Hard disk data protection method and device based on artificial intelligence

Abstract

The invention relates to the field of hard disk data protection, in particular to a hard disk data protection method and device based on artificial intelligence. The method comprises the following steps: acquiring a hard disk history monitoring log; performing multi-period hard disk load analysis on the historical hard disk monitoring log, and performing load peak fluctuation fitting so as to construct a hard disk load peak fluctuation curve; carrying out peak value trend evolution analysis on the hard disk load peak value fluctuation curve, and carrying out abnormal load peak value detection to obtain a time period where an abnormal peak value point is located; carrying out current time period redundant data calculation on the hard disk according to the time period of the abnormal peak point, and carrying out dynamic global data backup decision, so as to generate an abnormal peak global backup strategy; and performing abnormal write behavior detection and attack node tracing positioning on the hard disk historical monitoring log, and marking a hostile attack tracing positioning point. According to the invention, safe and reliable hard disk data protection is realized.

Description

Technical Field

[0001] The present invention relates to the field of hard disk data protection, and in particular to a hard disk data protection method and device based on artificial intelligence. Background Art

[0002] With the continuous advancement of informatization and digitalization, hard disks, as important storage devices in computers and servers, are responsible for the storage and management of massive amounts of data. Whether for individual users or enterprise-level applications, the data in hard disks carries vital business information and personal data. With the dramatic increase in the amount of data, the risk of hard disk failure and data loss has gradually emerged. Especially during long-term operation, hard disks may be affected by a variety of factors, such as physical wear, overload operation, power fluctuations, mechanical damage, etc. These factors may cause hard disk failure, data damage or even loss. Traditional hard disk data protection methods often rely on backup and recovery technology, but this method cannot monitor and effectively predict the potential failure risk of hard disks in real time, and in the face of complex attacks or hardware damage, the recovery process usually takes a long time and is inefficient. Therefore, a more intelligent hard disk data protection method is needed. Summary of the invention

[0003] In order to solve the above technical problems, the present invention proposes a hard disk data protection method and device based on artificial intelligence to solve at least one of the above technical problems.

[0004] To achieve the above object, the present invention provides a hard disk data protection method based on artificial intelligence, comprising the following steps: Step S1: Obtain hard disk historical monitoring logs; perform hard disk load analysis for multiple periods on the hard disk historical monitoring logs, and perform load peak fluctuation fitting to construct a hard disk load peak fluctuation curve; Step S2: performing a peak trend evolution analysis on the hard disk load peak fluctuation curve and performing abnormal load peak detection to obtain the time period where the abnormal peak point is located; Step S3: Calculate the redundant data of the hard disk in the current time period according to the time period where the abnormal peak point is located, and make a dynamic global data backup decision, so as to generate an abnormal peak global backup strategy; Step S4: Detect abnormal write behavior and locate attack nodes in the hard disk history monitoring log, and mark malicious attack tracing points; Step S5: Identify the damaged data area of ​​the malicious attack source tracing location point, and then perform adaptive data repair on a region-by-region basis to build an adaptive data repair strategy; Step S6: Make a hierarchical data encryption decision based on the hard disk historical monitoring log, and perform intelligent collaborative protection control based on the adaptive data repair strategy abnormal peak global backup strategy to build an intelligent collaborative protection model.

[0005] By collecting hard disk historical monitoring logs, the present invention can understand the performance changes of the hard disk in detail, including load fluctuations, write / read operation frequencies, etc., which provides basic data for subsequent analysis. Through multi-period hard disk load analysis, the normal operation mode and potential fluctuation trend of the hard disk can be revealed, helping to determine whether the hard disk has an abnormal load state. By fitting load fluctuations, the peak trend and periodic fluctuation of the hard disk load can be identified, providing a reference for subsequent detection of abnormal peaks. Trend evolution analysis of the load fluctuation curve can effectively identify the change pattern of the hard disk load and determine whether there is a long-term abnormal trend or potential problem. Abnormal load peak detection can accurately identify abnormal fluctuations in the hard disk load, and excessive loads can be detected. A high or low load value may mean that the hard disk is under attack or has a fault. By marking the abnormal peak point, the time period of the abnormality can be accurately located, providing key clues for subsequent attack tracing and data repair. When the abnormal peak is identified, the data redundancy level of the current time period is calculated to ensure rapid recovery in the event of data abnormality or attack. The global data backup strategy is automatically determined based on the current load abnormality status, and the backup frequency and backup content can be dynamically adjusted to improve the efficiency and accuracy of data recovery. The constructed global backup strategy helps reduce the risk of data loss and provides an effective protection method when the hard disk fails or is attacked. By analyzing the historical monitoring logs, the data on the hard disk can be detected. Abnormal write behavior, frequent large-scale write operations may mean that some kind of malicious attack is in progress. By marking and tracing the nodes of malicious attacks, the source of the attack can be accurately located, which is crucial to preventing data loss, responding to attacks in a timely manner, and isolating infected nodes. By identifying malicious attack behaviors, potential threats can be identified in advance, and protective measures can be taken in time to prevent the spread of attacks. After identifying the attack nodes, the damaged data areas can be accurately identified, providing precise targets for subsequent repair work and reducing unnecessary repair operations. Based on the different characteristics of damaged data, an adaptive repair strategy is used to repair each area one by one, which not only improves the efficiency of repair, but also reduces the impact of the repair process on system performance. Through precise An accurate data repair strategy can effectively ensure that the company's data is restored to a complete state after an attack, reducing the risk of data loss. Through historical monitoring log analysis, different encryption strategies can be formulated for different data levels (such as critical data, non-critical data, etc.). In this way, important data can be protected at a higher level to reduce the risk of data leakage. Combined with adaptive data repair and backup strategies, intelligent protection control of the company's hard disk system can be achieved. Different protection measures work together to ensure that the hard disk is fully protected when it is attacked or fails. Through intelligent collaborative protection, the company's hard disk system can maintain higher security and stability in the face of multiple threats, ensuring data integrity and recoverability.

[0006] Preferably, step S1 comprises the following steps: Step S11: obtaining a hard disk historical monitoring log, collecting multi-modal hard disk monitoring parameters from the hard disk historical monitoring log, and extracting multi-modal hard disk monitoring parameters; Step S12: performing time series data flow evolution on the multi-modal hard disk monitoring parameters, thereby generating hard disk flow data time series evolution characteristics; Step S13: performing multi-period hard disk load analysis on the time series evolution characteristics of the hard disk traffic data to generate hard disk load data of different time periods; Step S14: Calculate the traffic load peak value of the hard disk load data in different time periods, and extract the hard disk traffic load peak value in each time period; Step S15: performing load peak fluctuation fitting on the hard disk traffic load peak in each time period, thereby constructing a hard disk load peak fluctuation curve.

[0007] The present invention uses multimodal monitoring parameters that are not limited to the basic load data of the hard disk, but can also include multiple indicators such as temperature, read and write speed, I / O operation, delay, etc. This multimodal data acquisition can help to more comprehensively understand the operating status of the hard disk. Through multimodal acquisition, it can ensure that different types of hard disk performance indicators are monitored synchronously, reducing the limitations of a single monitoring method. Different indicators can complement each other, analyze hard disk performance from multiple dimensions, obtain historical monitoring logs and extract key parameters, so that the system can obtain the operating status of the hard disk in real time, and can trace back to historical problems, which is convenient for better analysis of potential risks. By converting hard disk monitoring parameters into time-series data flow, it can track the load, read and write operations, temperature and other parameters of the hard disk. The law of changes in data over time can help discover potential periodic changes, trend fluctuations or sudden problems. By analyzing the evolution characteristics of time series data traffic, the behavior patterns of hard disks in different time periods can be identified to help determine whether the hard disk is in normal working condition, whether there is performance degradation or other hidden dangers. The traffic evolution characteristics can provide early warning when the hard disk load changes, helping technicians to discover potential hard disk failures or performance bottlenecks in advance, so as to take measures to avoid failures. By analyzing the hard disk load in different time periods, the load patterns of hard disks in different time periods can be identified. The load performance may be different during peak working hours and idle hours. By dividing the time periods, abnormal loads can be identified more accurately. This time division The analysis can help identify the regularity of load changes (such as load fluctuations during normal work) and abnormal loads (such as load anomalies during non-working hours), so as to respond to abnormal behaviors more promptly. By analyzing load data at different time periods, it can help enterprises optimize hard disk resource allocation, especially perform necessary maintenance or backup operations when the system load is low, and improve the overall efficiency of the system. By performing peak calculations on hard disk load data at different time periods, it can help identify the load peaks of the hard disk in a specific time period. These peaks are usually the moments when the hard disk is under the greatest pressure and may affect the performance or stability of the hard disk. Calculating the load peak not only helps locate the pressure period of the hard disk, but also provides information for subsequent load balancing, fault prevention and performance optimization. The calculation of peak values ​​can not only be used to identify normal load fluctuations, but also help detect whether there are abnormal peak values. These anomalies may be related to malicious attacks, hardware failures or other abnormal behaviors. By fitting the fluctuations of the load peak values, a fluctuation curve of the hard disk load peak value can be constructed. This curve shows the load change pattern of the hard disk in different time periods and can provide an important basis for future load prediction. Through the load fluctuation curve, enterprises can intuitively see the trend of the hard disk load and judge whether there is a gradually increasing load pressure or abnormal changes in load fluctuations. This helps to determine whether the hard disk needs to be expanded, upgraded or other maintenance operations. The fitting of the load fluctuation curve can help identify abnormal patterns of load fluctuations.If the load peak value in a certain period does not match the historical fluctuation pattern, it may mean potential hard disk failure or network attack, which can provide clues for subsequent security detection.

[0008] Preferably, the specific steps of step S12 are: Perform abnormal outlier filtering on multi-modal hard disk monitoring parameters to obtain outlier filtering monitoring parameters; Analyze the hard disk temperature changes of the outlier filtering monitoring parameters and extract the hard disk temperature change characteristics; Calculate the real-time read and write rate of the outlier filtering monitoring parameters to obtain the real-time read and write rate of the hard disk; Perform data writing error rate analysis on outlier filtering monitoring parameters to generate data writing error rate; The hard disk real-time read and write rate and data write error rate are mined to generate the hard disk real-time traffic state characteristics; According to the hard disk temperature change characteristics, the hard disk real-time traffic state characteristics are subjected to time series data flow evolution, thereby generating hard disk traffic data time series evolution characteristics.

