File electronization information security system

Abstract

The invention relates to the technical field of information security, in particular to an archive electronic information security system which comprises an archive operation behavior prediction module, an archive data encryption and security storage module, an archive security protection strategy execution module and an archive resource scheduling and security monitoring module. According to the method, through time series data analysis, potential risk behaviors can be recognized in advance, illegal access and abnormal operation can be prevented, losses caused by human errors or malicious behaviors are reduced, data integrity and confidentiality are guaranteed, archive data are stored in blocks, encryption is carried out according to sensitivity and access frequency, and the security of the archive data is improved. Multi-factor identity verification is executed, the flexibility and accuracy of protection measures are enhanced, security vulnerabilities are reduced, priority protection of sensitive archives is ensured through real-time monitoring and resource scheduling optimization, resource waste and risk exposure are avoided, and the security of the sensitive archives is improved. And the overall safety protection capability of archive management in a complex threat environment is improved by collaborative measures.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to an electronic archive information security system. Background Art

[0002] The field of information security technology involves the protection of confidentiality, integrity and availability of information to prevent unauthorized access, tampering, destruction or leakage of information. This field covers a variety of technical methods such as encryption technology, identity authentication, access control, data integrity verification, network security protection and security auditing, which are widely used in data storage, transmission, processing and other links to ensure that information systems have high security and reliability in complex and changing threat environments.

[0003] Existing technologies mainly rely on encryption technology, access control and security auditing to ensure the security of archives, but they fail to provide sufficient forward-looking protection in the face of ever-changing security threats. Current methods lack real-time prediction and risk assessment of user operation behaviors, and cannot effectively identify potential risk behaviors. Even through hierarchical access control and data encryption, there are still operational deviations or abnormal behaviors that are missed, resulting in security vulnerabilities. For example, archive management cannot promptly identify and respond to illegal access or minor deviations in operations, thus generating unnecessary security risks. Existing technologies also have deficiencies in dynamic resource scheduling and real-time monitoring, and cannot flexibly adjust storage space and bandwidth resources according to the actual risk level of operations, resulting in limited system response speed and resource allocation capabilities in emergency situations. Summary of the invention

[0004] The purpose of the present invention is to solve the shortcomings of the prior art and to propose an electronic archive information security system.

[0005] In order to achieve the above-mentioned purpose, the present invention adopts the following technical scheme: A file electronic information security system comprises: The archive operation behavior prediction module extracts the time series characteristics of archive operations based on the operation data of archive users, predicts the user's next operation according to the user's original operation mode, obtains the operation behavior prediction results, identifies potential risk behaviors, and generates archive access security risk assessment results; The archive data encryption and security storage module stores the data in blocks according to the archive access security risk assessment results and the archive data content, divides the data according to the archive sensitivity and access frequency, generates a block data set, encrypts the archive data block by block, stores the encrypted data blocks through the B-tree index structure, and generates an encrypted archive data block set; The archive security protection strategy execution module identifies risky operation behaviors based on the encrypted archive data block set, generates archive security protection requirements, adjusts access rights, executes multi-factor identity authentication security measures, monitors deviations between operation behaviors and predictions, and generates security protection strategy execution results; The archive resource scheduling and security monitoring module dynamically schedules archive resources in real time based on the execution results of the security protection strategy, allocates resources to risk operations first, optimizes access rights, storage space, and bandwidth resource allocation by real-time monitoring of user operations, and obtains resource usage and security protection records.

[0006] As a further solution of the present invention, the step of obtaining the operation behavior prediction result is specifically: Based on the operation data of archive users, extract the operation data features of archive users, including access time, operation type and access object, analyze the time series feature vector of each data feature, and generate a time series matrix through the sequence trend of operation time; The characteristic vectors in the time series matrix are analyzed to extract the changing trend and correlation of the operation behavior characteristics. The time interval distribution and the characteristic change rate are calculated using the formula: ; Calculate the characteristic change trend amplitude; in, Indicates the magnitude of the characteristic change trend. For the time series The eigenvalues ​​of the features, is the mean of the eigenvalues, is the feature weight parameter, Indicates the total number of features; The feature change trend amplitude is called, compared with the user's original operation mode, the user's next operation behavior is predicted through the feature change trend, the prediction probability analysis is performed on each operation type, and normalization processing is performed to obtain the operation behavior prediction result.

[0007] As a further solution of the present invention, the steps for obtaining the archive access security risk assessment result are specifically as follows: Based on the operation behavior prediction results, extract the original data of each user's access profile, perform access frequency statistics and classify access types, analyze the distribution of access time periods, perform screening based on permission configuration and access behavior characteristics, and generate access behavior statistics; Based on the access behavior statistics, combined with the access behavior frequency, access time and user authority range, abnormal behavior pattern recognition is performed, high-frequency access and access behaviors that do not match authority are marked, and compared with normal patterns to obtain abnormal access behavior characteristics; Based on the abnormal access behavior characteristics, an assessment is performed in combination with access path information, operation permissions and behavior patterns to determine the risk level of each type of abnormal behavior, and differentiated risk levels are divided according to risk standards to generate archive access security risk assessment results.

