Abstract
The Internet of Things (IoT) can combine a wide range of information space with physical space and use related technologies to provide effective information interaction between objects. Nowadays, a large amount of Internet data transmitted by E-commerce communication data is vulnerable to interference, intrusion, and other attacks, posing a major threat and challenge to data security. Based on the IoT data analysis platform Hadoop, starting from the data, the problems faced by the E-commerce information security are analyzed and the E-commerce security is improved. Through the comparison of Delphi method, fuzzy comprehensive evaluation method, weighted linear evaluation method, grey cluster analysis method, analytic hierarchy process, and using the complex fuzzy evaluation method of the vague set theory, the security weights of the first and second levels are calculated according to the vague entropy value of each index attribute. It provides a useful reference for E-commerce informatization security evaluation methods. The first-level and second-level comprehensive evaluations of the vague set are used to detect and analyze E-commerce network security, transaction security, data security, and physical security. The weight of each indicator occupies a total of 100% and the final risk status is close to 0. Therefore, it can be concluded that the risk status of the E-commerce information security is “safe”.
1. Introduction
With the quick growth of E-commerce and the IoT in recent days, making large digital media boom in the age of large metal devices, it has also led to the rise of big data related industries. As a rapidly developing digital platform, E-commerce carries a large amount of multimodal unstructured data. With the increase of massive data every day, if the data can be processed well according to the existing E-commerce data processing capacity, then large concurrent requests can be responded to, ensuring the security of the transaction process and the processing of structured and unstructured data. It remains to be seen whether the security management of big data storage can be guaranteed.
E-commerce information security needs to be built up on the basis of the big data platform Hadoop to establish an information security detection and evaluation model, depending on the objectives of the system of data security architecture, using a combination of technology and management to maintain information security and ensure that the status of IoT large format digital data plays a special discriminatory role to promote the growth of E-business.
The combination of big data and E-commerce security is an in-depth study of the composition of the E-commerce security system and its key security defense strategies and technologies, and some hidden dangers of the security system are analyzed. The birth of today’s big data technology can solve the contradictory problem of E-commerce security. The introduction of the distributed Apache Hadoop platform, which is more popular and widely used today, describes the structure of Hadoop in detail and proposes to guide and monitor E-commerce behavior based on data to improve the E-commerce security system.
2. Related Work
At this time, there are not many achievements that can both qualitatively and quantitatively describe the E-commerce information security evaluation model. The main reason is the variability and limitations of the E-commerce construction environment, resulting in deviations in the evaluation of the system, and it is impossible to set up a uniform system of assessment in science. Ni et al. investigated the structure and properties of mist calculation and looked into the fog net’s key roles, including real-time services, transient memory, data dissemination, and dispersed calculations, proposing to target threats to safety and privacy of IoT apps [1]. Yang et al. proposed a collaborative AmBC (CABC) type system in this way, in which readers can recover a message not just from A-BD, but also from RF sources. For frequency selective fading channels, a CABC system model over ambient orthogonal frequency division multiplexing (OFDM) carriers was proposed and a low-complexity optimal ML detector was derived based on it [2]. Ansari and Sun proposed a Mobile Edge Internet of Things (MEIoT) by using fiber optic wireless access technology, cloudlet concept, and software defined network framework architecture. In addition, two dynamic agent VM relocation approaches were introduced to minimize the end-to-end latency between agent VMs and their IoT devices and to minimize the total grid-connected energy consumption of small clouds, respectively. The properties of the proposed methods were verified through broad range of simulations [3]. The main findings of the Faraoni et al. study were related to the importance of website characteristics as an antecedent of E-loyalty in online grocery retailing. Although the phenomenon of originality value exploration has been extensively studied, some aspects of it remain to be fully explored, especially the effects of E-trust, E-satisfaction, and E-commitment [4]. Imtiaz et al. considered a discussion on the interpretation of customer privacy, security, and trust. The importance of privacy concerns, appropriate security measures, and trust development were also highlighted [5]. Miao et al. built a data science and big data analysis application platform based on microservice architecture for education or nonprofessional research fields. In a microservices-based environment, component updates for individual components were facilitated. The platform had a personal code experiment environment and integrated JupyterHub based on Spark and HDFS for multiuser use and a visual modeling tool that followed the modular design based on data science engine engineering [6]. Thien et al. worked on the implementation of an automatic calibration to data profiling setup and workflow for defining liquid–liquid equilibrium data using a Raman micron emission spectroscopy and a microfluidic platform. The pure fractions were premixed online using a micromixer to form a sealed system with the bonus of eliminating future losses of volatile fractions [7]. These studies are instructive to a certain extent, but in some cases the demonstrations are insufficient or inaccurate and can be further improved.