[0009] The present invention uses outliers that may be caused by transient errors, sensor failures or other interference factors. These outlier data may affect the accuracy of subsequent analysis. Through outlier filtering, these abnormal data can be effectively eliminated to ensure that the data quality relied on by subsequent analysis is higher. Outlier filtering helps to remove unreasonable extreme values ​​from many monitoring parameters, making the data more stable and helping to analyze the real operating status of the hard disk. After filtering out the abnormal data, the remaining data can more accurately reflect the actual operating status of the hard disk, avoiding erroneous load or performance evaluation. Hard disk temperature is an important indicator of hard disk operation health. Excessive temperature may cause hard disk failure or performance degradation. Through temperature change analysis, the fluctuation of hard disk temperature can be monitored in real time, and the possible causes of hard disk failure can be discovered in time. The temperature anomaly of the hard disk damage, extracting the temperature change characteristics can reveal the change pattern of the hard disk temperature, help identify which operations or environmental factors cause temperature fluctuations (such as long-term high load, ambient temperature changes, etc.), by monitoring the temperature change characteristics, the system can give early warning of hard disk failures due to excessive temperature, so as to take preventive measures (such as cooling, reducing load, etc.). The read and write rate is a key indicator to measure the performance of the hard disk. Through the real-time read and write rate calculation, you can timely understand the current read and write performance of the hard disk. The real-time read and write rate reflects the level of the hard disk load. Understanding the read and write rate of the hard disk helps to evaluate whether it is in a high load state, whether there is a performance bottleneck, or whether there are potential signs of failure. A sudden drop in the read and write rate may indicate that the hard disk is The disk has bottlenecks or failures. Real-time monitoring of read and write rates can help detect these problems in a timely manner and respond to them. The write error rate is directly related to the integrity and reliability of the data. Analysis of the write error rate helps identify abnormal conditions that occur during the hard disk writing process, such as bad sectors on the hard disk, file system errors or damage, etc. A high error rate may be a sign that the hard disk is about to fail. By monitoring the write error rate, enterprises can identify potential damage risks to the hard disk in advance and take measures such as data backup, migration or repair to detect data write errors in a timely manner, which helps prevent data loss, damage or inconsistency and improve the overall data security of the hard disk. Combining the real-time read and write rates of the hard disk with the data write error rate to conduct traffic status mining can provide a more comprehensive understanding of The current load and health status of the hard disk. This multi-dimensional analysis can reveal abnormal patterns hidden under the surface and provide more accurate risk assessment. The mining of traffic status characteristics can reveal whether the hard disk has abnormal load, performance bottlenecks or data transmission anomalies, which helps to timely discover potential security threats (such as attack behaviors) or hardware failures. Through traffic status feature analysis, the normal and abnormal traffic patterns of the hard disk can be identified, which is of great significance for subsequent anomaly detection, data recovery and performance optimization. Combining temperature change characteristics with traffic status characteristics to perform time series data traffic evolution analysis can better reveal the change trend of hard disk performance over time. Excessive temperature changes may cause hard disk traffic fluctuations, which in turn affects the read and write rates of the hard disk.The time series traffic evolution characteristics can dynamically reflect the changes in the operating status of the hard disk in different time periods, helping enterprises to promptly discover the bottlenecks or potential failures of hard disk performance. By analyzing the time series traffic evolution characteristics, it is possible to make an intelligent assessment of the health status of the hard disk, and combine factors such as temperature to predict possible hard disk failures, and then take corresponding preventive measures (such as reducing load, increasing redundancy, etc.).

[0010] Preferably, step S2 comprises the following steps: Step S21: performing a peak trend evolution analysis on the hard disk load peak fluctuation curve to generate load peak trend evolution data; Step S22: performing multi-time window rolling prediction on the load peak trend evolution data to obtain load peak prediction data of multiple time windows; Step S23: performing abnormal load peak detection on the load peak prediction data of multiple time windows, and marking abnormal load peak points; Step S24: Locate the time period of the abnormal load peak point, thereby obtaining the time period where the abnormal peak point is located.

[0011] The present invention can help discover the law of hard disk load changes over time through trend evolution analysis of the hard disk load peak fluctuation curve, understand the volatility of hard disk load in different time periods, help identify the trend of load increase or decrease, and avoid hard disk failure caused by overload. Trend evolution data helps predict future changes in load peak. If the load fluctuates abnormally, analyzing the trend can provide a basis for subsequent protective measures. By understanding the load trend, the enterprise can dynamically adjust the resource allocation and load management of the hard disk. When the load is high, it may be necessary to optimize performance through load balancing or adjusting the write frequency. Through multi-time window rolling prediction, the enterprise can obtain the load peak in different time windows. Prediction data provides a dynamic view of short-term load. This method can help enterprises predict upcoming high-load periods, facilitate resource scheduling or risk prevention and control in advance, and adopt multi-window prediction technology. The length of the prediction time window can be adjusted according to actual needs to adapt to different load analysis needs. For peak period prediction, a longer time window may be used, while for sudden load response, a shorter time window can be used. Multi-window prediction enables enterprises to respond more flexibly to load changes. For upcoming load peaks, data backup, system load adjustment or redundant system startup can be performed in advance. By detecting abnormal load peaks on load peak prediction data, It can quickly identify abnormal load conditions in different time windows. If the load fluctuation exceeds the normal range, it may be that the hard disk has failed or encountered a malicious attack. The abnormal load peak may be caused by hardware failure (such as hard disk aging, bad sectors) or external attacks (such as DDoS attacks, ransomware). Marking abnormal peak points can help enterprises take remedial measures in time to avoid greater impact on the system. By marking and locating abnormal load peaks, the IT operation and maintenance team can find the root cause of the problem more quickly, whether it is a hard disk failure, network problem or malicious attack, reducing the time and effort of troubleshooting. By locating the time period, it can accurately identify the time when the abnormal load peak occurs. This This information is crucial for further analyzing the causes of abnormal loads. If abnormal load fluctuations occur during a specific period of time, it may be related to specific operations or attack behaviors (such as a large number of write requests, attack traffic, etc.). After locating the specific time period, the enterprise can further investigate the operation records, network activities and security logs during the period to help discover whether malicious behaviors (such as ransomware, malicious access, etc.) have caused the abnormal load. By analyzing the time period when the abnormal peak occurs, it can be identified whether there is an external attack pattern (such as certain attack tools sending requests at a high frequency at a specific time). This provides a strong basis for building the enterprise's intrusion detection system and helps to avoid or defend against similar attacks in advance.

[0012] Preferably, step S3 comprises the following steps: Step S31: analyzing the hard disk storage status of the hard disk in the current time period according to the time period where the abnormal peak point is located, thereby obtaining the hard disk storage status; Step S32: Calculate the redundant data of the hard disk in the current time period, and extract the redundant data of the abnormal peak time period; Step S33: performing redundant data cleaning processing on the hard disk based on the redundant data in the abnormal peak time period, thereby obtaining redundant optimized hard disk data; Step S34: making a dynamic global data backup decision for the redundant optimized hard disk data according to the hard disk storage status, thereby generating an abnormal peak global backup strategy.

[0013] By analyzing the time period where the abnormal peak point is located, the present invention can deeply understand the storage status of the hard disk during this period. If the abnormal peak occurs in a certain time period, analyzing the hard disk storage status helps to understand whether the hard disk is in a high load, overheated, or has a performance bottleneck. Through storage status analysis, it can be identified whether the hard disk is approaching the edge of failure. In particular, during the abnormal load peak period, the storage status of the hard disk may be affected. At this time, the analysis of the storage status can help the enterprise discover potential risks in time. The analysis results of the storage status help the enterprise adjust the load, assign tasks or take other optimization measures according to the current status of the hard disk. If some hard disk storage is in a critical state, the enterprise The industry can migrate or expand data to avoid data loss and system crashes. Redundant data calculation is a key step to ensure data integrity and reliability. By calculating the redundant data of the current time period, especially extracting the redundant data of the abnormal peak time period, it can be ensured that the data will not be lost or damaged when the hard disk load is abnormal. The extraction of redundant data helps to provide sufficient backup data before a failure occurs, which is particularly important for data protection during high system load or abnormal peak periods. It can reduce data loss caused by hard disk failures or attacks. By extracting redundant data during the abnormal peak time period, it can provide accurate data support for subsequent backup strategies, making the backup process more precise. Redundant data cleaning can effectively reduce the burden of redundant storage and improve system efficiency by optimizing redundant data, avoiding unnecessary redundancy or omissions. Redundant data cleaning can help remove redundant and duplicate data, reduce the waste of storage space, and improve the utilization rate of hard disk resources. By optimizing redundant data, the burden of redundant storage can be effectively reduced and the system efficiency can be improved. By cleaning redundant data, the management efficiency of hard disk data can be improved, ensuring that the backup data is more streamlined and efficient, which is convenient for subsequent data recovery, migration and access. Redundant data cleaning can also help eliminate data inconsistency problems caused by data redundancy, ensure the consistency of the enterprise's data storage status, avoid errors caused by redundant data, and dynamically adjust the global data backup strategy according to the hard disk storage status to ensure that the hard disk is under load. Timely and effective backup can be performed during abnormal loads, failures or high loads, which helps to improve the system's disaster recovery capabilities and avoid data loss. By generating a global backup strategy for abnormal peaks, enterprises can ensure that global data can be effectively protected even in the event of abnormal hard disk loads. This strategy can comprehensively consider multiple factors such as hard disk load, redundant data and storage status to formulate the optimal backup plan. The global backup strategy not only improves data security, but also can quickly restore data when the hard disk fails or is attacked. Whether it is a hardware failure or a malicious attack (such as a ransomware virus), it helps to restore services as soon as possible when the system crashes or data is damaged, minimizing business interruption time.

[0014] Preferably, the specific steps of step S4 are: Step S41: Detect abnormal writing behavior on the hard disk history monitoring log and extract abnormal writing behavior; Step S42: calculating the abnormal behavior frequency of the abnormal writing behavior to obtain the abnormal writing behavior frequency parameter; Step S43: performing time series variation statistics on the abnormal write behavior frequency parameter, thereby generating abnormal write behavior frequency variation characteristics; Step S44: performing malicious attack behavior analysis based on the abnormal write behavior frequency change characteristics, thereby generating malicious attack behavior data; Step S45: trace the attack node source of the malicious attack behavior data and mark the malicious attack source tracing location point.

[0015] The present invention can quickly identify abnormalities in write patterns by detecting abnormal write behaviors in the hard disk history monitoring log. Excessive number of write requests in a certain period of time, or frequent changes in write operations, may be signs of abnormal behavior (malware tampering with data, ransomware encrypting files, etc.). Abnormal write behavior may be a signal that data has been tampered with, especially when certain files or data are frequently modified without normal business needs. Detecting abnormal write behavior helps prevent sensitive data from being maliciously tampered with or deleted. This detection can capture early signs of malicious attacks in a timely manner, such as attackers trying to perform a large number of data write operations without being noticed, which provides a head start for subsequent security protection and response. By calculating abnormal write behavior, The frequency of abnormal write operations can help determine whether these abnormal behaviors are persistent or malicious. Frequent abnormal write operations may indicate that data tampering, ransomware attacks or other malicious operations are in progress. Some attack behaviors may not erupt all at once in a short period of time, but are frequent operations in a small range over a long period of time. By calculating the frequency of abnormal write behaviors, this scattered and hidden attack mode can be captured, thereby improving the effectiveness of early detection. The calculation of abnormal frequency parameters can be used to monitor hard disk behavior in real time, triggering alarms when frequent abnormal writes occur, helping enterprises to discover potential security issues in the first place. By statistically analyzing the time series changes in the frequency of abnormal write behaviors, the changing trend of attack behaviors can be observed. The pattern of frequency changes may reflect the attack The strategy of the attacker changes, or the intensity of the attack gradually increases. Through these time-series change characteristics, the security team can accurately evaluate the persistence and development trend of the attack. Many attack behaviors (such as ransomware, botnets, etc.) may show specific time-series patterns, such as sudden increments in a specific time period. Statistics on frequency changes can help reveal these hidden attack behavior patterns. Time-series change statistics can help companies promptly discover abnormal phenomena such as sudden increases in frequency, which is usually a signal of intensified attacks. As the ransomware infection gradually spreads, the write frequency may increase rapidly. Analyzing these changes allows companies to deploy protective measures in advance, such as shutting down infected devices, starting backup and recovery, etc. Combined with the frequency change characteristics of abnormal write behaviors, companies can In order to more accurately identify malicious attack behaviors, especially those related to data tampering, virus propagation, etc., by analyzing the frequency change characteristics, it is possible to effectively distinguish normal operations from malicious operations, thereby better identifying potential ransomware attacks, data leaks and other security threats. Malicious attack behavior analysis can help enterprises dynamically identify various security threats, such as DDoS attacks, malware, etc. These attacks may conceal their attack intentions through frequent hard disk write operations. By analyzing the write behavior, potential attackers can be discovered and responded to in a timely manner. Some complex attacks (such as APT attacks) are often concealed. By analyzing the changes in abnormal write behavior, enterprises can identify these long-term latent and low-key attacks, providing early detection and prevention capabilities.By marking the traceability points of malicious attack behaviors, enterprises can track the attack source and attack path, identify the specific range of attackers, and traceability of attack nodes helps reveal the motivation, target, and attack method behind the attack. Through traceability of attack nodes, enterprises can quickly isolate attacked nodes or devices to prevent the attack from spreading to other systems. At the same time, traceability analysis helps to lock down compromised terminals or network entrances to prevent further damage. Malicious attack traceability can not only help to respond to current attacks in a timely manner, but also provide key evidence for subsequent security incident investigations, helping enterprises analyze the source and means of attacks.