[0008] As a further solution of the present invention, the step of acquiring the block data set is specifically: Analyze the archive access security risk assessment results, extract the sensitivity level and access frequency characteristics of each archive in the archive access record, convert the sensitivity data into a numerical weight, and generate an archive sensitivity and access frequency characteristic matrix by normalizing the number of accesses within a time period; The sensitivity and access frequency characteristic matrix of the archive is called, and the data is segmented according to the differences in sensitivity and access frequency. The weight parameters are adjusted in combination with the block size limit and data continuity requirements, and the formula is adopted: ; Calculate the segmentation standard value of the data block and obtain the segmentation characteristics of the archive data; in, Indicates the segmentation standard value of the data block, is the sensitivity weight, To access the frequency eigenvalues, is the average sensitivity of the data block, is the current file sensitivity value, is the content continuity parameter of the data block; The file data block feature is called, and the data block range to which each file belongs is determined by comparing the segmentation standard with the sensitivity and frequency values ​​of the files in the feature matrix, so as to generate a block data set.

[0009] As a further solution of the present invention, the steps of obtaining the encrypted archive data block set are specifically as follows: Based on the block data set, the data is split according to a preset data block size, each data block is encrypted, and the content of each data block is encrypted using a corresponding encryption technology to generate an encrypted data block; Based on the encrypted data blocks, sorting is performed according to the unique identifier of each data block, and the encrypted data blocks are inserted into the B-tree structure in sequence, and each node is sorted and indexed during the insertion process to generate a B-tree index structure; Based on the B-tree index structure, the encrypted data blocks are associated with index entries, the storage location of each data block is determined according to the location information of the data block, and the location of each encrypted data block is stored in the B-tree node through an index linked list to generate an encrypted archive data block set.

[0010] As a further solution of the present invention, the steps for obtaining the archive security protection requirements are specifically as follows: Extracting access behavior logs from the encrypted archive data block set, using access timestamps, user identifiers and operation type information in the logs, filtering illegal access and abnormal operations in chronological order, and generating an initial set of risky operations; The access behavior characteristics are analyzed according to each record in the initial set of risk operations, including operation frequency, access path length and operation type weight, using the formula: ; Calculate the access risk feature value of each record to obtain an updated risk operation assessment set; in, Indicates the access risk characteristic value, Indicates the operating frequency, represents the average value of the operating frequency, represents the standard deviation of the operating frequency, Indicates the access path length, Indicates the maximum access path length, Indicates the weight of the operation type, are the adjustment coefficients for frequency, path, and weight, respectively; The records in the updated risk operation assessment set are clustered according to their behavior patterns, and records with similar risk characteristic values ​​are grouped together. Based on the distribution of risk values ​​within the group in the clustering results, it is determined whether there is illegal access and abnormal operation, and the archive security protection requirements are generated.

[0011] As a further solution of the present invention, the steps of obtaining the security protection strategy execution result are specifically as follows: Based on the archive security protection requirements, the access permission adjustment conditions are analyzed, the access permission parameter set and the user hierarchical permission parameter set are called, the permissions to be adjusted are determined, and a user set whose permissions need to be adjusted is generated; Based on the user set whose permissions need to be adjusted, combined with the user multi-factor authentication parameter set and the access permission parameter set, the formula is: ; Calculate the modified user access permission value and generate an adjusted access permission set; in, is the corrected user access permission value. is the current permission level, is the preset authority base value, Weight parameter for multi-factor authentication; The adjusted access permission set is called, combined with the user behavior monitoring parameter set and the deviation prediction model parameter set, the user operation deviation is compared with the prediction deviation, and the security protection strategy execution result is generated.

[0012] As a further solution of the present invention, the steps of obtaining the resource usage and security protection records are specifically as follows: Based on the execution results of the security protection strategy, according to the user operation logs and resource access data recorded by real-time monitoring, the user behavior parameters associated with the risky operation are screened, and the user risk behavior parameter set is obtained by classifying the user behavior and marking the operation type of sensitive file access, combined with the timestamp, user identity and resource call type marked in the log; Based on the behavior frequency and sensitivity level in the user risk behavior parameter set, the formula is used: ; Calculate the priority score of user operations, evaluate the impact of user risk operations and quantify the priority, and obtain the user risk operation score result; in, Represents the priority score of the user operation. Represents the frequency of behavior, Represents the sensitivity level, Represents the resource call type. Represents the operation time interval, is the weight parameter; Combined with the user risk operation scoring results, the resource allocation strategy is dynamically optimized to prioritize bandwidth, storage space, and access rights to risk operations with high scores, and resource usage and security protection records are obtained.

[0013] Compared with the prior art, the advantages and positive effects of the present invention are: In the present invention, through time series data analysis and prediction of user operation patterns, potential risk behaviors can be identified in advance, illegal access and abnormal operations can be prevented, thereby improving information security. The ability to identify potential threats in advance can effectively reduce the losses caused by human errors or malicious behaviors, ensure data integrity and confidentiality, and store archival data in blocks and encrypt them according to sensitivity and access frequency. This not only improves storage security, but also enables different levels of security requirements to be more accurately met. By dynamically adjusting access rights and performing multi-factor identity authentication, the flexibility and accuracy of protection measures are enhanced, and the occurrence of security vulnerabilities is effectively reduced. Real-time monitoring and resource scheduling optimization ensure that during the operation, access to sensitive archives is protected first, avoiding waste of security resources and unnecessary risk exposure. The measures work synergistically to improve the overall security protection capabilities of archive management in a complex threat environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1 is a system flow chart of the present invention; Figure 2 A flow chart of the prediction results of the operation behavior in the present invention; Figure 3 A flowchart of the file access security risk assessment results in the present invention; Figure 4 It is a flowchart of the block data set in the present invention; Figure 5 A flowchart of encrypting a file data block set in the present invention; Figure 6 A flowchart of the file security protection requirements in the present invention; Figure 7 It is a flowchart of the execution result of the security protection strategy in the present invention; Figure 8 This is a flow chart of resource usage and security protection records in the present invention. DETAILED DESCRIPTION

[0015] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0016] In the description of the present invention, it should be understood that the terms "length", "width", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside" and the like indicate positions or positional relationships based on the positions or positional relationships shown in the drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as limiting the present invention. In addition, in the description of the present invention, "multiple" means two or more, unless otherwise clearly and specifically defined.

