Data security tracing method and system based on artificial intelligence

Abstract

The invention provides a data security traceability method and system based on artificial intelligence, relates to the field of data security, and is used for solving the problems of relatively poor data security traceability accuracy and response delay in the prior art. The method comprises the following steps: updating a user behavior attention model, and carrying out multi-dimensional aggregation analysis on all data flow paths comprising abnormal nodes and abnormal edges; determining the path with the highest comprehensive score value in all the data flow paths as a target abnormal path; performing data security traceability analysis on the target abnormal path to obtain a traceability analysis result; and determining a chain creation rule, taking each data circulation event on the target abnormal path as a block in combination with the chain creation rule, connecting the data circulation events in series to form a traceability chain, and starting a corresponding safety response strategy according to a traceability analysis result, the safety response strategy being obtained through self-adaptive generation according to the traceability chain. According to the technical scheme provided by the invention, the accuracy of data security traceability is improved.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of data security technology, and in particular to a data security tracing method and system based on artificial intelligence. Background Art

[0002] With the rapid development of information technology, network security threats are becoming increasingly complex and diverse. In order to effectively deal with these threats, data security traceability analysis has become an important research field. Although traditional security protection methods (such as firewalls and intrusion detection systems) can prevent known threats to a certain extent, they are no longer effective when facing new attacks and internal threats. Therefore, how to monitor and analyze user behavior in real time, identify abnormal paths, and take effective response measures has become the focus of current research.

[0003] Existing data security tracing methods rely on pre-defined rules or signatures of known threats for detection, focus on single data flow events or isolated user behaviors, and emphasize post-audit and recovery.

[0004] However, existing data security traceability methods cannot adapt to the rapidly changing security environment. When an abnormal path is found, manual intervention is usually required for detailed investigation, which is not only time-consuming and laborious, but may also lead to response delays and increase losses. Blockchain technology has shown great potential in data security traceability due to its immutability and transparency. However, most of the current applications remain in the proof-of-concept stage and have not yet formed a complete mechanism for adaptively generating security response strategies. Summary of the invention

[0005] The embodiments of the present application provide a data security tracing method and system based on artificial intelligence to solve the problems of poor accuracy and delayed response of data security tracing in the prior art.

[0006] In a first aspect, an embodiment of the present application provides a data security tracing method based on artificial intelligence, comprising: Acquire the real-time access data of the target system, and based on the real-time access data, use an incremental learning strategy to update the user behavior attention model to obtain an updated user behavior attention model, wherein the access data includes: operation logs, user behavior data, and network traffic information, and the user behavior attention model is obtained by applying a multi-level graph attention network to model historical access data; A variety of anomaly detection algorithms are used to detect the newly added nodes and edges in the updated user behavior attention model to obtain the overall anomaly detection results corresponding to the real-time access data; When the overall anomaly detection result is that there are abnormal nodes and abnormal edges, a multi-dimensional aggregation analysis is performed on all data flow paths including abnormal nodes and abnormal edges in the updated user behavior attention model to obtain a comprehensive score value of each data flow path, and the path with the highest comprehensive score value among all the data flow paths is determined as the target abnormal path, and the multiple dimensions include time dimension, user behavior dimension, data sensitivity dimension and business logic dimension; Perform data security traceability analysis on the target abnormal path to obtain the traceability analysis result, determine the chain creation rule based on the traceability analysis result, and combine the chain creation rule to treat each data flow event on the target abnormal path as a block, which are connected in series to form a traceability chain. Initiate the corresponding security response strategy based on the traceability analysis result, and the security response strategy is adaptively generated according to the traceability chain.

[0007] Optionally, the process of constructing the user behavior attention model includes: Acquire a historical access data set of a target system, and select a target feature according to the historical access data set to form a target feature set; An initial anomaly recognition model using the Hoefding tree model structure is constructed, and ensemble learning is performed based on the initial anomaly recognition model to obtain an anomaly recognition ensemble model; According to the historical access data set and the prediction results of the anomaly recognition integrated model, an initial user behavior model is generated, the initial user behavior model is trained to generate a trained user behavior model, the trained user behavior model is enhanced by using a graph sampling and aggregation algorithm to obtain an enhanced user behavior model, and the enhanced user behavior model is adjusted by using a multi-level graph attention network to obtain a user behavior attention model.

[0008] Optionally, the acquiring a historical access data set of the target system and selecting a target feature according to the historical access data set to form a target feature set includes: Using a log recording system and a network traffic monitoring tool, the operation log, user behavior data and network traffic information of the target system are collected to obtain a historical access data set, wherein the historical access data set includes multiple historical access data, and one historical access data includes the operation log, user behavior data and network traffic information; Preprocessing all the historical access data in the historical access data set to obtain a preprocessed data set, wherein the preprocessing includes: cleaning, deduplication, removal of erroneous data, formatting, and data filling; Based on the preprocessed data set, the association relationship value between each known feature and the label is calculated by using the mutual information method and the chi-square test, and the features whose association relationship value with the label is greater than a preset relationship threshold are selected to form a preliminary feature set; wherein the label is used to indicate whether the historical access data is an abnormal access pattern, and the known feature is a feature to be determined for distinguishing between a normal access pattern and an abnormal access pattern; Using a recursive feature elimination method combined with a support vector machine, determining redundant features in the preliminary feature set, removing the redundant features, so as to optimize the preliminary feature set, and obtaining an optimized feature set; The optimized feature set is subjected to a dimensionality reduction process using principal component analysis to retain the main variation features, and the feature set with the main variation features is subjected to a dimensionality reduction process again using linear discriminant analysis to obtain a feature set after dimensionality reduction; The importance value of each feature in the feature set after dimensionality reduction is evaluated using random forest, and features whose importance values ​​are greater than a preset importance threshold are determined as target features to form a target feature set.

[0009] Optionally, the constructing of an initial anomaly recognition model using a Hoffding tree model structure, and performing ensemble learning based on the initial anomaly recognition model to obtain an anomaly recognition ensemble model include: Initialize the hyperparameters of the Hoeffding tree model structure, including the maximum depth, the minimum number of samples required for node splitting, confidence, regularization factor, gain threshold, and penalty coefficient. Optimize the parameters of the Hoeffding tree model structure according to the target feature set and historical access data to obtain the initial anomaly recognition model. The grid search algorithm is used to traverse the preset hyperparameter space to find the potential optimal hyperparameter combination, and Bayesian optimization is introduced to tune the potential optimal hyperparameter combination to optimize the initial anomaly recognition model and obtain the optimized hyperparameter combination. The optimized hyperparameter combination corresponds to the optimized anomaly recognition model. Dividing the historical access data set into a training set, a validation set, and a test set, using a cross-validation technique to evaluate the performance of the optimized anomaly recognition model, and adjusting the hyperparameters of the optimized anomaly recognition model until the optimized anomaly recognition model converges; The optimized anomaly recognition model is integrated and learned by using ensemble learning technology to obtain an anomaly recognition integrated model.

[0010] Optionally, generating an initial user behavior model according to a historical access data set and a prediction result of an anomaly recognition integrated model, training the initial user behavior model to generate a trained user behavior model, enhancing the trained user behavior model using a graph sampling and aggregation algorithm to obtain an enhanced user behavior model, and adjusting the enhanced user behavior model using a multi-level graph attention network to obtain a user behavior attention model, including: When the prediction result of the anomaly identification integrated model is an abnormal access pattern, historical access data corresponding to the abnormal access pattern is selected from the historical access data set, and the user behavior data in the historical access data includes: user operation sequence, interaction object and resource request; Based on the historical access data set and the prediction results of the anomaly recognition integrated model, combined with the traceability permissions and security levels in the historical access data, a user behavior graph structure of the corresponding level is constructed. The nodes in the user behavior graph structure are data entities, which are users or files. The edges in the user behavior graph structure represent the relationship between entities, which are read or write. The initial weight of the edge is designed to reflect the strength of the relationship through the initial weight. Training a pre-established initial user behavior model in combination with the user behavior graph structure and the target feature set to generate a trained user behavior model; For each node in the trained user behavior model, using a graph sampling and aggregation algorithm, neighbor node information is added to the node information to enhance the trained user behavior model to obtain an enhanced user behavior model; A multi-level graph attention network is applied to increase the attention of the critical path in the enhanced user behavior model and reduce the attention of the non-critical path, so as to obtain a user behavior attention model; the critical path is the path corresponding to the abnormal access pattern.