[0016] Preferably, the specific steps of step S5 are: Step S51: mining attack propagation paths for malicious attack source tracing locations to obtain multiple attack propagation paths; Step S52: identifying data damaged areas according to multiple attack propagation paths, and generating multiple malicious attack damaged areas; Step S53: analyzing the damaged data formats of multiple malicious attack damaged areas to generate damaged area data formats; Step S54: performing recoverability evaluation on the damaged area data format, thereby obtaining the recoverability of each damaged area; Step S55: Based on the recoverability of each damaged area, adaptive data repair is performed area by area to construct an adaptive data repair strategy.

[0017] The present invention can help enterprises understand the propagation path of the attack from the starting point to multiple target nodes by mining the attack propagation path of the malicious attack source tracing location point. This process can reveal how the attacker propagates the attack through the system or network, help analyze the attack chain, and find the attack source and key nodes. The mining of the attack propagation path helps to further confirm the starting point of the attack and its propagation mode, and helps the security team to quickly lock the attack source and reduce the blind spot of the defense system. By analyzing the attack path, the security team can prevent the spread of the attack by isolating key nodes or systems before the attack spreads, thereby minimizing the impact of the attack on the network. Attack propagation path mining helps to establish a detailed audit log of the attack, provide evidence for incident investigation, and help enterprises understand the attack method, attacker motivation and specific links of vulnerability exposure. By combining multiple attack propagation paths, it is possible to identify which systems, files or data are affected by malicious attacks. Some areas may be tampered with, deleted or damaged due to the attacker's operation. Through regional identification, enterprises can focus on data recovery work in these areas. The identification of damaged data areas not only helps to discover the current attacked areas, but also predicts other areas that the attacker may expand to, forming a comprehensive risk assessment. Ensure that the company's security measures cover all potentially damaged areas. Identifying and marking damaged areas helps focus resources on repairs, rather than blindly repairing the entire system. This makes data recovery more efficient and targeted. Analysis of damaged data formats helps companies identify the data formats and structures within damaged areas. Attacks may cause database corruption, file format tampering, and other issues. Understanding data formats helps avoid data loss or inconsistency during recovery. By identifying the data formats of damaged areas, companies can choose appropriate data recovery tools or methods in a targeted manner to ensure data integrity and accuracy during the repair process. Analyzing data formats can make the recovery process more orderly and efficient, avoid problems such as incorrect repairs or format mismatches, and reduce manual intervention and improve the efficiency of automated repairs. Evaluating the recoverability of each damaged area can provide a quantitative basis for repairs, helping to determine which areas of data can be recovered and which areas may never be recovered. This evaluation provides reliable data support for decision-making in the recovery process. By evaluating the recoverability of different damaged areas, companies can perform data recovery based on priority. The recovery of important data or critical systems will be given priority, while other alternatives (such as regeneration, replacement, etc.) can be considered for areas that cannot be recovered. Recoverability assessment can help enterprises allocate repair resources efficiently, ensuring that the most important areas are restored first, while saving time and money and avoiding wasting time on irreparable data. Repairing each damaged area based on its recoverability means that enterprises can choose the most appropriate repair method for different damaged areas. Some areas may be restored through backup, while others may need to be repaired through reconstruction or data migration.Adaptive repair strategies make the recovery process more accurate. Based on recoverability assessment and regional repair strategies, the efficiency of the repair process can be improved, and unnecessary steps and time waste can be reduced. Rapid recovery of damaged areas can minimize the impact of attacks on business operations. Adaptive repair strategies will adjust the repair plan according to actual conditions, such as dynamically selecting backup sources, repair methods or recovery tools, thereby improving the success rate of the repair process and avoiding data damage or loss.

[0018] Preferably, the specific steps of step S6 are: Step S61: Identify key storage data nodes from the hard disk history monitoring log and extract key storage data nodes; Step S62: performing semantic analysis on key storage data nodes one by one to obtain storage data features of each node; Step S63: Perform dynamic data semantic sensitivity calculation on the storage data features of each node to generate data semantic sensitivity of each node; Step S64: making a hierarchical data encryption decision according to the data semantic sensitivity of each node, thereby obtaining a hierarchical data encryption engine; Step S65: Perform intelligent collaborative protection control on the adaptive data repair strategy, the layered data encryption engine and the abnormal peak global backup strategy to build an intelligent collaborative protection model.

[0019] The present invention can accurately identify the critical data nodes in the hard disk by analyzing the hard disk historical monitoring log. These nodes may contain sensitive information or business-critical data and may become targets of attack. By locating these nodes, enterprises can focus on protecting these core data, avoid wasting resources on less important data, and focus on key storage data nodes, so that security protection measures can be more accurate and efficient, which helps to reduce the situation of excessive protection and improve the efficiency of overall security resource utilization. Identifying key storage data nodes also helps to predict in advance which data areas may be attacked or damaged, so as to implement stronger security measures (such as strengthening backup, encryption, etc.). By analyzing the semantics of each key storage node, Through data analysis, enterprises can fully understand the type, structure and sensitivity of data. Some data nodes may store financial data, while others may store employee information or customer data. In-depth understanding of the semantic characteristics of data can help enterprises determine the sensitivity level and protection priority of data. Through data semantic analysis, it can be identified whether the data contains sensitive information (such as personal information, financial data, etc.), so as to conduct accurate security assessment and protection, and ensure that highly sensitive data is given priority protection. After understanding the semantics of data nodes, enterprises can formulate corresponding access control policies based on the different characteristics of data to ensure that only authorized personnel can access sensitive data. Dynamic sensitivity calculation can be performed based on the characteristics of stored data, and the actual content and changes of data can be dynamically calculated. Dynamically evaluate the sensitivity of data. For highly sensitive data (such as financial and customer personal information), more stringent protection measures can be taken. By calculating the semantic sensitivity of data, enterprises can apply different strategies to data of different sensitivity levels in encryption, backup and other operations. For highly sensitive data, stronger encryption algorithms and more frequent backups are used, while low-sensitivity data may adopt more conventional strategies. Over time, the sensitivity of data may change (for example, some data changes from low sensitivity to high sensitivity). By dynamically calculating the semantic sensitivity of data, enterprises can adjust data protection strategies in real time to respond to changes in data sensitivity. Layered data encryption decisions can apply different encryption algorithms according to different data sensitivities. Strategy, highly sensitive data may be encrypted using the Advanced Encryption Standard (AES-256), while low-sensitivity data may be encrypted using conventional encryption methods. This layered encryption strategy can significantly improve encryption efficiency and reduce the impact of encryption operations on system performance. Layered encryption can effectively prevent data leakage. Even if an attacker successfully invades the system, he or she will not be able to access the encrypted data. Layered encryption can also prevent data from being intercepted or tampered with during transmission, further strengthening the confidentiality of data. Different types of data may face different laws, regulations and compliance requirements. Through layered encryption decisions, enterprises can encrypt data according to its sensitivity and compliance requirements to ensure that it meets the requirements of relevant regulations (such as GDPR, CCPA, etc.).By intelligently and collaboratively controlling the adaptive data repair strategy, the layered data encryption engine, and the abnormal peak global backup strategy, enterprises can form an all-round, multi-level intelligent protection system. This collaborative mechanism can ensure effective data protection and recovery in any situation (such as data damage, loss, or encryption attack, etc.). Relying on a single protection mechanism may be risky (such as backup data being tampered with by attackers, encryption algorithms being cracked, etc.), and collaborative control can reduce the risk of single point failures. Multiple protection levels and strategies complement each other to cope with a wider range of security threats. The intelligent collaborative protection model can dynamically adjust the protection strategy according to the attack mode and data damage. When data damage or encryption anomalies are detected, the system can automatically trigger the repair and backup mechanism. Intelligent adjustment and response improve the system's emergency response capabilities and reduce human intervention.

[0020] In this specification, a hard disk data protection device based on artificial intelligence is provided, which is used to execute the hard disk data protection method based on artificial intelligence as described above, including: The peak fluctuation module is used to obtain the hard disk historical monitoring log; perform hard disk load analysis in multiple periods on the hard disk historical monitoring log, and perform load peak fluctuation fitting to construct the hard disk load peak fluctuation curve; The peak trend evolution module is used to analyze the peak trend evolution of the hard disk load peak fluctuation curve and detect abnormal load peaks to obtain the time period where the abnormal peak point is located; The global backup module is used to calculate the redundant data of the hard disk in the current time period according to the time period of the abnormal peak point, and make dynamic global data backup decisions, so as to generate the abnormal peak global backup strategy; The attack source tracing module is used to detect abnormal write behavior in the hard disk history monitoring log and trace the attack node, marking the malicious attack source location point; The adaptive repair module is used to identify the damaged data area at the malicious attack source location point, and then adaptively repair the data area by area to build an adaptive data repair strategy; The intelligent collaborative protection module is used to make hierarchical data encryption decisions based on the hard disk historical monitoring log, and to perform intelligent collaborative protection control based on the adaptive data repair strategy abnormal peak global backup strategy to build an intelligent collaborative protection model.

[0021] By performing load analysis on historical monitoring logs, the present invention can comprehensively understand the usage of the hard disk, load change trends and fluctuation rules. The hard disk load peak fluctuation curve can help identify abnormal load fluctuations, which is convenient for subsequent risk prediction. Through load fluctuation fitting, the normal fluctuation range of the hard disk load can be effectively identified. Once the load fluctuates abnormally, the system can trigger an alarm or start protective measures in time to reduce the risk of failure. Load fluctuation analysis can not only identify potential risks, but also help enterprises optimize the use of hard disk resources and avoid excessive load or potential hard disk failures. The trend evolution analysis of the peak fluctuation curve can help enterprises understand the long-term trend and potential changes of the hard disk load. Over time, the hard disk load may show cycles. The system can automatically detect and identify these changing trends. The detection of abnormal load peaks can accurately identify abnormal load fluctuations, thereby locating possible failure points or potential attack behaviors. Through abnormal peak detection, a clear time window can be provided for subsequent backup, data repair and other operations. The appearance of abnormal peaks may mean that the hard disk is about to face the risk of failure or data loss. Dynamic global backup decisions can automatically evaluate which data is critical and back it up first to ensure that important data will not be lost when the hard disk fails. According to the time period of the abnormal peak and real-time data redundancy calculation, the system can dynamically adjust the backup strategy, such as increasing the backup frequency and selecting the best backup. Backup windows, etc., improve backup efficiency and effectiveness. Through intelligent decision-making on backup strategies, enterprises can recover data more quickly. Even if a hard disk failure or data loss occurs, backup data can be quickly restored to ensure business continuity. Through abnormal write behavior detection, it is possible to quickly discover whether there is a malicious attack behavior (such as ransomware, data tampering, etc.). Once an abnormal write is detected, the system will track the specific attack node to help security personnel locate the intrusion source. Once the attack tracing location point is determined, measures can be taken quickly, such as isolating the attack source, blocking malicious processes, etc., to prevent the attack from spreading further. The attack tracing module not only helps to deal with current attacks, but also provides detailed attack chain information for post-analysis, helping enterprises improve network security defense Protection, improve the ability to respond to future threats, by identifying the damaged areas of malicious attack source tracing points, it can accurately determine which data areas are affected and repair them one by one. Adaptive repair can automatically select the most appropriate repair method according to the specific type, sensitivity and degree of damage of the data. The automated repair process can greatly improve the repair efficiency, reduce the need for manual intervention, and reduce the system recovery time. The system can flexibly adjust the repair strategy and adopt different repair methods for different damaged data. The adaptive repair module can quickly restore the damaged data, thereby reducing the impact of the attack on the business operation of the enterprise, ensuring that the business operation is not interrupted and the data is not lost, and reducing the financial or reputation loss caused by data loss. Through the layered data encryption strategy,Different encryption methods are used for data of different sensitivities to ensure that data is fully protected during storage, transmission and use. Intelligent collaborative protection can combine encryption, backup and repair strategies to ensure data security under multi-level protection. The intelligent collaborative protection model not only makes decisions on data encryption, but also adjusts protection measures according to the needs of repair and backup strategies. The various protection modules work together to provide comprehensive data security protection. In the face of potential network attacks or system failures, the intelligent collaborative protection module can automatically adjust the protection strategy, and the system can adaptively respond to various emergencies, thereby reducing manual intervention and increasing recovery speed. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 A schematic diagram of the steps of a hard disk data protection method based on artificial intelligence of the present invention; Figure 2 Detailed implementation flow chart of step S1; Figure 3 Detailed implementation flow chart of step S2; Figure 4 Detailed implementation flow chart of step S3. DETAILED DESCRIPTION

[0023] It should be understood that the specific embodiments described herein are only used to explain the present invention, and are not used to limit the present invention.