[0017] See also Figure 1 , a file electronic information security system includes: The archive operation behavior prediction module performs time series data analysis based on the operation data of archive users, including access time, operation type, and access object, extracts the time series characteristics of archive operations, and predicts the user's next operation according to the user's original operation mode to obtain the operation behavior prediction results, identify potential risk behaviors, and generate archive access security risk assessment results; The archive data encryption and security storage module stores the data in blocks according to the archive access security risk assessment results and the archive data content. Each data block is divided according to the archive sensitivity and access frequency to generate a block data set, encrypt the archive data block by block, store the encrypted data blocks through the B-tree index structure, and generate an encrypted archive data block set; The archive security protection strategy execution module identifies risky operation behaviors, including illegal access and abnormal operations, based on the encrypted archive data block set, generates archive security protection requirements, adjusts access rights, executes multi-factor identity authentication security measures, triggers corresponding protection strategies, monitors deviations between operation behaviors and predictions, and generates security protection strategy execution results; The archive resource scheduling and security monitoring module dynamically schedules archive resources in real time based on the execution results of security protection strategies, and prioritizes the allocation of resources to risky operations, including access to sensitive archives. By monitoring user operations in real time, it optimizes the resource allocation of access rights, storage space, and bandwidth, and obtains resource usage and security protection records.

[0018] The results of operation behavior prediction include the predicted operation type, predicted access time, and predicted access object. The results of archive access security risk assessment include risk level assessment, potential risk behavior identification, and user behavior deviation assessment. The block data set includes sensitivity category blocks, frequency category blocks, and data block indexes. The encrypted archive data block set includes encrypted data blocks, index structures, and metadata information. Archive security protection requirements include anti-illegal access requirements, abnormal operation monitoring requirements, and identity authentication enhancement requirements. The results of security protection strategy execution include permission adjustment records, verification measure implementation details, and monitoring deviation reports. Resource usage and security protection records include resource allocation details, protection activity records, and operation monitoring logs.

[0019] See also Figure 2 , the specific steps for obtaining the operation behavior prediction results are: Based on the operation data of archive users, extract the operation data features of archive users, including access time, operation type and access object, analyze the time series feature vector of each data feature, and generate a time series matrix through the sequence trend of operation time; The interval between each time point and the subsequent time point is calculated as a time difference array, and the time difference is used as the basic indicator for evaluating operation density. The time characteristic description is established by statistically analyzing the mean and standard deviation of the time interval, analyzing the operation type, extracting the type classification mark of each user operation, and counting the frequency of each category of operation. The relative frequency and absolute frequency are used as the characteristic values ​​of the operation type, and the access object information is extracted, including the key attributes of the access object, such as ID, category, and size. The access object feature matrix is ​​formed by quantifying the attributes, and the above three features are integrated into a time series matrix. Through normalization processing, the data characteristics of each dimension are made consistent, reducing the calculation deviation caused by uneven dimensions, forming a data foundation that can accurately reflect the user operation characteristics, and providing support for subsequent analysis and prediction.

[0020] Analyze the characteristic vectors in the time series matrix, extract the changing trend and correlation of the operation behavior characteristics, and calculate the time interval distribution and characteristic change rate using the formula: ; Calculate the characteristic change trend amplitude; in, Indicates the magnitude of the characteristic change trend. For the time series The eigenvalues ​​of the features, is the mean of the eigenvalues, is the feature weight parameter, Indicates the total number of features; The formula is useful because it introduces the weight parameter , can adjust the weight according to the change rules of operation characteristics in a specific time period, improve the accuracy of capturing change trends and the calculation precision, so as to better meet the analysis needs of various operation characteristic modes; Extracting time node eigenvalues ​​from a time series matrix , by performing statistical calculations on each eigenvalue to obtain its mean , calculate the weight parameter according to the importance distribution rule of time series nodes For example, suppose the time series contains 8 nodes, and the eigenvalues ​​are , , , , , , , , mean , weight parameter , substitute the value into the formula: ; ; ; This value indicates that the change in operation behavior is small, which provides a basis for subsequent predictions. The specific value comes from the construction process of the time series matrix, in which the weight parameter is set based on the operation frequency weight function of the time period. The higher the frequency, the greater the weight, which is obtained by analyzing the frequency distribution.

