Server security anti-theft trigger type alarm system

Abstract

The invention discloses a server security anti-theft trigger type alarm system, which relates to the technical field of server security, and comprises a biological recognition module, a monitoring module, a judgment module, a warning module and a linkage module, the biological recognition module is used for verifying the identity of a user trying to access the server; the method comprises the following steps: acquiring a biological characteristic sample of a user, such as a fingerprint, an iris or a facial image, performing digital processing on the acquired biological characteristic sample through biological recognition equipment, and storing the processed biological characteristic sample in a safe database; according to the invention, by integrating high-precision biological recognition, real-time monitoring and intelligent analysis technologies, comprehensive security protection is provided for the server, and the system can accurately recognize and prevent unauthorized access, timely detect abnormal events and quickly judge potential threats through intelligent analysis, so that the security risk is reduced to the greatest extent.

Description

Technical Field

[0001] The invention relates to the technical field of server security, and in particular to a server security anti-theft trigger alarm system. Background Art

[0002] In today's digital age, servers are core devices that store and process a large amount of critical data, so their security is of vital importance. Servers face numerous security threats, including illegal access, data leakage, physical damage, and network attacks. With the continuous development of technology, hacker methods are becoming increasingly diverse and complex, and traditional security protection measures are gradually showing their shortcomings.

[0003] For example, authentication methods that rely solely on usernames and passwords are easily cracked or stolen, and cannot effectively identify the true identity of users. The physical environment of the server may also be affected by various factors. For example, abnormal changes in temperature and humidity may damage the server hardware, and unauthorized entry into the server room or illegal movement of the server may cause data loss or system damage. In addition, network stability issues and abnormal user access behavior may become security risks, but existing security systems often find it difficult to fully and timely detect and respond to these threats.

[0004] The current server security alarm system has certain limitations in terms of function and performance. Some systems are not accurate and flexible enough in biometric verification, and may not be able to accurately determine the legitimacy of the user's identity, nor can they make adaptive adjustments based on different access scenarios and risk situations. When monitoring the physical status of the server and environmental changes, some systems do not have comprehensive sensor deployment, and have limited data processing and analysis capabilities, making it difficult to accurately detect potential security threats, and there may be false positives or false negatives.

[0005] Some systems lack scientific and comprehensive analysis methods for judging and evaluating security threats, and are unable to accurately distinguish between normal operations and security threats, resulting in low accuracy and reliability of alarms. After the alarm signal is issued, the relevant linkage measures are not perfect and cannot effectively work with the server operating system and other security systems to enhance security protection capabilities. At the same time, in terms of system recovery, existing systems often lack intelligent recovery mechanisms, cannot quickly and accurately restore the normal operation of the server, and cannot learn lessons from previous security incidents and continuously optimize their own security strategies.

[0006] In order to solve the above defects, a technical solution is now provided. Summary of the invention

[0007] The purpose of the present invention is to solve the problems of existing server security alarm systems in terms of inaccurate and flexible biometric verification, limited monitoring capabilities, inaccurate threat assessment, imperfect linkage measures, and lack of intelligent recovery mechanisms, and to propose a server security anti-theft trigger alarm system.

[0008] The purpose of the present invention can be achieved through the following technical solutions: A server security anti-theft trigger alarm system, comprising: A biometric module to verify the identity of users trying to access the server; Monitoring module, used to monitor the physical status and environmental changes of the server in real time; The judgment module is used to analyze the data of the monitoring module and the biometric recognition module to determine whether there is a security threat; The warning module is used to send out an alarm signal when the judgment module determines that there is a security threat; The linkage module is used to link with the server operating system or other security systems to enhance security protection.

[0009] Furthermore, the process of the biometric module verifying the identity of the user attempting to access the server is as follows: Obtain biometric samples of user fingerprints, irises or facial images, digitize them, store them in a secure database and associate them with user identity information; When a user accesses a server, they authenticate through a verification process using a biometric device, including a fingerprint reader, iris scanner, or facial recognition camera, where the biometric device converts the captured biometric features into a digital signal and compares it with a database sample; If the features match successfully, a verification success signal is generated, and an authorization signal is sent to the server access control system to unlock the server and allow the user to perform subsequent operations. If there is no match, the user is required to re-verify, and a security alarm is triggered after the preset number of failures. Regardless of the verification result, the verification time, user ID and result are recorded and stored in the security log for auditing and monitoring; When abnormal behavior such as multiple consecutive authentication failures is detected, the warning module is triggered to issue a security alert and temporarily lock the server until the problem is resolved.

[0010] Furthermore, the specific operation steps of the verification process are as follows: When one biometric feature is successfully verified, it will automatically choose whether to further verify other biometric features according to the situation. By detecting the risk level of the current access scenario, when the risk level is greater than the preset standard, other biometrics will be automatically triggered for secondary verification. The risk level is comprehensively analyzed through risk indicators to obtain network stability value, physical evaluation value, abnormal evaluation value and habit abnormality value: the risk indicators include network stability index, physical environment index, access time index and operation habit index; The obtained network stability value, physical evaluation value, abnormal evaluation value and abnormal value are normalized and then input into the following formula: To get the comprehensive judgment value ZPZ, where WWP, WPZ, YXZ and GYZ are network stability value, physical evaluation value, abnormal evaluation value and learning abnormality value respectively. The preset weight coefficients are network stability value, physical evaluation value, abnormal evaluation value and learning abnormal value, and the obtained comprehensive judgment value is used as the evaluation standard of risk level; The obtained comprehensive judgment value is compared with the preset comprehensive judgment threshold. When the comprehensive judgment value is greater than the preset comprehensive judgment threshold, it is determined that a secondary verification is required.

[0011] Furthermore, the specific operation steps of the network stability value, physical evaluation value, abnormal evaluation value and abnormal value analysis are as follows: Network stability indicators: Network latency: measures the network latency from the user device to the server in milliseconds; Network packet loss rate: calculates the proportion of data packets lost during data transmission; Normalize the obtained network delay time and network packet loss rate and substitute them into the following formula: To get the network stability value WWP, where wy and wd are the network delay time and network packet loss rate respectively, and this network stability value is used as the standard to measure network stability; Physical environment indicators: Light intensity: The light intensity at the server location is measured using an ambient light sensor; Noise level: Use noise sensors to detect the noise decibel level of the surrounding environment; Temperature and humidity: Use temperature and humidity sensors to monitor the ambient temperature and humidity around the server; The obtained light intensity, noise level, temperature and humidity are normalized and then input into the following formula: To get the physical value WPZ, where are the actual light intensity, noise level, temperature and humidity, respectively. The preset standard light intensity, noise level, temperature and humidity are respectively, and the obtained physical evaluation values ​​are used as the standard for measuring the physical environment; Access time metrics: Non-working hours access: record the time when the user accesses the server and judge whether it is within the preset working hours. If the access time is within the preset working hours, the time judgment value is recorded as 0, otherwise, the time judgment value is recorded as 1. Access frequency change: Analyze the frequency of users accessing the server within a preset time period, and compare the user access frequency change rate with the preset change rate standard to determine the degree of deviation, quantify it in percentage, and record it as the frequency deviation value; The obtained time judgment value and frequency deviation value are normalized and then summed to obtain an abnormal evaluation value, which is used as a standard for measuring access time anomalies; Operating habit indicators: Input speed change: monitor the user's input speed during the biometric identification process, and calculate the difference between the real-time input speed and the user's historical average speed to obtain the speed difference value; Number of wrong operations: count the number of wrong operations of users during the biometric identification process and record it as the wrong operation value; The obtained speed difference value and wrong operation value are normalized and then summed to obtain the abnormal value, which is used as the standard for measuring abnormal operation habits.

[0012] Furthermore, the specific operation steps of the monitoring module to monitor the physical state and environmental changes of the server in real time are as follows: Deploy vibration, temperature, humidity, infrared motion, access control, and pressure sensors in and around key parts of the server; Calibrate the sensor so that it can accurately detect the predetermined state and changes. The sensor collects data in real time and transmits it to the central processing unit of the monitoring module; The data processing center receives sensor data, performs preliminary processing such as denoising and formatting, analyzes the processed data, and uses preset thresholds and algorithms to detect abnormal or unauthorized activities; Record sensor readings and abnormal events in security logs, continuously monitor to ensure the physical security of servers, and respond immediately when abnormalities are detected; Regularly synchronize data with server operating systems and other security systems; When an abnormal situation is detected, an alarm signal is sent to the judgment module, and feedback is received from the judgment module. If a security threat is confirmed, the warning module and the linkage module are assisted to execute safety measures.

[0013] Furthermore, the specific operation steps of the monitoring module assisting the warning module and the linkage module in executing safety measures are as follows: Provide specific information: Provide the alert module with specific data about the abnormal event, including the type of sensor that triggered the abnormality, the reading change and the timestamp, as well as the server location and environmental status information to assist in determining the severity of the threat and selecting the alert method; Confirm the legitimacy of the alarm: cross-verify different sensor data with the alarm module to ensure that no single sensor is falsely alarmed, and analyze whether the current anomaly conforms to the known security threat model based on historical data and preset patterns; Continuous monitoring and feedback: After the warning module issues an alarm, it continues to monitor the server status. If the abnormality worsens or there is a new abnormality, it will promptly feedback updated information to adjust the alarm level in time or take more urgent measures.

[0014] Furthermore, the specific operation steps of the judgment module to judge whether there is a security threat are as follows: Receive real-time data streams from monitoring and biometric modules, perform data cleaning, denoising, and normalization preprocessing, and extract key features, including abnormal number of biometric attempts, abnormal server movement, and abnormal changes in environmental parameters; Through machine learning algorithms or rule engines, the features are pattern-recognized, threats are assessed, and whether a security threat is constituted is determined. If a threat is determined, the warning module is triggered. Otherwise, further data is collected and analyzed and the alarm threshold is adjusted. Continuously monitor data streams, update threat assessments in real time, record analysis results and decisions in security logs, and provide feedback to monitoring and biometric modules to adjust their behavior, including increasing monitoring sensitivity or recalibrating biometric devices.

[0015] Furthermore, the operation steps of the judgment module to judge whether the assessed threat constitutes a security threat are as follows: Data collection: Extract historical data from security logs, monitoring and biometric modules and related security systems, including the number of biometric attempts, server movement, and environmental parameter changes; Data processing: clean historical data, remove duplications, errors and outliers, and normalize for comparison; Establish a baseline model: Determine the range of normal behavior through statistical methods, including determining the average number of attempts and standard deviation based on biometric data, and consider those outside the range as abnormal; Real-time data comparison: compare the current real-time data with historical data, including the number of biometric attempts, server movement, and whether changes in environmental parameters are abnormal; Determine weights: Determine the weights of different threat factors through expert evaluation and data analysis; Establishing level standards: Establishing high, medium and low threat level standards based on weights and historical data analysis results; Dynamic Adjustment: Adjust weights and rating standards as new data and security situations change, and dynamically adjust the threat level of current events based on real-time data analysis.

[0016] Furthermore, the specific operation steps of the warning module sending out an alarm signal are as follows: Receive the judgment module signal, verify its legitimacy and accuracy to prevent false alarms, determine the severity of the threat based on the judgment module information, set the alarm level, and select the sound and light alarm, SMS notification, email notification, or phone call alarm method based on the level and preset strategy; If an audible and visual alarm is configured, the server area alarm is activated and a text message, email, or automatic phone call notification is sent to the administrator or security personnel; Record the detailed information of the alarm event and store it in the security log, and send a signal to the linkage module to trigger a linkage response; After the alarm is issued, continue monitoring to determine whether the threat has been lifted. If lifted, issue an alarm cancellation signal and notify relevant personnel.

[0017] Furthermore, the specific operation steps of the linkage module and the server operating system or other security system are as follows: Receive alarm signals from the warning module and determine linkage strategies based on the alarm type and severity; Send instructions to the server operating system to execute linkage strategies, including locking the server, disconnecting the network, activating video surveillance, controlling the access control system, and adjusting environmental settings; Record the linkage operation details in the security log and notify the security personnel or administrator; Automatically evaluate the server status after the threat is resolved and automatically perform recovery operations based on the results; Use machine learning algorithms to predict recovery operation time and success rate to provide decision support for security personnel; After the recovery operation is completed, fully verify the server to ensure normal recovery, analyze the results and optimize the recovery strategy; Evaluate the effectiveness of linkage operations to determine whether security threats are successfully prevented; feed back the results to the judgment module and warning module to adjust future alarms and linkage strategies.

[0018] Compared with the prior art, the present invention has the following beneficial effects: (1) The present invention provides comprehensive security protection for the server by integrating high-precision biometrics, real-time monitoring and intelligent analysis technologies. The system can accurately identify and block unauthorized access, detect abnormal events in a timely manner, and quickly identify potential threats through intelligent analysis, thereby minimizing security risks; (2) When the present invention identifies a security threat, the system will automatically trigger multiple levels of warnings and linkage measures to ensure a quick and effective response. The system will issue an alarm through sound, light, text messages, emails, etc., and will integrate with the operating system and other security systems to implement measures such as locking and monitoring to effectively prevent the spread of threats. (3) The present invention uses machine learning technology to achieve adaptive adjustment and optimization of security policies. The system can continuously learn and adjust based on real-time data and historical events to adapt to the ever-changing security environment, enhancing the ability to prevent and respond to future threats. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to facilitate understanding by those skilled in the art, the present invention is further described below in conjunction with the accompanying drawings; Figure 1 This is the overall system block diagram of the present invention. DETAILED DESCRIPTION

[0020] The technical solution of the present invention will be clearly and completely described below in conjunction with the embodiments. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0021] It should be understood that the terms "include" and "comprising" used in the specification and claims of the present disclosure indicate the presence of described features, integers, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or collections thereof.

[0022] It should also be understood that the terms used in this disclosure are only for the purpose of describing specific embodiments and are not intended to limit the disclosure. As used in this disclosure and claims, the singular forms of "a", "an", and "the" are intended to include the plural forms unless the context clearly indicates otherwise. It should also be further understood that the term "and / or" used in this disclosure and claims refers to any combination of one or more of the associated listed items and all possible combinations, and includes these combinations.

[0023] like Figure 1 As shown, a server security anti-theft trigger alarm system includes a biometric recognition module, a monitoring module, a judgment module, a warning module and a linkage module; The biometric module is used to verify the identity of users trying to access the server; Obtain the user's biometric samples, such as fingerprints, irises, or facial images, digitize the obtained biometric samples through a biometric device, and store them in a secure database. These data are associated with the user's identity information. When the user needs to access the server, first authenticate the user on the biometric device. The user places his finger on the fingerprint reader, or puts his eyes on the iris scanner, or puts his face on the facial recognition camera. The specific verification process is as follows: When one biometric feature is successfully verified, it will automatically choose whether to further verify other biometric features according to the situation. By detecting the risk level of the current access scenario, when the risk level is greater than the preset standard, other biometric features will be automatically triggered for secondary verification. The risk level is comprehensively analyzed through the following risk indicators: Network stability indicators: Network delay time: measure the network delay from the user device to the server in milliseconds. The higher the delay, the greater the risk. For example, when the delay exceeds the threshold, the risk level increases accordingly. Network packet loss rate: calculate the proportion of data packets lost during data transmission. The higher the packet loss rate, the lower the reliability of communication, and the risk level increases accordingly. The obtained network delay time and network packet loss rate are normalized and substituted into the following formula: To get the network stability value WWP, where wy and wd are the network delay time and network packet loss rate respectively, and this network stability value is used as the standard to measure network stability; Physical environment indicators: Light intensity: The light intensity at the server location is measured by an ambient light sensor. Too dark or too bright light may affect the accuracy of biometrics and may also indicate abnormal environmental conditions; Noise level: The noise sensor is used to detect the decibel level of noise in the surrounding environment. A high noise environment may interfere with voice commands during the biometric process or affect the user's attention, thereby increasing the risk; Temperature and humidity: Temperature and humidity sensors are used to monitor the ambient temperature and humidity around the server. Extreme temperature and humidity conditions may affect the performance of the server and biometric equipment, increasing the risk; The obtained light intensity, noise level, temperature and humidity are normalized and then inserted into the following formula: To get the physical value WPZ, where are the actual light intensity, noise level, temperature and humidity, respectively. The preset standard light intensity, noise level, temperature and humidity are respectively, and the obtained physical evaluation values ​​are used as the standard for measuring the physical environment; Access time indicators: Non-working hours access: record the time when users access the server to determine whether it is within the preset working hours. Non-working hours access may mean a higher risk. When the access time is within the preset working hours, the time judgment value is recorded as 0, otherwise, the time judgment value is recorded as 1; Access frequency change: analyze the frequency of users accessing the server within a period of time. If the access frequency suddenly increases or decreases, it may indicate an abnormal situation. The user's access frequency change rate is compared with the preset change rate standard to determine the degree of deviation, quantify it in percentage, and record it as the frequency deviation value; the obtained time judgment value and frequency deviation value are normalized and summed to obtain the abnormal evaluation value, and this abnormal evaluation value is used as the standard for measuring access time abnormalities; Operation habit indicators: Input speed change: monitor the input speed of the user during the biometric identification process, and calculate the difference between the real-time input speed and the historical average speed of the user to obtain the speed difference value; Number of wrong operations: count the number of wrong operations of the user during the biometric identification process and record it as the wrong operation value; normalize the obtained speed difference value and wrong operation value and sum them to obtain the abnormal value, and use this abnormal value as the standard for measuring abnormal operation habits; Then the obtained network stability value, physical evaluation value, abnormal evaluation value and abnormal value are normalized and entered into the following formula: To get the comprehensive judgment value ZPZ, where WWP, WPZ, YXZ and GYZ are network stability value, physical evaluation value, abnormal evaluation value and learning abnormality value respectively. The preset weight coefficients are respectively the network stability value, physical evaluation value, abnormal evaluation value and learning abnormal value, and the obtained comprehensive judgment value ZPZ is used as the assessment standard of the risk level; the obtained comprehensive judgment value ZPZ is compared with the preset comprehensive judgment threshold value, and when the comprehensive judgment value ZPZ is greater than the preset comprehensive judgment threshold value, it is judged that secondary verification is required.

[0024] The biometric device captures the user's biological features and converts them into digital signals, and compares the captured biometric features with the biometric samples stored in the database; when the biometric features match successfully, the biometric module will generate a verification success signal. When the biometric features do not match, the system will require the user to re-verify, or trigger a security alarm after multiple failures, and the number of failures is set between 5 and 10 times; After successful verification, the biometric module sends an authorization signal to the server's access control system, allowing the user to access the server. When the user is authorized, the server's locking mechanism will be released and the user can perform subsequent operations. Regardless of whether the verification is successful or failed, the biometric module will record the verification time, user ID and verification results, and store this information in the security log for future auditing and monitoring. If abnormal behavior is detected, such as multiple consecutive verification failures, the biometric module will trigger the warning module, issue a security alarm, and may temporarily lock the server until the problem is resolved.

[0025] The monitoring module is used to monitor the physical status and environmental changes of the server in real time; Deploy various sensors at key locations of the server and in the surrounding environment, including vibration sensors, temperature sensors, humidity sensors, infrared motion sensors, access control sensors, pressure sensors, etc. Calibrate all deployed sensors to ensure that they can accurately detect predetermined physical states and environmental changes. The sensors collect data in real time and transmit the data to the central processing unit of the monitoring module. The sensors send the collected data to the data processing center of the monitoring module via wired or wireless means. The data processing center of the monitoring module receives the data from the sensors and performs preliminary processing, such as denoising and formatting. The monitoring module analyzes the processed data and uses preset thresholds and algorithms to detect any abnormal or unauthorized activity. For example, if an infrared sensor detects movement in the server room during non-working hours, or a vibration sensor detects that a server has been illegally moved; all sensor readings and any abnormal events are recorded in the security log for subsequent analysis and auditing. The monitoring module continuously monitors sensor data to ensure the physical security of the server. Whenever an abnormality is detected, the system responds immediately; the monitoring module regularly synchronizes data with the server's operating system and other security systems to ensure that all systems have access to the latest security information; Once the monitoring module detects an abnormal situation, it will immediately send an alarm signal to the judgment module for further analysis and confirmation of whether it is a security threat. The monitoring module receives feedback from the judgment module. If the judgment module confirms that there is a security threat, the monitoring module will assist the warning module and the linkage module to implement corresponding security measures. Specifically: Provide details: The monitoring module provides the warning module with specific data of the abnormal event, including the type of sensor that triggered the abnormality, changes in readings, timestamps and other information. For example, if the abnormality is triggered by a vibration sensor, the monitoring module will inform the warning module of detailed data such as the amplitude, frequency and duration of the vibration; at the same time, the server's location information and current environmental status (such as temperature, humidity, etc.) are also provided so that the warning module can more accurately determine the severity of the threat and take appropriate alarm measures.

[0026] Confirm the legitimacy of the alarm: Verify the legitimacy and accuracy of the alarm signal with the warning module. By cross-verifying the data of different sensors, ensure that it is not a false alarm of a single sensor. If multiple sensors detect anomalies at the same time, such as a vibration sensor and an infrared motion sensor being triggered at the same time, the credibility of the alarm is higher. The monitoring module analyzes historical data and preset patterns to determine whether the current abnormal situation conforms to the known security threat pattern, and further confirm the legitimacy of the alarm. Continuous Monitoring and Feedback: After the warning module sounds the alarm, the monitoring module continues to monitor the physical state and environment of the server. If the abnormal situation deteriorates further or new abnormalities occur, the updated information will be fed back to the warning module in a timely manner so that the alarm level can be adjusted or more urgent measures can be taken. For example, if only slight vibrations are detected initially and then the vibration amplitude increases, the monitoring module will immediately notify the warning module, which can upgrade the alarm according to the situation, such as upgrading from sound and light alarms to text message notifications and automatic phone calls at the same time.

[0027] The judgment module is used to analyze the data from the monitoring module and the biometric recognition module to determine whether there is a security threat; Receive real-time data streams from the monitoring module and biometric module, pre-process the received data, including data cleaning, denoising, normalization, etc., to ensure the accuracy and availability of the data, extract key features from the pre-processed data, which may include abnormal number of biometric attempts, abnormal movement of the server, abnormal changes in environmental parameters, etc.; use machine learning algorithms or rule engines to perform pattern recognition on the extracted features to identify possible security threats, and conduct threat assessment on the identified patterns to determine whether they constitute a security threat. The specific process is as follows: Extract data recorded by the monitoring module and biometric module in the past period of time (such as the past month, quarter or year) from the security log, including the number of biometric attempts, server movement, environmental parameter changes, and corresponding timestamps, user IDs and other information. At the same time, collect data from other relevant security systems (if any), such as network traffic monitoring systems, intrusion detection systems, etc., to obtain more comprehensive historical security information; clean the collected historical data, remove duplicate data, erroneous data and outliers, and perform data normalization to unify different types of data to the same scale for comparison; Based on the cleaned historical data, establish a baseline model of normal behavior. Statistical methods, such as calculating the average value, standard deviation, etc., can be used to determine the number of biometric attempts and the range of environmental parameters under normal circumstances; for example, by analyzing the biometric data of the past month, it is determined that the average number of normal biometric attempts per day is X times, and the standard deviation is Y times. Then, when judging the current data, if the number of biometric attempts exceeds the range of X±Z*Y (Z is a coefficient determined according to the security policy), it may be considered abnormal; compare the real-time data currently received from the monitoring module and the biometric module with the historical data. The comparison includes whether the number of biometric attempts exceeds the normal range, whether the movement of the server is consistent with the historical pattern, whether the changes in environmental parameters are abnormal, etc.; According to the security strategy and actual situation, the weights of different threat factors are determined. Specifically, the weight values ​​can be determined through expert evaluation, data analysis and other methods to ensure the rationality and accuracy of the weights; based on the weights of threat factors and the analysis results of historical data, the threat level classification standards are formulated. The threat level can be divided into three levels: high, medium and low; with the continuous influx of new data and changes in the security situation, the threat level classification standards are regularly adjusted and optimized. For example, if a new security threat pattern is discovered, it is necessary to adjust the weights and level classification standards of threat factors in a timely manner to ensure accurate judgment of security threats. At the same time, according to the results of real-time data analysis, the threat level of the current event is dynamically adjusted. If more abnormal situations are found in the further data collection and analysis process, the threat level may be increased; conversely, if subsequent data shows that the situation is not so serious, the threat level can be reduced.

[0028] Based on the results of the threat assessment, corresponding decisions are made. If a security threat is determined to exist, the warning module will be triggered. If the assessment result is unclear, further data collection and analysis are required, and alarm thresholds are set to distinguish between normal operations and security threats. The alarm thresholds are adjusted based on historical data and security policies. The judgment module continuously monitors the data stream, analyzes and updates the threat assessment in real time, and records all analysis results and decisions in the security log for subsequent audit and analysis, and provides feedback to the monitoring module and biometric module so that they can adjust their behavior, such as increasing the sensitivity of monitoring or recalibrating biometric equipment.

[0029] The warning module is used to send out an alarm signal when the judgment module determines that there is a security threat; Wait for the signal from the judgment module, which indicates that a security threat has been detected. After receiving the threat signal, verify the legitimacy and accuracy of the signal to ensure that it is not a false alarm; determine the severity of the threat based on the information provided by the judgment module and set the corresponding alarm level; select the appropriate alarm method based on the alarm level and the preset alarm strategy, including sound and light alarm, SMS notification, email notification, automatic phone call, etc.; When the sound and light alarm is configured, the warning module will activate the siren in the area where the server is located, emitting a loud sound and flashing light to attract the attention of on-site personnel, and send text messages or emails to the mobile devices of the preset administrator or security personnel to notify them of the existence of security threats; automatically call the preset security personnel or administrator's phone number for voice notification; record detailed information of all alarm events, including time, location, threat type, alarm method, etc., and store this information in the security log. The warning module sends a signal to the linkage module to trigger a linkage response with the server operating system or other security systems, such as locking the server, closing the entrance, starting video surveillance, etc.; after the alarm is issued, the warning module continues to monitor the situation to determine whether the threat has been resolved or further alarms are required. Once the threat is confirmed to be lifted, the warning module will send an alarm cancellation signal and notify all relevant personnel.

[0030] The linkage module is used to link with the server operating system or other security systems to enhance security protection; Obtain an alarm signal from the warning module, which indicates that a security threat has been identified. Based on the type and severity of the alarm, the linkage module determines a corresponding linkage strategy, which may include locking the server, shutting down the network connection, starting video surveillance, etc. The linkage module sends instructions to the server operating system to lock the server to prevent unauthorized data access and operation, cut off the server's network connection to prevent data leakage or network attacks, and activate the video surveillance system in the area where the server is located to record the on-site situation and provide video evidence for subsequent security analysis; At the same time, it controls the access control system of the server room, locks or unlocks the door to control the entry and exit of personnel, and adjusts the environmental settings of the server room, such as temperature and humidity, to protect the server from damage by environmental factors; records the detailed information of all linkage operations, including time, operation type, execution results, etc., and stores this information in the security log to notify security personnel or system administrators so that they can take further actions; after the threat is lifted, prepare to perform system recovery operations, such as restarting the server, restoring network connections, etc.; and provide decision support for administrators through the recovery mechanism. The recovery mechanism process is as follows: After the threat is removed, the server status is automatically evaluated and recovery operations are automatically performed based on the evaluation results. Specifically, the server's file system integrity and database status are automatically checked, and then the corresponding recovery procedures, such as file repair and database recovery, are automatically started. Machine learning algorithms are used to predict the time and success rate of recovery operations to provide decision support for security personnel. For example, based on historical data and current security threats, the time required for server restart and possible problems can be predicted so that security personnel can prepare in advance. After the recovery operation is completed, the server is fully verified to ensure that the system has returned to normal, including functional testing, performance testing, etc., to ensure that the server's functions and performance indicators are restored to the state before the security threat occurred; analyze the results of the recovery operation, summarize the lessons learned, and optimize the recovery strategy of the linkage module. For example, if a recovery operation is found to be ineffective, the recovery process can be adjusted or new recovery measures can be added to improve the ability to respond to security threats in the future.

[0031] Evaluate the effectiveness of the linkage operation to determine whether the security threat has been successfully prevented; feed back the results of the linkage operation to the judgment module and the warning module so that they can adjust future alarms and linkage strategies.

[0032] The preferred embodiments of the present invention disclosed above are only used to help explain the present invention. The preferred embodiments do not describe all the details in detail, nor do they limit the invention to only specific implementation methods. Obviously, many modifications and changes can be made according to the content of this specification. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the present invention, so that those skilled in the art can understand and use the present invention well. The present invention is limited only by the claims and their full scope and equivalents.

Claims

1. A server security anti-theft trigger alarm system, characterized in that: include: A biometric module to verify the identity of users trying to access the server; Monitoring module, used to monitor the physical status and environmental changes of the server in real time; The judgment module is used to analyze the data of the monitoring module and the biometric recognition module to determine whether there is a security threat; The warning module is used to send out an alarm signal when the judgment module determines that there is a security threat; The linkage module is used to link with the server operating system or other security systems to enhance security protection.

2. A server security anti-theft trigger alarm system according to claim 1, characterized in that: The process by which the biometric module verifies the identity of a user attempting to access the server is as follows: Obtain biometric samples of user fingerprints, irises or facial images, digitize them, store them in a secure database and associate them with user identity information; When a user accesses a server, they authenticate through a verification process using a biometric device, including a fingerprint reader, iris scanner, or facial recognition camera, where the biometric device converts the captured biometric features into a digital signal and compares it with a database sample; If the features match successfully, a verification success signal is generated, and an authorization signal is sent to the server access control system to unlock the server and allow the user to perform subsequent operations. If there is no match, the user is required to re-verify, and a security alarm is triggered after the preset number of failures. Regardless of the verification result, the verification time, user ID and result are recorded and stored in the security log for auditing and monitoring; When abnormal behavior such as multiple consecutive authentication failures is detected, the warning module is triggered to issue a security alert and temporarily lock the server until the problem is resolved.

3. A server security anti-theft trigger alarm system according to claim 2, characterized in that: The specific steps of the verification process are as follows: When one biometric feature is successfully verified, it will automatically select whether to further verify other biometric features according to the situation. By detecting the risk level of the current access scenario, when the risk level is greater than the preset standard, it will automatically trigger other biometric features for secondary verification; The risk level is comprehensively analyzed through risk indicators to obtain network stability value, physical evaluation value, abnormal evaluation value and habit abnormality value: the risk indicators include network stability index, physical environment index, access time index and operation habit index; The obtained network stability value, physical evaluation value, abnormal evaluation value and abnormal value are normalized and then input into the following formula: To get the comprehensive judgment value ZPZ, where WWP, WPZ, YXZ and GYZ are network stability value, physical evaluation value, abnormal evaluation value and learning abnormality value respectively. The preset weight coefficients are network stability value, physical evaluation value, abnormal evaluation value and learning abnormal value, and the obtained comprehensive judgment value is used as the evaluation standard of risk level; The obtained comprehensive judgment value is compared with the preset comprehensive judgment threshold. When the comprehensive judgment value is greater than the preset comprehensive judgment threshold, it is determined that a secondary verification is required.

4. A server security anti-theft trigger alarm system according to claim 3, characterized in that: The specific operation steps of the network stability value, physical evaluation value, abnormal evaluation value and abnormal value analysis are as follows: Network stability indicators: Network latency: measures the network latency from the user device to the server in milliseconds; Network packet loss rate: calculates the proportion of data packets lost during data transmission; Normalize the obtained network delay time and network packet loss rate and substitute them into the following formula: To get the network stability value WWP, where wy and wd are the network delay time and network packet loss rate respectively, and this network stability value is used as the standard to measure network stability; Physical environment indicators: Light intensity: The light intensity at the server location is measured using an ambient light sensor; Noise level: Use noise sensors to detect the noise decibel level of the surrounding environment; Temperature and humidity: Use temperature and humidity sensors to monitor the ambient temperature and humidity around the server; The obtained light intensity, noise level, temperature and humidity are normalized and then input into the following formula: To get the physical value WPZ, where are the actual light intensity, noise level, temperature and humidity, respectively. The preset standard light intensity, noise level, temperature and humidity are respectively, and the obtained physical evaluation values ​​are used as the standard for measuring the physical environment; Access time metrics: Non-working hours access: record the time when the user accesses the server and judge whether it is within the preset working hours. If the access time is within the preset working hours, the time judgment value is recorded as 0, otherwise, the time judgment value is recorded as 1. Access frequency change: Analyze the frequency of users accessing the server within a preset time period, and compare the user access frequency change rate with the preset change rate standard to determine the degree of deviation, quantify it in percentage, and record it as the frequency deviation value; The obtained time judgment value and frequency deviation value are normalized and then summed to obtain an abnormal evaluation value, which is used as a standard for measuring access time anomalies; Operating habit indicators: Input speed change: monitor the user's input speed during the biometric identification process, and calculate the difference between the real-time input speed and the user's historical average speed to obtain the speed difference value; Number of wrong operations: count the number of wrong operations of users during the biometric identification process and record it as the wrong operation value; The obtained speed difference value and wrong operation value are normalized and then summed to obtain the abnormal value, which is used as the standard for measuring abnormal operation habits.

5. A server security anti-theft trigger alarm system according to claim 1, characterized in that: The specific operation steps of the monitoring module to monitor the physical status and environmental changes of the server in real time are as follows: Deploy vibration, temperature, humidity, infrared motion, access control, and pressure sensors in and around key parts of the server; Calibrate the sensor so that it can accurately detect the predetermined state and changes. The sensor collects data in real time and transmits it to the central processing unit of the monitoring module; The data processing center receives sensor data, performs preliminary processing such as denoising and formatting, analyzes the processed data, and uses preset thresholds and algorithms to detect abnormal or unauthorized activities; Record sensor readings and abnormal events in security logs, continuously monitor to ensure the physical security of servers, and respond immediately when abnormalities are detected; Regularly synchronize data with server operating systems and other security systems; When an abnormal situation is detected, an alarm signal is sent to the judgment module, and feedback is received from the judgment module. If a security threat is confirmed, the warning module and the linkage module are assisted to execute safety measures.

6. A server security anti-theft trigger alarm system according to claim 5, characterized in that: The specific operation steps of the monitoring module assisting the warning module and the linkage module in executing safety measures are as follows: Provide specific information: Provide the alert module with specific data about the abnormal event, including the type of sensor that triggered the abnormality, the reading change and the timestamp, as well as the server location and environmental status information to assist in determining the severity of the threat and selecting the alert method; Confirm the legitimacy of the alarm: cross-verify different sensor data with the alarm module to ensure that no single sensor is falsely alarmed, and analyze whether the current anomaly conforms to the known security threat model based on historical data and preset patterns; Continuous monitoring and feedback: After the warning module issues an alarm, it continues to monitor the server status. If the abnormality worsens or there is a new abnormality, it will promptly feedback updated information to adjust the alarm level in time or take more urgent measures.

7. A server security anti-theft trigger alarm system according to claim 1, characterized in that: The specific operation steps of the judgment module to judge whether there is a security threat are as follows: Receive real-time data streams from monitoring and biometric modules, perform data cleaning, denoising, and normalization preprocessing, and extract key features, including abnormal number of biometric attempts, abnormal server movement, and abnormal changes in environmental parameters; Through machine learning algorithms or rule engines, the features are pattern-recognized, threats are assessed, and whether a security threat is constituted is determined. If a threat is determined, the warning module is triggered. Otherwise, further data is collected and analyzed and the alarm threshold is adjusted. Continuously monitor data streams, update threat assessments in real time, record analysis results and decisions in security logs, and provide feedback to monitoring and biometric modules to adjust their behavior, including increasing monitoring sensitivity or recalibrating biometric devices.

8. A server security anti-theft trigger alarm system according to claim 7, characterized in that: The operation steps of the judgment module judging whether the threat assessment constitutes a security threat are as follows: Data collection: Extract historical data from security logs, monitoring and biometric modules and related security systems, including the number of biometric attempts, server movement, and environmental parameter changes; Data processing: clean historical data, remove duplications, errors and outliers, and normalize for comparison; Establish a baseline model: Determine the range of normal behavior through statistical methods, including determining the average number of attempts and standard deviation based on biometric data, and consider those outside the range as abnormal; Real-time data comparison: compare the current real-time data with historical data, including the number of biometric attempts, server movement, and whether changes in environmental parameters are abnormal; Determine weights: Determine the weights of different threat factors through expert evaluation and data analysis; Establishing level standards: Establishing high, medium and low threat level standards based on weights and historical data analysis results; Dynamic Adjustment: Adjust weights and rating standards as new data and security situations change, and dynamically adjust the threat level of current events based on real-time data analysis.

9. A server security anti-theft trigger alarm system according to claim 1, characterized in that: The specific operation steps of the warning module sending out an alarm signal are as follows: Receive the judgment module signal, verify its legitimacy and accuracy to prevent false alarms, determine the severity of the threat based on the judgment module information, set the alarm level, and select the sound and light alarm, SMS notification, email notification, or phone call alarm method based on the level and preset strategy; If an audible and visual alarm is configured, the server area alarm is activated and a text message, email, or automatic phone call notification is sent to the administrator or security personnel; Record the detailed information of the alarm event and store it in the security log, and send a signal to the linkage module to trigger a linkage response; After the alarm is issued, continue monitoring to determine whether the threat has been lifted. If lifted, issue an alarm cancellation signal and notify relevant personnel.

10. A server security anti-theft trigger alarm system according to claim 1, characterized in that: The specific operation steps of linking the linkage module with the server operating system or other security system are as follows: Receive alarm signals from the warning module and determine linkage strategies based on the alarm type and severity; Send instructions to the server operating system to execute linkage strategies, including locking the server, disconnecting the network, activating video surveillance, controlling the access control system, and adjusting environmental settings; Record the linkage operation details in the security log and notify the security personnel or administrator; Automatically evaluate the server status after the threat is resolved and automatically perform recovery operations based on the results; Use machine learning algorithms to predict recovery operation time and success rate to provide decision support for security personnel; After the recovery operation is completed, fully verify the server to ensure normal recovery, analyze the results and optimize the recovery strategy; Evaluate the effectiveness of linkage operations to determine whether security threats have been successfully prevented; Feed the results back to the judgment module and warning module to adjust future alarms and linkage strategies.

Images