Data intelligent security protection method and system for computer terminal data interaction

Abstract

The invention discloses a data intelligent security protection method and system for computer terminal data interaction, and relates to the technical field of network security. Comprising the following steps of S1, collecting scene data, performing preprocessing, and performing security risk assessment; s2, performing data synthesis conversion and encryption processing on the interaction data; s3, constructing a user portrait and establishing an intelligent identity authentication mechanism; s4, dividing data access permissions according to user roles and responsibilities; s5, making a data backup plan; and S6, deploying a security auditing system. According to the method, the potential security risk in the terminal data interaction process can be detected by performing preliminary security assessment on the interaction scene; data encryption processing is performed after the interaction data is synthesized and converted, so that original data features can be confused, the encryption complexity is increased, and unified management and transmission of the data are facilitated; and user behaviors are deeply known based on a user portrait mode, so that the access control authority can be more accurately set, and misinformation and interference are reduced.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a data intelligent security protection method and system for computer terminal data interaction. Background Art

[0002] With the development of computer networks, network topology has become increasingly complex. From traditional local area networks (LANs) to wide area networks (WANs), and then to today's cloud computing environments and the Internet of Things (IoT), terminal devices may be connected to a variety of different network environments. For example, an office terminal within an enterprise may be connected to an enterprise server through a local area network, and at the same time connected to an external cloud service provider through the Internet. This complex network topology increases the paths for data interaction and potential security risk points.

[0003] Attackers are constantly developing new attack methods to obtain terminal data. Common attack methods include malware (such as viruses, Trojans, ransomware, etc.), phishing, distributed denial of service attacks (DDoS), man-in-the-middle attacks, etc. For example, malware can be installed on terminal devices and steal data by disguising itself as legitimate software programs or files; phishing obtains data by deceiving users into entering sensitive information.

[0004] In today's era, data is generated and accumulated at an extremely fast speed, and the amount of data on terminal devices is also growing. The large amount of data increases the frequency and complexity of data interaction, and also puts higher requirements on data security protection. In addition to traditional text data, there may be various types of data on terminal devices, such as audio, video, image, sensor data, etc. Different types of data have different characteristics and security requirements.

[0005] The user's operation behavior on the computer terminal is complex and diverse. Users may install various unauthorized software, visit unsafe websites, click suspicious links, etc. For example, some users may download software from unofficial channels to obtain certain application functions. These software may contain malicious code, thus leading to data leakage risks.

[0006] Different users have different levels of security awareness. Some users may have a high level of security awareness, follow security operating procedures, and regularly update software and passwords, while others may not pay enough attention to security issues and easily become targets of attackers. For example, some users may use simple passwords or use the same password in multiple accounts, increasing the risk of account theft.

[0007] Although traditional encryption technologies (such as symmetric encryption and asymmetric encryption) play an important role in protecting data, they also have some limitations. For example, symmetric encryption requires shared keys and key management is complex; asymmetric encryption has high computational complexity and is less efficient when processing large amounts of data. Moreover, encryption technology can only protect the confidentiality of data during transmission and storage, and is relatively weak in protecting the integrity and availability of data. Existing access control technologies with unclear role definitions or unreasonable permission settings may also have loopholes, which can easily lead to users accessing resources they should not access.

[0008] In order to solve the above problems, the present invention proposes a data intelligent security protection method and system for computer terminal data interaction. Summary of the invention

[0009] The main purpose of the present invention is to provide a data intelligent security protection method and system for computer terminal data interaction, which can effectively solve the problems in the background technology.

[0010] In order to achieve the above object, the present invention adopts the following technical solutions:

[0011] The data intelligent security protection method for computer terminal data interaction comprises the following steps:

[0012] S1: Collect and pre-process the data of computer terminal data interaction scenarios, count the risk influencing factors, and conduct security risk assessment on computer terminal data interaction scenarios, and use this to carry out corresponding data intelligent security protection planning;

[0013] S2: Performing data synthesis conversion on the computer terminal interaction data, and then encrypting the synthesized and converted computer terminal interaction data based on a data encryption algorithm;

[0014] S3: Build user portraits and establish intelligent identity authentication mechanisms based on user portraits;

[0015] S4: Finely divide data access permissions based on user roles and responsibilities, classify and label data, and set corresponding access policies based on data sensitivity;

[0016] S5: Develop a data backup plan, regularly back up data to storage media, and test the integrity and recoverability of the backup data;

[0017] S6: Deploy a security audit system to record various types of information data, monitor the activities and operation of computer terminals in real time, and establish a security alarm mechanism for risk alarm.

[0018] Preferably, in S1, six influencing factors, namely, exposure rate, severity, controllability, complexity, timeliness and value, are divided according to the computer terminal data interaction scenario data, and the interaction scenarios of the computer terminals are divided into security risk levels accordingly.