[0011] Optionally, the multi-level graph attention network is applied to increase the attention of the critical path in the enhanced user behavior model and reduce the attention of the non-critical path to obtain the user behavior attention model, including: Construct a multi-level graph attention network based on a hierarchical attention mechanism, including node level and path level; Using a multi-level graph attention network, we calculate the local attention score of a node relative to its neighbor nodes at the node level and the path-level attention score of the node on the path. The weighted sum of the local attention score and the path-level attention score is determined as the total attention score of the node. An adjustment factor is introduced in the weighted summation process to adjust the weights of the local attention score and the path-level attention score. For each edge in the critical path, the edge weight is adjusted in combination with the initial weight of the edge and the total attention score of the starting node to obtain a first adjusted edge weight. The first adjusted edge weight is used to increase the attention of the critical path in the enhanced user behavior model. For each edge in the non-critical path, the edge weight is adjusted in combination with the initial weight of the edge and the total attention score of the starting node to obtain a second adjusted edge weight. The second adjusted edge weight is used to reduce the attention of the non-critical path to obtain a user behavior attention model.

[0012] Optionally, the target abnormal path is subjected to data security tracing analysis to obtain a tracing analysis result, a chain creation rule is determined according to the tracing analysis result, and each data flow event on the target abnormal path is respectively taken as a block in combination with the chain creation rule, and connected in series to form a tracing chain, and a corresponding security response strategy is initiated according to the tracing analysis result. The security response strategy is adaptively generated according to the tracing chain, and includes: Determine the key nodes and key edges in the target abnormal path by using a causal relationship analysis method; the key nodes include at least one of the following: nodes with a flow greater than a preset flow value, nodes with authority higher than a preset authority, nodes serving as decision points, nodes with an activity greater than a preset activity, and nodes with a risk value greater than a preset threshold; the key edges include at least one of the following: edges with a flow greater than a preset flow value, edges with a value greater than a preset value, edges with an activity greater than a preset activity, and nodes with a risk value greater than a preset threshold; Combine key nodes and key edges with the impact range assessment results of the target abnormal path and security response recommendation information to obtain the traceability analysis results; Based on the traceability analysis results, combined with smart contracts, chain creation rules are defined, including block creation conditions and priority rules between different blocks; When the block creation conditions are met, according to the priority rules, each data flow event on the target abnormal path is taken as a block and connected in series to form a traceability chain. The traceability chain is stored on the distributed nodes, and the corresponding access control mechanism is configured on the distributed nodes. According to the traceability chain and the traceability analysis results, combined with the security response knowledge base of the expert system, an unsupervised learning algorithm is used to adaptively generate a security response strategy corresponding to the traceability analysis results, and the corresponding security response strategy is initiated according to the traceability analysis results.

[0013] In a second aspect, the embodiment of the present application provides a data security tracing system based on artificial intelligence, including: An acquisition and update module is used to acquire real-time access data of the target system, and based on the real-time access data, an incremental learning strategy is used to update the user behavior attention model to obtain an updated user behavior attention model. The access data includes: operation logs, user behavior data, and network traffic information. The user behavior attention model is obtained by applying a multi-level graph attention network based on historical access data modeling; A detection module is used to detect the newly added nodes and edges in the updated user behavior attention model using a variety of anomaly detection algorithms to obtain the overall anomaly detection results corresponding to the real-time access data; An analysis and determination module is used to perform a multi-dimensional aggregation analysis on all data flow paths including abnormal nodes and abnormal edges in the updated user behavior attention model when the overall abnormality detection result is that there are abnormal nodes and abnormal edges, obtain a comprehensive score value of each data flow path, and determine the path with the highest comprehensive score value among all the data flow paths as the target abnormal path, and the multiple dimensions include time dimension, user behavior dimension, data sensitivity dimension and business logic dimension; An analysis startup module is used to perform data security traceability analysis on the target abnormal path to obtain traceability analysis results, determine chain creation rules based on the traceability analysis results, and combine the chain creation rules to treat each data flow event on the target abnormal path as a block, which are connected in series to form a traceability chain. The corresponding security response strategy is started according to the traceability analysis results. The security response strategy is adaptively generated according to the traceability chain.

[0014] In a third aspect, an embodiment of the present application provides a computing device, comprising a processing component and a storage component; the storage component stores one or more computer instructions; the one or more computer instructions are used to be called and executed by the processing component to implement an artificial intelligence-based data security tracing method as described in any one of the first aspects.

[0015] In a fourth aspect, an embodiment of the present application provides a computer storage medium storing a computer program. When the computer program is executed by a computer, it implements an artificial intelligence-based data security tracing method as described in any one of the first aspects.

[0016] In summary, in an embodiment of the present application, a data security tracing method based on artificial intelligence is provided, which includes: obtaining real-time access data of the target system, and updating the user behavior attention model using an incremental learning strategy based on the real-time access data to obtain an updated user behavior attention model, wherein the access data includes: operation logs, user behavior data, and network traffic information, and the user behavior attention model is obtained by applying a multi-level graph attention network based on historical access data modeling; using a variety of anomaly detection algorithms to detect the newly added nodes and newly added edges in the updated user behavior attention model to obtain the overall anomaly detection result corresponding to the real-time access data; when the overall anomaly detection result is that there are abnormal nodes and abnormal edges, the updated A multi-dimensional aggregation analysis is performed on all data flow paths including abnormal nodes and abnormal edges in the user behavior attention model to obtain a comprehensive score for each data flow path, and the path with the highest comprehensive score among all data flow paths is determined as the target abnormal path. The multiple dimensions include time dimension, user behavior dimension, data sensitivity dimension and business logic dimension. A data security traceability analysis is performed on the target abnormal path to obtain the traceability analysis result, and the chain creation rules are determined based on the traceability analysis result. Combined with the chain creation rules, each data flow event on the target abnormal path is treated as a block and connected in series to form a traceability chain. The corresponding security response strategy is initiated based on the traceability analysis result. The security response strategy is adaptively generated based on the traceability chain.

[0017] Beneficial effects of the present invention: (1) The embodiments of the present application use an incremental learning strategy to enable the user behavior attention model to dynamically adapt to emerging threats and changes in user behavior, ensuring that it remains efficient in an ever-changing security environment.

[0018] (2) In the embodiment of the present application, through a multi-level graph attention network, the user behavior attention model can focus more on the key path, effectively distinguish normal access patterns from abnormal access patterns, and reduce the false alarm rate.

[0019] (3) The embodiments of the present application use a variety of anomaly detection algorithms to capture abnormal behaviors from different angles, thereby improving the reliability and accuracy of the detection results.

[0020] (4) The embodiments of the present application ensure a comprehensive evaluation of abnormal paths and improve the accuracy of abnormal path identification through multi-dimensional aggregation analysis of the time dimension, user behavior dimension, data sensitivity dimension, and business logic dimension.

[0021] (5) The embodiment of the present application determines the target abnormal path through the comprehensive score value, which can quickly locate the path most likely to have risks among many paths, thereby improving the response efficiency.

[0022] (6) The embodiment of the present application uses blockchain technology to build a traceability chain to ensure that each data flow event is recorded in a block, forming an unalterable chain structure, which enhances the security and transparency of the data. The security response strategy is automatically generated based on the traceability analysis results to ensure that the response measures can be initiated in a timely manner, reducing the time and cost of manual intervention.

[0023] (7) The embodiments of the present application use blockchain technology and smart contracts to achieve automated response and intelligent strategy generation, thereby improving response speed and processing efficiency.