3. E-Commerce Model and Security Issues in the Era of Big Data of IoT
At present, the level of the IoT with high social acceptance is a model that divides the IoT into three layers from the bottom-up according to the process of data collection, transmission, and processing in the network. Figure 1 shows the general overall architecture of an IoT system. Different IoT application areas have different usage structures, but the overall application structure idea is the same. The information security technology of the IoT is also carried out in accordance with the multilevel requirements of the general IoT architecture [8].
At present, there are two main concepts of the IoT: narrow and broad. The narrow concept of the IoT refers to the IoT that realizes the intelligent identification, perception, positioning, and management of items. The broad meaning of IoT is the fusion of information space and physical space. Digitization connects all things, enabling the effective interaction of information between things and things, people and people, and the real environment. The complex application of computerized human society has reached a higher level by integrating various information technologies into social behavior through new service models.
As the basis for building the IoT, the perception layer is the data source for the entire network. There are various devices in the perception layer, including identification devices, such as RFID and cameras, as well as perception devices represented by sensors, such as infrared sensors [9]. The network layer is responsible for the safe, stable, and efficient interaction of data between the perception layer and the application layer. The application layer is mainly responsible for the storage and processing of data on the IoT system and is the key point for the specific operation of the IoT. If the IoT does not manage user data properly or the storage method is not rigorous, it is easy to be attacked by criminals and leak user’s private data. In more serious cases, IoT applications may be exploited to install backdoors and attack the entire IoT system.
Due to the imperfection of the information security technology of the IoT and the occurrence of the high frequency of the security events of the IoT, countries all over the world have drawn high attention. Not only enterprises and research institutions, but also government agencies have issued corresponding guidelines and actively invested in the research and development of the information security protection technology of the IoT.
3.1. Influencing Factors of E-Commerce Security
As an important business activity relying on the Internet, E-commerce is very necessary to build a security architecture. According to the principles and standards of the security system, the factors affecting the information security of E-commerce are analyzed and studied, and finally a representative, comprehensive, and practical index system is obtained, which is ready for the assessment of information security. The specific security hierarchy includes the following six points: (1) Network service layer: it includes access control, scanning for hidden threats, and firewalls on the network. (2) Encryption technology layer: this section includes asymmetric encryption and symmetric encryption. (3) Digital certification: it includes digital certificates and CA certification. (4) Transaction protocol layer: it includes transaction quantity, transaction time, and transaction content. (5) Business system layer: E-commerce system application layer. (6) E-commerce service requirements: it has integrity, anonymity, reliability, and validity. In E-commerce, it is the protection of these security levels and the information associated with them [10]. Then, the main threats to information security in the E-commerce environment can be simply divided into these aspects: (1) viruses, (2) natural physical threats to the platform, and (3) deterioration of the security environment, as shown in Figure 2.
The entire business chain of E-commerce consists of many parts, from suppliers to middlemen to consumers, which need to go through the continuous flow of materials. The amount of information that comes with it is also very large, and there are some uncertain hidden dangers in the transmission of information more or less [11]. Next, the security risks generated in the process of information flow and processing will be analyzed. The sources of E-commerce information security risks are mainly composed of these parts.(1)Information security risk information brought by information transmission: to realize its value, it requires strong liquidity, and many paths need to be passed in the process of information transmission. As an important resource, in order to maximize the value of information, information must ensure the transmission time of information and control the error rate of information within a certain range [12].(2)Risks arising from information sharing and processing: because in the process of information transmission, it is necessary to continuously process and reproduce the source information and intercept useful information. Therefore, in the process of sharing and processing information, various subjects of E-commerce will inevitably encounter risks in information conversion and other aspects. In order to ensure the normal and smooth operation of E-commerce activities, it is indispensable to ensure the relative integrity of information and the security and accuracy of storage protection to achieve the usefulness of these information.(3)Information security risks caused by information uncertainty: since E-commerce is a complete and complex system, whether the subject is an individual, an enterprise, or other functional departments such as banks, governments, or even the Internet system platform, the information presented by them will have certain random information, fuzzy information, grey information, and other uncertain information. Therefore, the uncertainty of information in E-commerce inevitably brings security risks [13].
