with the same size and distributed by the Internet of things virtual cloud, the network isolation layers are virtual connection mapping channels which are created by the Internet of things virtual cloud and are used for providing the sub-clouds with the process of executing each sub-cloud, and mapping refers to corresponding software service functions which are realized in the Internet of things virtual cloud based on conversion of hardware service functions of the Internet of things terminal; one sub cloud corresponds to one Internet of things terminal;
Step S102: establishing an operation archive, wherein the operation archive comprises a process item set, a space pointer set and a channel medium set; the process item set comprises processes executed by all sub-clouds, and is recorded as Wherein/>Represents an a-th process, A represents the total number of processes; the space pointer set comprises an isolation space distributed by the virtual cloud of the Internet of things, and the space pointer set is recorded as/>Wherein, the method comprises the steps of, wherein,Represents the B-th isolation space, and B represents the total number of isolation spaces; the channel medium set comprises a network isolation layer created by virtual cloud of the Internet of things, and the channel medium set is recorded as/>Wherein/>Represents the D-th network isolation layer, D represents the total number of network isolation layers;
The specific implementation process of the step S200 includes:
step S201: the method comprises the steps of constructing an operation association behavior chain identification model, wherein the operation association behavior chain refers to the behavior that each process accesses an isolation space by means of a network isolation layer control in the process of executing each sub-cloud; dividing the time in one day into k continuous time slices by taking the day as the time cycle period, and recording any one time slice as Wherein c represents the sequence number of the time segment; adding a time tag to the operation association action chain, recording the time range of the occurrence of the operation association action chain, and recording any operation association action chain as/>The time tag attached to the operation association action chain is recorded asTime tag/>Representing run-associated behavior chain/>Time segment/>, within the t-th time cycle periodIn (c) occurs, run associative behavior chain/>Representing progress/>By means of a network isolation layer/>Control access to isolated space/>And occupy isolated space/>；
Step S202: and carrying out classification and identification on the operation association behavior chain according to the time segment and the network isolation layer, wherein the classification and identification mode is as follows:
at time tag Acquiring all processes and all isolation spaces for realizing control interaction between processes and the isolation spaces by means of network isolation layers, generating a behavior association group, and recording as/>Wherein/>Representing the time segment/>, within the t-th time cycle periodBy isolating the layers by means of a networkBehavior association group for realizing control of interaction process,/>Representing behavioral association groups/>Process identification set composed of all processes in (a)/>, andRepresenting behavioral association groups/>A space recognition set consisting of all isolation spaces, and/>，/>;
The specific implementation process of the step S300 includes:
Step S301: according to the classification and identification result, corresponding behavior association groups under the same network isolation layer are comprehensively organized, a database to be cleaned is generated, and the database is marked as Q; acquiring processes in a process project set Any behavior association group/>' is obtained from a database Q to be cleanedIf/>Extracting behavior association group/>Computing Process/>In behavior association group/>The specific calculation formula is as follows:
Wherein, Representing progress/>In behavior association group/>Reliability in/>Representing behavioral association groups/>A process identification set consisting of all processes in the hierarchy,Representing process identification set/>And process identification setTotal number of processes contained in intersection of,/>Representing process identification setsThe total number of processes contained in the process, T represents the total number of time cycle periods;
If it is Let/>If/>And/>Order in principle;
Step S302: data cleaning is carried out on the behavior association group, a credibility threshold value is preset, and if a process is carried outIn the behavior association groupIf the credibility in the process is smaller than or equal to the credibility threshold value, the process/>Identifying collections from processes/>While cleaning up the process/>Occupied isolation space/>Identifying collections from space/>And associate groups of actions/>Updating;
acquiring another process in the process item set, returning to step S301, and performing cleaning iteration until all processes in the process item set participate in the completion behavior association group Is updated, and the iteration is cleared;
Correlating groups of actions to be updated finally Is marked asWherein/>Representing behavioral association groups/>Process identification set composed of all processes in (a)/>, andRepresenting behavioral association groups/>A space recognition set consisting of all isolation spaces, and/>,/>;
The specific implementation process of the step S400 includes:
step S401: according to the data cleaning result, calculating the safety limit value of the network isolation layer in the time segment, wherein the specific calculation formula is as follows:
Wherein/> Representing the network isolation layer/>At time slice/>Internal safety margin,/>Representing spatially identified collections/>Total number of isolation spaces contained in/(Representing process identification set/>The total number of processes involved;
step S402: presetting a safety threshold value if And if the safety threshold value is greater than or equal to the safety threshold value, sending out an early warning prompt.
2. A 5G communication technology based user data analysis and identification system, the system comprising: the system comprises an Internet of things virtual cloud module, a data processing module, a data analysis module and a behavior early warning module;
The virtual cloud module of the Internet of things is used for establishing a virtual cloud database of the Internet of things and recording and storing sub-cloud operation data corresponding to the end of the Internet of things; establishing an operation archive, and classifying and counting processes executed by the sub-cloud, an isolation space allocated by the virtual cloud of the Internet of things and a network isolation layer created by the virtual cloud of the Internet of things;
The data processing module is used for constructing an operation association behavior chain identification model, recording the behavior of each process for controlling access to the isolation space by means of the network isolation layer, and attaching a time tag to the operation association behavior chain; classifying and identifying the operation association behavior chains according to the time labels to generate a behavior association group;
The data analysis module calculates the credibility of the process in the behavior association group according to the classification and identification result; data cleaning and updating are carried out on the behavior association group;
the behavior early warning module calculates the safety limit value of the network isolation layer in the time segment according to the data cleaning result; and sending out an early warning prompt;