[0024] Based on the above description, the artificial intelligence-based data security tracing method provided in this embodiment can detect and respond to anomalies more efficiently and accurately when facing complex and changing security threats. Furthermore, this embodiment improves the user behavior attention model's attention to key paths through a multi-level graph attention mechanism and targeted path weight adjustment, enhances the accuracy and real-time performance of abnormal behavior detection, and reduces the false alarm rate, achieving more intelligent and efficient abnormal behavior identification and response.

[0025] These and other aspects of the present application will become more clearly understood in the description of the following embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, a brief introduction will be given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0027] Figure 1 A flowchart of a data security tracing method based on artificial intelligence provided in an embodiment of the present application; Figure 2 A schematic diagram of the structure of an artificial intelligence-based data security tracing system provided in an embodiment of the present application; Figure 3 A schematic diagram of the structure of a computing device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0028] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application.

[0029] In some of the processes described in the specification and claims of this application and the above-mentioned figures, multiple operations that appear in a specific order are included, but it should be clearly understood that these operations may not be executed in the order in which they appear in this article or executed in parallel. The sequence numbers of the operations, such as 11, 12, etc., are only used to distinguish between different operations, and the sequence numbers themselves do not represent any execution order. In addition, these processes may include more or fewer operations, and these operations may be executed in sequence or in parallel. It should be noted that the descriptions of "first", "second", etc. in this article are used to distinguish different messages, devices, modules, etc., do not represent the order of precedence, and do not limit the "first" and "second" to different types.

[0030] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of this application.

[0031] Figure 1 A flowchart of a data security tracing method based on artificial intelligence provided in an embodiment of the present application, such as Figure 1 As shown, the method includes: Step S11, obtain the real-time access data of the target system, and based on the real-time access data, use an incremental learning strategy to update the user behavior attention model to obtain an updated user behavior attention model. The access data includes: operation logs, user behavior data and network traffic information. The user behavior attention model is obtained by applying a multi-level graph attention network based on historical access data modeling.

[0032] Among them, real-time access data is used to reflect all activities of the target system at the current time point. The incremental learning strategy allows the user behavior attention model to gradually update and improve itself through new real-time access data without retraining the entire dataset. This incremental learning method enables the user behavior attention model to adapt to the changing environment. The user behavior attention model is a multi-level graph attention network obtained by modeling historical access data, which is used to capture the key paths and relationships in user behavior patterns. The user behavior attention model improves the accuracy of anomaly detection by focusing on important nodes and edges.

[0033] Step S12: Use a variety of anomaly detection algorithms to detect the newly added nodes and newly added edges in the updated user behavior attention model to obtain the overall anomaly detection results corresponding to the real-time access data.

[0034] Among them, multiple anomaly detection algorithms are a series of methods used to identify deviations from normal behavior patterns. These algorithms can analyze the time series characteristics or graph structure characteristics of data to discover potential abnormal behaviors. New nodes and new edges can refer to new user behaviors or data flow paths that appear in real-time access data. These new elements may indicate new interaction patterns or potential security threats. The overall anomaly detection result is a comprehensive and accurate assessment of the results of multiple anomaly detection algorithms to determine whether there are abnormal nodes and abnormal edges, and thus determine whether there is abnormal behavior.

[0035] As a possible implementation, step S12 includes the following steps: Step 121, apply the support vector machine algorithm to perform abnormal probability detection on each node and edge in the updated user behavior attention model, and obtain a first abnormal probability score value. Step 122, introduce the isolation forest algorithm, and calculate the corresponding second abnormal probability score value for each node and edge in the updated user behavior attention model, which is used to supplement the abnormal detection result. Step 123, use the local outlier factor algorithm to evaluate the third abnormal probability score value of each node and edge in the updated user behavior attention model from a local perspective to improve the detection accuracy. Step 124, based on the first abnormal probability score value, the second abnormal probability score value and the third abnormal probability score value, combined with the preset marking rules, determine which nodes and edges should be marked as abnormal, and obtain the final abnormal marking result. Step 125, apply the autoencoder to remove the noise in the final abnormal marking result, obtain the cleaned abnormal marking result, and improve the accuracy of abnormal detection. Optionally, this embodiment can also introduce a variational autoencoder to perform probability modeling on the cleaned abnormal marking result, estimate the possibility of abnormal events, obtain a probabilistic abnormal marking result, and provide a more fine-grained risk assessment.

[0036] Step S13: When the overall anomaly detection result shows that there are abnormal nodes and abnormal edges, a multi-dimensional aggregation analysis is performed on all data flow paths including abnormal nodes and abnormal edges in the updated user behavior attention model to obtain a comprehensive score value for each data flow path, and the path with the highest comprehensive score value among all data flow paths is determined as the target abnormal path. The multiple dimensions include time dimension, user behavior dimension, data sensitivity dimension, and business logic dimension.

[0037] Among them, multi-dimensional aggregation analysis can refer to the evaluation of data flow paths from multiple perspectives (time dimension, user behavior dimension, data sensitivity dimension, and business logic dimension) to ensure the comprehensiveness and accuracy of abnormal paths. The comprehensive score value refers to the overall score of each path obtained by weighted summation of the analysis results of different dimensions to measure its abnormality. The target abnormal path refers to the path with the highest comprehensive score. This path is considered to be the abnormal path with the highest risk and needs to be processed and responded to first.

[0038] Step S14: perform data security traceability analysis on the target abnormal path to obtain the traceability analysis results, determine the chain creation rules based on the traceability analysis results, and combine the chain creation rules to treat each data flow event on the target abnormal path as a block, which are connected in series to form a traceability chain. According to the traceability analysis results, the corresponding security response strategy is initiated. The security response strategy is adaptively generated based on the traceability chain.

[0039] Among them, data security traceability analysis can refer to a detailed investigation of specific events in the target abnormal path to understand the cause and development process of the event in order to find the problem. Forming a traceability chain can refer to using blockchain technology to record each data flow event as an unalterable block and link them in sequence to form a complete chain of events. The introduction of the traceability chain helps to track and audit abnormal behaviors. The security response strategy refers to a series of response measures automatically generated based on the traceability chain and traceability analysis results, which aims to quickly contain threats and restore the normal operation of the target system. The security response strategy is dynamically adjusted to adapt to different threat scenarios.

[0040] Exemplarily, in a large enterprise network environment, the computer department deploys the data security traceability system provided by this application, and the data security traceability system continuously collects logs, user operation records, and inbound and outbound traffic information of servers, workstations, and network devices. Whenever new access data is generated, the data security traceability system immediately uses an incremental learning strategy to update the user behavior attention model to ensure that the model is always up to date. Once the update is completed, the data security traceability system automatically applies a variety of anomaly detection algorithms to check the newly generated nodes and edges. If certain behaviors are detected to deviate from the normal pattern, further multi-dimensional aggregation analysis is triggered to evaluate the risk level of all paths involved. After detailed analysis, the system determines a path containing a large number of abnormal nodes and abnormal edges, which is marked as the target abnormal path. Subsequently, the data security traceability system automatically generates a traceability chain, records each relevant event, and initiates corresponding security response strategies, such as blocking the account involved, notifying management, and initiating emergency review procedures.

[0041] By executing steps S11 to S14, the embodiment of the present application uses an incremental learning strategy and a multi-level graph attention network, so that the system can update and adapt to new threat patterns in real time, reduce response delays, and improve the adaptability and flexibility of the data security traceability system. The combination of multiple anomaly detection algorithms and multi-dimensional aggregation analysis improves the comprehensiveness and accuracy of abnormal path identification, reduces the false alarm rate, and ensures that only truly abnormal behaviors are marked. By using blockchain technology and smart contracts, automated response and intelligent strategy generation are achieved, which not only speeds up processing speed, but also reduces the need for manual intervention and improves efficiency. By building a traceability chain, it is ensured that each data flow event is recorded in an unalterable block, which enhances the security and transparency of the data and facilitates subsequent audits and accountability. Through accurate evaluation and traceability analysis of abnormal paths, the system can quickly locate the path that is most likely to have risks among many paths, and promptly initiate the corresponding security response strategy, reducing potential losses. Therefore, the data security traceability method based on artificial intelligence improves the ability to respond to complex and changeable security threats and protects the information assets and business operations of enterprises.