3.2. E-Commerce Information Security Architecture
The information environment is the social environment, political environment, and cultural environment in which the information subject is located. The information environment of privacy information disclosure refers to the consumption policy, consumption system, and group consumption culture involved in the process of consumer privacy information disclosure. To ensure the smooth progress of the evaluation work, choosing a scientific and reasonable evaluation index system is as important as choosing an appropriate evaluation model and method [14]. It can be said that the evaluation index system is the basis and premise of the evaluation work. If the indicators are not selected well, it is difficult to make the evaluation results accurate and reasonable.
In the evaluation system, the evaluation indicators are often described in vague language, such as severity and quality, all of which have a strong personal subjective color, and it is difficult to quantify in the evaluation calculation, which makes the evaluation results inaccurate. Information security is implemented through the definition of various security responsibilities and provides support for the organization’s security management, security operation and maintenance, and security technology. As the key link of the evaluation work, the importance of the evaluation system is self-evident. The E-commerce information security system mainly analyzes its influencing factors from the platform system of E-commerce operation and its own operating characteristics in the actual transaction process [15]. It is based on the information security management system documentation and security control mechanism in the BS7799 (ISO 17799) standard commonly used in developed countries. Based on the scientific and reasonable classification standard, the evaluation index system of E-commerce information security is constructed. From the integrity, scientificity, practicability, and relevance, four factors with greater influence are selected from the numerous influencing factors of information security in E-commerce. The four factors are cyber security, order transaction security, data security, and physical security. And taking it as the first-level indicator, the entire indicator system is formed by determining the representative subordinate indicators according to the principle of indicator selection. The set of E-commerce information security indicators is shown in Table 1.
3.3. Inspection Methods for E-Commerce Information Security in the Internet of Things Environment
Up to now, research methods at home and abroad for the evaluation and quantification of information security can be divided into three categories. One is the evaluation and quantification method based on the theoretical knowledge of probability theory. The second is to evaluate quantitative methods based on the expertise of experts in related fields, such as AHP and Delphi method. The third is fuzzy logic method, such as fuzzy complete evaluation method. By comparing the Delphi method, the diffusion complex number evaluation method, the weighted linear evaluation method, the grey cluster analysis method, and the AHP, it provides a useful reference for the E-commerce information security evaluation method [16]. Information security assessment is from the perspective of risk management and risk control, using scientific methods and technologies to identify and evaluate threats to networks and information systems.
3.3.1. Delphi Method
The Delphi method can be widely used as a qualitative and subjective analysis method in the field of forecasting. At present, this method is mainly used for the establishment of the evaluation index system and the determination process of specific indicators. The main purpose is to seek advice from experts through multiple rounds of consultation through blind selection and to conduct continuous evaluation and prediction. After many rounds of analysis and judgment, the opinions of experts tend to be consistent, and a unified and reliable conclusion and plan are obtained. As a tool for important forecasting activities, the main steps in its implementation include: (1) Determine the forecast target and formulate a consultation table. (2) Determine the expert group. (3) Collect and process the weights of each indicator independently reported by each expert and calculate the mean and standard deviation of each indicator weight. (4) Collect and organize data multiple times until discrepancies arise. The weight of each indicator and the mean value do not exceed the default standard, and finally the prediction result is obtained [17].