[0021] Call the feature change trend amplitude, compare it with the user's original operation mode, predict the user's next operation behavior through the feature change trend, perform prediction probability analysis on each operation type, and perform normalization processing to obtain the operation behavior prediction result; First, the corresponding eigenvalue sequence in the time series matrix is ​​screened from the user's historical operation records, the eigenvalues ​​are grouped by time period and the main feature distribution rules in each group are counted, the changing eigenvalues ​​of the operation type are extracted, and a benchmark template is generated according to the fluctuation pattern of the time series. In the benchmark template, the distribution range of the eigenvalues ​​and the operation frequency become important references. By comparing the change amplitude of the current operation behavior characteristics with the change trend of the corresponding characteristics in the benchmark template, it is determined whether there is a significant deviation. The probability weight is calculated according to the operation type, and the operation frequency, feature change amplitude and feature weight are combined. The predicted probability distribution of each operation type is obtained through normalization processing, and the operation type with the highest probability is selected as the operation behavior prediction result. This result is further used to generate specific operation suggestions to provide the final result of user operation behavior prediction.

[0022] See also Figure 3 ,The specific steps for obtaining the archive access security risk assessment results are: Based on the prediction results of operation behavior, extract the original data of each user's access file, conduct access frequency statistics and classify access types, analyze the distribution of access time periods, screen according to permission configuration and access behavior characteristics, and generate access behavior statistics; First, we record and analyze the user's access behavior in detail. Based on the user's login time, operation path and access purpose, we map each user's operation into different behavior sequences. By gradually decomposing these sequences, we distinguish various access types such as browsing, editing, and downloading, and record the operation frequency corresponding to each type. After the statistics are completed, we further analyze the distribution of users' access in different time periods throughout the day in combination with the time dimension of the data. By constructing time intervals and accumulating the access frequency in each interval, we form a distribution law description of high-frequency access periods. We screen based on the permission configuration and access behavior characteristics. The screening process is based on the rationality of the access behavior, such as checking whether the access type matches the user's permission and whether the access duration is abnormal. We filter out records of frequent access to multiple sensitive files in a short period of time, while retaining behaviors within the expected permission range to generate access behavior statistics.

[0023] Based on the access behavior statistics, combined with the access behavior frequency, access time and user authority range, abnormal behavior pattern recognition is performed, high-frequency access and access behaviors that do not match authority are marked, and compared with normal patterns to obtain abnormal access behavior characteristics; By gradually segmenting the distribution interval of access frequency, the user's behavior data is refined into multiple feature sets. By comparing the statistical pattern of normal access behavior, high-frequency access users and their authority range are cross-validated. For behaviors with an operation frequency significantly higher than the historical statistical mean within the authority range, they are segmented and classified in combination with the time characteristics of the operation behavior to identify potential abnormal behaviors. At the same time, the access records that do not match the authority are checked one by one, and the access behaviors that do not match the user role authority are compared with the key features of the normal pattern from multiple angles, including the similarity of the access path and the deviation of the access period, to obtain the abnormal access behavior characteristics, and conduct continuous tracking and analysis based on the marked data.

[0024] Based on the characteristics of abnormal access behavior, combined with access path information, operation permissions and behavior patterns, an assessment is conducted to determine the risk level of each type of abnormal behavior, and differentiated risk levels are divided according to risk standards to generate archive access security risk assessment results; Abnormal behaviors are graded from low to high based on risk standards. By gradually analyzing the key nodes in the access path, multiple repetitions or jumps in the path are identified, and the authority level and actual operation of the relevant behaviors are compared and evaluated. Combined with the distribution characteristics of abnormal behaviors in the time dimension, the degree of deviation of the behavior pattern is further analyzed, and behaviors that are obviously inconsistent with historical access patterns are marked as high risk. At the same time, differentiated risk levels are refined, and abnormal behaviors of different degrees are included in the corresponding levels by setting risk thresholds. Finally, the archive access security risk assessment results are generated, so that security management has a clear basis for graded response at the execution level.

[0025] See also Figure 4 , the specific steps for obtaining the block data set are: Analyze the archive access security risk assessment results, extract the sensitivity level and access frequency characteristics of each archive in the archive access record, convert the sensitivity data into numerical weights, and generate the archive sensitivity and access frequency feature matrix by normalizing the number of accesses within a time period; Firstly, the data characteristics of each archive are extracted, including sensitivity level, access frequency and time distribution. The sensitivity data are digitally encoded and converted into quantitative sensitivity level values. At the same time, the access frequency of each archive is counted based on the timestamp data in the access record. The access frequency is normalized to eliminate the influence of time span or access cycle. The archive sensitivity and access frequency feature matrix is ​​constructed by calculating the mean and variance of the sensitivity level value and the normalized access frequency. Each row in the matrix represents a file, and each column represents a characteristic value of the file. The matrix accurately represents the distribution status of the archive in terms of sensitivity and access characteristics.

[0026] The archive sensitivity and access frequency feature matrix is ​​called, and the data is segmented according to the differences in sensitivity and access frequency. The weight parameters are adjusted in combination with the block size limit and data continuity requirements, using the formula: ; Calculate the segmentation standard value of the data block and obtain the segmentation characteristics of the archive data; in, Indicates the segmentation standard value of the data block, is the sensitivity weight, To access the frequency eigenvalues, is the average sensitivity of the data block, is the current file sensitivity value, is the content continuity parameter of the data block; The benefit of the formula is that by combining the sensitivity weight, access frequency and sensitivity difference, it can effectively balance the sensitivity and access characteristic distribution of archive data blocks, thereby achieving the optimization of data segmentation; Extracting sensitivity weights from feature matrix and access frequency The value of sensitivity weight It is allocated based on the sensitivity level of the file. For example, the file with a sensitivity level of 1 has a corresponding weight of 0.5, and the file with a sensitivity level of 2 has a corresponding weight of 1.0. Obtained through normalization processing; Extract the sensitivity average of the chunked data blocks , by calculating the average sensitivity value of the files in the block, the sensitivity of the current file is obtained Directly from the feature matrix; Combining content continuity parameters Control the logical consistency of the blocks, set Calculation based on data logic distribution; Assume that the sensitivity weight of a file in the feature matrix , access frequency , the average sensitivity of the data block , current profile sensitivity , content continuity parameter , substitute the value into the formula: ; The result shows that the data block segmentation standard value is 0.624, which is used to determine whether the current archive needs to be segmented and integrated with a certain data block or segmented independently, providing a basis for data segmentation.