[0042] How to build an accurate user behavior attention model is a key step to accurately identify abnormal nodes and abnormal edges, and can provide technical support for accurately identifying abnormal target paths. However, the existing technology only relies on pre-defined rules or signatures of known threats for detection, and cannot guarantee the accuracy of abnormal nodes and abnormal edges. The embodiment of the present application introduces a multi-level graph attention network.

[0043] Correspondingly, the process of constructing the user behavior attention model includes: Step 111, obtain the historical access data set of the target system, select the target features according to the historical access data set to form a target feature set. The data in the historical access data set reflects all activities of the target system at different time points. The target feature is the most representative and discriminative feature extracted from the historical access data through a series of feature selection methods (such as mutual information method, chi-square test, recursive feature elimination method, principal component analysis and linear discriminant analysis). The target feature is used to build and train the key attributes of the model, such as the user's operation sequence, interactive objects, resource requests, etc. Target feature set: The final feature set formed after preprocessing and feature selection contains the features that are most helpful for abnormal behavior identification.

[0044] As a possible implementation, step 111, obtaining a historical access data set of a target system, and selecting a target feature according to the historical access data set to form a target feature set, includes: Step a1: Use the logging system and network traffic monitoring tools to collect the target system's operation logs, user behavior data, and network traffic information to obtain a historical access data set, which includes multiple historical access data, and one historical access data includes the operation log, user behavior data, and network traffic information. Among them, the logging system is a software or hardware component used to record system operations and events, such as operating system logs, application logs, etc. These logs contain detailed information about system activities. Network traffic monitoring tools are tools used to capture and analyze data packets transmitted over the network, which can provide in-depth insights into network communication patterns.

[0045] Step a2: preprocess all the historical access data in the historical access data set to obtain a preprocessed data set, wherein the preprocessing includes: cleaning, deduplication, removal of erroneous data, formatting and data filling.

[0046] Step a3: Based on the preprocessed data set, the mutual information method and chi-square test are used to calculate the correlation value between each known feature and the label, and the features whose correlation value with the label is greater than the preset relationship threshold are selected to form a preliminary feature set; wherein the label is used to indicate whether the historical access data is an abnormal access pattern, and the known feature is a feature to be determined for distinguishing between normal access patterns and abnormal access patterns. Among them, the known feature is an attribute or indicator extracted from the historical access data that may help distinguish between normal access patterns and abnormal access patterns.

[0047] Step a4: Use recursive feature elimination method in combination with support vector machine to determine redundant features in the preliminary feature set, remove redundant features to optimize the preliminary feature set, and obtain an optimized feature set.

[0048] Step a5: Use principal component analysis to perform dimensionality reduction processing on the optimized feature set to retain the main variation characteristics, and use linear discriminant analysis to perform dimensionality reduction processing on the feature set that retains the main variation characteristics again to obtain the feature set after dimensionality reduction.

[0049] Step a6: Use random forest to evaluate the importance value of each feature in the feature set after dimensionality reduction, and determine the features whose importance values ​​are greater than a preset importance threshold as target features to form a target feature set.

[0050] By executing steps a1 to a6, the embodiment of the present application provides a series of data processing and technical means to ensure the efficient extraction of the most valuable features from massive historical access data, and provide support for building a high-performance data security traceability system. Specifically, through detailed log records and network traffic monitoring, the data security traceability system obtains comprehensive and detailed historical access data, providing a solid foundation for subsequent analysis. The preprocessing step ensures the consistency and accuracy of the data, eliminates noise and redundancy, and improves the quality of subsequent modeling. Through the mutual information method and chi-square test, the data security traceability system can quickly screen out features that are highly correlated with abnormal access patterns, greatly reducing the feature space. The recursive feature elimination method combined with the application of support vector machines effectively removes redundant features, simplifies the model structure, and improves computational efficiency. The two dimensionality reduction processes of principal component analysis and linear discriminant analysis not only reduce the feature dimension, but also enhance the ability to distinguish features and improve the classification effect.

[0051] The importance evaluation of random forest ensures the rationality of the final target feature set, enabling the model to capture the key features of abnormal behavior more accurately.

[0052] Step 112, construct an initial anomaly recognition model using the Hoeffding tree model structure, perform ensemble learning based on the initial anomaly recognition model, and obtain an anomaly recognition ensemble model. The Hoeffding tree model is an incremental decision tree algorithm suitable for online learning scenarios, and can update model parameters while continuously receiving new data. The model can quickly adapt to changing data distributions. The initial anomaly recognition model is a preliminary model built based on the Hoeffding tree model structure, which is used to detect abnormal behavior. By optimizing hyperparameters (such as maximum depth, minimum number of samples required for node splitting, confidence, etc.), ensure that the model has good generalization ability. Ensemble learning refers to the technology of combining multiple weak classifiers into a strong classifier. Commonly used methods include random forests, gradient boosting trees, etc. Ensemble learning can improve the stability and accuracy of the model. The anomaly recognition ensemble model is an ensemble model composed of multiple Hoeffding tree models, which can more accurately identify abnormal behavior and reduce the deviation that may be caused by a single model.

[0053] As a possible implementation method, step 112, constructing an initial anomaly recognition model using a Hoffding tree model structure, performing ensemble learning based on the initial anomaly recognition model to obtain an anomaly recognition ensemble model, includes: Step b1, initialize the hyperparameters of the Hoeffding tree model structure, which include: maximum depth, minimum number of samples required for node splitting, confidence, regularization factor, gain threshold and penalty coefficient. The parameters of the Hoeffding tree model structure are optimized according to the target feature set and historical access data to obtain the initial anomaly recognition model. Among them, the maximum depth is to limit the maximum number of layers of the decision tree to prevent overfitting. The minimum number of samples required for node splitting is used to specify the minimum number of samples required for each node splitting to ensure sufficient statistical reliability. Confidence is to set the threshold for evaluating the effectiveness of node splitting to decide whether to continue splitting. The regularization factor is used to control the complexity of the model to prevent overfitting. The gain threshold is to set the minimum value of indicators such as information gain or Gini coefficient when the node is split to decide whether to split. The penalty coefficient imposes additional costs on complex models to balance the complexity and performance of the model.

[0054] Step b2: Use the grid search algorithm to traverse the preset hyperparameter space to find the potential optimal hyperparameter combination, introduce Bayesian optimization to tune the potential optimal hyperparameter combination to optimize the initial anomaly recognition model, and obtain the optimized hyperparameter combination. The optimized hyperparameter combination corresponds to the optimized anomaly recognition model.

[0055] Step b3: divide the historical access data set into a training set, a validation set, and a test set, use cross-validation technology to evaluate the performance of the optimized anomaly recognition model, and adjust the hyperparameters of the optimized anomaly recognition model until the optimized anomaly recognition model converges.

[0056] Step b4: Using ensemble learning technology, perform ensemble learning on the optimized anomaly recognition model to obtain an anomaly recognition ensemble model.

[0057] By executing steps b1 to b4, the embodiment of the present application initializes the hyperparameters of the Hofting tree model and performs preliminary optimization in combination with the target feature set and historical access data, so that the data security traceability system can quickly build an initial anomaly recognition model with good performance. The combination of grid search and Bayesian optimization enables the data security traceability system to efficiently explore the hyperparameter space and find the optimal hyperparameter combination to ensure the best performance of the model under various conditions. Through the application of cross-validation technology, the system can comprehensively and reliably evaluate the performance of the model to ensure that it has good generalization ability and stability. The application of ensemble learning technology not only improves the accuracy of abnormal behavior identification, but also reduces the deviation and false alarm rate that may be caused by a single model, and enhances the overall robustness and reliability of the data security traceability system.