3.3.2. Fuzzy Comprehensive Evaluation Method
Simple and comprehensive evaluation is done through fuzzy evaluation, while the evaluation of complex evaluation is based on the evaluation of strengths and weaknesses [18]. One of them is the vague set theory, which is used to represent uncertain things. The vague synthesis evaluation method needs to create the proper judge function and judge matrix, combine the obtained weights and the judge value obtained from the final operation, and determine the most favorable decision for the decision maker according to the principle of maximum subordination. The decision that is most beneficial to the decision maker is determined. Its main process is the following: firstly, the set of relevant factors is determined, that is, the set of relevant factors of the evaluation object is denoted as , and further subdivided into . Then, the comment set is established and the single factor of the factor set is evaluated, the membership degree to the evaluation level is obtained, and then the evaluation set is obtained, which is a fuzzy subset. Finally, the weights of the relevant evaluation factors to the comment set are determined.
3.3.3. Linear Weighted Evaluation Method
Linear weighted evaluation methods are widely used in technology-related evaluations. The main process is to first evaluate the underlying indicators, and then quantify the value of the indicators [19]. Then, the value of the top-level indicator is obtained. The specific implementation process is to multiply the value of the basic indicator by the weighting factor of the relative importance of the indicator, and then add the top-level indicator. Finally, the previous operations are repeated continuously until the upper layer is reached as an indicator, and the result of the comprehensive evaluation is finally obtained. The linear weighted sum is defined as follows:
Assuming that there are n of parameters, and through the corresponding weight coefficient , the weighted sum is . This is the generalization of expectations in probability theory.
3.3.4. Grey Cluster Analysis Method
According to the classification, grey clustering can be divided into two categories: one category is grey relational clustering. It is mainly used to merge similar factors and reduce the number of indicators. Basically, there are n observation objects, and each object has m characteristic data.
The absolute correlation degree with all i ≤ j, , and is calculated, and the characteristic variable correlation matrix A is gotten. The critical value r is given, and r is greater than or equal to 0 or less than or equal to 1. When the correlation degree is greater than or equal to a given critical value, and are regarded as the same class. The other category is grey variable weight clustering. There are n clustering objects, m clustering indicators, and s different grey classes. According to the sample of the i (i = 1,2,..., n) object about the j (j = 1,2,..., m) index, the i-th object is classified into the k-th grey class, which is called grey clustering. Grey cluster analysis is often used to assess geological hazards and it is also used in the assessment of air and water pollution levels. It is a method of cluster analysis based on the correlation coefficient determined by the grey system correlation analysis method, including grey correlation clustering and grey class whitening function clustering. The analysis method steps are divided into two steps: the first step is to calculate the correlation coefficient and the correlation degree. The process mainly includes: (1) Initialize the data, set the system object and characteristic parameter sequence to be evaluated, perform dimensionless processing on the original data involved in the analysis, and compress the analysis data between (0 and 1). (2) Find the difference sequence, the two-level minimum difference and the maximum difference, and determine the grey level to which each clustering index value of each clustering object belongs. (3) Find the correlation coefficient and the correlation degree. The second step is to perform cluster analysis calculation. The domain of discourse of clustering is set, and the domain of discourse is the entirety of the objects being evaluated. The size sequence of each object in the universe can be obtained, the distance of each evaluation object can be calculated, the samples with the closest distance can be clustered into one class, and so on, until all evaluation indicators are classified into one class [20].
3.3.5. Analytic Hierarchy Process
The structure diagram of AHP is shown in Figure 3. The AHP approach to evaluation entails three stages: the first stage is system decomposition, the second stage is safety judgment, and the third stage is comprehensive judgment.
4. Construction and Testing of E-Commerce Data Platform
The ecosystem of the Hadoop platform is shown in Figure 4. The commonly used large scale digital data instruments include tools such as Hadoop, HPCC, Inform, Rachel Drill, and Pentaho BI. The big data security system is the infrastructure that supports the security construction and management of the big data platform system, taking into account the big data technology system and management system.
4.1. Big Data Platform Hadoop Architecture System
Initially, Hadoop was primarily used to administer huge volume of communal Internet pages, thus the security issues were not required to be considered in the design of Hadoop. The Hadoop platform includes functional modules such as file system, database, data processing, data warehouse, and big data analysis language interface. Hadoop’s original vision is a cluster based on a trusted environment. The main contents of the big data platform security risk assessment are as follows: protecting the boundary of the big data platform network, digitization of vulnerabilities, basic configuration inspection, weak password detection, version detection, maintenance management, deprivation, strategic data extraction and integration, comprehensive policy management, unified event analysis, full-text retrieval and data auditing, behavior for handling sensitive information, key security policies to support the management of structured and unstructured data. The evaluation points are shown in Figure 5.
