Encryption transmission method for student data

Abstract

The invention relates to the technical field of data encryption, in particular to a student data encryption transmission method which comprises the following steps: collecting student data including personal information and academic scores, classifying the student data into different security levels based on data sensitivity, and marking each security level as a security level. According to the method, the student data sensitivities are classified and allocated to different security levels, and a matched encryption algorithm is appointed for each level, so that the allocation mode of encryption resources is optimized, and meanwhile, differential strategies are realized in sensitive data protection. And hierarchical encryption tasks are subjected to parallel processing, and each processing core is responsible for encryption tasks of data of different hierarchies, so that the speed and the processing capability of large-scale data encryption are improved. The data flow is monitored in real time, abnormal behaviors are dynamically detected, lagging response to potential risks in transmission is avoided, and potential abnormal activities are identified by detecting fine deviation with a normal model, so that the data transmission security is enhanced.

Description

Technical Field

[0001] The present invention relates to the technical field of data encryption, and particularly to an encrypted transmission method for student data. Background Art

[0002] The technical field of data encryption mainly studies how to protect the confidentiality, integrity, and authenticity of data through cryptographic means, ensuring that data is protected from unauthorized access or tampering threats during storage and transmission. This field covers core technologies such as symmetric encryption algorithms (such as AES), asymmetric encryption algorithms (such as RSA), hash algorithms (such as the SHA series), and hybrid encryption systems. The encrypted transmission method for student data is a technical solution focusing on data security protection in the education field, aiming to ensure that sensitive data such as students' personal information and academic achievements will not be tampered with or leaked through hierarchical encryption.

[0003] However, existing technologies mostly adopt a unified scheme in the encryption strategy and fail to implement hierarchical protection according to data sensitivity, resulting in low resource utilization, overprotection of low-sensitivity data, and failure to provide priority protection for high-sensitivity data. In terms of ensuring transmission security, existing technologies lack real-time monitoring and fine-grained anomaly detection capabilities and can only identify risks through preset rules. This approach may show low adaptability in the face of complex or new attacks. In addition, in terms of adjusting encryption intensity, existing technologies usually rely on manually or statically set encryption strategies and are difficult to dynamically adjust the encryption level according to risks, increasing potential security risks in high-risk scenarios. Summary of the Invention

[0004] The purpose of the present invention is to solve the drawbacks existing in the prior art and propose an encrypted transmission method for student data.

[0005] To achieve the above purpose, the present invention adopts the following technical solution. An encrypted transmission method for student data includes the following steps:

[0006] Collect student data, including personal information and academic achievements. Based on data sensitivity, classify the student data into different security levels, and mark each security level with a security level to obtain a hierarchical marking result; Based on the hierarchical marking result, assign an encryption algorithm to each security level to obtain an encryption algorithm matching list;

[0007] Use the encryption algorithm matching list to encrypt each security level, process the encryption of personal information and academic achievements separately to obtain an encrypted data set; The encrypted data set uses a multi-core processor architecture to parallelize the encryption tasks and processes different data levels through different processing cores;

[0008] Use machine learning to monitor data streams in real time, detect deviations from the normal encrypted data model, and obtain an anomaly detection model; based on the anomaly detection model, combine with real-time monitoring of data streams, analyze abnormal behaviors, and obtain abnormal behavior results;

[0009] According to the abnormal behavior results, dynamically adjust the encryption strength to obtain an encryption strength adjustment record.

[0010] Preferably, the steps for obtaining the hierarchical marking result are as follows:

[0011] Collect the personal information and academic achievements of students, extract the data type, data volume, sensitivity weight, and interaction dependency degree, establish an initial data matrix, where the rows of the initial data matrix represent different data types and the columns represent the characteristic parameter values, and generate an initial data matrix result;

[0012] According to the initial data matrix result, calculate the classification score value, and the calculation formula is:

[0013]

[0014] where, C i is the classification score value of data item i, x i is the interaction dependency degree of data item i, y i is the data volume parameter, z i is the sensitivity weight, w i is the weight factor corresponding to the data type, u i is the sensitivity mark of data item i, v i is the standard threshold associated with the sensitivity mark u i is the constraint factor of the data type; i Based on the classification score value, divide the data into different security levels according to the preset classification threshold rules to obtain the hierarchical marking result.