[0027] Call the file data block feature, determine the data block range of each file by comparing the segmentation standard with the sensitivity and frequency value of the file in the feature matrix, and generate a block data set; Calling the archival data blocking feature, first compare the blocking standard value with the whole archive, calculate the randomness of the data block to which it belongs according to the sensitivity weight and access frequency value of each archive, and determine whether blocking is needed by setting the blocking standard threshold. Archives that meet the blocking standard are directly included in the current data block, and archives that do not meet the standard are recorded as independent blocks. At the same time, during the blocking process, the continuity parameters of the blocking content are adjusted in real time based on the differences in archive sensitivity to ensure the integrity and logic of the blocking. Finally, the list of blocked archives is integrated to generate a blocked data set, and archiving is completed with a structure with clear logic and balanced distribution of sensitivity and access frequency to ensure that the generated results meet the needs of data storage and security management.

[0028] See also Figure 5 , the specific steps for obtaining the encrypted archive data block set are: Based on the block data set, the data is split according to the preset data block size, each data block is encrypted, and the content of each data block is encrypted using the corresponding encryption technology to generate an encrypted data block; The original data set is read one by one and split into fixed byte sizes. Each data block is attached with a serial number as a unique identifier. After the data is split, encryption is performed on each data block. The encryption protocol is used to convert the data content byte by byte to ensure that the encryption result meets the confidentiality requirements. During the encryption process, the encryption result of each data block is verified for validity to verify whether the encrypted data is stored completely and matches the input data. At the same time, the encryption time and ciphertext size of each encrypted data block are recorded. All encrypted data blocks are archived in a structured manner to generate encrypted data blocks.

[0029] Based on the encrypted data blocks, the encrypted data blocks are sorted according to the unique identifier of each data block, and the encrypted data blocks are inserted into the B-tree structure in sequence. During the insertion process, each node is sorted and indexed to generate a B-tree index structure; All data blocks are fully scanned using the identifier attached to the encrypted data block and arranged in ascending order. After the sorting is completed, the encrypted data blocks are inserted into the nodes of the B-tree structure one by one. During the insertion process, leaf nodes are allocated first to store data blocks. At the same time, the storage status of each node is checked to ensure that the data blocks in the node remain in an ordered state, and the maximum and minimum values ​​of each node are recorded in the parent node to form an index relationship. During the sorting and insertion process, for data blocks that exceed the node storage capacity, they are allocated to new child nodes by splitting the nodes to maintain the balance of the B-tree, and finally a B-tree index structure is generated.

[0030] Based on the B-tree index structure, the encrypted data blocks are associated with the index entries, the storage location of each data block is determined according to the location information of the data block, and the location of each encrypted data block is stored in the B-tree node through the index linked list to generate an encrypted archive data block set; The unique identifier of each encrypted data block is bound to the corresponding index entry through a two-way mapping mechanism to ensure that the data block can be quickly located. According to the storage path of the data block in the B-tree, the node information is traced back level by level to determine the physical storage address of each data block, and a new linked list structure is added to the B-tree node to record the position relationship of the encrypted data block. All linked list information is reviewed to ensure that the storage location pointed to by the linked list is consistent with the actual data block location. The location index table of the encrypted data block is merged with the B-tree index structure for storage to generate an encrypted archive data block set, providing an accurate index basis for subsequent retrieval and decryption.

[0031] See also Figure 6 , the specific steps for obtaining archive security protection requirements are: Extract access behavior logs from the encrypted archive data block set, use the access timestamp, user ID and operation type information in the logs to filter illegal access and abnormal operations in chronological order, and generate an initial set of risky operations; First, the block data needs to be structurally analyzed, the timestamp of each record needs to be extracted and sorted in chronological order, the user identification needs to be matched with the independent identification code one by one through the system log recording function, and the operation type needs to be analyzed through the behavior field in the record to identify the operation characteristics of reading, writing, and deleting. At the same time, the access records need to be deduplicated and consistency checked. The consistency check includes the matching check of user permissions and operation types and the rationality assessment of repeated operations in the time series. After the verification is completed, the logs are further reorganized in chronological order to form a complete set of operation sequences, and access behavior records with suspicious characteristics are screened. By comparing the characteristics such as operation frequency, path length and permission type, whether there are unauthorized or abnormal operations, an initial set of risky operations is finally formed, which will serve as the basis for subsequent analysis.

[0032] Analyze access behavior characteristics based on each record in the initial set of risk operations, including operation frequency, access path length, and operation type weight, using the formula: ; Calculate the access risk feature value of each record to obtain an updated risk operation assessment set; in, Indicates the access risk characteristic value, Indicates the operating frequency, represents the average value of the operating frequency, represents the standard deviation of the operating frequency, Indicates the access path length, Indicates the maximum access path length, Indicates the weight of the operation type, are the adjustment coefficients for frequency, path, and weight, respectively;

[0033] The benefit of the formula is that it weighs the importance of each eigenvalue by adjusting the weight parameters, making it more consistent with the actual scenario of risk operations, and combining it with a standardized numerical range to improve the accuracy of the assessment.