[0019] Preferably, the data synthesis conversion in S2 is based on the improved variational autoencoder to perform data synthesis conversion, which is as follows:

[0020] The input computer terminal interaction data X0 is processed using a vector quantization-based variational autoencoder pre-trained on a large-scale dataset:

[0021] The input data X0 is passed through the encoder to obtain the feature JQ, as follows:

[0022] Unsupervised coding based on artificial neural networks:

[0023]

[0024] Among them, h y1 is the encoder output; jh1 is the activation function; and are the weights and thresholds of neurons in the encoding process;

[0025] According to the codebook KV, find the feature closest to each feature in JQ and replace them one by one to obtain the quantized feature Q.

[0026]

[0027] Among them, i is the i-th data input, a kv is the reference feature in the codebook;

[0028] The quantitative feature Q is used as the input x0 of the diffusion model. During the forward diffusion process, Gaussian noise is gradually added to x0. For each time step t, the computer terminal interaction synthetic data x after adding noise is calculated according to the following formula: t ;

[0029]

[0030] δ t =1-λ t ;

[0031]

[0032] Among them, σ t is a Gaussian distribution t ~N(0,I) noise;δ t is a variable; is the variable δ t The cumulative value oft (λ t ∈(0,1)) is the noise time variation table;

[0033] In the reverse denoising process, a noise prediction network ξ is trained θ Predicting noise, its loss function L is defined as follows:

[0034]

[0035] Where E(·) is the expectation; t is the time step not greater than T; To meet a specific distribution A random initial sample of is the data with t time step noise added; ξ is the noise, which obeys Gaussian distribution N(0,I); For the noise prediction network ξ θ For input and the prediction noise at time step t;

[0036] Gaussian noise is gradually removed by the following formula:

[0037]

[0038] Among them, β follows Gaussian distribution;

[0039] The above steps are used to gradually construct x0; the features obtained after denoising are quantized to obtain the quantized features Q, and then the features are replaced according to the codebook KV, and the following decoder is trained based on the artificial neural network:

[0040]

[0041] Among them, h y2 is the decoder output; jh2 is the activation function; X' is the data to be decoded input to the decoder; and are the weights and thresholds of neurons in the decoding process;

[0042] Finally, the quantitative feature Q is transformed into input data X0;

[0043] The computer terminal interaction data is also trained based on the generative adversarial network, where the generator G takes the input data X0 or other random noise restored by the decoder as input to generate new data;

[0044] The loss function L of the generator G The definition is as follows:

[0045]

[0046] Where MSE(·) is the mean square error; G(η) is the generated data; y is the real data;

[0047] Then, based on the discriminator, the data generated by the generator is comprehensively judged;

[0048] The loss function L of the discriminator D It is expressed as:

[0049]

[0050] Wherein, D(y') is the discriminator's discrimination result on the input data y'; D(G(η)) is the discriminator's discrimination result on the generated data G(η);

[0051] During the training process, the generator and the discriminator are trained alternately;

[0052] Then, based on the quick sort algorithm, a base element z is selected, the synthesized array is divided into two parts, the two parts are recursively sorted based on the quick sort algorithm, the base element is incorporated into the encryption key, and the encryption operation of the sorted data is performed based on the quantum encryption algorithm.

[0053] Preferably, in S2, a key storage method of periodically changing keys is also adopted.

[0054] Preferably, in S3, multi-dimensional user behavior data is collected and identified based on an improved clustering algorithm to construct a dynamic user profile, as follows:

[0055] Collect and pre-process user behavior data and computer terminal interaction scene data; first, implement data dimension reduction through several discrete wavelet transforms, where the discrete wavelet transform dynamically adjusts the resolution according to the distribution of the data; after completing the glth wavelet transform, the data are converted into low-frequency components and high-frequency components; the low-frequency components continue to participate in the next round of discrete wavelet transforms until the specified GLth discrete wavelet transforms are completed; after several transformations, clustering starts from the lowest frequency component, and gradually iterates upward to cluster components with higher frequencies:

[0056] The number of clusters for the initial clustering is calculated based on the elbow rule as follows:

[0057]

[0058] Where SSE is the sum of squared errors; k is the kth cluster; c k is the center of the kth cluster; s is the data point in the cluster; ||·|| represents the Euclidean distance;

[0059] Based on the SSE values ​​under different K values, find the elbow point of the corresponding SSE curve as the K value;

[0060] Randomly select K data points as initial cluster centers;

[0061] For each data point, calculate its distance to each cluster center:

[0062]

[0063] Among them, d0 (d0∈[1,d]) is the dimension of the data point;

[0064] For each cluster, update its cluster center based on the adaptive ant colony algorithm;

[0065] The adaptive ant colony algorithm is specifically as follows:

[0066]

[0067] in, is the transition probability of each optional path from point u to point v; yp uv is the value of pheromone concentration at point (u, v); π1 is the pheromone importance factor; π2 is the importance factor of the heuristic function; qf uv is the heuristic information value; ds1 is the distance from the starting point to the next point; ds2 is the distance from the next point to the target point; ω1 is the weight of ds1; ω2 is the weight of ds2; Θ is the turning coefficient; is the number of revolutions between the previous point and the next point; ω 2max and ω 2min are the maximum and minimum weights of ω2 respectively; k best is the optimal coefficient value;