[0058] Step 113: Generate an initial user behavior model based on the historical access data set and the prediction results of the anomaly recognition integrated model, train the initial user behavior model to generate a trained user behavior model, enhance the trained user behavior model using a graph sampling and aggregation algorithm to obtain an enhanced user behavior model, and adjust the enhanced user behavior model using a multi-level graph attention network to obtain a user behavior attention model. The graph sampling and aggregation algorithm is a technology for enhancing the trained user behavior model, and by adding the information of neighbor nodes to each node, the enhanced user behavior model can better capture the relationship between local and global.

[0059] As a possible implementation method, step 113, based on the historical access data set and the prediction result of the anomaly recognition integrated model, generates an initial user behavior model, trains the initial user behavior model, generates a trained user behavior model, enhances the trained user behavior model using a graph sampling and aggregation algorithm to obtain an enhanced user behavior model, and adjusts the enhanced user behavior model using a multi-level graph attention network to obtain a user behavior attention model, including: Step c1: When the prediction result of the anomaly identification integrated model is an abnormal access pattern, select historical access data corresponding to the abnormal access pattern from the historical access data set, and the user behavior data in the historical access data includes: user operation sequence, interaction object and resource request. Among them, the abnormal access pattern can refer to the data record marked as deviating from the normal behavior pattern by the anomaly identification integrated model. The user operation sequence includes a series of operations performed by the user in the system, such as login, query, modification, etc. The interaction object is the system component or entity with which the user interacts, such as a file, database table, application, etc. Resource request refers to the user's request behavior for system resources (such as files, network connections).

[0060] Step c2: Based on the historical access data set and the prediction results of the anomaly recognition integrated model, combined with the traceability permissions and security levels in the historical access data, a user behavior graph structure of the corresponding level is constructed. The nodes in the user behavior graph structure are data entities, and the data entities are users or files. The edges in the user behavior graph structure represent the relationship between entities, and the relationship is read or write. The initial weight of the edge is designed to reflect the strength of the relationship through the initial weight. Among them, the traceability permission defines the operation permissions that each user or role can perform in the target system, which is used to track and verify the user's activities. The security level is a different level divided according to sensitivity and importance, which is used to evaluate the security requirements of data and resources. The user behavior graph structure includes nodes and edges, which helps to capture complex user behavior patterns. The initial weight is a numerical value of the edge, which reflects the strength or importance of the relationship between entities.

[0061] Step c3: training the pre-established initial user behavior model in combination with the user behavior graph structure and the target feature set to generate a trained user behavior model.

[0062] Step c4: for each node in the trained user behavior model, using graph sampling and aggregation algorithms, add neighbor node information to the node information to enhance the trained user behavior model to obtain an enhanced user behavior model.

[0063] Step c5: Apply a multi-level graph attention network to increase the attention of the key path in the enhanced user behavior model and reduce the attention of the non-key path to obtain a user behavior attention model; the key path is the path corresponding to the abnormal access pattern. The key path may refer to the path that best reflects the abnormal access pattern.

[0064] Specifically, step c5, applying a multi-level graph attention network, increasing the attention of the key path in the enhanced user behavior model, and reducing the attention of the non-key path, to obtain a user behavior attention model, including: Step c51, construct a multi-level graph attention network based on a hierarchical attention mechanism, and the multi-level includes a node level and a path level. Among them, the hierarchical attention mechanism is a method of allocating attention weights at different levels of abstraction to ensure that the model can focus on important parts. In this embodiment, it is used to simultaneously pay attention to local information at the node level and global information at the path level. The multi-level graph attention network is a model that extends the traditional graph neural network, which can apply the attention mechanism on graph structure data and dynamically adjust the weights of the edges to better capture the relationship between nodes. Multi-level refers to the application of attention mechanisms at different levels of the network, such as the node level and the path level. The node level is used to focus on the relationship between a single node and its direct neighbor nodes, emphasizing local features. The path level is used to focus on the node sequence and their mutual relationships on the entire path, emphasizing global features.

[0065] Step c52: Using a multi-level graph attention network, calculate the local attention score of the node relative to the neighboring nodes at the node level and the path-level attention score of the node on the path. The local attention score is used to measure the importance of a node relative to its direct neighboring nodes. The path-level attention score is used to measure the importance of a node on the entire path, reflecting the key role of the node in the global path. The multi-level graph attention network is used to calculate the above two types of attention scores to help the model understand the importance of nodes and paths more accurately.

[0066] Step c53, the weighted sum of the local attention score and the path-level attention score is determined as the total attention score of the node, and an adjustment factor is introduced in the weighted summation process, and the adjustment factor is used to adjust the weights of the local attention score and the path-level attention score. Among them, the total attention score is a combination of the local and path-level attention scores to comprehensively evaluate the importance of the node in the entire graph structure. Weighted summation refers to adding the local and path-level attention scores according to certain weights to form the final total attention score. The adjustment factor is used to adjust the relative importance of the local and path-level attention scores, and can be optimized according to the specific application scenario to achieve the best effect.

[0067] Exemplary, regulatory factors It can be calculated by the following formula: ; in, Indicates The local importance score of each node, Indicates The global importance score of a node on the entire path, Indicates the number of nodes. Adjustment factor The calculation combines the information of both local and global dimensions, avoiding the bias that may be caused by single-dimensional evaluation. For example, relying only on local information may ignore some global abnormal behaviors, while relying only on global information may miss local details. In addition, the adjustment factor Its focus can be automatically optimized according to different application scenarios and data distribution.

[0068] The total attention score The calculation formula can be: ; in, It is The total attention score of nodes, It is The local importance score of each node, It is The global importance score of a node on the entire path, is a regulation factor used to adjust the weights of local and global importance scores. The total attention score can comprehensively evaluate the importance of the node in the entire graph structure.

[0069] Step c54: for each edge in the critical path, the edge weight is adjusted in combination with the initial weight of the edge and the total attention score of the starting node to obtain a first adjusted edge weight. The first adjusted edge weight is used to increase the attention of the critical path in the enhanced user behavior model. For each edge in the non-critical path, the edge weight is adjusted in combination with the initial weight of the edge and the total attention score of the starting node to obtain a second adjusted edge weight. The second adjusted edge weight is used to reduce the attention of the non-critical path to obtain a user behavior attention model.

[0070] Exemplarily, for each edge in the critical path, the weight of the edge is adjusted in combination with the initial weight of the edge and the total attention score of the starting node to obtain a first adjusted edge weight, exemplarily: ; in, It is the first The first adjusted weight of the edge, It is The initial weight of the edge, is the coefficient used to increase the edge weight, ; It is The total attention score of the starting node of the edge. The starting node is one node of the edge, and the other nodes of the edge are the terminal nodes.

[0071] Among them, the coefficient used to increase the edge weight It is calculated using the following formula: ; in, is the total attention score change of each edge in the critical path. is the maximum value of the variation. is the standard deviation of the total attention score variation of each edge in the critical path.

[0072] For each edge in the non-critical path, corresponding adjustments are also made to obtain the second adjusted edge weight, exemplarily: ; in, Is the first in the non-critical path The second adjusted weight of the edge, It is The initial weight of the edge, It is The total attention score of the starting node of the edge, is the coefficient used to reduce the edge weight, .

[0073] Among them, the coefficient used to reduce the edge weight It is calculated using the following formula: ; in, is the total attention score change of each edge in the non-critical path, is the minimum value of the change. is the standard deviation of the total attention score change of each edge in the non-critical path.

[0074] In this embodiment, and The calculation is based on the maximum and minimum values ​​of the total attention score changes of each edge in the critical path and non-critical path, as well as the standard deviation, which effectively reduces the impact of data fluctuations and ensures the stability and reliability of weight adjustment. In addition, this embodiment can dynamically adjust the edge weight according to actual data, enhancing the adaptability and flexibility of the data security traceability system.