[0024] The present application example provides a hard disk data protection method and device based on artificial intelligence. The execution subject of the hard disk data protection method and device based on artificial intelligence includes but is not limited to: mechanical equipment, data processing platform, cloud server node, network upload device, etc. equipped with the system can be regarded as the general computing node of the present application, and the data processing platform includes but is not limited to: at least one of an audio image management system, an information management system, and a cloud data management system.

[0025] See also Figures 1 to 4 The present invention provides a hard disk data protection method based on artificial intelligence, and the hard disk data protection method based on artificial intelligence includes the following steps: Step S1: Obtain hard disk historical monitoring logs; perform hard disk load analysis for multiple periods on the hard disk historical monitoring logs, and perform load peak fluctuation fitting to construct a hard disk load peak fluctuation curve; Step S2: performing a peak trend evolution analysis on the hard disk load peak fluctuation curve and performing abnormal load peak detection to obtain the time period where the abnormal peak point is located; Step S3: Calculate the redundant data of the hard disk in the current time period according to the time period where the abnormal peak point is located, and make a dynamic global data backup decision, so as to generate an abnormal peak global backup strategy; Step S4: Detect abnormal write behavior and locate attack nodes in the hard disk history monitoring log, and mark malicious attack tracing points; Step S5: Identify the damaged data area of ​​the malicious attack source tracing location point, and then perform adaptive data repair on a region-by-region basis to build an adaptive data repair strategy; Step S6: Make a hierarchical data encryption decision based on the hard disk historical monitoring log, and perform intelligent collaborative protection control based on the adaptive data repair strategy abnormal peak global backup strategy to build an intelligent collaborative protection model.

[0026] By collecting hard disk historical monitoring logs, the present invention can understand the performance changes of the hard disk in detail, including load fluctuations, write / read operation frequencies, etc., which provides basic data for subsequent analysis. Through multi-period hard disk load analysis, the normal operation mode and potential fluctuation trend of the hard disk can be revealed, helping to determine whether the hard disk has an abnormal load state. By fitting load fluctuations, the peak trend and periodic fluctuation of the hard disk load can be identified, providing a reference for subsequent detection of abnormal peaks. Trend evolution analysis of the load fluctuation curve can effectively identify the change pattern of the hard disk load and determine whether there is a long-term abnormal trend or potential problem. Abnormal load peak detection can accurately identify abnormal fluctuations in the hard disk load, and excessive loads can be detected. A high or low load value may mean that the hard disk is under attack or has a fault. By marking the abnormal peak point, the time period of the abnormality can be accurately located, providing key clues for subsequent attack tracing and data repair. When the abnormal peak is identified, the data redundancy level of the current time period is calculated to ensure rapid recovery in the event of data abnormality or attack. The global data backup strategy is automatically determined based on the current load abnormality status, and the backup frequency and backup content can be dynamically adjusted to improve the efficiency and accuracy of data recovery. The constructed global backup strategy helps reduce the risk of data loss and provides an effective protection method when the hard disk fails or is attacked. By analyzing the historical monitoring logs, the data on the hard disk can be detected. Abnormal write behavior, frequent large-scale write operations may mean that some kind of malicious attack is in progress. By marking and tracing the nodes of malicious attacks, the source of the attack can be accurately located, which is crucial to preventing data loss, responding to attacks in a timely manner, and isolating infected nodes. By identifying malicious attack behaviors, potential threats can be identified in advance, and protective measures can be taken in time to prevent the spread of attacks. After identifying the attack nodes, the damaged data areas can be accurately identified, providing precise targets for subsequent repair work and reducing unnecessary repair operations. Based on the different characteristics of damaged data, an adaptive repair strategy is used to repair each area one by one, which not only improves the efficiency of repair, but also reduces the impact of the repair process on system performance. Through precise An accurate data repair strategy can effectively ensure that the company's data is restored to a complete state after an attack, reducing the risk of data loss. Through historical monitoring log analysis, different encryption strategies can be formulated for different data levels (such as critical data, non-critical data, etc.). In this way, important data can be protected at a higher level to reduce the risk of data leakage. Combined with adaptive data repair and backup strategies, intelligent protection control of the company's hard disk system can be achieved. Different protection measures work together to ensure that the hard disk is fully protected when it is attacked or fails. Through intelligent collaborative protection, the company's hard disk system can maintain higher security and stability in the face of multiple threats, ensuring data integrity and recoverability.

[0027] In the embodiment of the present invention, refer to Figure 1 , is a flowchart of a hard disk data protection method based on artificial intelligence of the present invention. In this example, the steps of the hard disk data protection method based on artificial intelligence include: Step S1: Obtain hard disk historical monitoring logs; perform hard disk load analysis for multiple periods on the hard disk historical monitoring logs, and perform load peak fluctuation fitting to construct a hard disk load peak fluctuation curve; In this embodiment, the scope and type of hard disk monitoring logs to be collected are determined. Generally speaking, these logs should contain key indicators such as timestamps, read and write operations, IOPS (input and output operations per second), latency, bandwidth, etc. System monitoring tools (such as iostat, perfmon, or custom scripts) are used to collect these monitoring data within a specific time period to ensure that the collected data covers different workloads and time periods for comprehensive analysis. Log data can be stored in CSV files, databases, or real-time monitoring systems to ensure that the data format is consistent and easy to process later. In the acquired log data, preliminary data cleaning is performed, which includes removing invalid records, processing missing values, and unifying the time format. Python's Pandas library can be used to read CSV files and perform data preprocessing. For timestamps, ensure that the time format of each record is consistent and convert it into a time series format that can be used for analysis. The cleaned data should be arranged in chronological order to facilitate subsequent processing. The cleaned data is grouped and analyzed according to different time periods (such as hours, days, and weeks). The groupby function of the Pandas library can be used to group the data and calculate statistics such as the average load, maximum load, and minimum load for each time period. The load index is used to analyze the load differences in different time periods (such as weekdays and weekends, morning peak and evening peak), and identify which time periods have higher loads and which time periods have lower loads. This helps to understand the usage pattern and load changes of the hard disk. After completing the load analysis, the analysis results are fitted with the load peak fluctuation using the fitting algorithm. You can choose a suitable mathematical model (such as polynomial regression, exponential smoothing, etc.) to fit the load data. The selection of a suitable model depends on the distribution characteristics of the data. Use Python's SciPy library or NumPy library for fitting. During the fitting process, record the load value of each time period, and calculate the trend line of the load fluctuation through the fitting algorithm. Use visualization tools (such as Matplotlib or Seaborn) to visualize the original load data and the fitting curve to help intuitively understand the change trend of the load peak. Finally, organize the load fluctuation data obtained by fitting into a load peak fluctuation curve. According to the fitting results, generate the corresponding fluctuation curve graph, mark the maximum peak value, minimum valley value and the corresponding time point of the load, and add necessary annotations and marks on the graph to clearly convey the key points of the load change. The curve will be used for subsequent performance analysis and optimization suggestions to provide data support for hard disk management and maintenance.

[0028] Step S2: performing a peak trend evolution analysis on the hard disk load peak fluctuation curve and performing abnormal load peak detection to obtain the time period where the abnormal peak point is located; In this embodiment, it is ensured that the constructed load peak fluctuation curve data is available for analysis, and the load fluctuation data is imported from the previous analysis step into the data processing environment. The Pandas library of Python is usually used to read the data in the CSV file or database to ensure that the structure of the data is complete, including the timestamp and the corresponding load value. The data is preliminarily checked to confirm that there are no missing values ​​or outliers to ensure the accuracy of subsequent analysis. The load peak data is analyzed in time series to observe the trend of load changes. The moving average method can be used to smooth the fluctuation data so that the trend can be identified more clearly. The moving average is calculated by the rolling function of Pandas, and an appropriate window size (such as 3 hours or 24 hours) is set to smooth short-term fluctuations. The standard deviation and variance of the load are calculated to quantify the amplitude of the load fluctuation, and the load changes in each time period are recorded to identify the trend characteristics such as periodic changes and seasonal fluctuations of the load. The load fluctuation curve and its moving average are drawn using data visualization tools (such as Matplotlib or Seaborn) to intuitively display the peak change trend and mark the obvious peaks and troughs. Determine the detection criteria for abnormal load peaks, usually based on statistical methods. A threshold can be set. Points below the average load minus two standard deviations or above the average load plus two standard deviations are considered abnormal. Use Python's NumPy library to calculate the mean and standard deviation of the load data, and apply thresholds based on these statistical values ​​to detect abnormal load peaks. This can be achieved through simple conditional filtering. Generate a Boolean array to identify abnormal points. For each detected abnormal peak, record its corresponding timestamp and load value to form an abnormal load data set. Once the abnormal peak point is determined, it is necessary to extract the time period in which these abnormal points are located. This can be done by grouping and summarizing the timestamps of the abnormal load points, determining the start and end time of each abnormal event, and using Pandas' groupby function and time difference calculation to identify consecutive abnormal load points to determine their time period. If the abnormal peak interval is less than the set threshold (for example, a few minutes), they are considered to belong to the same event. Record the time period of each abnormal event, including the start time, end time, and corresponding maximum load value, to form the final abnormal load time period data set.

[0029] Step S3: Calculate the redundant data of the hard disk in the current time period according to the time period where the abnormal peak point is located, and make a dynamic global data backup decision, so as to generate an abnormal peak global backup strategy; In this embodiment, Python's Pandas library is used to import the abnormal peak time period data into the analysis environment to ensure that the data structure is complete and easy to process, and confirm other data required for redundant data calculation, such as hard disk usage, storage capacity, current backup status, etc. in the current time period. This information will be used to evaluate the basis for redundant data calculation and backup decision-making. According to the time period where the abnormal peak is located, all data records in the time period are extracted, and the amount of redundant data of the current hard disk is calculated. Redundant data usually refers to storage space or historical backup data that is not effectively utilized during abnormal load. By analyzing the current hard disk usage and calculating the proportion of redundant data, the ratio of data volume (such as GB) to available storage space can be used to quantify redundancy, identify the storage efficiency of the hard disk under abnormal load conditions, use data analysis tools (such as NumPy) to perform statistical analysis on the data, generate a report on redundant data, record the size and proportion of redundant data and its impact on system performance, and after calculating the redundant data, determine the decision criteria for the backup strategy. These criteria can be used to determine the decision criteria for the backup strategy. Including the current amount of redundant data, system load, current backup frequency, and business importance, according to the set standards, decide whether to perform global data backup. If the amount of redundant data exceeds a certain threshold (redundant data occupies 10% of the total storage space), the global backup process is triggered, and conditional statements or rule engines (such as Drools) are used to dynamically determine whether a global backup needs to be performed. This process should take into account the current load of the system to avoid backup operations during peak hours and affect system performance. Once it is determined that a global backup is needed, a specific backup strategy is formulated, including the time point of the backup, the type of backup data (full backup or incremental backup), the backup storage location (local or cloud), etc. Combined with the calculation results of redundant data, an optimal backup plan is designed. If the redundant data is high, a full backup can be selected; if the redundant data is low, an incremental backup can be selected to save storage space and time, ensuring that the backup strategy is flexible and can be dynamically adjusted according to subsequent load changes and system status to ensure a balance between data security and system performance.