[0034] Operation frequency, obtained by counting the number of operations within a specific time period; The mean of the operating frequency is calculated by averaging the frequencies of all the records; The standard deviation of the operating frequency is given by the formula calculate, is the total number of records; The access path length is obtained by parsing the hierarchical depth of the user access path in the log; Maximum path length, which counts the maximum value of the path level in the access log; Operation type weight, which maps the importance of a specific operation type by giving it a weight value. The weight is determined based on the potential impact of the operation on data integrity and security. They represent the adjustment coefficients of frequency, path and weight respectively. The adjustment coefficients are set according to the risk characteristic distribution and are related to the actual scenario fluctuations; set up , , , , , , , , , put it into the formula: ; ; ; ; The result shows that the risk characteristic value of access behavior is 1.143, based on which further classification and analysis can be performed.

[0035] Perform behavioral pattern clustering on the records in the updated risk operation assessment set, group the records with similar risk feature values ​​together, and determine whether there are illegal accesses and abnormal operations based on the distribution of risk values ​​within the group in the clustering results, and generate archive security protection requirements; First, the risk characteristic value of each record needs to be analyzed, and the similarity between records is calculated using the Euclidean distance formula. Records with similar characteristic values ​​are grouped into the same group based on the similarity. For each group of records, the internal maximum risk value needs to be evaluated. The calculation of the maximum risk value is based on the highest characteristic value of the records in the group. By setting a dynamic risk threshold, the rationality of the distribution of risk characteristic values ​​of each group is verified. In the verification step, the risk characteristic value is compared with the dynamic threshold. When the characteristic values ​​in the group are all lower than the threshold, the group is marked as low risk. If the characteristic value of a group is higher than the threshold, it is marked as high risk. The grouping results and risk tags are combined to further determine whether it constitutes illegal access or abnormal operation. Finally, the archive security protection requirements are generated based on the analysis results of all grouped records to guide the subsequent implementation of security policies.

[0036] See also Figure 7 , the specific steps for obtaining the security protection strategy execution results are: Based on the requirements of archive security protection, analyze the adjustment conditions of access rights, call the access rights parameter set and user hierarchical permission parameter set, determine the permissions to be adjusted, and generate the user set whose permissions need to be adjusted; Analyze the adjustment conditions of access rights. First, obtain access rights parameter set A and user graded access rights parameter set B. Compare the user access rights in parameter set A with the user permission levels in parameter set B item by item, establish a user permission difference set, and screen users with large permission differences by analyzing the distribution trend of the set and the boundary values ​​of the permission level difference intervals. Then, by comparing the historical data of user permission changes in the permission difference set, confirm the specific direction and scope of the permission adjustment. By matching the analysis results with the permission change standards in the preset adjustment rules item by item, obtain the user set whose permissions need to be adjusted.

[0037] Based on the user set that needs to adjust permissions, combined with the user multi-factor authentication parameter set and the access permission parameter set, the formula ; Calculate the modified user access permission value and generate an adjusted access permission set; in, is the corrected user access permission value. is the current permission level, is the preset authority base value, Weight parameter for multi-factor authentication; The formula is beneficial by introducing the weight parameter of multi-factor authentication , which can effectively balance the current permissions Compared with the preset authority baseline value The impact on the revised results makes the revised permissions More accurate and more sensitive to multi-factor authentication information; Assume that a user's current permission level , preset authority base value , Multi-factor authentication weight parameter , calculate the corrected user access rights value through the formula The steps are as follows: Calculate the numerator part: ; Calculate the denominator: ; Calculate the corrected permissions: ; The result shows that the revised user access permission value is 5.67, which is an improvement over the current permission level and in line with the directional adjustment of the preset permission benchmark value, providing a data basis for further adjustment of the permission set P.

[0038] Call the adjusted access permission set, combine the user behavior monitoring parameter set and the deviation prediction model parameter set, compare the user operation deviation with the prediction deviation, and generate the security protection strategy execution result; The adjusted access permission set is called, and the deviation value of the user's operation behavior and the predicted behavior is obtained through the user behavior monitoring parameter set and the deviation prediction model parameter set. The calculation process includes: feature extraction of the user's historical operation behavior records, obtaining the operation mode and behavior frequency of each user, performing deviation quantitative analysis on the user's current operation data and the historical operation mode, using the difference threshold for classification, generating the user behavior prediction value through the prediction formula preset in the deviation prediction model parameter set E, and then comparing the actual operation behavior with the predicted value one by one to calculate the deviation value, and by matching the deviation value distribution with the security protection strategy library, the specific difference level between the operation behavior deviation and the prediction is obtained, and the difference level is compared with the triggering condition of the protection strategy in combination with the security protection strategy execution condition to generate the security protection strategy execution result.