[0015] Preferably, the steps for obtaining the encryption algorithm matching list are as follows:

[0016] Based on the hierarchical marking result, calculate the encryption algorithm strength, and the calculation formula is:

[0017]

[0018]

[0019] where, E i represents the encryption algorithm strength selected for the i-th layer, α is the adjustment coefficient of the security requirement level of layer i, L i is the security requirement level, γ is the reaction sensitivity to the sensitivity deviation adjustment, S i is the sensitivity index of layer i, and T is the sensitivity threshold;

[0020] According to the strength of the encryption algorithm, an encryption algorithm is assigned to each security level, and AES-128, AES-192 or AES-256 is selected according to the high or low strength of the encryption algorithm to obtain an encryption algorithm matching list.

[0021] Preferably, the steps for obtaining the encrypted data set are as follows:

[0022] Based on the encryption algorithm matching list, an encryption algorithm is selected for each security level to obtain an encryption scheme corresponding to the security level;

[0023] Based on the encryption scheme corresponding to the security level, encryption processing is respectively performed on personal information and academic achievements to obtain an encrypted personal information data set and an encrypted academic achievement data set;

[0024] Integrate the encrypted personal information data set and the encrypted academic achievement data set to form a unified encrypted data set.

[0025] Preferably, for the encrypted data set, through a multi-core processor architecture, the encryption tasks are processed in parallel. The steps of processing different data levels through different processing cores are specifically as follows:

[0026] Configure the multi-core processor architecture, allocate the encrypted data set to multiple processing cores, and each core is responsible for different data levels for parallel processing to obtain a task allocation scheme;

[0027] Based on the task allocation scheme, each processing core independently processes the allocated data level using a predetermined encryption algorithm, performs encryption operations, and obtains the encryption results of each core;

[0028] Summarize the encryption results of each core to form an encrypted data set.

[0029] Preferably, the steps for obtaining the anomaly detection model are as follows:

[0030] Collect the encrypted data features in the real-time data stream, extract the data distribution and traffic trend to obtain the encrypted data features;

[0031] Based on the encrypted data features, use a support vector machine to construct a behavior model, and identify the distribution range of the encrypted features of normal data through the training process to generate an anomaly detection model.

[0032] Preferably, the steps for obtaining the abnormal behavior result are as follows:

[0033] Based on the anomaly detection model and the real-time monitored data stream, obtain the traffic volatility, time deviation and data distribution anomaly degree, and generate a real-time anomaly feature parameter set;

[0034] According to the real-time anomaly feature parameter set, calculate the abnormal behavior score, and the calculation formula is:

[0035]

[0036] Among them, A b is the abnormal behavior score, Q t is the current traffic rate, Q m is the model reference value of the traffic rate, F t is the data deviation factor, T b is the time interval of real-time monitoring, D t is the eigenvalue of the real-time data distribution feature, D m is the model reference value of the data distribution;

[0037] Based on the abnormal behavior score, analyze the abnormal behavior of traffic fluctuations or abnormal data distribution, and combine with the change trend of the real-time data stream to judge the type and risk level of the abnormal behavior, and obtain the abnormal behavior result.

[0038] Preferably, the step of obtaining the encryption strength adjustment record is as follows:

[0039] Based on the abnormal behavior result, extract the risk indicators associated with the encryption policy, including the frequency of tampering attempts, the intensity of traffic anomalies, and the data integrity deviation, to obtain the risk assessment input parameter set;

[0040] According to the risk assessment input parameter set, calculate the risk level score, and the calculation formula is:

[0041]

[0042] Among them, R s is the risk level score, P a is the frequency of tampering attempts, T r is the time window length, F d is the current traffic anomaly intensity, F m is the model reference traffic intensity, D a is the data integrity deviation;

[0043] According to the risk level score, dynamically adjust the current encryption. When the risk level score exceeds the preset risk threshold, upgrade the encryption algorithm strength to obtain the encryption strength adjustment record.

[0044] Compared with the prior art, the advantages and positive effects of the present invention are as follows:

[0045] The present invention optimizes the allocation of encryption resources by classifying the data sensitivity of students, assigning them to different security levels, and specifying a matching encryption algorithm for each level, while implementing differential strategies in the protection of sensitive data. The hierarchical encryption tasks are processed in parallel, and each processing core is responsible for the encryption tasks of different levels of data, improving the speed and processing capacity of large-scale data encryption. And the data stream is monitored in real time and abnormal behaviors are dynamically detected to avoid the lag response to potential risks during transmission. By detecting the subtle deviations from the normal model, potential abnormal activities are identified, enhancing the security of data transmission. Combining with the dynamic adjustment strategy of encryption intensity, the encryption algorithm intensity is automatically upgraded according to the risk behaviors monitored in real time, making the encryption scheme have real-time adaptability and flexibility, and being able to quickly improve the protection level in high-risk scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 It is a schematic diagram of the steps of the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0047] In order to make the objectives, technical solutions and advantages of the present invention clearer and more understandable, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0048] Please refer to Figure 1 , the present invention provides a technical solution, an encryption transmission method for student data, including the following steps:

[0049] Collect student data, including personal information and academic achievements. Based on data sensitivity, classify the student data into different security levels, and each security level is marked with a security level to obtain a hierarchical marking result; based on the hierarchical marking result, specify an encryption algorithm for each security level to obtain an encryption algorithm matching list;

[0050] Using the encryption algorithm matching list, encrypt each security level, process the encryption of personal information and academic achievements separately to obtain an encrypted data set; the encrypted data set is processed in parallel through a multi-core processor architecture, and different data levels are processed by different processing cores;

[0051] Use machine learning to monitor the data stream in real time, detect the deviation from the normal encrypted data model to obtain an abnormal detection model; based on the abnormal detection model, combine with the real-time monitored data stream to analyze abnormal behaviors to obtain an abnormal behavior result;

[0052] According to the abnormal behavior result, dynamically adjust the encryption intensity to obtain an encryption intensity adjustment record.

[0053] The steps for obtaining the hierarchical marking result are as follows:

[0054] Collect the personal information and academic achievements of students, extract the data type, data volume, sensitivity weight, and degree of interaction dependence, establish an initial data matrix, where the rows of the initial data matrix represent different data types and the columns represent the characteristic parameter values, and generate the result of the initial data matrix;

[0055] According to the result of the initial data matrix, calculate the classification score value, and the calculation formula is:

[0056]

[0057] where C i is the classification score value of data item i, x i is the degree of interaction dependence of data item i, y i is the data volume parameter, z i is the sensitivity weight, w i is the weight factor corresponding to the data type, u i is the sensitivity mark of data item i, v i is the standard threshold associated with the sensitivity mark u i is the constraint factor of the data type; i

[0058] According to the classification score value, divide the data into different security levels according to the preset classification threshold rule to obtain the level marking result.

[0059] Specifically, based on the previously obtained personal information and academic achievements of students, read elements such as name, student ID, and major field in the personal information, as well as score records in the academic achievements. Compare each piece of information with the established data structure for field name and numerical type. If the number of characters in the name is less than 1 or greater than 30, perform corresponding indexing and correction through the previously recorded list of personnel. If the student ID is not an 8-digit number, refer to the original registration form to update the corresponding item of the student ID. Check the score values within the range of 0 to 150 points. If a score outside this range is found, check the previously recorded data to identify any input errors or omissions. After corresponding all fields with the previously confirmed characteristic parameter index table, check the values of the personal information for the sensitivity index and interaction dependence index item by item. Arrange the name, student ID, major information, and corresponding score fields in a row-column form into a matrix data structure, where the rows represent data types such as personal basic information and academic achievements, and the columns correspond to characteristic parameters such as sensitivity weight, data volume size, and degree of interaction dependence. Each field occupies a coordinate position in this matrix and is accompanied by corresponding detection records, thus initially forming an overall matrix information data set. Subsequently, for record items with higher sensitivity or more complex interaction dependence, combine the previously summarized interaction requirement comparison table and mark them as the key points for subsequent attention. Finally, complete the merging and summarization of all item information to generate the result of the initial data matrix.​

[0060] The advantage of the formula is that it can integrate the degree of interactive dependence, data sensitivity, and sensitivity marking deviation, etc. into the same quantitative value, so as to provide a more intuitive score comparison in the subsequent security level division;

[0061] x i The acquisition steps of x are as follows: monitor the degree of interactive dependence of data item i, count the total number of times data item i is associated and accessed in the system through the previously obtained interaction log, which is recorded as 30 times, and at the same time record the total daily interaction times of the system as 200 times, so as to calculate the numerical value of the interactive dependence degree of this item

[0062] y i The acquisition steps of y are as follows: count the total amount of data actually stored and transmitted for this data item. After being recorded by the monitoring tool, a data volume of 200KB is obtained and converted into a dimensionless index y with reference to the established scale i = 200;