[0068] Pheromones have been updated as follows:

[0069] yp uv (τ+1)=(1-ρ)yp uv (τ)+Δyp uv (τ);

[0070]

[0071]

[0072] Among them, τ is the number of iterations; ρ is the pheromone volatility coefficient; ρ min is the minimum value of the pheromone volatility coefficient; Δyp uv (τ) is yp uv (τ) is the change value; kl is the ant; ζ is the pheromone carried by the ant; yp is the target value; yp min is the minimum target value;

[0073] In the target value range, 16 points are selected as the next update points. According to the heuristic mechanism, the clustering error values ​​corresponding to the update points are calculated, and the three points with the smallest clustering error values ​​are selected as the target points for the next iterative update.

[0074] Based on the above adaptive genetic algorithm, a dynamic adaptive search is performed to reduce the distance threshold of the next clustering according to the distribution characteristics of the data;

[0075] When a computer terminal interacts with data, in addition to conventional authentication methods, it automatically analyzes the matching degree between the current interaction scenario and the user portrait. If the matching degree is lower than the preset matching degree threshold, an additional authentication step is added or the continued interaction of data is restricted.

[0076] Preferably, in S3, a single sign-on method is also implemented to regularly review user permissions.

[0077] Preferably, in S4, a smart contract is set up to regulate data interaction behaviors and rules. When an interaction behavior that violates the contract rules occurs, a protection mechanism is automatically triggered to prevent data interaction and record violation information.

[0078] Preferably, in S5, a disaster recovery plan for coping with emergencies is also formulated.

[0079] Preferably, in S6, the data intelligence security protection measures are also regularly evaluated and reviewed.

[0080] A fault detection system based on a mobile communication network, comprising:

[0081] Collection and evaluation module: used to collect computer terminal data interaction scenario data and conduct security risk assessment, and use this to carry out corresponding data intelligent security protection planning;

[0082] Data encryption module: used to perform data synthesis conversion on computer terminal interaction data, and then encrypt the synthesized and converted computer terminal interaction data based on the data encryption algorithm;

[0083] Identity authentication module: used to build user portraits and establish intelligent identity authentication mechanisms based on user portraits;

[0084] Access division module: used to finely divide data access rights according to user roles and responsibilities, classify and mark data, and set corresponding access policies according to data sensitivity;

[0085] Data backup module: used to formulate data backup plans, regularly back up data to storage media, and test the integrity and recoverability of backup data;

[0086] Security audit module: used to conduct security audits, record various information data, monitor the activities and operation of computer terminals in real time, and establish a security alarm mechanism for risk alarms;

[0087] The acquisition and assessment module includes an acquisition processing unit and a risk assessment unit;

[0088] The acquisition and processing unit is used to acquire computer terminal data interaction scene data and perform preprocessing;

[0089] The risk assessment unit is used to count risk influencing factors and perform security risk assessment on computer terminal data interaction scenarios, and accordingly perform corresponding data intelligent security protection planning;

[0090] The data encryption module includes a data synthesis unit and a sorting encryption unit;

[0091] The data synthesis unit is used to perform data synthesis conversion on the computer terminal interaction data;

[0092] The sorting and encryption unit is used to perform a quick sorting process on the synthesized and converted computer terminal interaction data based on a data encryption algorithm, and then perform encryption processing.

[0093] Compared with the prior art, the present invention provides a data intelligent security protection method and system for computer terminal data interaction, which has the following beneficial effects:

[0094] The present invention can detect potential security risks in the terminal data interaction process by performing a preliminary security assessment on the computer terminal interaction scenario; it can obfuscate the original data characteristics and increase the complexity of encryption after synthetic conversion, while increasing the availability and applicability of data, and facilitating unified management and transmission of data; it can also gain an in-depth understanding of user behavior based on user portraits, and can set access control permissions more accurately to reduce false alarms and interference; it can also dynamically adapt to changes in the network environment to provide effective security protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0095] Figure 1 This is a flow chart of the method mentioned in Example 1 of the present invention;

[0096] Figure 2 This is a schematic diagram of the data synthesis process mentioned in Example 1 of the present invention;

[0097] Figure 3 This is a schematic diagram of the improved clustering algorithm process mentioned in Example 1 of the present invention;

[0098] Figure 4 This is a system block diagram mentioned in Example 2 of the present invention.

[0099] In the figure:

[0100] 100. Collection and evaluation module; 110. Collection and processing unit; 120. Risk assessment unit; 200. Data encryption module; 210. Data synthesis unit; 220. Sorting and encryption unit; 300. Identity authentication module; 400. Access partitioning module; 500. Data backup module; 600. Security audit module. DETAILED DESCRIPTION

[0101] The technical solutions in the embodiments of the present invention will be described clearly and completely below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments.