[0030] Step S4: Detect abnormal write behavior and locate attack nodes in the hard disk history monitoring log, and mark malicious attack tracing points; In this embodiment, a data processing tool (such as Python's Pandas library) is used to import the monitoring log into the analysis environment. Ensure that the log data is arranged in chronological order for subsequent analysis. Define the standards for abnormal write behavior. These standards may include abnormal write frequency (such as multiple writes to the same file in a short period of time), abnormally large write data volume, abnormal write target path (such as system files or sensitive files), etc. Design a detection algorithm for write behavior, usually using a rule-based detection method or a machine learning algorithm. For the rule method, set a variety of conditions, such as the write frequency exceeding a certain threshold is considered abnormal; for the machine learning method, it is necessary to train the model to identify normal and abnormal behavior. Use the set rules or trained models to scan the historical monitoring logs to detect abnormal write behavior. You can use Python's Scikit-learn library to apply machine learning models, or directly use Pandas to conditionally filter data. Record all detected abnormal write behaviors, including timestamps, source IP, target files, write data volume, and other information for subsequent analysis and auditing. In the detected abnormal write behavior, further analyze the source IP address and other related information to trace the origin of the attack. You can use network traffic analysis tools (such as Wireshark) or IP geolocation services (such as MaxMind) to help determine the geographic location of the source IP. Combined with the time information of abnormal write behavior, identify possible attack paths and operation steps, and record detailed information of the attack nodes. If there are multiple abnormal write behaviors, analyze the correlation between them, determine whether they belong to the same attack event, and mark the relevant attack nodes. Ensure that all marked malicious attack tracing points are recorded and stored in the database to ensure that the data is structured and queryable. Record detailed information for each attack node, including source IP, abnormal behavior type, timestamp, etc. Generate a detailed attack tracing report to describe the process and results of abnormal write behavior detection and attack node tracing. The report should include a visual chart that shows the time distribution and attack path of abnormal behavior to help the security team quickly understand the attack mode and scope of impact.

[0031] Step S5: Identify the damaged data area of ​​the malicious attack source tracing location point, and then perform adaptive data repair on a region-by-region basis to build an adaptive data repair strategy; In this embodiment, by reviewing the historical monitoring logs, the files written or modified during the attack are identified. The modification time, size change and content change of these files are important bases for judging the damaged area. Combined with the metadata of the file system (such as file creation, modification time, access rights, etc.), determine which files or data blocks are affected in the attack, and mark these areas as "damaged areas". Perform a detailed analysis of each damaged area identified to evaluate its importance and impact. Considerations include the sensitivity of the data, business importance, and whether there are backups available. Use a data integrity verification method (such as hash verification) to verify the data in the damaged area to determine whether the data is indeed damaged. By comparing the hash value of the original file with the hash value of the current file, timely identify data tampering. Record detailed information for each damaged area, including file path, damage level, impact assessment results, etc., so as to facilitate the formulation of subsequent repair plans. Develop an adaptive data repair strategy, and select a suitable repair method for each damaged area based on its importance and impact. Common repair methods include recovery from backup, repair through data redundancy mechanism, or recovery using data recovery tools. For important damaged areas, full backups are used for recovery first. Automated scripts (such as using Bash or Python scripts) can be used to extract data from backup storage and overwrite damaged areas. For areas without backup or incomplete backup, data recovery software (such as TestDisk, Recuva) can be used to attempt recovery. This software can usually scan the hard disk for recoverable data blocks. During the adaptive data repair process, monitor the progress and effect of the repair in real time. Record the success or failure of each repair operation, the results of the data integrity check after the repair, and other information. Use automated monitoring tools (such as Nagios or Zabbix) to track the repair process to ensure that timely alarms and adjustments can be made when problems occur. Conduct subsequent assessments on each repaired area to verify the integrity and consistency of the data and ensure that the repaired data can be used normally.

[0032] Step S6: Make a hierarchical data encryption decision based on the hard disk historical monitoring log, and perform intelligent collaborative protection control based on the adaptive data repair strategy abnormal peak global backup strategy to build an intelligent collaborative protection model.

[0033] In this embodiment, the data classification standard is determined, which can usually be divided into high sensitivity (such as personal information, financial data), medium sensitivity (such as operational data) and low sensitivity (such as public information). An encryption strategy is set, and different encryption algorithms and key management strategies are applied to different categories of data. For high-sensitivity data, a strong encryption algorithm (such as AES-256) is selected; for medium-sensitivity data, a moderate encryption algorithm (such as AES-128) is used; and for low-sensitivity data, lightweight encryption or no encryption can be selected. According to the analysis results of the previous step, the data in the hard disk is encrypted in layers, and encryption tools (such as OpenSSL or GnuPG) are used to implement specific encryption operations to ensure that the encryption process is automated to improve efficiency and security. During the implementation process, the detailed information of each encryption operation is recorded, including the type of encrypted data, encryption algorithm, key generation and management methods, etc., to ensure Ensure the safe storage of encryption keys, establish a complete key management system, update keys regularly, check the integrity and availability of encrypted data, ensure that encryption does not affect normal business operations, use hash verification methods to verify the integrity of data during the encryption process, combine adaptive data repair strategies with abnormal peak global backup strategies, and design an intelligent collaborative protection control model. The model should be able to automatically trigger data repair and backup operations when abnormal activities are detected to ensure data security. Use rule engines (such as Drools or Apache Camel) to implement intelligent decision-making logic and set trigger conditions. When abnormal peaks or data corruption are detected, automatically perform data repair and perform global backup during the repair process. Design data flows and control flows to ensure collaborative work between modules in the system, define the input and output of each module, and ensure that information can be transmitted and processed in a timely manner.

[0034] In this embodiment, refer to Figure 2 , is a flowchart of detailed implementation steps of step S1. In this embodiment, the detailed implementation steps of step S1 include: Step S11: obtaining a hard disk historical monitoring log, collecting multi-modal hard disk monitoring parameters from the hard disk historical monitoring log, and extracting multi-modal hard disk monitoring parameters; Step S12: performing time series data flow evolution on the multi-modal hard disk monitoring parameters, thereby generating hard disk flow data time series evolution characteristics; Step S13: performing multi-period hard disk load analysis on the time series evolution characteristics of the hard disk traffic data to generate hard disk load data of different time periods; Step S14: Calculate the traffic load peak value of the hard disk load data in different time periods, and extract the hard disk traffic load peak value in each time period; Step S15: performing load peak fluctuation fitting on the hard disk traffic load peak in each time period, thereby constructing a hard disk load peak fluctuation curve.

[0035] In this embodiment, the source of the hard disk monitoring log is determined. These logs may come from the monitoring tools of the operating system, hard disk management software (such as SMART monitoring), third-party monitoring systems or customized logging tools. The integrity of the log records is ensured, including important parameters such as timestamps, read and write rates, IOPS (input and output operations per second), latency, and error rates. An automated script or tool is designed to regularly extract historical monitoring logs from the determined data source. This can be done through an API interface, command line tools, or directly from log files. During the collection process, the consistency of the data format is ensured, and the data is stored in a predetermined data format (such as CSV, JSON) for subsequent processing. The collected monitoring logs are Clean the logs to remove invalid records, duplicate entries, and missing data. Use data cleaning tools (such as Pandas) to operate on the log data to ensure data quality. Further format the log data for subsequent multimodal parameter extraction to ensure that the data can be effectively parsed and maintain the necessary fields and structures. Extract multimodal monitoring parameters such as read and write rates, latency, and hard disk usage from the cleaned historical logs. Design corresponding extraction algorithms based on different hard disk monitoring indicators and store the extracted parameters in a structured database for subsequent analysis. Ensure that each parameter is associated with its corresponding timestamp and hard disk ID. Integrate the extracted multimodal hard disk monitoring parameters into a unified time series data set to ensure All parameters are aligned with timestamps and arranged in chronological order for time series analysis. The data is standardized to ensure that different monitoring parameters are on the same scale for subsequent analysis. Time series analysis methods such as sliding windows, Fourier transforms, or wavelet transforms are used to extract features from the integrated data, identify periodic patterns, trends, and outliers, and calculate statistical features such as the mean, variance, maximum, and minimum values ​​of the traffic to help understand the evolution of traffic. Use visualization tools (such as Matplotlib or Seaborn) to draw a time series diagram of the hard disk traffic to show the trend of traffic over time. This will help identify peaks and troughs in traffic. Through visualization results, evaluate whether there are obvious flow Abnormal or periodic fluctuations in traffic volume lay the foundation for the next load analysis. The generated time series evolution characteristics are stored in the database, and each step of the data processing process is recorded for subsequent audit and optimization. Detailed documents are written to record each step and method of data processing for future reference and improvement. According to business needs or traffic characteristics, the time series data is divided into multiple time periods, which can be divided by hour, day or week. Ensure that the amount of data in each time period is sufficient for effective analysis, determine the start and end time of each time period, ensure that all data is evenly distributed in each time period, summarize the monitoring parameters in each time period, calculate the average load, peak load and total load of each time period, and calculate the average read and write rate and total IOPS of each time period.Use aggregation functions (such as groupby in Pandas) to group and calculate data to ensure the accuracy and consistency of the results. Store hard disk load data for different time periods in the database to ensure the structure and queryability of the data. Record the load characteristics of each time period for subsequent analysis and reporting. Write documents to describe the analysis process and calculation methods for each time period in detail to facilitate subsequent audits and optimization. Use visualization tools to display hard disk load characteristics for different time periods to help identify load change trends and peak periods. Use histograms, line charts, or heat maps to intuitively display load conditions. By visualizing the results and comparing them with historical data, help identify potential load anomalies and clarify the definition of load peaks, such as in each time period. The maximum read and write rate, IOPS, etc. of the hard disk in the system should be determined to ensure that this standard can effectively reflect the peak state of the load. The method for calculating the load peak may be used, which may be a simple maximum value calculation, or combined with sliding window technology to capture sudden load conditions. The load data of each time period is traversed to calculate the load peak of each time period. This can be achieved by writing simple code (such as the max() function in Python). The peak value of each time period is recorded and compared with other statistical data (such as average load) to better understand the changes in the load. The calculated load peak is stored in the database to ensure the structure of the data for subsequent query and analysis. The peak value of each time period and its corresponding timestamp are recorded. Detailed A report describing the calculation process and results of the load peak is prepared for subsequent reference and optimization. Visual tools are used to display the changing trend of the load peak to help understand the load fluctuations in different time periods. The peak load period is identified through chart display. Comparative analysis is performed in combination with historical data to identify potential load anomalies and provide a basis for subsequent optimization and adjustment. A suitable fitting model is selected, such as linear regression, polynomial regression or other time series prediction models (such as ARIMA model). According to the characteristics of the load peak, a suitable model is selected to capture the fluctuation trend. The parameter settings of the model are determined, such as the order of the polynomial, the regression variables, etc., to ensure that the model can effectively fit the peak data. The calculated load peak is organized into a suitable fitting model. The data format is ensured to include timestamps and corresponding load peak values, which provides a basis for subsequent fitting. The data is standardized to improve the fitting effect, ensuring that the data is on the same scale. The sorted data is input into the selected fitting model, and the load peak fluctuation fitting is performed. Statistical analysis tools (such as Scikit-learn and Statsmodels) are used for fitting, and the fitting effect of the model is evaluated. The fitting results are recorded, including statistical indicators such as fitting parameters and R² values, to evaluate the effectiveness and accuracy of the model. The load peak fluctuation curve is drawn using visualization tools to show the comparison between the fitting results and the actual data. The accuracy and fluctuation trend of the fitting are intuitively displayed through comparison charts. The fitting results are combined for analysis.Identify potential load fluctuation patterns and provide a basis for subsequent optimization strategies.