Therefore, it is necessary to carry out a risk assessment of the big data platform according to the security requirements and level protection requirements of the big data system based on the characteristics of big data. For specific big data applications, the big data security architecture system is constructed and the corresponding security assurance techniques are studied to solve practical security problems.
The key issues to be considered in securing a Hadoop-based big data platform are as follows: authentication mechanism, authorization mechanism, access control, data hiding and encryption, secure deployment of network edge devices, system security, device security, auditing, and event monitoring. It is used to prevent the leakage, tampering and loss of sensitive data, unauthorized access to data, leakage of secret keys, violation of user privacy and so on.
4.2. E-Commerce Information Security Assessment Based on Vague Set
The concept of fuzzy set is a complex fuzzy approach to assessment grounded in vague collection policy, which is frequently applied in many fields with complex and objective evaluation results for multilevel, multidisciplinary, and multispecies evaluation. According to various possibilities, multiple hierarchical answers are obtained, and the final evaluation results are clear and systematic. It can effectively solve vague and difficult-to-quantify problems.
The definition is: A is the domain of discourse set, and any element in it is represented by V. A vague set P on A refers to a pair of membership functions on A: and .Here, and denote the lower bound of membership of supporting evidence, which is called the true membership function of vague set A. The membership of an element x in the vague set A is defined by a subinterval on the interval (0 and1). The interval is the vague value of element x in A, denoted as . When A is a finite universe of discourse, that is, A is discrete, then the vague set P is expressed as follows:
When A is an infinite universe of discourse, that is, A is continuous, then the vague set P is expressed as follows:
If and are both 1 or 0, then the information about x is very accurate, depending on whether x belongs to the set vague. The set vague has degenerated into a normal set.
Fuzzy sets are tools used to describe dispersed message, and within message law, message entry entropy is the degree of information insecurity measured in probabilistic terms, and message entropy reflects the degree of disorder in a system. As an objective weighting method, this method of entropy weighting is mainly used to determine the weights of indicators and can be used for all evaluation problems. Just in the same way as the message entropy, the entropy of the vessel set can be considered, as well as the true and false attribution datasets. Based on the entropy formula and weight formula given by the information entropy value method, and based on these formulas, the formulas of vague entropy and weights are given. The decision or evaluation matrix is given in the message entropy algorithm as follows:where, m indicates the count of units to be tested, n refers to the list of metrics to be tested, and represents the evaluation value of the indicators in the i-th row and j-column. is normalized to get the following equation:
When computing the entity values of the assessment of j-th index, the identity of equity is given by the following equation:
In the vague set, the introduction of fuzzy entropy is to preserve the properties describing fuzzy sets , and . Then, there are the following axiomatic formulas, wheredenote the normalized values, respectively. Assuming , then we obtain the following equation:
And when A = (0,0) or A=(1,1), , , and are all 0. These three formulas have been proved to be reasonable and fully consider the unknown and uncertain information of the vagueness of the vague set, which is in line with the objective reality. is called the fuzzy positive entropy of vague set A. is called the fuzzy negentropy of vague set A.
reflects the importance of the indicator. For a given j, if the evaluation index weight is larger, the difference of the described evaluation index will be greater and the entropy value of the evaluation index will be smaller. Therefore, the weight factor of the j-th index can be represented by entropy as follows:
Therefore, in the vague set theory, considering the true and false membership, the formula for calculating the weight can be obtained as follows:
With the weight formula, the comprehensive attribute value of each scheme or evaluation can be calculated according to the vague value of each indicator and the corresponding weight.
In the vague set, the vague comprehensive attribute value of each indicator can also be calculated as follows:
4.3. Application of Vague Set Evaluation Model in E-Commerce Information Security Evaluation
4.3.1. First-Level Comprehensive Evaluation of E-Commerce Information Security Based on Vague Set
and are used to denote the number of “yes” and “no” given by n experts. Then, the degree to which indicator meets and does not meet the risk status in each comment can be calculated by the following formula:
The evaluation opinions of various experts are counted, and the degree of satisfaction and dissatisfaction of the risk status in each comment can be calculated using the formula index , and the statistical results are expressed in vague as shown in Tables 2–5:
From the vague values given in these tables, each vague value is normalized, respectively. The calculations involved in the normalization process are all implemented with MATLAB to obtain a matrix. After a complete MATLAB calculation, the results are shown in Table 6.