[0102] Embodiment 1:

[0103] See also Figure 1-3 The data intelligent security protection method for computer terminal data interaction of the present invention comprises the following steps:

[0104] S1: Collect and pre-process the data of computer terminal data interaction scenarios, count the risk influencing factors, and conduct security risk assessment on computer terminal data interaction scenarios, and use this to make corresponding data intelligent security protection plans; the details are as follows:

[0105] Comprehensively collect computer terminal data interaction scenario data, including but not limited to network connection type (such as wired, wireless), data transmission objects (internal systems, external partners, Internet users, etc.) and data sensitivity (such as personal privacy information, commercial secrets, general business data, etc.).

[0106] Potential security risks, such as cyber attacks, malware infections, data leaks, etc., are determined based on six influencing factors: exposure rate, severity, controllability, complexity, timeliness, and value. Among them, exposure rate is used to measure the frequency of possible failure time. In-depth analysis can also be carried out with the help of security assessment tools and professional security consulting services.

[0107] Different levels can be divided according to the degree of influence of each influencing factor, for example:

[0108] The risk levels include unacceptable risk, major risk, relatively high risk, medium risk and general risk;

[0109] The controllability includes completely out of control, difficult to control, generally controllable, simply controllable and completely controllable;

[0110] Complexity includes high complexity, medium complexity and low complexity;

[0111] Timeliness includes high timeliness, medium timeliness and low timeliness;

[0112] Value includes high value, medium value and low value;

[0113] The computer terminal data interaction scenario data is evaluated separately according to the above-mentioned different influencing factors, and the risk assessment results are comprehensively judged. Based on this, a detailed data intelligent security protection plan is formulated to clarify the protection goals, strategies and specific implementation steps.

[0114] S2: Perform data synthesis conversion on the computer terminal interaction data, and then encrypt the synthesized and converted computer terminal interaction data based on the data encryption algorithm; the details are as follows:

[0115] Before encrypting the interactive data of the computer terminal, the data is first synthesized and converted. The method of encrypting the data after the synthesis conversion can greatly improve the data encryption efficiency and better protect the security of the data.

[0116] Data synthesis conversion is based on the improved variational autoencoder for data synthesis conversion, as follows:

[0117] Reference Figure 2 , the input computer terminal interaction data X0 is processed using a vector quantization-based variational autoencoder pre-trained on a large-scale dataset:

[0118] The input data X0 is passed through the encoder to obtain the feature JQ, as follows:

[0119] Unsupervised coding based on artificial neural networks:

[0120]

[0121] Among them, h y1 is the encoder output; jh1 is the activation function; and are the weights and thresholds of neurons in the encoding process;

[0122] According to the codebook KV, find the feature closest to each feature in JQ and replace them one by one to obtain the quantized feature Q.

[0123]

[0124] Among them, i is the i-th data input, a kv is the reference feature in the codebook;

[0125] The quantitative feature Q is used as the input x0 of the diffusion model. During the forward diffusion process, Gaussian noise is gradually added to x0. For each time step t, the computer terminal interaction synthetic data x after adding noise is calculated according to the following formula:t ;

[0126]

[0127] δ t =1-λ t ;

[0128]

[0129] Among them, σ t is a Gaussian distribution t ~N(0,I) noise;δ t is a variable; is the variable δ t The cumulative value of t (λ t ∈(0,1)) is the noise time variation table, which can be a linear value from 0.0001 to 0.01;

[0130] In the reverse denoising process, a noise prediction network ξ is trained θ Predicting noise, its loss function L is defined as follows:

[0131]

[0132] Where E(·) is the expectation; t is the time step not greater than T; To meet a specific distribution A random initial sample of is the data with t time step noise added; ξ is the noise, which obeys Gaussian distribution N(0,I); For the noise prediction network ξ θ For input and the prediction noise at time step t;

[0133] Gaussian noise is gradually removed by the following formula:

[0134]

[0135] Among them, β follows Gaussian distribution;

[0136] The above steps are used to gradually construct x0; the features obtained after denoising are quantized to obtain the quantized features Q, and then the features are replaced according to the codebook KV, and the following decoder is trained based on the artificial neural network:

[0137]

[0138] Among them, h y2 is the decoder output; jh2 is the activation function; X' is the data to be decoded input to the decoder; and are the weights and thresholds of neurons in the decoding process;

[0139] Finally, the quantitative feature Q is transformed into input data X0;

[0140] The computer terminal interaction data is also trained based on the generative adversarial network, where the generator G takes the input data X0 or other random noise restored by the decoder as input to generate new data;

[0141] The loss function L of the generator G The definition is as follows:

[0142]

[0143] Where MSE(·) is the mean square error; G(η) is the generated data; y is the real data;

[0144] Then, based on the discriminator, the data generated by the generator is comprehensively judged;

[0145] The loss function L of the discriminator D It is expressed as:

[0146]

[0147] Wherein, D(y') is the discriminator's discrimination result on the input data y'; D(G(η)) is the discriminator's discrimination result on the generated data G(η);

[0148] During the training process, the generator and discriminator are trained alternately; first, the discriminator is fixed and the generator is trained so that the data it generates is more realistic and can better deceive the discriminator. Then the generator is fixed and the discriminator is trained so that it can more accurately judge the authenticity of the data. Through continuous adversarial training, the performance of both the generator and the discriminator is improved, and finally the generator can generate high-quality synthetic data.