[0075] By executing steps c51 to c54, the embodiment of the present application introduces some technologies suitable for data security traceability scenarios from the construction of a multi-level graph attention network to the final adjustment of edge weights, thereby improving the performance and reliability of the data security traceability system. Specifically, by constructing a multi-level graph attention network based on a hierarchical attention mechanism, the data security traceability system can simultaneously allocate attention weights at the node level and the path level, ensuring that the model not only focuses on local features, but also captures global relationships, thereby improving the comprehensiveness and accuracy of abnormal behavior detection. By using a multi-level graph attention network to calculate local and path-level attention scores, and determining the total attention score by weighted summation, the data security traceability system can more accurately evaluate the importance of each node in the entire graph structure, thereby avoiding the possible deviation caused by a single-dimensional evaluation. By introducing an adjustment factor, the data security traceability system can flexibly adjust the weights of the local and path-level attention scores, optimize according to the needs of different application scenarios, and enhance the adaptability and flexibility of the model. By adjusting the weights of the edges in the critical paths, the data security traceability system can increase the attention of these paths, ensuring that potential security threats will not be ignored, and improving the response speed and processing efficiency of the data security traceability system. By reducing the focus on non-critical paths, the data security traceability system can effectively reduce the false alarm rate, avoid unnecessary alarms interfering with normal business operations, and improve the reliability and user experience of the data security traceability system.

[0076] By executing steps c1 to c5, the embodiment of the present application improves the performance and reliability of the data security traceability system. Specifically, by constructing a user behavior graph structure from the historical access data corresponding to the abnormal access pattern, the data security traceability system can more accurately capture the abnormal behavior pattern and improve the accuracy of anomaly detection. Combining the user behavior graph structure and the target feature set for training ensures that the user behavior model not only considers a single event, but also covers the overall behavior pattern, providing a more comprehensive understanding of behavior. The application of graph sampling and aggregation algorithms enhances the user behavior model, enabling it to better capture the relationship between local and global, and improves the expressiveness and accuracy of the model. The application of multi-level graph attention networks enables the data security traceability system to dynamically adjust the weights of critical paths and non-critical paths, increasing the focus on critical paths and reducing the focus on non-critical paths, thereby more accurately identifying abnormal behaviors and reducing false alarm rates. The entire process is highly automated, reducing the need for manual intervention, improving the response speed and processing efficiency of the data security traceability system, and being able to detect and respond to potential security threats in the first place.

[0077] By executing steps 111 to 113, the embodiment of the present application uses a series of feature selection methods to enable the data security traceability system to screen out the most representative and discriminative target features from a large amount of historical access data, thereby improving the accuracy and efficiency of subsequent modeling. The Hofting tree model structure and its optimization process ensure that the model can quickly adapt to changing data distributions, while ensemble learning further improves the stability and accuracy of the model. By constructing a user behavior graph structure and enhancing the user behavior model using graph sampling and aggregation algorithms, the data security traceability system can more comprehensively understand user behavior patterns and capture complex interactive relationships. The application of a multi-level graph attention network enables the model to dynamically adjust path weights, increase the attention of critical paths, and reduce the attention of non-critical paths, thereby more accurately identifying abnormal behaviors. The entire process is highly automated, reducing the need for manual intervention, improving the response speed and processing efficiency of the data security traceability system, while also reducing the false alarm rate, ensuring that only truly abnormal behaviors are marked.

[0078] How to adaptively generate security response strategies is a key step in forming a complete mechanism for adaptively generating security response strategies, which cannot be achieved with existing technologies. Therefore, the embodiment of the present application introduces smart contracts, distributed nodes, and unsupervised learning algorithms in step S14, and refines step S14.

[0079] Exemplarily, step S14, performing data security traceability analysis on the target abnormal path to obtain the traceability analysis result, determining the chain creation rule according to the traceability analysis result, combining the chain creation rule, treating each data flow event on the target abnormal path as a block, connecting them in series to form a traceability chain, and starting the corresponding security response strategy according to the traceability analysis result. The security response strategy is adaptively generated according to the traceability chain, including: Step 141, determine the key nodes and key edges in the target abnormal path through the causal analysis method; the key nodes include at least one of the following: nodes with flow greater than a preset flow value, nodes with authority higher than a preset authority, nodes serving as decision points, nodes with activity greater than a preset activity, and nodes with a risk value greater than a preset threshold; the key edges include at least one of the following: edges with flow greater than a preset flow value, edges with a value greater than a preset value, edges with activity greater than a preset activity, and nodes with a risk value greater than a preset threshold.

[0080] Among them, a node with a flow greater than a preset flow value refers to a node whose data transmission volume exceeds the normal range, which may indicate abnormal activity. A node with a higher authority than a preset authority refers to a node with high authority, which may be the point where sensitive operations occur. A node as a decision point can be understood as a node that plays a decision-making role in the network or target system process, such as the operation of an administrator account. A node with an activity greater than a preset activity may refer to a frequently active node, which may indicate abnormally active behavior. A node with a risk value greater than a preset threshold refers to a node with a higher risk score based on a comprehensive assessment. An edge with a flow greater than a preset flow value may refer to an edge with a large amount of data transmission between connected nodes. An edge with a value greater than a preset value is an edge involving the transmission of important resources or sensitive information. An edge with an activity greater than a preset activity is a frequently used edge, which may indicate abnormal activity. A node with a risk value greater than a preset threshold may refer to an edge associated with a high-risk node.

[0081] Step 142: Combine the key nodes and key edges with the impact range assessment result of the target abnormal path and the security response suggestion information to obtain the traceability analysis result. The security response suggestion information is a suggestion for countermeasures, such as blocking an account, restricting access rights, etc.

[0082] Step 143: Based on the traceability analysis results and in combination with smart contracts, define chain creation rules, which include block creation conditions and priority rules between different blocks. Among them, smart contracts are program codes that automatically execute contract terms to ensure the consistency and immutability of the rules. Chain creation rules are specific rules that specify how to build a traceability chain, including block creation conditions (such as creating blocks when specific events occur) and priority rules between blocks (such as sorting by time or importance). Block creation conditions are conditions that trigger the creation of new blocks, such as detecting abnormal behavior or reaching a certain time interval. Priority rules are used to determine the order in which different blocks are arranged in the traceability chain to ensure that important events are recorded first.

[0083] Step 144: When the block creation conditions are met, each data flow event on the target abnormal path is treated as a block according to the priority rules, and connected in series to form a traceability chain. The traceability chain is stored on the distributed nodes, and the corresponding access control mechanism is configured on the distributed nodes. According to the traceability chain and the traceability analysis results, combined with the expert system's security response knowledge base, an unsupervised learning algorithm is used to adaptively generate a security response strategy corresponding to the traceability analysis results, and the corresponding security response strategy is initiated according to the traceability analysis results. Among them, the distributed nodes are computer systems distributed in different locations, which jointly maintain the traceability chain to ensure its immutability and transparency. The unsupervised learning algorithm is a machine learning method that can discover patterns in data without labeled data, and is used to automatically generate security response strategies.

[0084] By executing steps 141 to 144, the embodiment of the present application can improve the accuracy and timeliness of data security traceability. Specifically, through the causal analysis method, the data security traceability system can accurately identify the key nodes and key edges in the target abnormal path, ensuring that only the truly important behavior patterns are focused on, thereby improving the accuracy of anomaly detection. By combining key nodes and key edges with the impact range assessment results and security response recommendation information, the data security traceability system can comprehensively assess the potential impact of abnormal behavior, use smart contracts to define chain creation rules, ensure the consistency and immutability of the rules, and combine the expert system's security response knowledge base to achieve automatic generation of security response strategies, reducing the need for manual intervention. By constructing a traceability chain and storing it on distributed nodes, the data security traceability system ensures the immutability and transparency of the data, facilitating subsequent audits. The security response strategy is automatically generated based on the traceability chain and analysis results, and the data security traceability system can quickly take countermeasures to reduce potential losses and protect the company's information assets and business operations.