[0039] See also Figure 8, the specific steps for obtaining resource usage and security protection records are: Based on the execution results of security protection strategies, according to the user operation logs and resource access data recorded by real-time monitoring, the user behavior parameters associated with risky operations are screened, and the user risk behavior parameter set is obtained by classifying user behaviors and marking the operation types of sensitive file accesses, combined with the timestamps, user identities and resource call types marked in the logs; According to the user operation logs and resource access data recorded in real-time monitoring, the core parameters in the operation logs are extracted, including operation type, timestamp, user identity, resource call identification and other information, and operation records involving sensitive file access are screened. Based on the content type analysis in the operation logs, different operation behaviors are classified and sensitive operations are classified and marked. By calling the resource call record database, the associated resource call history of each operation is screened item by item, the resources associated with the risky operation are identified, the sensitivity level and access frequency of the resources are extracted, the user identity is matched with the operation behavior, and the basic record of user risk behavior is generated. Through parameter analysis and behavior pattern modeling of the basic record of risk behavior, the user's operation frequency, resource call type, operation time interval and other behavioral feature parameters are extracted, and the user behavior feature set is integrated. The extracted user operation features are sorted according to the sensitivity level and stored as a user risk behavior parameter set for subsequent priority calculation and resource allocation strategy adjustment.

[0040] Based on the behavior frequency and sensitivity level in the user risk behavior parameter set, the formula is used: ; Calculate the priority score of user operations, evaluate the impact of user risk operations and quantify the priority, and obtain the user risk operation score result; in, Represents the priority score of the user operation. Represents the frequency of behavior, Represents the sensitivity level, Represents the resource call type. Represents the operation time interval, is the weight parameter; The formula is beneficial in that it introduces multiple parameters such as user operation frequency, sensitivity level, resource call type, and operation time interval, and combines different weights to quantify user behavior priorities and improve resource allocation efficiency and security; Extraction behavior frequency , sensitivity level (1-5 quantization, 5 is the highest), resource call type (1 for normal resource call, 2 for priority resource call), operation time interval Unit time; Setting weight parameters , put it into the formula: ; The result shows that the priority score of the user operation is 23.25. The value is used in subsequent dynamic resource allocation to guide the execution of the priority resource allocation strategy and ensure the security requirements of sensitive operations and key resources.

[0041] Combined with the user's risk operation scoring results, dynamically optimize resource allocation strategies, prioritize bandwidth, storage space, and access rights to risk operations with high scores, and obtain resource usage and security protection records; The resource sensitivity level, call frequency, and bandwidth requirement corresponding to high-priority user operations are extracted from the scoring results, and the user operation priorities are dynamically sorted. Resources are allocated preferentially to user operations with higher scores. The resource allocation policy database is called up in real time to dynamically adjust sensitive file access rights, storage space, bandwidth and other resources. The resource allocation strategy is optimized based on the sensitivity level coefficient of the scoring data. The user operation, timestamp, resource type and allocation result of each resource allocation are recorded. The allocation record is synchronously updated in the resource usage log. The usage of allocated resources is periodically monitored to ensure the security and efficiency of resource usage, and generate resource usage and security protection records.

[0042] The above are only preferred embodiments of the present invention and are not intended to limit the present invention in other forms. Any technician familiar with the profession may use the technical contents disclosed above to change or modify them into equivalent embodiments with equivalent changes and apply them to other fields. However, any simple modification, equivalent change and modification made to the above embodiments based on the technical essence of the present invention without departing from the technical solution of the present invention still falls within the protection scope of the technical solution of the present invention.

Claims

1. A file electronic information security system, characterized in that: The system comprises: The archive operation behavior prediction module extracts the time series characteristics of archive operations based on the operation data of archive users, predicts the user's next operation according to the user's original operation mode, obtains the operation behavior prediction results, identifies potential risk behaviors, and generates archive access security risk assessment results; The archive data encryption and security storage module stores the data in blocks according to the archive access security risk assessment results and the archive data content, divides the data according to the archive sensitivity and access frequency, generates a block data set, encrypts the archive data block by block, stores the encrypted data blocks through the B-tree index structure, and generates an encrypted archive data block set; The archive security protection strategy execution module identifies risky operation behaviors based on the encrypted archive data block set, generates archive security protection requirements, adjusts access rights, executes multi-factor identity authentication security measures, monitors deviations between operation behaviors and predictions, and generates security protection strategy execution results; The archive resource scheduling and security monitoring module dynamically schedules archive resources in real time based on the execution results of the security protection strategy, allocates resources to risk operations first, optimizes access rights, storage space, and bandwidth resource allocation by real-time monitoring of user operations, and obtains resource usage and security protection records.

2. The electronic archive information security system according to claim 1, characterized in that: The steps for obtaining the operation behavior prediction result are specifically as follows: Based on the operation data of archive users, extract the operation data features of archive users, including access time, operation type and access object, analyze the time series feature vector of each data feature, and generate a time series matrix through the sequence trend of operation time; The characteristic vectors in the time series matrix are analyzed to extract the changing trend and correlation of the operation behavior characteristics. The time interval distribution and the characteristic change rate are calculated using the formula: ； Calculate the characteristic change trend amplitude; in, Indicates the magnitude of the characteristic change trend. For the time series The eigenvalues ​​of the features, is the mean of the eigenvalues, is the feature weight parameter, Indicates the total number of features; The feature change trend amplitude is called, compared with the user's original operation mode, the user's next operation behavior is predicted through the feature change trend, the prediction probability analysis is performed on each operation type, and normalization processing is performed to obtain the operation behavior prediction result.