[0149] Through the combination of the above-mentioned diffusion variational autoencoder and the generative adversarial network, the original data is first processed by the diffusion variational autoencoder, and then the restored features or data are further synthesized and optimized using the generative adversarial network, so that more realistic and high-quality synthetic data can be generated.

[0150] Then, based on the quick sort algorithm, a base element z is selected and the synthesized array is divided into two parts, one part is smaller than the base element z, and the other part is larger than the base element z. The two parts are recursively sorted based on the quick sort algorithm, and the base element is integrated into the encryption key. The encryption operation of the sorted data is performed based on the quantum encryption algorithm. At the same time, a key storage method with regular key replacement is adopted to further enhance data security.

[0151] By performing synthetic conversion on the data first, the characteristics of the original data can be obfuscated and the complexity of encryption can be increased. Further encryption after synthetic conversion can improve the availability and applicability of the data. The synthetically converted data is more suitable for different encryption algorithms, which can improve data quality and availability, and facilitate unified management and transmission of data.

[0152] S3: Build a user profile and establish an intelligent identity authentication mechanism based on the user profile; the details are as follows:

[0153] Reference Figure 3 , collect and pre-process user behavior data and computer terminal interaction scene data; first, the dimension of the data is reduced through several discrete wavelet transforms, in which the discrete wavelet transform dynamically adjusts the resolution according to the distribution of the data; it can better capture the hierarchical structure and detailed information of the data, and provide a more accurate feature description for clustering. After completing the glth wavelet transform, the data are converted into low-frequency components and high-frequency components; the decomposed low-frequency components will continue to participate in the next round of discrete wavelet transforms until the specified GL discrete wavelet transforms are completed; after multiple transformations, clustering starts from the lowest frequency component, and gradually iterates upward to cluster components with higher frequencies. After each clustering, the distance threshold of the next clustering is adaptively reduced based on the ant colony algorithm, and the requirements for clustering density and connecting lines between data points are improved; and in each clustering process, the cluster center is dynamically adjusted according to the distribution characteristics of the data;

[0154] During the clustering process, the number of clusters of the initial clustering is calculated based on the following elbow rule:

[0155]

[0156] Where SSE is the sum of squared errors; k is the kth cluster; c k is the center of the kth cluster; s is the data point in the cluster; ||·|| represents the Euclidean distance;

[0157] Based on the SSE values ​​under different K values, find the elbow point of the corresponding SSE curve as the K value;

[0158] Randomly select K data points as initial cluster centers;

[0159] For each data point, calculate its distance to each cluster center:

[0160]

[0161] Among them, d0 (d0∈[1,d]) is the dimension of the data point;

[0162] For each cluster, update its cluster center based on the adaptive ant colony algorithm;

[0163] The adaptive ant colony algorithm is as follows:

[0164]

[0165]

[0166] in, is the transition probability of each optional path from point u to point v; yp uv is the value of pheromone concentration at point (u, v); π1 is the pheromone importance factor; π2 is the importance factor of the heuristic function; qf uv is the heuristic information value; ds1 is the distance from the starting point to the next point; ds2 is the distance from the next point to the target point; ω1 is the weight of ds1; ω2 is the weight of ds2; Θ is the turning coefficient; is the number of revolutions between the previous point and the next point; ω 2max and ω 2min are the maximum and minimum weights of ω2 respectively; k best is the optimal coefficient value;

[0167] Pheromones have been updated as follows:

[0168] yp uv (τ+1)=(1-ρ)yp uv (τ)+Δyp uv (τ);

[0169]

[0170] Among them, τ is the number of iterations; ρ is the pheromone volatility coefficient; ρ min is the minimum value of the pheromone volatility coefficient; Δyp uv (τ) is yp uv (τ) is the change value; kl is the ant; ζ is the pheromone carried by the ant; yp is the target value; yp min is the minimum target value;

[0171] In the target value range, 16 points are selected as the next update points. According to the heuristic mechanism, the clustering error values ​​corresponding to the update points are calculated, and the three points with the smallest clustering error values ​​are selected as the target points for the next iterative update.

[0172] Based on the above adaptive genetic algorithm, a dynamic adaptive search is performed to reduce the distance threshold of the next clustering according to the distribution characteristics of the data;

[0173] The above clustering algorithm performs adaptive adjustment on cluster centers etc. based on an adaptive genetic algorithm, which can better reflect the changes of clustering.