[0085] Figure 2 A schematic diagram of the structure of a data security tracing system based on artificial intelligence provided in an embodiment of the present application is shown in FIG. Figure 2 As shown, the system includes: The acquisition update module 21 is used to obtain the real-time access data of the target system, and based on the real-time access data, use an incremental learning strategy to update the user behavior attention model to obtain an updated user behavior attention model. The access data includes: operation logs, user behavior data and network traffic information. The user behavior attention model is obtained by applying a multi-level graph attention network based on historical access data modeling.

[0086] The detection module 22 is used to use a variety of anomaly detection algorithms to detect the newly added nodes and newly added edges in the updated user behavior attention model to obtain the overall anomaly detection results corresponding to the real-time access data.

[0087] The analysis and determination module 23 is used to perform multi-dimensional aggregation analysis on all data flow paths including abnormal nodes and abnormal edges in the updated user behavior attention model when the overall abnormality detection result is that there are abnormal nodes and abnormal edges, to obtain a comprehensive score value for each data flow path, and determine the path with the highest comprehensive score value among all data flow paths as the target abnormal path. The multiple dimensions include time dimension, user behavior dimension, data sensitivity dimension and business logic dimension.

[0088] The analysis startup module 24 is used to perform data security traceability analysis on the target abnormal path, obtain the traceability analysis results, determine the chain creation rules based on the traceability analysis results, and combine the chain creation rules to treat each data flow event on the target abnormal path as a block, which are connected in series to form a traceability chain. The corresponding security response strategy is started according to the traceability analysis results. The security response strategy is adaptively generated based on the traceability chain.

[0089] Figure 2 The data security traceability system based on artificial intelligence can perform Figure 1 The implementation principle and technical effect of the data security traceability method based on artificial intelligence described in the illustrated embodiment will not be repeated. The specific way in which each module and unit performs operations in the data security traceability system based on artificial intelligence in the above embodiment has been described in detail in the embodiment of the method, and will not be elaborated here.

[0090] In one possible design, Figure 2 The artificial intelligence-based data security traceability system of the embodiment shown can be implemented as a computing device, such as Figure 3 As shown, the computing device may include a storage component 31 and a processing component 32; The storage component 31 stores one or more computer instructions, wherein the one or more computer instructions are called and executed by the processing component 32 .

[0091] The processing component 32 is used to: obtain the real-time access data of the target system, and update the user behavior attention model using an incremental learning strategy based on the real-time access data to obtain an updated user behavior attention model, where the access data includes: operation logs, user behavior data and network traffic information, and the user behavior attention model is obtained by applying a multi-level graph attention network based on historical access data modeling; use a variety of anomaly detection algorithms to detect the newly added nodes and newly added edges in the updated user behavior attention model to obtain the overall anomaly detection result corresponding to the real-time access data; when the overall anomaly detection result is that there are abnormal nodes and abnormal edges, all the nodes in the updated user behavior attention model including The data flow paths of abnormal nodes and abnormal edges are subjected to multi-dimensional aggregation analysis to obtain the comprehensive score value of each data flow path, and the path with the highest comprehensive score value among all data flow paths is determined as the target abnormal path. The multiple dimensions include time dimension, user behavior dimension, data sensitivity dimension and business logic dimension. Data security traceability analysis is performed on the target abnormal path to obtain the traceability analysis results, and the chain creation rules are determined according to the traceability analysis results. Combined with the chain creation rules, each data flow event on the target abnormal path is regarded as a block and connected in series to form a traceability chain. The corresponding security response strategy is initiated according to the traceability analysis results. The security response strategy is adaptively generated according to the traceability chain.

[0092] The processing component 32 may include one or more processors to execute computer instructions to complete all or part of the steps in the above method. Of course, the processing component may also be implemented by one or more application-specific integrated circuits (ASIC), digital signal processors (DSP), digital signal processing devices (DSPD), programmable logic devices (PLD), field programmable gate arrays (FPGA), controllers, microcontrollers, microprocessors or other electronic components to perform the above method.

[0093] The storage component 31 is configured to store various types of data to support operations at the terminal. The storage component can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as random access memory (RAM), static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.

[0094] Of course, the computing device may also include other components, such as input / output interfaces, display components, communication components, etc.

[0095] The input / output interface provides an interface between the processing component and the peripheral interface module, which may be an output device, an input device, etc.

[0096] The communication component is configured to facilitate, among other things, wired or wireless communications between the computing device and other devices.

[0097] Among them, the computing device can be a physical device or an elastic computing host provided by a cloud computing platform, etc. In this case, the computing device can refer to a cloud server, and the above-mentioned processing components, storage components, etc. can be basic server resources rented or purchased from the cloud computing platform.

[0098] The present application also provides a computer storage medium storing a computer program, wherein the computer program can achieve the above-mentioned Figure 1 The artificial intelligence-based data security tracing method of the illustrated embodiment.

[0099] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0100] The system embodiment described above is merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment. Those of ordinary skill in the art may understand and implement it without creative work.

[0101] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0102] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A data security tracing method based on artificial intelligence, characterized in that: include: Acquire the real-time access data of the target system, and based on the real-time access data, use an incremental learning strategy to update the user behavior attention model to obtain an updated user behavior attention model, wherein the access data includes: operation logs, user behavior data, and network traffic information, and the user behavior attention model is obtained by applying a multi-level graph attention network to model historical access data; A variety of anomaly detection algorithms are used to detect the newly added nodes and edges in the updated user behavior attention model to obtain the overall anomaly detection results corresponding to the real-time access data; When the overall anomaly detection result is that there are abnormal nodes and abnormal edges, a multi-dimensional aggregation analysis is performed on all data flow paths including abnormal nodes and abnormal edges in the updated user behavior attention model to obtain a comprehensive score value of each data flow path, and the path with the highest comprehensive score value among all the data flow paths is determined as the target abnormal path, and the multiple dimensions include time dimension, user behavior dimension, data sensitivity dimension and business logic dimension; Perform data security traceability analysis on the target abnormal path to obtain the traceability analysis result, determine the chain creation rule based on the traceability analysis result, and combine the chain creation rule to treat each data flow event on the target abnormal path as a block, which are connected in series to form a traceability chain. Initiate the corresponding security response strategy based on the traceability analysis result, and the security response strategy is adaptively generated according to the traceability chain.

2. The method according to claim 1, characterized in that: The process of building a user behavior attention model includes: Acquire a historical access data set of a target system, and select a target feature according to the historical access data set to form a target feature set; An initial anomaly recognition model using the Hoefding tree model structure is constructed, and ensemble learning is performed based on the initial anomaly recognition model to obtain an anomaly recognition ensemble model; According to the historical access data set and the prediction results of the anomaly recognition integrated model, an initial user behavior model is generated, the initial user behavior model is trained to generate a trained user behavior model, the trained user behavior model is enhanced by using a graph sampling and aggregation algorithm to obtain an enhanced user behavior model, and the enhanced user behavior model is adjusted by using a multi-level graph attention network to obtain a user behavior attention model.

3. The method according to claim 2, characterized in that The acquiring of a historical access data set of the target system and selecting a target feature according to the historical access data set to form a target feature set includes: Using a log recording system and a network traffic monitoring tool, the operation log, user behavior data and network traffic information of the target system are collected to obtain a historical access data set, wherein the historical access data set includes multiple historical access data, and one historical access data includes the operation log, user behavior data and network traffic information; Preprocessing all the historical access data in the historical access data set to obtain a preprocessed data set, wherein the preprocessing includes: cleaning, deduplication, removal of erroneous data, formatting, and data filling; Based on the preprocessed data set, the association relationship value between each known feature and the label is calculated by using the mutual information method and the chi-square test, and the features whose association relationship value with the label is greater than a preset relationship threshold are selected to form a preliminary feature set; wherein the label is used to indicate whether the historical access data is an abnormal access pattern, and the known feature is a feature to be determined for distinguishing between a normal access pattern and an abnormal access pattern; Using a recursive feature elimination method combined with a support vector machine, determining redundant features in the preliminary feature set, removing the redundant features, so as to optimize the preliminary feature set, and obtaining an optimized feature set; The optimized feature set is subjected to a dimensionality reduction process using principal component analysis to retain the main variation features, and the feature set with the main variation features is subjected to a dimensionality reduction process again using linear discriminant analysis to obtain a feature set after dimensionality reduction; The importance value of each feature in the feature set after dimensionality reduction is evaluated using random forest, and features whose importance values ​​are greater than a preset importance threshold are determined as target features to form a target feature set.