3. The electronic archive information security system according to claim 2, characterized in that: The steps for obtaining the archive access security risk assessment results are specifically as follows: Based on the operation behavior prediction results, extract the original data of each user's access profile, perform access frequency statistics and classify access types, analyze the distribution of access time periods, perform screening based on permission configuration and access behavior characteristics, and generate access behavior statistics; Based on the access behavior statistics, combined with the access behavior frequency, access time and user authority range, abnormal behavior pattern recognition is performed, high-frequency access and access behaviors that do not match authority are marked, and compared with normal patterns to obtain abnormal access behavior characteristics; Based on the abnormal access behavior characteristics, an assessment is performed in combination with access path information, operation permissions and behavior patterns to determine the risk level of each type of abnormal behavior, and differentiated risk levels are divided according to risk standards to generate archive access security risk assessment results.

4. The electronic archive information security system according to claim 3 is characterized in that: The steps of obtaining the block data set are specifically as follows: Analyze the archive access security risk assessment results, extract the sensitivity level and access frequency characteristics of each archive in the archive access record, convert the sensitivity data into a numerical weight, and generate an archive sensitivity and access frequency characteristic matrix by normalizing the number of accesses within a time period; The sensitivity and access frequency characteristic matrix of the archive is called, and the data is segmented according to the differences in sensitivity and access frequency. The weight parameters are adjusted in combination with the block size limit and data continuity requirements, and the formula is adopted: ； Calculate the segmentation standard value of the data block and obtain the segmentation characteristics of the archive data; in, Indicates the segmentation standard value of the data block, is the sensitivity weight, To access the frequency eigenvalues, is the average sensitivity of the data block, is the current file sensitivity value, is the content continuity parameter of the data block; The file data block feature is called, and the data block range to which each file belongs is determined by comparing the segmentation standard with the sensitivity and frequency values ​​of the files in the feature matrix, so as to generate a block data set.

5. The electronic archive information security system according to claim 4 is characterized in that: The steps of obtaining the encrypted archive data block set are specifically as follows: Based on the block data set, the data is split according to a preset data block size, each data block is encrypted, and the content of each data block is encrypted using a corresponding encryption technology to generate an encrypted data block; Based on the encrypted data blocks, sorting is performed according to the unique identifier of each data block, and the encrypted data blocks are inserted into the B-tree structure in sequence, and each node is sorted and indexed during the insertion process to generate a B-tree index structure; Based on the B-tree index structure, the encrypted data blocks are associated with index entries, the storage location of each data block is determined according to the location information of the data block, and the location of each encrypted data block is stored in the B-tree node through an index linked list to generate an encrypted archive data block set.

6. The electronic archive information security system according to claim 5, characterized in that: The steps for obtaining the archive security protection requirements are specifically as follows: Extracting access behavior logs from the encrypted archive data block set, using access timestamps, user identifiers and operation type information in the logs, filtering illegal access and abnormal operations in chronological order, and generating an initial set of risky operations; The access behavior characteristics are analyzed according to each record in the initial set of risk operations, including operation frequency, access path length and operation type weight, using the formula: ； Calculate the access risk feature value of each record to obtain an updated risk operation assessment set; in, Indicates the access risk characteristic value, Indicates the operating frequency, represents the average value of the operating frequency, represents the standard deviation of the operating frequency, Indicates the access path length, Indicates the maximum access path length, Indicates the weight of the operation type, are the adjustment coefficients for frequency, path, and weight, respectively; The records in the updated risk operation assessment set are clustered according to their behavior patterns, and records with similar risk characteristic values ​​are grouped together. Based on the distribution of risk values ​​within the group in the clustering results, it is determined whether there is illegal access and abnormal operation, and the archive security protection requirements are generated.

7. The electronic archive information security system according to claim 6, characterized in that: The steps for obtaining the security protection strategy execution result are specifically as follows: Based on the archive security protection requirements, analyze the access permission adjustment conditions, call the access permission parameter set and the user hierarchical permission parameter set, determine the permissions to be adjusted, and generate a user set whose permissions need to be adjusted; Based on the user set whose permissions need to be adjusted, combined with the user multi-factor authentication parameter set and the access permission parameter set, the formula is: ； Calculate the modified user access permission value and generate an adjusted access permission set; in, is the corrected user access permission value. is the current permission level, is the preset authority base value, Weight parameter for multi-factor authentication; The adjusted access permission set is called, combined with the user behavior monitoring parameter set and the deviation prediction model parameter set, the user operation deviation is compared with the prediction deviation, and the security protection strategy execution result is generated.

8. The electronic archive information security system according to claim 7, characterized in that: The steps for obtaining the resource usage and security protection records are as follows: Based on the execution results of the security protection strategy, according to the user operation logs and resource access data recorded by real-time monitoring, the user behavior parameters associated with the risky operation are screened, and the user risk behavior parameter set is obtained by classifying the user behavior and marking the operation type of sensitive file access, combined with the timestamp, user identity and resource call type marked in the log; Based on the behavior frequency and sensitivity level in the user risk behavior parameter set, the formula is used: ； Calculate the priority score of user operations, evaluate the impact of user risk operations and quantify the priority, and obtain the user risk operation score result; in, Represents the priority score of the user operation. Represents the frequency of behavior, Represents the sensitivity level, Represents the resource call type. Represents the operation time interval, is the weight parameter; Combined with the user risk operation scoring results, the resource allocation strategy is dynamically optimized to prioritize bandwidth, storage space, and access rights to risk operations with high scores, and resource usage and security protection records are obtained.

Images