The virtual cloud module of the Internet of things further comprises a database unit and an archive unit;
The system comprises a database unit, an Internet of things virtual cloud database, a network isolation layer and a network mapping unit, wherein the database unit is used for establishing an Internet of things virtual cloud database, the Internet of things virtual cloud database stores operation data corresponding to sub-clouds connected through 5G communication, the sub-clouds are connected with each other in an interactive mode based on ports of an Internet of things terminal, the operation data comprise isolation spaces occupied by processes in the execution process of each sub-cloud and network isolation layers called by the processes in the execution process of each sub-cloud, the isolation spaces are independent memory spaces with the same size and distributed by the Internet of things virtual cloud, the network isolation layers are virtual connection mapping channels which are created by the Internet of things virtual cloud and are used for providing the sub-clouds with the execution process, and the mapping refers to corresponding software service functions which are converted into the Internet of things virtual cloud based on each hardware service function of the Internet of things terminal; one sub cloud corresponds to one Internet of things terminal;
The archive unit is used for establishing an operation archive, wherein the operation archive comprises a process item set, a space pointer set and a channel medium set; the process item set comprises processes executed by all sub-clouds, and is recorded as Wherein/>Represents an a-th process, A represents the total number of processes; the space pointer set comprises an isolation space distributed by the virtual cloud of the Internet of things, and the space pointer set is recorded as/>Wherein, the method comprises the steps of, wherein,Represents the B-th isolation space, and B represents the total number of isolation spaces; the channel medium set comprises a network isolation layer created by virtual cloud of the Internet of things, and the channel medium set is recorded as/>Wherein/>Represents the D-th network isolation layer, D represents the total number of network isolation layers;
the data processing module further comprises a behavior chain recording unit and a classification and identification unit;
The behavior chain recording unit is used for constructing an operation association behavior chain identification model, wherein the operation association behavior chain refers to the behavior that each process accesses an isolation space by means of a network isolation layer control in the process of executing each sub-cloud execution process; dividing the time in one day into k continuous time slices by taking the day as the time cycle period, and recording any one time slice as Wherein c represents the sequence number of the time segment; adding a time tag to the operation association action chain, recording the time range of the occurrence of the operation association action chain, and recording any operation association action chain as/>The time tag attached to the operation association action chain is recorded as/>Time tag/>Representing run-associated behavior chain/>Time segment/>, within the t-th time cycle periodIn (c) occurs, run associative behavior chain/>Representing progress/>By means of a network isolation layer/>Control access to isolated space/>And occupy isolated space/>;
The classification and identification unit performs classification and identification on the operation association behavior chain according to the time segment and the network isolation layer, and the classification and identification mode is as follows:
at time tag Acquiring all processes and all isolation spaces for realizing control interaction between processes and the isolation spaces by means of network isolation layers, generating a behavior association group, and recording asWherein/>Representing the time segment/>, within the t-th time cycle periodBy isolating layer/>, by means of a networkA behavioral association group is implemented that controls the interaction process,Representing behavioral association groups/>Process identification set composed of all processes in (a)/>, andRepresenting behavioral association groups/>A space recognition set composed of all the isolated spaces, and;
The data analysis module further comprises a credibility analysis unit and a data cleaning unit;
The credibility analysis unit is used for comprehensively planning corresponding behavior association groups under the same network isolation layer according to the classification and identification results, generating a database to be cleaned and marking the database as Q; acquiring processes in a process project set Any behavior association group/>' is obtained from a database Q to be cleanedIf/>Extracting behavior association group/>Computing Process/>In behavior association group/>The specific calculation formula is as follows:
Wherein, Representing progress/>In behavior association group/>Reliability in/>Representing behavioral association groups/>A process identification set consisting of all processes in the hierarchy,Representing process identification set/>And process identification setTotal number of processes contained in intersection of,/>Representing process identification setsThe total number of processes contained in the process, T represents the total number of time cycle periods;
If it is If/>Order in principle;
The data cleaning unit is used for cleaning the data of the behavior association group, presetting a credibility threshold value, and if the process is performedIn behavior association group/>If the credibility in the process is smaller than or equal to the credibility threshold value, the process/>Identifying a collection from a processWhile cleaning up the process/>Occupied isolation space/>Identifying collections from space/>And associate groups of actions/>Updating;
Acquiring another process in the process project set, returning to the credibility analysis unit for processing, and performing cleaning iteration until all processes in the process project set participate in completing the behavior association group Is updated, and the iteration is cleared;
Correlating groups of actions to be updated finally Is marked asWherein/>Representing behavioral association groupsProcess identification set composed of all processes in (a)/>, andRepresenting behavioral association groups/>A space recognition set composed of all the isolated spaces, and;
The behavior early warning module further comprises a safety limit value analysis unit and an early warning prompt unit;
the safety limit value analysis unit calculates the safety limit value of the network isolation layer in the time segment according to the data cleaning result, and the specific calculation formula is as follows:
Wherein/> Representing the network isolation layer/>At time slice/>Internal safety margin,/>Representing spatially identified collections/>Total number of isolation spaces contained in/(Representing process identification set/>The total number of processes involved;
The early warning prompt unit is used for presetting a safety limit value threshold value if the safety limit value is And if the safety threshold value is greater than or equal to the safety threshold value, sending out an early warning prompt.
CN202311608917.5A 2023-11-29 2023-11-29 User data analysis and identification system and method based on 5G communication technology Active CN117640407B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202311608917.5A CN117640407B (en) 2023-11-29 2023-11-29 User data analysis and identification system and method based on 5G communication technology