[0174] When a computer terminal interacts with data, in addition to conventional authentication methods, it automatically analyzes the matching degree between the current interaction scenario and the user portrait. If the matching degree is lower than the preset matching degree threshold, an additional authentication link is added or the continued interaction of data is restricted. For example, the superposition of passwords, fingerprint recognition, facial recognition, SMS verification codes, etc. greatly increases the security of identity authentication. When performing important data interaction operations, users can also be required to enter passwords and receive SMS verification codes at the same time, or perform fingerprint recognition, to ensure that only legitimate users can perform operations.

[0175] At the same time, a single sign-on method is implemented to facilitate users and improve security, reducing security risks caused by multiple accounts and passwords. User permissions are also reviewed regularly, and user accounts that no longer require access permissions are deleted in a timely manner to prevent abuse of permissions.

[0176] The user portrait-based approach can provide a deeper understanding of user behavior and data characteristics, and set access control permissions more accurately. For example, dynamically adjust the user's access rights to data and resources based on the user's role, historical operation records, and current data interaction context. For high-risk operations or access requests, additional identity authentication (such as multi-factor authentication) can be performed to ensure that only legally authorized users can access sensitive data, preventing abuse of permissions and data leakage.

[0177] S4: Finely divide data access permissions based on user roles and responsibilities, classify and label data, and set corresponding access policies based on data sensitivity; the details are as follows:

[0178] Data access permissions can be finely divided according to user roles and responsibilities. For example, administrators can have the highest permissions, while ordinary employees can only access data related to their work.

[0179] Classify and label data, and set different access control policies according to the sensitivity. Stricter access control measures can be adopted for highly sensitive data, such as two-factor authentication and access approval.

[0180] You can also use technical means such as firewalls and intrusion detection systems to limit external network access to computer terminals, while also strictly controlling access to internal networks.

[0181] Smart contracts can also be written to regulate data interaction behaviors and rules. For example, conditions for obtaining data access rights, frequency limits for data interaction, data format standards, etc. Once an interaction that violates the contract rules occurs, the protection mechanism is automatically triggered to prevent data interaction and record violation information, thus achieving automated and intelligent security protection.

[0182] S5: Develop a data backup plan, regularly back up data to storage media, and test the integrity and recoverability of the backup data; the details are as follows:

[0183] Develop a data backup plan to regularly back up important data to a secure storage medium, such as an external hard drive, network storage device, or cloud storage service. Test the integrity and recoverability of the backup data to ensure that the data can be quickly and effectively restored when it is lost or damaged. You can also establish a disaster recovery plan to deal with possible system failures, natural disasters, and other emergencies to ensure data security and business continuity.

[0184] S6: Deploy a security audit system to record various types of information data, monitor the activities and operation of computer terminals in real time, and establish a security alarm mechanism for risk alarm. The details are as follows:

[0185] Deploy a security audit system to record user operations, system events, network traffic and other information for post-analysis and auditing. Monitor the network activities and process operations of computer terminals in real time to detect abnormal behaviors and security threats in a timely manner. Tools such as intrusion detection systems (IDS) and intrusion prevention systems (IPS) can be used. A security alarm mechanism is also established. When a security incident is detected, an alarm message is immediately issued to notify relevant personnel to handle it.

[0186] Embodiment 2:

[0187] See also Figure 4 The present invention provides a fault detection system based on a mobile communication network, comprising:

[0188] Collection and evaluation module 100: used to collect computer terminal data interaction scenario data and conduct security risk assessment, and accordingly carry out corresponding data intelligent security protection planning;

[0189] Data encryption module 200: used to perform data synthesis conversion on the computer terminal interaction data, and then encrypt the synthesized and converted computer terminal interaction data based on the data encryption algorithm;

[0190] Identity authentication module 300: used to construct a user profile and establish an intelligent identity authentication mechanism based on the user profile;

[0191] Access division module 400: used to finely divide data access rights according to user roles and responsibilities, classify and mark data, and set corresponding access policies according to data sensitivity;

[0192] Data backup module 500: used to formulate a data backup plan, regularly back up data to a storage medium, and test the integrity and recoverability of the backup data;

[0193] Security audit module 600: used to conduct security audits, record various information data, monitor the activities and operation of computer terminals in real time, and establish a security alarm mechanism for risk alarms;

[0194] The collection and assessment module 100 includes a collection and processing unit 110 and a risk assessment unit 120;

[0195] The acquisition and processing unit 110 is used to acquire computer terminal data interaction scene data and perform preprocessing;

[0196] The risk assessment unit 120 is used to collect statistics on risk influencing factors and conduct security risk assessment on computer terminal data interaction scenarios, and accordingly carry out corresponding data intelligent security protection planning;

[0197] The data encryption module 200 includes a data synthesis unit 210 and a sort encryption unit 220;

[0198] The data synthesis unit 210 is used to perform data synthesis conversion on the computer terminal interaction data;

[0199] The sorting and encryption unit 220 is used to perform a quick sorting process on the synthesized and converted computer terminal interaction data based on a data encryption algorithm, and then perform encryption processing.

[0200] The above description is only a preferred specific implementation manner of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can make equivalent replacements or changes according to the technical scheme and inventive concept of the present invention within the technical scope disclosed by the present invention, which should be covered by the protection scope of the present invention.

Claims

1. A data intelligent security protection method for computer terminal data interaction, characterized in that: The steps include: S1: Collect and pre-process the data of computer terminal data interaction scenarios, count the risk influencing factors, and conduct security risk assessment on computer terminal data interaction scenarios, and use this to carry out corresponding data intelligent security protection planning; S2: Performing data synthesis conversion on the computer terminal interaction data, and then encrypting the synthesized and converted computer terminal interaction data based on a data encryption algorithm; S3: Build user portraits and establish intelligent identity authentication mechanisms based on user portraits; S4: Finely divide data access permissions based on user roles and responsibilities, classify and label data, and set corresponding access policies based on data sensitivity; S5: Develop a data backup plan, regularly back up data to storage media, and test the integrity and recoverability of the backup data; S6: Deploy a security audit system to record various types of information data, monitor the activities and operation of computer terminals in real time, and establish a security alarm mechanism for risk alarm.

2. The data intelligent security protection method for computer terminal data interaction according to claim 1 is characterized in that: In S1, six influencing factors, namely, exposure rate, severity, controllability, complexity, timeliness and value, are divided according to the computer terminal data interaction scenario data, and the interaction scenarios of the computer terminals are divided into security risk levels based on these factors.

3. The data intelligent security protection method for computer terminal data interaction according to claim 1 is characterized in that: The data synthesis conversion in S2 is based on the improved variational autoencoder to perform data synthesis conversion, which is as follows: The input computer terminal interaction data X0 is processed using a vector quantization-based variational autoencoder pre-trained on a large-scale dataset: The input data X0 is passed through the encoder to obtain the feature JQ, as follows: Unsupervised coding based on artificial neural networks: Among them, h y1 is the encoder output; jh1 is the activation function; and are the weights and thresholds of neurons in the encoding process; According to the codebook KV, find the feature closest to each feature in JQ and replace them one by one to obtain the quantized feature Q. Among them, i is the i-th data input, a kv is the reference feature in the codebook; The quantitative feature Q is used as the input x0 of the diffusion model. During the forward diffusion process, Gaussian noise is gradually added to x0. For each time step t, the computer terminal interaction synthetic data x after adding noise is calculated according to the following formula: t ; d t =1-λ t ; Among them, σ t is a Gaussian distribution t ~N(0,I) noise;δ t is a variable; is the variable δ t The cumulative value of t (λ t ∈(0,1)) is the noise time variation table; In the reverse denoising process, a noise prediction network ξ is trained θ Predicting noise, its loss function L is defined as follows: Where E(·) is the expectation; t is the time step not greater than T; To meet a specific distribution A random initial sample of is the data with t time step noise added; ξ is the noise, which obeys Gaussian distribution N(0,I); For the noise prediction network ξ θ For input and the prediction noise at time step t; Gaussian noise is gradually removed by the following formula: Among them, β follows Gaussian distribution; The above steps are used to gradually construct x0; the features obtained after denoising are quantized to obtain the quantized features Q, and then the features are replaced according to the codebook KV, and the following decoder is trained based on the artificial neural network: Among them, h y2 is the decoder output; jh2 is the activation function; X' is the data to be decoded input to the decoder; and are the weights and thresholds of neurons in the decoding process; Finally, the quantitative feature Q is transformed into input data X0; The computer terminal interaction data is also trained based on the generative adversarial network, where the generator G takes the input data X0 or other random noise restored by the decoder as input to generate new data; The loss function L of the generator G The definition is as follows: L G =MSE[(G(η)-y) 2 ]; Where MSE(·) is the mean square error; G(η) is the generated data; y is the real data; Then, based on the discriminator, the data generated by the generator is comprehensively judged; The loss function L of the discriminator D It is expressed as: L D =E[logD(y')+log(1-D(G(η)))]; Wherein, D(y') is the discriminator's discrimination result on the input data y'; D(G(η)) is the discriminator's discrimination result on the generated data G(η); During the training process, the generator and the discriminator are trained alternately; Then, based on the quick sort algorithm, a base element z is selected, the synthesized array is divided into two parts, the two parts are recursively sorted based on the quick sort algorithm, the base element is incorporated into the encryption key, and the encryption operation of the sorted data is performed based on the quantum encryption algorithm.

4. The data intelligent security protection method for computer terminal data interaction according to claim 3 is characterized in that: In S2, a key storage method of periodically changing keys is also adopted.