[0036] In this embodiment, the specific steps of step S12 are: Perform abnormal outlier filtering on multi-modal hard disk monitoring parameters to obtain outlier filtering monitoring parameters; Analyze the hard disk temperature changes of the outlier filtering monitoring parameters and extract the hard disk temperature change characteristics; Calculate the real-time read and write rate of the outlier filtering monitoring parameters to obtain the real-time read and write rate of the hard disk; Perform data writing error rate analysis on outlier filtering monitoring parameters to generate data writing error rate; The hard disk real-time read and write rate and data write error rate are mined to generate the hard disk real-time traffic state characteristics; According to the hard disk temperature change characteristics, the hard disk real-time traffic state characteristics are subjected to time series data flow evolution, thereby generating hard disk traffic data time series evolution characteristics.

[0037] In this embodiment, the standard for determining abnormal outliers is usually to use statistical methods such as Z-score, IQR (interquartile range method), etc. to identify outliers in monitoring parameters, define a threshold (Z-score>3) to identify abnormal data points, select appropriate monitoring parameters for analysis, such as read and write rates, latency, IOPS, temperature, etc., to ensure that these parameters can effectively reflect the status of the hard disk, collect multimodal hard disk monitoring parameter data, and perform preliminary cleaning to remove duplicate records and invalid data to ensure data integrity and consistency, use data processing libraries (such as Pandas) in programming languages ​​such as Python to implement data cleaning, prepare a basic data set for outlier filtering, and apply the selected outlier detection method. Analyze the monitoring parameters after cleaning, use the Z-score method to calculate the Z-score value of each parameter, and compare it with the preset threshold value, record the detected outliers, and delete these outliers from the original data set to obtain the monitoring parameters after outlier filtering, extract temperature-related data from the monitoring parameters after outlier filtering, ensure that the data includes timestamps and corresponding temperature values, perform preliminary cleaning on the temperature data to ensure the accuracy and completeness of the data, use tools such as Pandas to process the temperature data, and calculate the statistical characteristics of temperature changes, such as average temperature, temperature fluctuation range, maximum temperature and minimum temperature, etc. These characteristics can help understand the temperature changes of the hard disk in different time periods, and use the time series analysis method to calculate Calculate the trend and periodicity of temperature changes, identify potential abnormal fluctuations, use visualization tools (such as Matplotlib, Seaborn) to draw temperature change graphs, and show the trend of temperature changes over time. Through the graph, you can intuitively identify the peaks and troughs of temperature, analyze the abnormal fluctuations in the graph, and determine whether it may affect the performance or life of the hard disk. Store the extracted temperature change features in the database to ensure the structure and queryability of the data, record the process and results of the temperature analysis for subsequent optimization, write a detailed report, describe the results and findings of the temperature change analysis, and provide a basis for subsequent hard disk maintenance. Extract real-time read and write related data from the monitoring parameters after outlier filtering, and ensure that the data contains timestamps, read rates, and write rates, etc. Information, clean the data, remove invalid records, ensure the integrity and accuracy of the data, calculate the real-time read and write rate, usually you can get the read and write rate in a specific time period by averaging or using the sliding window method, you can use the read and write data of the past 5 minutes to calculate the average rate, use the Numpy or Pandas library in Python for calculation, ensure the efficiency and accuracy of the calculation process, store the calculated real-time read and write rate in the database, ensure the structure and queryability of the data, record the calculated timestamp and rate value for subsequent analysis, write detailed documents, record the process and method of real-time read and write rate calculation, provide a basis for subsequent auditing and optimization, use visualization tools to show the changing trend of real-time read and write rates,Helps identify potential performance bottlenecks or anomalies, analyzes the comparison between real-time read and write rates and historical data, determines whether the current performance is within the normal range and whether optimization is needed, extracts data write error-related data from the monitoring parameters after outlier filtering, ensures that the data includes information such as timestamps and error counts, cleans the data, removes invalid records, ensures data integrity and accuracy, calculates the data write error rate, and usually uses the formula: Error rate = (number of write errors / total number of write requests) × 100%, ensures that the number of write requests is accurately counted during the calculation process, uses Python and other tools to calculate the error rate, ensures the efficiency and accuracy of the calculation, and stores the calculated data write error rate in the database to ensure data Structuring and queryability, record the calculated timestamp and error rate value for subsequent analysis, write detailed documents, record the process and results of data write error rate calculation, provide a basis for subsequent audit and optimization, use visualization tools to display the changing trend of data write error rate, help identify potential problems and high-risk time periods, analyze the relationship between error rate and other monitoring parameters, and determine whether there is a correlation, such as whether the temperature increase leads to an increase in error rate, integrate the real-time read and write rate and data write error rate into a unified data set, ensure that the data is aligned by timestamp, so as to conduct traffic status analysis, use data processing tools such as Pandas for integration, ensure the consistency of data format, calculate the hard disk traffic status characteristics, including real-time read and write The average value, peak value, fluctuation range of the rate and the average value of the data write error rate, etc., use statistical analysis methods to extract the key features of the traffic state, design evaluation indicators of the traffic state according to actual needs, help understand the health of the traffic, use visualization tools to display the hard disk traffic state characteristics, help identify traffic peaks and abnormal situations, and intuitively display traffic changes through heat maps, line graphs, etc., analyze the relationship between traffic state characteristics and hard disk performance, and determine whether the traffic affects the normal operation of the hard disk. The generated real-time hard disk traffic state characteristics are stored in the database to ensure the structure and queryability of the data, record the calculation process and results of each feature, provide a basis for subsequent optimization, and write detailed documents to describe the traffic state mining. Process and results for subsequent audit and improvement, integrate hard disk temperature change characteristics and real-time traffic status characteristics into a unified data set, ensure data alignment by timestamp for time series analysis, use Pandas and other data processing tools to ensure data format consistency for subsequent analysis, use time series analysis methods such as moving average, exponential smoothing or correlation analysis, observe the relationship between temperature change and traffic status, extract evolution characteristics, calculate the degree of influence of temperature change on traffic status, identify potential influence patterns, extract time series evolution characteristics, including the correlation between temperature change and traffic status, trend changes, etc., evaluate the effectiveness of these characteristics in traffic status monitoring, use data mining technology to identify potential traffic anomaly patterns,To assist in subsequent risk assessment.

[0038] In this embodiment, refer to Figure 3 , is a flowchart of detailed implementation steps of step S2. In this embodiment, the detailed implementation steps of step S2 include: Step S21: performing a peak trend evolution analysis on the hard disk load peak fluctuation curve to generate load peak trend evolution data; Step S22: performing multi-time window rolling prediction on the load peak trend evolution data to obtain load peak prediction data of multiple time windows; Step S23: performing abnormal load peak detection on the load peak prediction data of multiple time windows, and marking abnormal load peak points; Step S24: Locate the time period of the abnormal load peak point, thereby obtaining the time period where the abnormal peak point is located.

[0039] In this embodiment, the generated load peak fluctuation curve data is collected to ensure that the data contains a timestamp and the corresponding load peak value, and that the data is complete and has no missing or duplicate records. A data processing tool (such as Pandas) is used to preprocess the data, and the load peak data is organized into a format suitable for analysis. An appropriate trend analysis method is selected, such as moving average, exponential smoothing, or linear regression. According to the characteristics of the data, it is decided which method to use to smooth fluctuations and extract trends. The analysis window length is set, such as using the data of the past 7 days to calculate the average load trend to reduce the impact of short-term fluctuations. The selected trend analysis method is applied to calculate the load peak fluctuation curve, and the moving average is calculated or the linear regression model is fitted to identify the peak load fluctuations. Analyze the long-term load trend, record the trend changes in each time period, including rising, falling and stable states, and generate corresponding trend data reports. Use visualization tools (such as Matplotlib or Seaborn) to draw load peak trend charts to intuitively display the changing trend and evolution process of the peak value. Store the analysis results and generated trend data in the database to ensure data structuring for subsequent query and analysis. At the same time, record the parameters and methods in the analysis process for subsequent audits. Select appropriate prediction models, such as ARIMA, SARIMA, LSTM, etc., depending on specific needs. ARIMA is suitable for linear time series, while LSTM is suitable for processing more complex nonlinear data. Determine the parameter settings of the model, for example Such as the number of autoregressive terms, the number of difference orders and the number of moving average terms to ensure that the model adapts to the data characteristics, convert the load peak trend evolution data into a format suitable for model input, ensure that the data is arranged in time series, and handle missing values. Divide the data according to the set time window (such as 1 hour, 1 day, etc.) for rolling prediction. The sliding window technology can be used to ensure the overlap between each window. Input the data into the selected prediction model and perform rolling prediction step by step. Each time, use the data from the previous few time points to predict the load peak at the next time point, and repeat this process. Record the prediction results for each time window and evaluate the prediction accuracy. Use indicators such as MSE (mean square error) and MAE (mean absolute error) for evaluation to determine the abnormal load peak. Standard, usually use statistical methods such as Z-score, IQR, etc. to identify outliers in the predicted data, set thresholds (such as Z-score>3) to identify outliers, select appropriate monitoring parameters for analysis, such as predicted load peak, actual load peak, etc., to ensure that these parameters can effectively reflect the abnormal load situation, apply the selected anomaly detection method, analyze the predicted data, calculate the Z-score of each load peak, and compare it with the set threshold, record the detected abnormal load peak, and mark the anomaly for subsequent analysis, store the marked abnormal load peak in the database, ensure the structure and queryability of the data, record the timestamp and detection result of each anomaly for subsequent analysis,Write a detailed report describing the process and results of abnormal load peak detection to provide a basis for subsequent risk assessment and optimization. Determine the time period of the abnormal load peak, usually including the data before and after the abnormal point. Set a time window, such as 1 hour before and after, for detailed analysis. Ensure that the range of the time period is reasonable and can reflect the impact of the abnormal load peak. Extract the abnormal load peak point and its corresponding time period data from the stored load peak data. Ensure that the extracted data includes timestamps, load values ​​and other relevant monitoring parameters. Use data processing tools (such as Pandas) to extract data to ensure data integrity and consistency. Record the time period of each abnormal load peak point. Generate a report on the abnormal load peak time period, including the start and end time of the time period, load value and its changes. Analyze the monitoring parameters within the time period to determine the cause of the abnormal load peak, such as whether it is related to system load, temperature changes and other factors. ,

[0040] In this embodiment, refer to Figure 4 , is a flowchart of detailed implementation steps of step S3. In this embodiment, the detailed implementation steps of step S3 include: Step S31: analyzing the hard disk storage status of the hard disk in the current time period according to the time period where the abnormal peak point is located, thereby obtaining the hard disk storage status; Step S32: Calculate the redundant data of the hard disk in the current time period, and extract the redundant data of the abnormal peak time period; Step S33: performing redundant data cleaning processing on the hard disk based on the redundant data in the abnormal peak time period, thereby obtaining redundant optimized hard disk data; Step S34: making a dynamic global data backup decision for the redundant optimized hard disk data according to the hard disk storage status, thereby generating an abnormal peak global backup strategy.