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202311608917.5A CN117640407B (en) 2023-11-29 2023-11-29 User data analysis and identification system and method based on 5G communication technology

Publications (2)

Publication Number Publication Date
CN117640407A CN117640407A (en) 2024-03-01
CN117640407B true CN117640407B (en) 2024-05-14

Family

ID=90037099

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202311608917.5A Active CN117640407B (en) 2023-11-29 2023-11-29 User data analysis and identification system and method based on 5G communication technology

Country Status (1)

Country Link
CN (1) CN117640407B (en)

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112883369A (en) * 2021-03-25 2021-06-01 中国科学院信息工程研究所 Credible virtualization system
KR102307641B1 (en) * 2021-04-30 2021-10-01 나무기술 주식회사 Parallel processing control system for cloud operation data analysis
CN114172930A (en) * 2021-11-09 2022-03-11 清华大学 Large-scale Internet of things service domain isolated communication method and device, electronic equipment and storage medium
CN115987644A (en) * 2022-12-26 2023-04-18 中国电力科学研究院有限公司 Intelligent power distribution internet of things safety authentication system
CN116647836A (en) * 2023-07-27 2023-08-25 深圳市芯保迪电子科技有限公司 Network security intelligent monitoring system and method based on 5G communication technology

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112883369A (en) * 2021-03-25 2021-06-01 中国科学院信息工程研究所 Credible virtualization system
KR102307641B1 (en) * 2021-04-30 2021-10-01 나무기술 주식회사 Parallel processing control system for cloud operation data analysis
CN114172930A (en) * 2021-11-09 2022-03-11 清华大学 Large-scale Internet of things service domain isolated communication method and device, electronic equipment and storage medium
CN115987644A (en) * 2022-12-26 2023-04-18 中国电力科学研究院有限公司 Intelligent power distribution internet of things safety authentication system
CN116647836A (en) * 2023-07-27 2023-08-25 深圳市芯保迪电子科技有限公司 Network security intelligent monitoring system and method based on 5G communication technology

Also Published As

Publication number Publication date
CN117640407A (en) 2024-03-01

Similar Documents

Publication Publication Date Title
Yang et al. A spatiotemporal compression based approach for efficient big data processing on cloud
Atat et al. Big data meet cyber-physical systems: A panoramic survey
CN109684181B (en) Alarm root cause analysis method, device, equipment and storage medium
US20230289661A1 (en) Root cause discovery engine
JP2021502625A (en) Computer implementation methods, computer systems, systems, and computer programs that determine security anomalies
US8260622B2 (en) Compliant-based service level objectives
Samiei et al. Classification of skin cancer stages using a AHP fuzzy technique within the context of big data healthcare
CN109740037A (en) The distributed online real-time processing method of multi-source, isomery fluidised form big data and system
CN109740038A (en) Network data distributed parallel computing environment and method
US12056625B2 (en) Determination of storage configuration for enterprise distributed environment
CN111552570B (en) Self-adaptive distribution method of data processing resources of Internet of things and cloud computing server
US10785243B1 (en) Identifying evidence of attacks by analyzing log text
US11882095B2 (en) Firewall insights processing and machine learning
WO2016073776A1 (en) System for management of health resources
CN113347170A (en) Intelligent analysis platform design method based on big data framework
CN110460662A (en) The processing method and system of internet of things data
CN114610475A (en) Training method of intelligent resource arrangement model
Cao et al. Behavior-based community detection: Application to host assessment in enterprise information networks
Mitropoulou et al. Anomaly detection in cloud computing using knowledge graph embedding and machine learning mechanisms
Mokhtar et al. Big data and semantics management system for computer networks
CN117640407B (en) User data analysis and identification system and method based on 5G communication technology
CN113886086A (en) Cloud platform computing resource allocation method, system, terminal and storage medium
CN116545740B (en) Threat behavior analysis method and server based on big data
CN110099415B (en) Cloud wireless access network computing resource allocation method and system based on flow prediction
Hu et al. Optimizing resource allocation for data-parallel jobs via gcn-based prediction

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant