Computer security protection system based on artificial intelligence

Abstract

The invention relates to the technical field of computer security protection, in particular to a computer security protection system based on artificial intelligence, which comprises a user side, a data sensing module, a physical access monitoring module, a hard disk behavior monitoring module, a protection decision analysis module, an execution module, a mobile storage device management and control module and a storage module. Physical access monitoring information is obtained by analyzing personnel behavior monitoring data, hard disk behavior monitoring information is obtained by analyzing manual hard disk operation data, and protection decision information is obtained by comprehensively analyzing the physical access monitoring information and the hard disk behavior monitoring information. Stealing behaviors of internal personnel or external lawbreakers are protected according to the protection decision information, so that the prevention strength of data stealing is increased; and the accessed mobile storage device is identified and controlled through the mobile storage device control module, and only the authorized mobile storage device can perform data read-write operation, so that an unauthorized copying behavior can be effectively prevented.

Description

Technical Field

[0001] The present invention relates to the field of computer security protection technology, and in particular to a computer security protection system based on artificial intelligence. Background Art

[0002] In today's highly digital and information-based era, computer systems and networks are increasingly used in various fields, from business operations, financial transactions to personal communications and entertainment; however, with the rapid development of the times, threats to computer security are becoming more complex and diverse, and traditional computer security protection methods are facing severe challenges.

[0003] At present, the existing computer security protection system is mainly used for network security, and has little prevention against physical data theft such as hard disk theft and copying. In some enterprises, despite the adoption of network firewalls, intrusion detection and other network security measures, due to insufficient physical access control, internal personnel or external criminals may still steal important information by directly dismantling the hard disk, using unauthorized mobile storage devices to copy data, etc., causing huge losses to the enterprise. Summary of the invention

[0004] The present invention provides a computer security protection system based on artificial intelligence to solve the above-mentioned technical problems.

[0005] The first aspect of the present invention provides an artificial intelligence-based computer security protection system, including a user end, a data perception module, a physical access monitoring module, a hard disk behavior monitoring module, a protection decision analysis module, an execution module, a mobile storage device management module and a storage module.

[0006] The user end includes a user registration unit and a user analysis unit; the user registration unit is used to collect the registration information of each user and send the registration information of each user to the user analysis unit; the registration information includes name, communication number, biometric data and rank data.

[0007] The user analysis unit is used to obtain the registration information of each user and analyze the registration information of each user to obtain the user's authorization information, identify the registration information of each user to obtain the job grade data of each user, and open the corresponding authorization information according to the user's job grade data. Among them, the users include temporary users, the identity of the temporary users is identified and the corresponding authorization information is opened to them. Temporary users include but are not limited to security analysts, data encryption experts, vulnerability assessment and penetration testers and physical security experts.

[0008] The data perception module obtains monitoring image data and hard disk information data through the camera and the sensor and sends the monitoring image data and hard disk information data to the storage module.

[0009] The physical access monitoring module is used to obtain monitoring image data and identify the monitoring image data to obtain personnel behavior monitoring data, analyze the personnel behavior monitoring data to obtain physical access monitoring information, and send the physical access monitoring information to the storage module.

[0010] As a further improvement of the present invention, the personnel behavior monitoring data is analyzed, and the specific analysis method is as follows: The personnel behavior monitoring data is identified to obtain the facial features and monitoring behavior characteristics of the monitored personnel in the monitoring area, the biometric data corresponding to the registration information of each user on the user end is obtained, the facial information and fingerprint information of each user is obtained based on the biometric data, and the facial features of the monitored personnel corresponding to the personnel behavior monitoring data are matched with the facial information corresponding to the registration information of each user. When the facial features of the monitored personnel do not belong to the facial information of each user, the corresponding personnel are marked as external personnel, otherwise, the corresponding personnel are marked as internal personnel.

[0011] When the corresponding person is an external person, if the external person is not a temporary user, the corresponding protection information is generated; if the external person is a temporary user, the monitoring behavior characteristics corresponding to the temporary user are obtained, and the authorization information corresponding to the temporary user is obtained, and the monitoring behavior characteristics of the temporary user are matched with the authorization information. When the monitoring behavior characteristics of the temporary user do not match the authorization information, the corresponding protection information is generated.

[0012] When the corresponding personnel are internal personnel, the authorization information of each internal personnel is obtained. If the monitoring behavior characteristics corresponding to the internal personnel do not match the authorization information corresponding to the internal personnel, the corresponding protection information is generated; if the monitoring behavior characteristics corresponding to the internal personnel match the authorization information corresponding to the internal personnel, the authorized internal personnel are recorded, the unit monitoring time is set, and the residence time of the authorized internal personnel in the corresponding monitoring area within the unit monitoring time is counted. The historical residence time of each authorized personnel within multiple historical unit monitoring times in the historical data is obtained, and the multiple historical residence times are calculated to obtain the average value and the value is marked Recorded as the reference residence time, the current internal staff's residence time is compared with the corresponding reference residence time. If the current internal staff's residence time exceeds the reference residence time, the internal staff's residence time is subtracted from the reference residence time to get the abnormal residence increment time, and the pre-set abnormal residence increment threshold is obtained. The abnormal residence increment time of the current internal staff is compared with the abnormal residence increment threshold. When the abnormal residence increment time is greater than the abnormal residence increment threshold, the corresponding protection information is generated; the protection information corresponding to the external staff and the protection information corresponding to the internal staff are integrated to obtain the rational access monitoring information.

[0013] The hard disk behavior monitoring module is used to obtain hard disk information data and identify the hard disk information data to obtain human-operated hard disk data, analyze the human-operated hard disk data to obtain hard disk behavior monitoring information, and send the hard disk behavior monitoring information to the storage module.

[0014] As a further improvement of the present invention, the human-operated hard disk data is analyzed, and the specific analysis method is as follows: The hard disk data operated by humans is identified to obtain the hard disk online information, hard disk read and write information and access information; the hard disk online information is identified by the sensor to obtain the online status of each hard disk; when the hard disk is removed, the corresponding hard disk online status is marked as the offline status; the hard disk offline time is counted and recorded as the hard disk offline time; the hard disk offline time is divided into multiple time intervals, each time interval corresponds to a time risk value; the offline time corresponding to the current hard disk is matched with multiple time intervals to obtain the time risk value corresponding to the hard disk offline time.

[0015] Identify the hard disk read and write information to obtain the hard disk read and write speed and reading time; compare the read and write speed corresponding to the hard disk read and write information with the set threshold; if the read and write speed corresponding to the hard disk read and write information is greater than the set threshold, mark the corresponding hard disk read and write speed as an abnormal read and write speed, extract the abnormal read and write time corresponding to the abnormal read and write speed of the hard disk information, calculate the abnormal read and write speed and the abnormal read and write time to obtain the abnormal read and write data volume, obtain a pre-set data volume read and write threshold and compare the abnormal read and write data volume with the data volume read and write threshold; when the abnormal read and write data volume is greater than the data volume read and write threshold, calculate the difference between the abnormal read and write data volume and the data volume read and write threshold and mark the difference as the read and write risk index.

[0016] Based on the access information corresponding to the hard disk data manually operated, the access time and access content are obtained, and a pre-set time interval is obtained. The time interval is a working time interval and a non-working time interval. The access time corresponding to the current access information is matched with the time interval. If the current access time is in the non-working time interval, the corresponding access information is marked as risky access information, and the access content corresponding to the risky access information is obtained. The access content corresponding to the risky access information is identified to obtain the important content of the access content, the data volume of the important content is counted, and the previous and next contents of the important content are identified to obtain the content continuity of the important content. When the important content has no continuity with the previous and next contents, the corresponding important content is marked as high-risk important content, and the data volume corresponding to the high-risk important content is marked as an access risk index; the working hours can be from 9:00 to 12:00 and from 14:00 to 17:30, and the rest of the time is regarded as non-working time.

[0017] A quadrilateral is constructed with the duration risk value and the read / write risk index as the long and short sides of the quadrilateral. A straight line is drawn perpendicular to the quadrilateral with the center of the quadrilateral as the starting point. The length of the straight line is equal to the value of the access risk index. A quadrangular pyramid is constructed with the quadrilateral and the straight line. The volume of the pyramid is calculated and the value of the volume is marked as the hard disk monitoring impact value. When the hard disk monitoring impact value is greater than the set threshold, hard disk behavior monitoring information is generated as hard disk behavior monitoring anomaly.

[0018] The protection decision analysis module is used to obtain physical access monitoring information and hard disk behavior monitoring information, and to perform comprehensive analysis on the physical access monitoring information and hard disk behavior monitoring information to obtain protection decision information, and then send the protection decision information to the execution module.

[0019] As a further improvement of the present invention, a comprehensive analysis is performed on the physical access monitoring information and the hard disk behavior monitoring information. The specific analysis method is as follows: Physical access monitoring information is identified to obtain protection information of external personnel and protection information of internal personnel, and the protection information of external personnel and internal personnel is matched with hard disk behavior monitoring information to obtain hard disk behavior monitoring information corresponding to the protection information of external personnel and internal personnel; hard disk behavior monitoring information is identified, and if the hard disk behavior monitoring information corresponding to the protection information of external personnel and internal personnel is normal, the protection information of external personnel and internal personnel is used as corresponding early warning information, and the early warning information is associated with the corresponding personnel as corresponding alarm decision information; on the contrary, when the hard disk behavior monitoring information is abnormal, the registration information of the corresponding external personnel or internal personnel is obtained and alarm decision information associated with the corresponding personnel is generated.

[0020] The execution module is used to receive protection decision information and perform corresponding execution operations according to the protection decision information.

[0021] As a further improvement of the present invention, the execution module includes a mobile storage device management and control module, which is used to identify and control the connected mobile storage devices, specifically: the mobile storage device is identified through authorization identification in the computer, and when the authorization identification is passed, the read and write permissions are opened to the mobile storage device that passes the authorization identification; conversely, the mobile storage device that does not pass the authorization cannot obtain read and write permissions; the authorized mobile storage devices are numbered, and the numbers are associated with users on the user side to obtain the users corresponding to the authorized mobile storage devices.

[0022] The storage module is used to store user registration information of the user end, and store monitoring image data, hard disk information data and alarm decision information.

[0023] Compared with the prior art, the technical solution provided by the present invention has the following beneficial effects: 1. The present invention obtains physical access monitoring information by analyzing personnel behavior monitoring data, obtains hard disk behavior monitoring information by analyzing human-operated hard disk data, and obtains protection decision information by comprehensively analyzing the physical access monitoring information and the hard disk behavior monitoring information. According to the protection decision information, protection is provided against the theft by internal personnel or external lawless elements, thereby increasing the prevention of physical data theft.

[0024] 2. The present invention identifies and controls the connected mobile storage devices through the mobile storage device management and control module. Only authorized mobile storage devices can perform data read and write operations, which can effectively prevent unauthorized copying and increase protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following briefly introduces the drawings required for use in the description of the embodiments. The following drawings are not intentionally scaled to the actual size, and the focus is on illustrating the main purpose of the present application.

[0026] Figure 1 It is a principle block diagram of the present invention. DETAILED DESCRIPTION

[0027] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0028] For ease of understanding, the specific process of the embodiment of the present invention is described below. Figure 1 In an embodiment of the present invention, an embodiment of a computer security protection system based on artificial intelligence includes: a user end, a data perception module, a physical access monitoring module, a hard disk behavior monitoring module, a protection decision analysis module, an execution module, a mobile storage device management and control module and a storage module.

[0029] The user end includes a user registration unit and a user analysis unit; the user registration unit is used to collect the registration information of each user and send the registration information of each user to the user analysis unit; the registration information includes name, communication number, biometric data and rank data.

[0030] The user analysis unit obtains the registration information of each user and analyzes the registration information of each user to obtain the user's authorization information, identifies the registration information of each user to obtain the job grade data of each user, and opens corresponding authorization information according to the user's job grade data. Among them, the users include temporary users, the identities of temporary users are identified and corresponding authorization information is opened to them. Temporary users include but are not limited to security analysts, data encryption experts, vulnerability assessment and penetration testers, and physical security experts.

[0031] The data perception module obtains monitoring image data and hard disk information data through the camera and the sensor and sends the monitoring image data and hard disk information data to the storage module.

[0032] The physical access monitoring module acquires monitoring image data and identifies the monitoring image data to obtain personnel behavior monitoring data, analyzes the personnel behavior monitoring data to obtain physical access monitoring information, and sends the physical access monitoring information to the storage module.

[0033] The personnel behavior monitoring data is analyzed in the following specific ways: The personnel behavior monitoring data is identified to obtain the facial features and monitoring behavior characteristics of the monitored personnel in the monitoring area, the biometric data corresponding to the registration information of each user on the user end is obtained, the facial information and fingerprint information of each user is obtained based on the biometric data, and the facial features of the monitored personnel corresponding to the personnel behavior monitoring data are matched with the facial information corresponding to the registration information of each user. When the facial features of the monitored personnel do not belong to the facial information of each user, the corresponding personnel are marked as external personnel, otherwise, the corresponding personnel are marked as internal personnel.

[0034] When the corresponding person is an external person, if the external person is not a temporary user, the corresponding protection information is generated; if the external person is a temporary user, the monitoring behavior characteristics corresponding to the temporary user are obtained, and the authorization information corresponding to the temporary user is obtained, and the monitoring behavior characteristics of the temporary user are matched with the authorization information. When the monitoring behavior characteristics of the temporary user do not match the authorization information, the corresponding protection information is generated.

[0035] When the corresponding personnel are internal personnel, the authorization information of each internal personnel is obtained. If the monitoring behavior characteristics corresponding to the internal personnel do not match the authorization information corresponding to the internal personnel, the corresponding protection information is generated; if the monitoring behavior characteristics corresponding to the internal personnel match the authorization information corresponding to the internal personnel, the authorized internal personnel are recorded, the unit monitoring time is set, and the residence time of the authorized internal personnel in the corresponding monitoring area within the unit monitoring time is counted. The historical residence time of each authorized personnel within multiple historical unit monitoring times in the historical data is obtained, and the multiple historical residence times are calculated to obtain the average value and the value is marked Recorded as the reference residence time, the current internal staff's residence time is compared with the corresponding reference residence time. If the current internal staff's residence time exceeds the reference residence time, the internal staff's residence time is subtracted from the reference residence time to get the abnormal residence increment time, and the pre-set abnormal residence increment threshold is obtained. The abnormal residence increment time of the current internal staff is compared with the abnormal residence increment threshold. When the abnormal residence increment time is greater than the abnormal residence increment threshold, the corresponding protection information is generated; the protection information corresponding to the external staff and the protection information corresponding to the internal staff are integrated to obtain the rational access monitoring information.

[0036] The hard disk behavior monitoring module acquires hard disk information data and identifies the hard disk information data to obtain human-operated hard disk data, analyzes the human-operated hard disk data to obtain hard disk behavior monitoring information, and sends the hard disk behavior monitoring information to the storage module.

[0037] The specific analysis method for manually operated hard disk data is as follows: The hard disk data operated by humans is identified to obtain the hard disk online information, hard disk read and write information and access information; the hard disk online information is identified by the sensor to obtain the online status of each hard disk; when the hard disk is removed, the corresponding hard disk online status is marked as the offline status; the hard disk offline time is counted and recorded as the hard disk offline time; the hard disk offline time is divided into multiple time intervals, each time interval corresponds to a time risk value; the offline time corresponding to the current hard disk is matched with multiple time intervals to obtain the time risk value corresponding to the hard disk offline time.

[0038] Identify the hard disk read and write information to obtain the hard disk read and write speed and reading time; compare the read and write speed corresponding to the hard disk read and write information with the set threshold; if the read and write speed corresponding to the hard disk read and write information is greater than the set threshold, mark the corresponding hard disk read and write speed as an abnormal read and write speed, extract the abnormal read and write time corresponding to the abnormal read and write speed of the hard disk information, calculate the abnormal read and write speed and the abnormal read and write time to obtain the abnormal read and write data volume, obtain a pre-set data volume read and write threshold and compare the abnormal read and write data volume with the data volume read and write threshold; when the abnormal read and write data volume is greater than the data volume read and write threshold, calculate the difference between the abnormal read and write data volume and the data volume read and write threshold and mark the difference as the read and write risk index.

[0039] Based on the access information corresponding to the hard disk data manually operated, the access time and access content are obtained, and a pre-set time interval is obtained. The time interval is a working time interval and a non-working time interval. The access time corresponding to the current access information is matched with the time interval. If the current access time is in the non-working time interval, the corresponding access information is marked as risky access information, and the access content corresponding to the risky access information is obtained. The access content corresponding to the risky access information is identified to obtain the important content of the access content, the data volume of the important content is counted, and the previous and next contents of the important content are identified to obtain the content continuity of the important content. When the important content has no continuity with the previous and next contents, the corresponding important content is marked as high-risk important content, and the data volume corresponding to the high-risk important content is marked as an access risk index; the working hours can be from 9:00 to 12:00 and from 14:00 to 17:30, and the rest of the time is regarded as non-working time.

[0040] A quadrilateral is constructed with the duration risk value and the read / write risk index as the long and short sides of the quadrilateral. A straight line is drawn perpendicular to the quadrilateral with the center of the quadrilateral as the starting point. The length of the straight line is equal to the value of the access risk index. A quadrangular pyramid is constructed with the quadrilateral and the straight line. The volume of the pyramid is calculated and the value of the volume is marked as the hard disk monitoring impact value. When the hard disk monitoring impact value is greater than the set threshold, hard disk behavior monitoring information is generated as hard disk behavior monitoring anomaly.

[0041] The protection decision analysis module obtains physical access monitoring information and hard disk behavior monitoring information, performs comprehensive analysis on the physical access monitoring information and hard disk behavior monitoring information to obtain protection decision information, and sends the protection decision information to the execution module.

[0042] Comprehensive analysis of physical access monitoring information and hard disk behavior monitoring information is performed as follows: Physical access monitoring information is identified to obtain protection information of external personnel and protection information of internal personnel, and the protection information of external personnel and internal personnel is matched with hard disk behavior monitoring information to obtain hard disk behavior monitoring information corresponding to the protection information of external personnel and internal personnel; hard disk behavior monitoring information is identified, and if the hard disk behavior monitoring information corresponding to the protection information of external personnel and internal personnel is normal, the protection information of external personnel and internal personnel is used as corresponding early warning information, and the early warning information is associated with the corresponding personnel as corresponding alarm decision information; on the contrary, when the hard disk behavior monitoring information is abnormal, the registration information of the corresponding external personnel or internal personnel is obtained and alarm decision information associated with the corresponding personnel is generated.

[0043] The execution module receives the protection decision information and performs corresponding execution operations according to the protection decision information.

[0044] The execution module includes a mobile storage device management and control module, which is used to identify and control the connected mobile storage devices, specifically: the mobile storage device is identified through the authorization identification in the computer, and when the authorization identification is passed, the read and write permissions are opened to the mobile storage device that has passed the authorization identification; conversely, the mobile storage device that has not passed the authorization cannot obtain the read and write permissions; the authorized mobile storage devices are numbered, and the numbers are associated with the users on the user side to obtain the users corresponding to the authorized mobile storage devices.

[0045] The storage module stores user registration information of the user end, and stores monitoring image data, hard disk information data and alarm decision information.

[0046] As described above, the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features thereof may be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A computer security protection system based on artificial intelligence, characterized in that: It includes a user end, a data perception module, an execution module and a storage module, and also includes: A physical access monitoring module is used to obtain monitoring image data and identify the monitoring image data to obtain personnel behavior monitoring data, analyze the personnel behavior monitoring data to obtain physical access monitoring information, and send the physical access monitoring information to the storage module; A hard disk behavior monitoring module is used to obtain hard disk information data and identify the hard disk information data to obtain human-operated hard disk data, analyze the human-operated hard disk data to obtain hard disk behavior monitoring information, and send the hard disk behavior monitoring information to the storage module; The protection decision analysis module is used to obtain physical access monitoring information and hard disk behavior monitoring information, and conduct a comprehensive analysis of the physical access monitoring information and the hard disk behavior monitoring information to obtain protection decision information, and send the protection decision information to the execution module; conduct a comprehensive analysis of the physical access monitoring information and the hard disk behavior monitoring information, specifically: identify the physical access monitoring information to obtain the protection information of external personnel and the protection information of internal personnel, match the protection information of external personnel and internal personnel with the hard disk behavior monitoring information, and obtain the hard disk behavior monitoring information corresponding to the protection information of external personnel and internal personnel; identify the hard disk behavior monitoring information, if the hard disk behavior monitoring information corresponding to the protection information of external personnel and internal personnel is normal, use the protection information of external personnel and internal personnel as corresponding early warning information, and associate the early warning information with the corresponding personnel as corresponding alarm decision information; on the contrary, when the hard disk behavior monitoring information is abnormal, obtain the registration information of the corresponding external personnel or internal personnel and generate alarm decision information associated with the corresponding personnel.

2. The computer security protection system based on artificial intelligence according to claim 1 is characterized in that: The user terminal includes a user registration unit and a user analysis unit; the user registration unit is used to collect the registration information of each user and send the registration information of each user to the user analysis unit; The user analysis unit is used to obtain the registration information of each user and analyze the registration information of each user to obtain the user's authorization information, identify the registration information of each user to obtain the job grade data of each user, and open the corresponding authorization information according to the user's job grade data. Among them, the users include temporary users, the identity of the temporary users is identified and the corresponding authorization information is opened to them.

3. The computer security protection system based on artificial intelligence according to claim 1 is characterized in that: The data perception module obtains monitoring image data and hard disk information data through a camera and a sensor and sends the monitoring image data and hard disk information data to the storage module.

4. The computer security protection system based on artificial intelligence according to claim 1 is characterized in that: The specific analysis method of analyzing the personnel behavior monitoring data is as follows: Identify the personnel behavior monitoring data to obtain the face and behavior characteristics of the monitoring personnel in the monitoring area, obtain the biometric data corresponding to the registration information of each user on the user end, obtain the facial information and fingerprint information of each user based on the biometric data, match the face of the monitoring personnel corresponding to the personnel behavior monitoring data with the facial information corresponding to the registration information of each user, and when the face of the monitoring personnel does not belong to the facial information of each user, mark the corresponding personnel as an external personnel, otherwise, mark the corresponding personnel as an internal personnel; When the corresponding person is an external person, if the external person is not a temporary user, then the corresponding protection information is generated; if the external person is a temporary user, the monitoring behavior characteristics corresponding to the temporary user corresponding to the external person are obtained, and the authorization information corresponding to the temporary user is obtained, and the monitoring behavior characteristics of the temporary user are matched with the authorization information. When the monitoring behavior characteristics of the temporary user do not match the authorization information, then the corresponding protection information is generated; When the corresponding personnel are internal personnel, the authorization information of each internal personnel is obtained. If the monitoring behavior characteristics corresponding to the internal personnel do not match the authorization information corresponding to the internal personnel, the corresponding protection information is generated; if the monitoring behavior characteristics corresponding to the internal personnel match the authorization information corresponding to the internal personnel, the authorized internal personnel are recorded, the unit monitoring time is set, and the residence time of the authorized internal personnel in the corresponding monitoring area within the unit monitoring time is counted. The historical residence time of each authorized personnel within multiple historical unit monitoring times in the historical data is obtained, and the multiple historical residence times are calculated to obtain the average value and the value is marked Recorded as the reference residence time, the current internal staff's residence time is compared with the corresponding reference residence time. If the current internal staff's residence time exceeds the reference residence time, the internal staff's residence time is subtracted from the reference residence time to get the abnormal residence increment time, and the pre-set abnormal residence increment threshold is obtained. The abnormal residence increment time of the current internal staff is compared with the abnormal residence increment threshold. When the abnormal residence increment time is greater than the abnormal residence increment threshold, the corresponding protection information is generated; the protection information corresponding to the external staff and the protection information corresponding to the internal staff are integrated to obtain the rational access monitoring information.

5. The computer security protection system based on artificial intelligence according to claim 1 is characterized in that: The specific analysis method of the manual hard disk data analysis is as follows: Identify the hard disk data operated by humans to obtain the hard disk online information, hard disk read and write information, and access information; identify the hard disk online information through the sensor to obtain the online status of each hard disk, and when the hard disk is removed, mark the corresponding hard disk online status as offline status, count the hard disk offline time and record it as the hard disk offline time, divide the hard disk offline time into multiple time intervals, each time interval corresponds to a time risk value, match the offline time corresponding to the current hard disk with multiple time intervals, and obtain the time risk value corresponding to the hard disk offline time; Identify the hard disk read and write information to obtain the hard disk read and write speed and reading time; compare the read and write speed corresponding to the hard disk read and write information with the set threshold; if the read and write speed corresponding to the hard disk read and write information is greater than the set threshold, mark the corresponding hard disk read and write speed as an abnormal read and write speed, extract the abnormal read and write time corresponding to the abnormal read and write speed of the hard disk information, calculate the abnormal read and write speed and the abnormal read and write time to obtain the abnormal read and write data volume, obtain a pre-set data volume read and write threshold and compare the abnormal read and write data volume with the data volume read and write threshold; when the abnormal read and write data volume is greater than the data volume read and write threshold, calculate the difference between the abnormal read and write data volume and the data volume read and write threshold and mark the difference as the read and write risk index; Based on the access information corresponding to the hard disk data operated manually, the access time and access content are obtained, and a pre-set time interval is obtained. The time interval is a working time interval and a non-working time interval. The access time corresponding to the current access information is matched with the time interval. If the current access time is within the non-working time interval, the corresponding access information is marked as risky access information, and the access content corresponding to the risky access information is obtained. The access content corresponding to the risky access information is identified to obtain the important content of the access content, the data volume of the important content is counted, and the previous and next contents of the important content are identified to obtain the content continuity of the important content. When the important content has no continuity with the previous and next contents, the corresponding important content is marked as high-risk important content, and the data volume corresponding to the high-risk important content is marked as the access risk index; A quadrilateral is constructed with the duration risk value and the read / write risk index as the long and short sides of the quadrilateral. A straight line is drawn perpendicular to the quadrilateral with the center of the quadrilateral as the starting point. The length of the straight line is equal to the value of the access risk index. A pyramid is then constructed with the quadrilateral and the straight line. The volume of the pyramid is calculated and the volume value is marked as the hard disk monitoring impact value. When the hard disk monitoring impact value is greater than the set threshold, hard disk behavior monitoring information is generated as hard disk behavior monitoring anomaly.

6. The computer security protection system based on artificial intelligence according to claim 1 is characterized in that: The execution module includes a mobile storage device management and control module, which is used to identify and control the connected mobile storage devices, specifically: the mobile storage device is identified through authorization identification in the computer, and when the authorization identification is passed, the read and write permissions are opened to the mobile storage device that has passed the authorization identification; conversely, the mobile storage device that has not passed the authorization cannot obtain the read and write permissions; the authorized mobile storage devices are numbered, and the numbers are associated with users on the user side to obtain the users corresponding to the authorized mobile storage devices.

Images