[0041] In this embodiment, the hard disk monitoring data in the time period corresponding to the abnormal peak point is collected, including multiple parameters such as hard disk read and write rate, IOPS, delay, temperature, etc., to ensure the integrity and consistency of the data. The database query tool is used to extract the relevant monitoring data in the specified time period to ensure the uniformity of the data format for subsequent analysis. The key indicators of the hard disk storage status are defined, such as storage utilization, activity, error rate, etc. These indicators can effectively reflect the health status of the hard disk in the abnormal peak time period. The calculation method of each indicator is determined. The storage utilization rate can be expressed as the ratio of the used space to the total space. The collected data is analyzed to calculate the defined storage status indicators. The data processing tools (such as Python's Pandas) are used to calculate the storage status indicators. s library) to calculate and analyze data, identify the hard disk status characteristics during the abnormal peak time period, such as whether there is an overload or error, whether there is a performance bottleneck, etc., use visualization tools (such as Matplotlib or Seaborn) to plot the hard disk storage status indicators into a chart, intuitively display the changes in storage status and abnormal phenomena, generate a detailed analysis report, summarize the storage status of the current time period, and put forward possible improvement suggestions, record the analysis process for subsequent audits, determine the definition of redundant data, including data backup, duplicate data, useless data, etc., clarify which data can be considered redundant, and set relevant calculation standards, and design indicators for redundant data calculation, such as the proportion of redundant data to total data and the amount of redundant data. Etc., extract relevant data of abnormal peak time period from the stored monitoring data, clean it, remove duplicate records and invalid data to ensure data accuracy, use data processing tools (such as Pandas) to process the data to ensure accurate identification of redundant data, apply defined standards to calculate redundant data in the current time period, and determine whether the data is repeated by comparing the hash value of the data block, thereby identifying redundant data, and record the calculation results of redundant data, including the number and proportion of redundant data, etc., to provide a basis for subsequent optimization. According to the calculation results of redundant data, design a cleaning strategy, which can consider completely deleting redundant data, migrating to low-cost storage, or compressing it, etc., and determine the priority of cleaning, such as giving priority to processing occupied space Large redundant data: Before cleaning redundant data, ensure that all important data is backed up to prevent data loss caused by cleaning operations. Use backup tools to back up data and record the time and content of the backup for subsequent recovery. Perform redundant data cleaning according to the designed cleaning strategy. You can use automated scripts or manual operations to clear redundant data based on its markers. Record the timestamp and type of each cleaned data for subsequent audit and recovery. Evaluate existing data backup strategies, analyze their effectiveness and feasibility during abnormal peak time periods, consider the current storage status and the impact of redundant data, determine backup goals, such as reducing loss risks and increasing recovery speed, and ensure that backup strategies can meet these goals.According to the analyzed hard disk storage status, determine the current backup needs, consider the data loss risk caused by abnormal peaks, adjust the backup frequency and backup content, design dynamic backup strategies, such as increasing the backup frequency during abnormal peaks and reducing the backup frequency under normal conditions, ensure the rational use of resources, and make global data backup decisions, including the time, content and method of backup (such as incremental backup, full backup, etc.), ensure that the backup strategy can adapt to the current hard disk status, use backup software or tools, perform data backup according to the formulated strategy, and ensure the automation and efficiency of the backup process. ,

[0042] In this embodiment, step S4 includes the following steps: Step S41: Detect abnormal writing behavior on the hard disk history monitoring log and extract abnormal writing behavior; Step S42: calculating the abnormal behavior frequency of the abnormal writing behavior to obtain the abnormal writing behavior frequency parameter; Step S43: performing time series variation statistics on the abnormal write behavior frequency parameter, thereby generating abnormal write behavior frequency variation characteristics; Step S44: performing malicious attack behavior analysis based on the abnormal write behavior frequency change characteristics, thereby generating malicious attack behavior data; Step S45: trace the attack node source of the malicious attack behavior data and mark the malicious attack source tracing location point.

[0043] In this embodiment, the hard disk historical monitoring log is collected and organized to ensure that the data contains information such as timestamp, write operation type, write amount, write failure record, etc. The data should be complete and in a unified format for subsequent analysis. The log data is imported and processed using tools such as Python's Pandas library, invalid records are removed and missing values ​​are filled. The standard of abnormal write behavior is determined, such as abnormal write rate, too many write failures, frequent write operations, etc. Historical data can be referenced to set reasonable thresholds, and statistical methods (such as Z-score and IQR method) can be used to determine what kind of behavior can be regarded as abnormal. The set abnormal standards are applied to detect the historical monitoring logs, and by writing a detection algorithm, the behavior that is significantly different from normal behavior can be identified. Different write operations are performed, and the detected abnormal write behaviors are recorded, including their types, frequencies, and timestamps. Data is prepared for subsequent analysis. The standard for calculating the frequency of abnormal write behaviors is determined, such as the number of abnormal write behaviors within a certain time window. A time window is set (such as hourly, daily, etc.) to facilitate frequency statistics. A frequency calculation formula is designed, which is usually: frequency = number of abnormal behaviors / total number of records within the time window. Necessary data, including timestamps and abnormal behavior types, are extracted from the stored abnormal write behavior records to ensure data integrity for frequency calculation. Data processing tools (such as Pandas) are used to organize data, and abnormal behaviors are grouped by time window. The set frequency calculation method is applied to the abnormal Frequent write behaviors are counted, the number of abnormal behaviors and the corresponding frequency in each time window are recorded, and a frequency data set is generated to ensure that the calculation results of each time window are recorded, including the timestamp and the frequency of abnormal behaviors. The calculated abnormal write behavior frequency parameters are sorted into time series data to ensure that the data is arranged by timestamp, and missing values ​​and abnormal points are processed. Data processing tools (such as Pandas) are used to clean the frequency data to ensure the accuracy and completeness of the data. The calculation method of frequency change characteristics is defined, such as the moving average, percentage change, standard deviation, etc. of the calculated frequency. These characteristics can reflect the changing trend of the frequency over time. The calculation period of the change characteristics can be selected as day, week or month, depending on the volatility of the data. The set feature calculation method performs statistical analysis on the frequency parameters of abnormal write behaviors, generates a frequency change feature data set, and records the frequency characteristics of each time period, including the magnitude of change, trend direction, etc., to provide a reference for subsequent analysis. According to the frequency change characteristics, a malicious attack behavior recognition model is established. Machine learning algorithms (such as decision trees and random forests) can be used to train the model to identify potential attack patterns, collect historical attack data, and annotate different types of attack behaviors for model training and verification. Relevant features are selected from the generated frequency change features as the input variables of the model to ensure that the features can effectively reflect the characteristics of the attack behavior. The time series data is converted into a format suitable for model input to ensure data integrity and consistency.Use the training set to train the malicious attack behavior recognition model, adjust the model parameters to optimize the performance, evaluate the accuracy of the model through cross-validation and other methods, verify the model with the test set, record the model's accuracy, recall and other indicators to ensure the effectiveness of the model in practical applications, use the trained model to analyze the frequency change characteristics of abnormal write behavior, identify possible malicious attack behaviors, generate relevant attack behavior data, record the type, timestamp and frequency characteristics of each identified attack behavior, so as to facilitate subsequent traceability analysis, determine the standards and methods for tracing the attack node, usually based on the timestamp, source IP address, log records and other information of the abnormal behavior. Tracing, design a tracing model, combine historical log data and attack behavior data, establish an attack path identification framework, extract necessary tracing information from malicious attack behavior data, including time, source, target, etc., to ensure the integrity and accuracy of the data for subsequent analysis, use data processing tools (such as Pandas) to clean the extracted data, remove invalid records, analyze the malicious attack behavior data according to the set tracing strategy, identify the attack source node and its path, and compare the log information with the historical records to track the starting point and propagation path of the attack behavior, and record the detailed information of each attack node, including attack type, attack time, source IP, etc.

[0044] In this embodiment, step S5 includes the following steps: Step S51: mining attack propagation paths for malicious attack source tracing locations to obtain multiple attack propagation paths; Step S52: identifying data damaged areas according to multiple attack propagation paths, and generating multiple malicious attack damaged areas; Step S53: analyzing the damaged data formats of multiple malicious attack damaged areas to generate damaged area data formats; Step S54: Evaluate the recoverability of the damaged area data format, so as to obtain the recoverability of each damaged area; Step S55: Based on the recoverability of each damaged area, adaptive data repair is performed area by area to construct an adaptive data repair strategy.

[0045] In this embodiment, historical monitoring logs related to malicious attacks are collected, including information such as timestamp, source IP, target IP, and operation type. These data will be used to analyze the propagation path of the attack. Data processing tools (such as Elasticsearch or Splunk) are used to extract necessary log data, and their formats are ensured to be unified and complete. A suitable path mining algorithm is selected, such as a graph-based algorithm (such as Dijkstra algorithm or depth-first search) to identify the attack propagation path. The attack source and target can be regarded as nodes in the graph, and the operation can be regarded as an edge. The path mining criteria are determined, such as the time sequence of attack propagation, the nature of the attack, etc. The selected algorithm is used to analyze the interaction between the attack source and the target to identify the propagation path of the attack. The attack propagation path is mined, the nodes and operation types of each path are recorded, and an attack propagation graph is constructed to generate multiple attack propagation paths. A unique identifier is assigned to each path for subsequent analysis and tracking. The mined attack propagation paths are stored in the database to ensure that the data is structured and queryable. The detailed information of each path, including nodes, operations, and timestamps, is recorded. The attack propagation path is displayed using visualization tools (such as Graphviz or Gephi), which intuitively display the propagation of the attack and the scope of impact, to help with subsequent analysis and determine the standards for data damaged areas, including system components, database tables, files, etc. affected by the attack. They can be defined based on the target nodes in the attack path. Combined with historical data, a classification standard for damaged areas is established. , in order to better identify and manage, extract the affected nodes and related data from the attack propagation path, analyze the degree of damage and type of each node, record the access frequency and data modification of each node, use data processing tools (such as Pandas) to clean and organize the extracted data to ensure the accuracy of the data, and identify multiple malicious attack damaged areas according to the set standards and extracted data. By analyzing the connectivity and degree of impact of the nodes, determine which areas are affected by the attack, record the detailed information of each damaged area, including name, type and degree of damage, to provide basic data for subsequent analysis, determine the standards for the damaged data format, including file type, data structure, encoding method, etc., and clarify which data formats are affected. It may be affected by malicious attacks. Design indicators for data format analysis, such as field integrity and data type consistency. Extract relevant data from the damaged area and analyze its format and structure to ensure that the extracted data is complete and accurate for analysis. Use data processing tools (such as Pandas) to clean the extracted data and remove invalid records and duplicate data. Perform format analysis on the damaged data according to the set standards and indicators. Record the specific data format information of each damaged area, including field type, data length, constraints, etc. Generate a report on the data format of the damaged area, record the data structure characteristics and potential problems of each area, and determine the standards for recoverability evaluation, including data backup status, data integrity, data redundancy, etc.Identify factors that affect data recoverability, design an assessment model, combine the damaged area data format and historical backup records, assess the recoverability of each area, extract relevant data from the damaged area, analyze its backup status and integrity, ensure the accuracy of the data, so as to conduct recoverability assessment, use data processing tools (such as Pandas) to clean and organize the extracted data, ensure the accuracy and integrity of the data, apply the set assessment standards and models, conduct recoverability assessment for each damaged area, record the recoverability indicators of each area, such as backup frequency, data integrity index, etc., generate a recoverability assessment report, and record the assessment results and potential risks of each damaged area for subsequent decision-making.

[0046] In this embodiment, step S6 includes the following steps: Step S61: Identify key storage data nodes from the hard disk history monitoring log and extract key storage data nodes; Step S62: performing semantic analysis on key storage data nodes one by one to obtain storage data features of each node; Step S63: Perform dynamic data semantic sensitivity calculation on the storage data features of each node to generate data semantic sensitivity of each node; Step S64: making a hierarchical data encryption decision according to the data semantic sensitivity of each node, thereby obtaining a hierarchical data encryption engine; Step S65: Perform intelligent collaborative protection control on the adaptive data repair strategy, the layered data encryption engine and the abnormal peak global backup strategy to build an intelligent collaborative protection model.

[0047] In this embodiment, the hard disk historical monitoring log is collected to ensure that the log contains information such as timestamps, data write and read operations, and data block identifiers. The data should be complete and in a unified format for subsequent analysis. Data processing tools (such as Python's Pandas library) are used to import and organize log data to ensure data integrity. It is determined what kind of storage data nodes can be regarded as key nodes. Generally, key nodes include frequently accessed files, important database tables, system configuration files, etc. Key node identification standards are designed, such as access frequency, data importance, data sensitivity, etc. Reasonable thresholds are set, and the set standards and thresholds are applied to analyze the historical monitoring logs to identify qualified key storage data nodes. Statistical analysis methods, such as high-frequency access statistics, record the information of identified key nodes, including node identifiers, access frequencies, data types, etc., for subsequent analysis, store the identified key storage data nodes in the database, ensure that the data is structured and queryable, record the detailed information of each node and its identification process, use visualization tools (such as Tableau or PowerBI) to display the distribution of key nodes, help intuitively understand the characteristics and importance of key data, determine the standards for data semantic analysis, including data types, data structures, data content, etc., clarify which features can be used to describe the semantics of stored data, and design parsing indicators, such as field types, data lengths, data relationships, etc., to conduct detailed semantic analysis. Extract relevant data from the identified key storage data nodes, analyze their structure and content, ensure that the extracted data is complete and accurate for subsequent analysis, use data processing tools (such as Pandas) to clean the extracted data, remove invalid records and duplicate data, and perform semantic analysis on each key storage data node according to the set standards and indicators, record the storage data characteristics of each node, including type, format, constraints, etc., generate a semantic feature data set for each node, ensure that the feature information of each node is complete and structured, and facilitate subsequent analysis, determine the calculation standard of data semantic sensitivity, including data confidentiality, integrity, availability, etc., set sensitivity evaluation indicators and calculation methods, design a sensitivity scoring system, and pass A scoring scale of 0 to 5 or 0 to 10 is often used for quantitative analysis. The necessary information is extracted from the stored data features, and its sensitivity is analyzed to ensure the accuracy of the analyzed data in order to perform dynamic sensitivity calculations. The extracted data is processed using data analysis tools (such as Python's NumPy or SciPy), and the sensitivity score of each node is calculated. The set sensitivity calculation criteria are applied to perform dynamic sensitivity assessments on each key storage data node, and the sensitivity score and related parameters of each node are recorded. A sensitivity data set is generated to ensure that the sensitivity information of each node is complete and structured for subsequent decision-making. The calculated data semantic sensitivity of each node is stored in the database to ensure that the data is structured and queryable.Record the calculation process and results of each node, use visualization tools to display the sensitivity distribution of nodes, help intuitively understand the sensitivity and protection needs of data, design a hierarchical data encryption strategy based on the data semantic sensitivity of each node, use strong encryption algorithms (such as AES-256) for highly sensitive data, and use lightweight encryption algorithms (such as RSA) for low-sensitivity data, determine the encryption priority and implementation rules, ensure that sensitive data is protected first, establish a hierarchical encryption model, define the encryption algorithm and processing flow of each level, ensure that the model can dynamically adapt to the sensitivity changes of nodes, design encryption key management strategies, ensure that keys at different levels can be securely stored and managed, implement data encryption node by node according to the designed hierarchical encryption strategy, record the encryption process and results of each node for subsequent audits, perform post-encryption verification, ensure the integrity and security of encrypted data, and ensure that it can be correctly decrypted during recovery.

[0048] In this embodiment, a hard disk data protection device based on artificial intelligence is provided, which is used to execute the hard disk data protection method based on artificial intelligence as described above, including: The peak fluctuation module is used to obtain the hard disk historical monitoring log; perform hard disk load analysis in multiple periods on the hard disk historical monitoring log, and perform load peak fluctuation fitting to construct the hard disk load peak fluctuation curve; The peak trend evolution module is used to analyze the peak trend evolution of the hard disk load peak fluctuation curve and detect abnormal load peaks to obtain the time period where the abnormal peak point is located; The global backup module is used to calculate the redundant data of the hard disk in the current time period according to the time period of the abnormal peak point, and make dynamic global data backup decisions, so as to generate the abnormal peak global backup strategy; The attack source tracing module is used to detect abnormal write behavior in the hard disk history monitoring log and trace the attack node, marking the malicious attack source location point; The adaptive repair module is used to identify the damaged data area at the malicious attack source location point, and then adaptively repair the data area by area to build an adaptive data repair strategy; The intelligent collaborative protection module is used to make hierarchical data encryption decisions based on the hard disk historical monitoring log, and to perform intelligent collaborative protection control based on the adaptive data repair strategy abnormal peak global backup strategy to build an intelligent collaborative protection model.

[0049] Therefore, the embodiments should be regarded as illustrative and non-restrictive from all points, and the scope of the present invention is limited by the appended claims rather than the above description, and it is therefore intended that all changes falling within the meaning and range of equivalent elements of the application documents are included in the present invention.

[0050] The above is only a specific embodiment of the present invention, so that those skilled in the art can understand or implement the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features invented herein.

Claims

1. A hard disk data protection method based on artificial intelligence, characterized in that: The following steps are involved: Step S1: Obtain hard disk historical monitoring logs; perform hard disk load analysis for multiple periods on the hard disk historical monitoring logs, and perform load peak fluctuation fitting to construct a hard disk load peak fluctuation curve; Step S2: performing a peak trend evolution analysis on the hard disk load peak fluctuation curve and performing abnormal load peak detection to obtain the time period where the abnormal peak point is located; Step S3: Calculate the redundant data of the hard disk in the current time period according to the time period where the abnormal peak point is located, and make a dynamic global data backup decision, so as to generate an abnormal peak global backup strategy; Step S4: Detect abnormal write behavior and locate attack nodes in the hard disk history monitoring log, and mark malicious attack tracing points; Step S5: Identify the damaged data area of ​​the malicious attack source tracing location point, and then perform adaptive data repair on a region-by-region basis to build an adaptive data repair strategy; Step S6: Make a hierarchical data encryption decision based on the hard disk historical monitoring log, and perform intelligent collaborative protection control based on the adaptive data repair strategy abnormal peak global backup strategy to build an intelligent collaborative protection model.

2. The hard disk data protection method based on artificial intelligence according to claim 1 is characterized in that: The specific steps of step S1 are: Step S11: obtaining a hard disk historical monitoring log, collecting multi-modal hard disk monitoring parameters from the hard disk historical monitoring log, and extracting multi-modal hard disk monitoring parameters; Step S12: performing time series data flow evolution on the multi-modal hard disk monitoring parameters, thereby generating hard disk flow data time series evolution characteristics; Step S13: performing multi-period hard disk load analysis on the time series evolution characteristics of the hard disk traffic data to generate hard disk load data of different time periods; Step S14: Calculate the traffic load peak value of the hard disk load data in different time periods, and extract the hard disk traffic load peak value in each time period; Step S15: performing load peak fluctuation fitting on the hard disk traffic load peak in each time period, thereby constructing a hard disk load peak fluctuation curve.

3. The method according to claim 2, characterized in that The specific steps of step S12 are: Perform abnormal outlier filtering on multi-modal hard disk monitoring parameters to obtain outlier filtering monitoring parameters; Analyze the hard disk temperature changes of the outlier filtering monitoring parameters and extract the hard disk temperature change characteristics; Calculate the real-time read and write rate of the outlier filtering monitoring parameters to obtain the real-time read and write rate of the hard disk; Perform data writing error rate analysis on outlier filtering monitoring parameters to generate data writing error rate; The hard disk real-time read and write rate and data write error rate are mined to generate the hard disk real-time traffic state characteristics; According to the hard disk temperature change characteristics, the hard disk real-time traffic state characteristics are subjected to time series data flow evolution, thereby generating hard disk traffic data time series evolution characteristics.

4. The method according to claim 1, characterized in that: The specific steps of step S2 are: Step S21: performing a peak trend evolution analysis on the hard disk load peak fluctuation curve to generate load peak trend evolution data; Step S22: performing multi-time window rolling prediction on the load peak trend evolution data to obtain load peak prediction data of multiple time windows; Step S23: performing abnormal load peak detection on the load peak prediction data of multiple time windows, and marking abnormal load peak points; Step S24: Locate the time period of the abnormal load peak point, thereby obtaining the time period where the abnormal peak point is located.

5. The hard disk data protection method based on artificial intelligence according to claim 1, characterized in that: The specific steps of step S3 are: Step S31: analyzing the hard disk storage status of the hard disk in the current time period according to the time period where the abnormal peak point is located, thereby obtaining the hard disk storage status; Step S32: Calculate the redundant data of the hard disk in the current time period, and extract the redundant data of the abnormal peak time period; Step S33: performing redundant data cleaning processing on the hard disk based on the redundant data in the abnormal peak time period, thereby obtaining redundant optimized hard disk data; Step S34: making a dynamic global data backup decision for the redundant optimized hard disk data according to the hard disk storage status, thereby generating an abnormal peak global backup strategy.

6. The hard disk data protection method based on artificial intelligence according to claim 1, characterized in that: The specific steps of step S4 are: Step S41: Detect abnormal writing behavior on the hard disk history monitoring log and extract abnormal writing behavior; Step S42: calculating the abnormal behavior frequency of the abnormal writing behavior to obtain the abnormal writing behavior frequency parameter; Step S43: performing time series variation statistics on the abnormal write behavior frequency parameter, thereby generating abnormal write behavior frequency variation characteristics; Step S44: performing malicious attack behavior analysis based on the abnormal write behavior frequency change characteristics, thereby generating malicious attack behavior data; Step S45: trace the attack node source of the malicious attack behavior data and mark the malicious attack source tracing location point.

7. The hard disk data protection method based on artificial intelligence according to claim 1, characterized in that: The specific steps of step S5 are: Step S51: mining attack propagation paths for malicious attack source tracing locations to obtain multiple attack propagation paths; Step S52: identifying data damaged areas according to multiple attack propagation paths, and generating multiple malicious attack damaged areas; Step S53: analyzing the damaged data formats of multiple malicious attack damaged areas to generate damaged area data formats; Step S54: performing recoverability evaluation on the damaged area data format, thereby obtaining the recoverability of each damaged area; Step S55: Based on the recoverability of each damaged area, adaptive data repair is performed area by area to construct an adaptive data repair strategy.

8. The hard disk data protection method based on artificial intelligence according to claim 1, characterized in that: The specific steps of step S6 are: Step S61: Identify key storage data nodes from the hard disk history monitoring log and extract key storage data nodes; Step S62: performing semantic analysis on key storage data nodes one by one to obtain storage data features of each node; Step S63: Perform dynamic data semantic sensitivity calculation on the storage data features of each node to generate data semantic sensitivity of each node; Step S64: making a hierarchical data encryption decision according to the data semantic sensitivity of each node, thereby obtaining a hierarchical data encryption engine; Step S65: Perform intelligent collaborative protection control on the adaptive data repair strategy, the layered data encryption engine and the abnormal peak global backup strategy to build an intelligent collaborative protection model.

9. A hard disk data protection device based on artificial intelligence, characterized in that: Used to execute the hard disk data protection method based on artificial intelligence as claimed in claim 1, comprising: The peak fluctuation module is used to obtain the hard disk historical monitoring log; perform hard disk load analysis in multiple periods on the hard disk historical monitoring log, and perform load peak fluctuation fitting to construct the hard disk load peak fluctuation curve; The peak trend evolution module is used to analyze the peak trend evolution of the hard disk load peak fluctuation curve and detect abnormal load peaks to obtain the time period where the abnormal peak point is located; The global backup module is used to calculate the redundant data of the hard disk in the current time period according to the time period of the abnormal peak point, and make dynamic global data backup decisions, so as to generate the abnormal peak global backup strategy; The attack source tracing module is used to detect abnormal write behavior in the hard disk history monitoring log and trace the attack node, marking the malicious attack source location point; The adaptive repair module is used to identify the damaged data area at the malicious attack source location point, and then adaptively repair the data area by area to build an adaptive data repair strategy; The intelligent collaborative protection module is used to make hierarchical data encryption decisions based on the hard disk historical monitoring log, and to perform intelligent collaborative protection control based on the adaptive data repair strategy abnormal peak global backup strategy to build an intelligent collaborative protection model.

Images