[0063] z i The acquisition steps of z are as follows: the sensitivity weight is selected as 0.8 for the corresponding item by comparing the potential impact level of this data item in this professional category through the previously sorted sensitivity list;

[0064] w i The acquisition steps of w are as follows: the weight factor corresponding to the data type is obtained by counting the importance of this type in the professional system, and it is set to 1.2 with reference to the previously collected weight evaluation table;

[0065] u i and v i The acquisition steps of u i is the sensitivity marking of data item i, and the numerical value 3 is obtained by recording the depth of privacy touched by the content of the data item. v i is the standard threshold associated with the sensitivity marking u i Through the analysis of the sensitivity detection threshold distribution of similar data, the value is confirmed to be 2;

[0066] k i The acquisition steps of k are as follows: the constraint factor of the data type is statistically analyzed in combination with the proportion of this type of data in system access control and risk management and control, and it is set to 1;

[0067] Calculation process:

[0068] First step, substitute the above parameters into the formula:

[0069]

[0070] Second step, add up the above results:

[0071] 5.625×10 -7 +0.4445 + 1 ≈ 1.4445005625

[0072] Step 3: Take the square root of it:

[0073]

[0074] The result shows that the classification score value for data item i is approximately 1.202, indicating that when making security level divisions for different data items subsequently, this data item can be included in the higher-priority monitoring scope, and the score value can be compared with other data items to make a more refined distinction in terms of sensitivity and interaction frequency, thereby making a more refined security level distinction.

[0075] According to the classification score values obtained previously, first arrange the scoring results of all data items, extract the interval reference between the minimum and maximum scores, and scan the distribution therein. If the score value is between 0.5 and 1.0, it is marked as the medium-sensitivity range; if the score value is less than 0.5, it is marked as the low-sensitivity range; if the score value exceeds 1.0, it is marked as the high-sensitivity range. Then, in combination with the established security level thresholds, determine the corresponding security levels by comparing each score value with the threshold definition criteria. The specific values of the security level thresholds are based on the previously extracted industry supervision requirements and the actual operation of the system, including statistical analysis of the user's historical access logs, recording the access frequency, access paths, and the number of security warnings for each data item in the past 180 days, and then calculating the sensitivity fluctuation range for the same type of data, and comprehensively determining each classification threshold based on the sensitivity mean and range. For example, set the low-sensitivity classification threshold to 0.5, the medium-sensitivity classification threshold to 1.0, and the high-sensitivity classification threshold to 1.5, and update and compare them periodically to adapt to the dynamically changing system access requirements. When comparing the score of each data item with these thresholds, those less than 0.5 are uniformly classified into the low-sensitivity level, those between 0.5 and 1.0 are classified into the medium-sensitivity level, those greater than 1.0 are classified into the high-sensitivity level, and those exceeding 1.5 are marked as the extremely high-sensitivity group, finally forming the security level marking results corresponding to each data item.

[0076] The steps to obtain the encryption algorithm matching list are as follows:

[0077] Based on the hierarchical marking results, calculate the encryption algorithm strength, and the calculation formula is:

[0078]

[0079] Among them, E i represents the encryption algorithm strength selected for the i-th layer, α is the adjustment coefficient of the security requirement level of layer i, Li is the security requirement level, γ is the reaction sensitivity to adjust the sensitivity deviation, and S i is the sensitivity index of level i, and T is the sensitivity threshold;

[0080] According to the strength of the encryption algorithm, an encryption algorithm is assigned to each security level. AES-128, AES-192, or AES-256 is selected according to the high or low strength of the encryption algorithm to obtain an encryption algorithm matching list.

[0081] Specifically, the advantage of the formula is that it combines key factors such as the security requirement level, sensitivity deviation, and sensitivity threshold into a unified strength calculation formula. By quantifying and comprehensively considering these parameters, the evaluation of the encryption algorithm strength can be made more targeted;

[0082] The steps to obtain α are as follows: Based on the number of intrusion events of level i in the past three months in the previously obtained level marking result, compare it with the average number of attacks of the same-level layers. By converting the ratio of the statistically accumulated number and the average number of actual records, a value that can reflect the security requirements of this level is obtained, and it is used as the reference source of α. After comparing this ratio with the industry benchmark, α = 1.8 is obtained;

[0083] L i The steps to obtain it are as follows: The security requirement level is based on the access control permissions registered in this level before. Add the number of key resources listed in the access control and the risk value it may cause. After statistically integrating the risk alarm information that occurred within 30 days, the security requirement level L of this level is obtained i = 3;

[0084] The steps to obtain γ are as follows: To adjust the reaction sensitivity to the sensitivity deviation, it is necessary to compare the distributions of different sensitivity indices at the same level, extract the maximum fluctuation range and analyze it with the handling situation of past sensitive events. Statistically count the number of triggered alarms with significantly deviated sensitivity from the normal value in the past quarter, convert the ratio of the number of alarms to the total number of events into the corresponding coefficient, and finally obtain γ = 2.5;

[0085] S i The steps to obtain it are as follows: The sensitivity index of level i is obtained by monitoring the previously accumulated user access and data request records, so as to summarize the interaction ratio of this level on data sensitive items. Specifically, the total number of sensitive interactions found in the records is 45 times, and the total number of interactions is 180 times. Take the ratio and weight it with the sensitivity score of this level to obtain S i = 1.6;

[0086] The steps to obtain T are as follows. The sensitivity threshold is analyzed based on the average value of sensitive data interactions within 90 days according to the sensitivity monitoring benchmarks sorted out previously, and combined with industry security specifications. This threshold is set as T = 1.2;

[0087] Calculation process:

[0088] First step, substitute the above parameters:

[0089] α = 1.8, L i = 3, γ = 2.5, S i = 1.6, T = 1.2

[0090] Second step, first calculate the numerator part:

[0091]

[0092] Total of numerator = 9.353 + 1.58125 ≈ 10.93425

[0093] Third step, calculate the denominator:

[0094] ln(1 + S i ) = ln(1 + 1.6) = ln(2.6) ≈ 0.95551

[0095] Fourth step, find E i :

[0096]

[0097] The result shows that the calculated value of the encryption algorithm strength for level i is approximately 11.441, indicating that a relatively high strength requirement needs to be considered when selecting an encryption strategy for this level. If a higher sensitivity or a higher security requirement level appears subsequently, it can be compared with this value. A value greater than 10 often represents a relatively high security requirement and stronger encryption means are needed, while a value less than 5 represents a relatively low security requirement and a more simplified encryption method can be selected.

[0098] According to the encryption algorithm strength results obtained previously, corresponding encryption methods need to be assigned for each security level. First, select the strength calculation values of each level statistically before, and compare them item by item with the pre-set encryption strength thresholds. For example, consider values below 5 as the low-strength range, values from 5 to 10 as the medium-strength range, and values greater than 10 as the high-strength range. Then, compare the relationship between these values and the corresponding thresholds item by item, and record whether they meet the corresponding interval or exceed the upper limit. When the strength result of a certain level is in the low-strength range, use AES-128 for encryption processing; when the strength falls in the medium-strength range, use AES-192 for encryption processing; when it exceeds the high-strength range, switch to AES-256 for encryption processing. These thresholds are numerical intervals extracted after retrieving the common encryption requirements in similar applications, and are screened by combining the monitoring data of multiple accesses and potential attack warnings that occurred in the local system within the recent 120 days. In addition, the high-risk access records existing in a single level will be compared. For example, check whether there are abnormal behaviors of attempting to access core data more than 10 times in the past month. If the number is higher than this, automatically list the corresponding level as a high-strength candidate list and match the AES-256 encryption scheme. After the screening and assignment processes are executed in sequence, summarize the encryption algorithm schemes corresponding to all levels to obtain an encryption algorithm matching list.

[0099] The steps for obtaining the encrypted data set are as follows:

[0100] Based on the encryption algorithm matching list, select the encryption algorithm for each security level to obtain the encryption scheme corresponding to the security level;

[0101] Based on the encryption scheme corresponding to the security level, perform encryption processing on personal information and academic achievements respectively to obtain the encrypted personal information data set and academic achievement data set;

[0102] Integrate the encrypted personal information data set and academic achievement data set to form a unified encrypted data set.