5. The data intelligent security protection method for computer terminal data interaction according to claim 1 is characterized in that: In S3, multi-dimensional user behavior data is collected and identified based on an improved clustering algorithm to construct a dynamic user profile, as follows: Collect and pre-process user behavior data and computer terminal interaction scene data; first, implement data dimension reduction through several discrete wavelet transforms, where the discrete wavelet transform dynamically adjusts the resolution according to the distribution of the data; after completing the glth wavelet transform, the data are converted into low-frequency components and high-frequency components; the low-frequency components continue to participate in the next round of discrete wavelet transforms until the specified GLth discrete wavelet transforms are completed; after several transformations, clustering starts from the lowest frequency component, and gradually iterates upward to cluster components with higher frequencies: The number of clusters for the initial clustering is calculated based on the elbow rule as follows: Where SSE is the sum of squared errors; k is the kth cluster; c k is the center of the kth cluster; s is the data point in the cluster; ||·|| represents the Euclidean distance; Based on the SSE values ​​under different K values, find the elbow point of the corresponding SSE curve as the K value; Randomly select K data points as initial cluster centers; For each data point, calculate its distance to each cluster center: Among them, d0 (d0∈[1,d]) is the dimension of the data point; For each cluster, update its cluster center based on the adaptive ant colony algorithm; The adaptive ant colony algorithm is specifically as follows: in, is the transition probability of each optional path from point u to point v; yp uv is the value of pheromone concentration at point (u, v); π1 is the pheromone importance factor; π2 is the importance factor of the heuristic function; qf uv is the heuristic information value; ds1 is the distance from the starting point to the next point; ds2 is the distance from the next point to the target point; ω1 is the weight of ds1; ω2 is the weight of ds2; Θ is the turning coefficient; Δl is the number of turns between the previous point and the next point; ω 2max and ω 2min are the maximum and minimum weights of ω2 respectively; k best is the optimal coefficient value; Pheromones have been updated as follows: yes uv (τ+1)=(1-ρ)yp uv (t)+Δyp uv (t); Ant kl passes through node (u,v) after the τth iteration; Among them, τ is the number of iterations; ρ is the pheromone volatility coefficient; ρ min is the minimum value of the pheromone volatility coefficient; Δyp uv (τ) is yp uv (τ) is the change value; kl is the ant; ζ is the pheromone carried by the ant; yp is the target value; yp min is the minimum target value; In the target value range, 16 points are selected as the next update points. According to the heuristic mechanism, the clustering error values ​​corresponding to the update points are calculated, and the three points with the smallest clustering error values ​​are selected as the target points for the next iterative update. Based on the above adaptive genetic algorithm, a dynamic adaptive search is performed to reduce the distance threshold of the next clustering according to the distribution characteristics of the data; When a computer terminal interacts with data, in addition to conventional authentication methods, it automatically analyzes the matching degree between the current interaction scenario and the user portrait. If the matching degree is lower than the preset matching degree threshold, an additional authentication step is added or the continued interaction of data is restricted.

6. The data intelligent security protection method for computer terminal data interaction according to claim 5 is characterized in that: In the S3, a single sign-on method is also implemented, and user permissions are reviewed regularly.

7. The data intelligent security protection method for computer terminal data interaction according to claim 1 is characterized in that: In S4, a smart contract is set up to regulate data interaction behaviors and rules. When an interaction behavior that violates the contract rules occurs, a protection mechanism is automatically triggered to prevent data interaction and record violation information.

8. The data intelligent security protection method for computer terminal data interaction according to claim 1 is characterized in that: In S5, a disaster recovery plan for dealing with emergencies is also formulated.

9. The data intelligent security protection method for computer terminal data interaction according to claim 1 is characterized in that: In said S6, data intelligence security protection measures are also regularly evaluated and reviewed.

10. A fault detection system based on a mobile communication network applied to any one of claims 1 to 9, characterized in that: include: Collection and evaluation module (100): used to collect computer terminal data interaction scenario data and conduct security risk assessment, and accordingly carry out corresponding data intelligent security protection planning; Data encryption module (200): used to perform data synthesis conversion on computer terminal interaction data, and then perform encryption processing on the synthesized and converted computer terminal interaction data based on a data encryption algorithm; Identity authentication module (300): used to construct a user profile and establish an intelligent identity authentication mechanism based on the user profile; Access division module (400): used to finely divide data access rights according to user roles and responsibilities, classify and mark data, and set corresponding access policies according to data sensitivity; Data backup module (500): used to formulate a data backup plan, regularly back up data to a storage medium, and test the integrity and recoverability of the backup data; Security audit module (600): used to conduct security audits, record various information data, monitor the activities and operation of computer terminals in real time, and establish a security alarm mechanism for risk alarms; The collection and assessment module (100) comprises a collection and processing unit (110) and a risk assessment unit (120); The acquisition and processing unit (110) is used to acquire computer terminal data interaction scene data and perform preprocessing; The risk assessment unit (120) is used to collect statistics on risk influencing factors and conduct security risk assessment on computer terminal data interaction scenarios, and accordingly conduct corresponding data intelligent security protection planning; The data encryption module (200) comprises a data synthesis unit (210) and a sorting encryption unit (220); The data synthesis unit (210) is used to perform data synthesis conversion on the computer terminal interaction data; The sorting and encryption unit (220) is used to perform a quick sorting process on the synthesized and converted computer terminal interaction data based on a data encryption algorithm, and then perform encryption processing.

Images