4. The method according to claim 2, characterized in that: The constructing of an initial anomaly recognition model using a Hoefding tree model structure, performing ensemble learning based on the initial anomaly recognition model, and obtaining an anomaly recognition ensemble model includes: Initialize the hyperparameters of the Hoeffding tree model structure, including the maximum depth, the minimum number of samples required for node splitting, confidence, regularization factor, gain threshold, and penalty coefficient. Optimize the parameters of the Hoeffding tree model structure according to the target feature set and historical access data to obtain the initial anomaly recognition model. The grid search algorithm is used to traverse the preset hyperparameter space to find the potential optimal hyperparameter combination, and Bayesian optimization is introduced to tune the potential optimal hyperparameter combination to optimize the initial anomaly recognition model and obtain the optimized hyperparameter combination. The optimized hyperparameter combination corresponds to the optimized anomaly recognition model. Dividing the historical access data set into a training set, a validation set, and a test set, using a cross-validation technique to evaluate the performance of the optimized anomaly recognition model, and adjusting the hyperparameters of the optimized anomaly recognition model until the optimized anomaly recognition model converges; The optimized anomaly recognition model is integrated and learned by using ensemble learning technology to obtain an anomaly recognition integrated model.

5. The method according to claim 2, characterized in that: The method generates an initial user behavior model based on the historical access data set and the prediction result of the abnormal recognition integrated model, trains the initial user behavior model to generate a trained user behavior model, enhances the trained user behavior model using a graph sampling and aggregation algorithm to obtain an enhanced user behavior model, and adjusts the enhanced user behavior model using a multi-level graph attention network to obtain a user behavior attention model, including: When the prediction result of the anomaly identification integrated model is an abnormal access pattern, historical access data corresponding to the abnormal access pattern is selected from the historical access data set, and the user behavior data in the historical access data includes: user operation sequence, interaction object and resource request; Based on the historical access data set and the prediction results of the anomaly recognition integrated model, combined with the traceability permissions and security levels in the historical access data, a user behavior graph structure of the corresponding level is constructed. The nodes in the user behavior graph structure are data entities, which are users or files. The edges in the user behavior graph structure represent the relationship between entities, which are read or write. The initial weight of the edge is designed to reflect the strength of the relationship through the initial weight. Training a pre-established initial user behavior model in combination with the user behavior graph structure and the target feature set to generate a trained user behavior model; For each node in the trained user behavior model, using a graph sampling and aggregation algorithm, neighbor node information is added to the node information to enhance the trained user behavior model to obtain an enhanced user behavior model; A multi-level graph attention network is applied to increase the attention of the critical path in the enhanced user behavior model and reduce the attention of the non-critical path, so as to obtain a user behavior attention model; the critical path is the path corresponding to the abnormal access pattern.

6. The method according to claim 5, characterized in that The multi-level graph attention network is applied to increase the attention of the key path in the enhanced user behavior model and reduce the attention of the non-key path, so as to obtain the user behavior attention model, including: Construct a multi-level graph attention network based on a hierarchical attention mechanism, including node level and path level; Using a multi-level graph attention network, we calculate the local attention score of a node relative to its neighbor nodes at the node level and the path-level attention score of the node on the path. The weighted sum of the local attention score and the path-level attention score is determined as the total attention score of the node. An adjustment factor is introduced in the weighted summation process to adjust the weights of the local attention score and the path-level attention score. For each edge in the critical path, the edge weight is adjusted in combination with the initial weight of the edge and the total attention score of the starting node to obtain a first adjusted edge weight. The first adjusted edge weight is used to increase the attention of the critical path in the enhanced user behavior model. For each edge in the non-critical path, the edge weight is adjusted in combination with the initial weight of the edge and the total attention score of the starting node to obtain a second adjusted edge weight. The second adjusted edge weight is used to reduce the attention of the non-critical path to obtain a user behavior attention model.

7. The method according to claim 1, characterized in that The target abnormal path is subjected to data security tracing analysis to obtain tracing analysis results, chain creation rules are determined according to the tracing analysis results, and each data flow event on the target abnormal path is respectively regarded as a block, which are connected in series to form a tracing chain in combination with the chain creation rules. The corresponding security response strategy is initiated according to the tracing analysis results. The security response strategy is adaptively generated according to the tracing chain, and includes: Determine the key nodes and key edges in the target abnormal path by using a causal relationship analysis method; the key nodes include at least one of the following: nodes with a flow greater than a preset flow value, nodes with authority higher than a preset authority, nodes serving as decision points, nodes with an activity greater than a preset activity, and nodes with a risk value greater than a preset threshold; the key edges include at least one of the following: edges with a flow greater than a preset flow value, edges with a value greater than a preset value, edges with an activity greater than a preset activity, and nodes with a risk value greater than a preset threshold; Combine key nodes and key edges with the impact range assessment results of the target abnormal path and security response recommendation information to obtain the traceability analysis results; Based on the traceability analysis results, combined with smart contracts, chain creation rules are defined, including block creation conditions and priority rules between different blocks; When the block creation conditions are met, according to the priority rules, each data flow event on the target abnormal path is taken as a block and connected in series to form a traceability chain. The traceability chain is stored on the distributed nodes, and the corresponding access control mechanism is configured on the distributed nodes. According to the traceability chain and the traceability analysis results, combined with the security response knowledge base of the expert system, an unsupervised learning algorithm is used to adaptively generate a security response strategy corresponding to the traceability analysis results, and the corresponding security response strategy is initiated according to the traceability analysis results.

8. A data security tracing system based on artificial intelligence, characterized in that: include: An acquisition and update module is used to acquire real-time access data of the target system, and based on the real-time access data, an incremental learning strategy is used to update the user behavior attention model to obtain an updated user behavior attention model. The access data includes: operation logs, user behavior data, and network traffic information. The user behavior attention model is obtained by applying a multi-level graph attention network based on historical access data modeling; A detection module is used to detect the newly added nodes and edges in the updated user behavior attention model using a variety of anomaly detection algorithms to obtain the overall anomaly detection results corresponding to the real-time access data; An analysis and determination module is used to perform a multi-dimensional aggregation analysis on all data flow paths including abnormal nodes and abnormal edges in the updated user behavior attention model when the overall abnormality detection result is that there are abnormal nodes and abnormal edges, obtain a comprehensive score value of each data flow path, and determine the path with the highest comprehensive score value among all the data flow paths as the target abnormal path, and the multiple dimensions include time dimension, user behavior dimension, data sensitivity dimension and business logic dimension; An analysis startup module is used to perform data security traceability analysis on the target abnormal path to obtain traceability analysis results, determine chain creation rules based on the traceability analysis results, and combine the chain creation rules to treat each data flow event on the target abnormal path as a block, which are connected in series to form a traceability chain. The corresponding security response strategy is started according to the traceability analysis results. The security response strategy is adaptively generated according to the traceability chain.

9. A computing device, characterized in that It includes a processing component and a storage component; the storage component stores one or more computer instructions; the one or more computer instructions are used to be called and executed by the processing component to implement an artificial intelligence-based data security tracing method as described in any one of claims 1-7.

10. A computer storage medium, characterized in that: A computer program is stored, and when the computer program is executed by a computer, an artificial intelligence-based data security tracing method as described in any one of claims 1 to 7 is implemented.

Images