According to the vague entropy value of each index attribute, the weight formula for calculating each secondary index attribute is obtained. The vague entropy value of each index attribute in Table 5 is substituted into the formula and the code is implemented with MATLAB, and the obtained weight of each index is as follows:
In the evaluation of e-commerce information security, in order to more clearly analyze the importance of evaluation indicators in each indicator layer, this paper decomposes the research object into actionable behavioral structures or features according to its essential properties or a certain point of the properties, and assigns weights to each element. It involves various influencing factors of the evaluation object and is also the premise of prediction and evaluation. Figure 6 can be used to express the weight composition of each indicator in network security, transaction security, data security, and physical security to make the expression more intuitive according to the weights given.
(a)
(b)
(c)
(d)
4.3.2. Second-Level Comprehensive Evaluation of E-Commerce Information Security Based on Vague Set
The second-level vague evaluation matrix of E-commerce information security is established to obtain the formula for normalizing the second-level indicators as follows:
The vague value of each second-level index in Table 6 is substituted into the formula, and the calculation process is also implemented by MATLAB, and the normalized result of the second-level index is expressed as a matrix as follows:
The entropy value formula and weight formula for calculating the index of the criterion layer are obtained from the formula, and the normalized value is brought into the corresponding formula to obtain the vague entropy value of each index of the criterion layer as follows:
Substituting E1, E2, E3, and E4 into the formula can get the weight of each standard layer indicator as follows:
From the weights of the indicators of the previous layer, the evaluation result of the higher layer can be calculated P = W ∗ R, that is, the final evaluation is as follows:
The final weight and final evaluation can be graphically represented as shown in Figure 7.
(a)
(b)
As a result, the final sorting result is shown in Figure 8.
It can be seen from the chart that the comprehensive evaluation of the first and second level of E-commerce information security in the vague set, the weight of each indicator in network security, transaction security, data security, and physical security occupies a total of 100%. The final risk status is close to 0, so it can be concluded that the risk status of the E-commerce information security is “safe”.
5. Discussion
E-commerce is a commercial activity that is based on the business theme, based on computer networks, and conducts business electronically under legal authorization. With the development of E-commerce, the amount of E-commerce data continues to grow, which poses an immeasurable threat to information security. Through the network layer of the IoT, the data interaction security evaluation of the sensing layer and the application layer, according to the influencing factors of E-commerce security, Delphi method, fuzzy comprehensive evaluation method, linear weighted evaluation method, grey cluster analysis method, analytic hierarchy process, and other related detection methods are mainly used in Hadoop environment to detect electronic information security.
The solution to the information security risks faced by E-commerce in the big data environment of the IoT is of great significance to promoting the development of E-commerce and even the national economy. It is hoped that there will be an effective security risk assessment model, which can solve the risk assessment problem of E-commerce information dynamics in the IoT environment and promote the safe, stable, and sustainable development of E-commerce and IoT data.
6. Conclusions
Through the Hadoop data analysis platform, this paper used the vague set method combined with the Delphi method, the fuzzy comprehensive evaluation method, the linear weighted evaluation method, the grey cluster analysis method, and the analytic hierarchy process to collect the predicted information security indicators and evaluate the E-commerce information security. The index system was divided into safe, relatively safe, general security, relatively dangerous, and dangerous grades, and expressed by the weight of each index in network security, transaction security, data security, and physical security so that the E-commerce information security issues could be expressed more intuitively. The application of vague set-based models and methods to E-commerce information security assessment is a research field that keeps pace with the times and meets urgent needs. E-commerce users should also pay attention to personal privacy protection, do not download files from unknown sources, and ensure that personal information is not stolen by others and cause unnecessary losses.
Data Availability
No data were used to support this study.
Conflicts of Interest
The authors declare that they have no conflicts of interest.
Acknowledgments
This work was supported by Key Laboratory of Eco-tourism in Hunan (STLV2003).