[0103] Specifically, based on the previously determined encryption algorithm matching list and combined with the security requirement strength registered in the previous text for each security level, AES-128, AES-192 or AES-256 are selected as candidate solutions. First, the strength threshold range recorded in the previous text is retrieved, including the system access frequency distribution and potential threat assessment data for different levels in the past 90 days. The upper limit of the acceptable encryption time overhead corresponding to the level with lower security requirements is set to 50 milliseconds. This value comes from the statistical and measurement process of previous encryption test samples. The time required for encryption and decryption is recorded and the mean plus standard deviation is extracted to obtain a stable interval. The maximum time consumption in this interval is used as the critical value. When the AES-128 algorithm is executed in the test environment and the average encryption and decryption time consumption is measured to be no more than this upper limit, it can be determined that the level can meet the requirements with AES-128. If the measured time consumption is in the range of 50 milliseconds to 100 milliseconds, it means that the corresponding The encryption speed requirement of the level is relatively loose, and then combined with the sensitivity assessment result of the level, if the sensitivity assessment result is greater than the industry's commonly used secondary standard (the standard is obtained by observing the distribution of data sensitivity levels in the past year and comparing its mean with the upper and lower quartiles), then switch to AES-192. When the average encryption and decryption time is measured to exceed 100 milliseconds, it is considered that a higher intensity and more complete response plan is required. At this time, the time monitoring record of AES-256 is compared and it is confirmed that although it may exceed the pre-set encryption speed threshold of the level, the security assessment result of the level has reached the warning line of the high sensitivity level. The warning line is obtained by statistics on data leakage incidents involving the level in the past 180 days. A total of 5 data leakage cases have been confirmed and the consequence assessments caused by them have been recorded, thereby triggering the AES-256 priority. Finally, the most suitable encryption algorithm is selected in the above comparison process to obtain the encryption plan corresponding to the security level.

[0104] Based on the encryption schemes corresponding to the security levels obtained previously, referring to the registered personal information fields of personnel (including name, ID number, home address, etc.) and the overall academic performance information coordinated previously (including exam scores, paper review scores, experimental project ratings, etc.), apply the selected encryption algorithm to the encryption execution process of the corresponding fields. First, in the implementation process, set an encryption mode with a key length of 128 bits, 192 bits, or 256 bits for the personal information fields, record whether there is an excessive increase in the volume of the actually encrypted data, and then, after processing all the personal information fields, perform the same encryption process on each academic performance information item in turn. During this period, conduct interval analysis on the score segments. For example, read and perform grouped encryption operations item by item in the interval from 0 to 150 points. If the average processing duration is lower than the previously set threshold of 200 milliseconds, it is considered that the encryption process is normal. Trace the source of this threshold to the statistical data of the time consumption in the encryption test stage of each professional course. After comparing the distribution of the single encryption operation duration with the security evaluation results in the past two weeks, select the 99th percentile as this threshold. If it is found during the execution that the duration is continuously greater than this value, then call the previously determined highest-strength algorithm to prevent potential data leakage. After both the personal information and academic performance are processed according to the corresponding algorithms, perform an encryption consistency check, including verifying repeated decryption and comparing the matching correctness of the original scores and names, etc. If there is a mismatch, trace the specific encryption and decryption links, re-perform the encryption operation on the relevant fields and record the corresponding values, and then output the encrypted personal information dataset and academic performance dataset that are all completed.

[0105] After all the encryption operations are completed, compare and verify the encrypted personal information dataset and the encrypted academic performance dataset obtained previously item by item, and read the total volume of the encrypted data to determine whether it exceeds the previously set storage capacity limit. This limit value is obtained based on the actual data storage ratio of the server of this system in the past six months. Statistically calculate the total data increase of personal information and academic performance on a weekly basis and extract the peak value, and then combine the weekly average increase to refine approximately 80% of the occupied space as the security redundancy area. When it is confirmed that the integration of the two does not exceed this limit, then merge them according to the field name and content index, make the rows and columns of the encrypted information of the same student correspond, aggregate the personal information items and their academic performance items through unified coding, and then, after the merger is completed, read all the newly generated data rows and perform an encryption identification check. By referring to the previously established key mapping list, match the corresponding-level encryption algorithm and key length to see if it conforms to the management rules of the same type of key distribution. If they are consistent, complete the merger and verification process. If it is found that there is a phenomenon of inconsistent levels or key mappings, then it is necessary to compare the previously stored encryption scheme again to check whether there is an error in the field identification. Finally, generate a unified encrypted dataset.

[0106] The encrypted data set parallelizes the encryption tasks through a multi-core processor architecture. The steps of processing different data levels by different processing cores are as follows:

[0107] Configure the multi-core processor architecture, allocate the encrypted data set to multiple processing cores, and each core is responsible for different data levels for parallel processing to obtain a task allocation scheme;

[0108] Based on the task allocation scheme, each processing core independently processes the allocated data level using a predetermined encryption algorithm, performs encryption operations, and obtains the encryption results of each core;

[0109] Summarize the encryption results of each core to form an encrypted data set.

[0110] Specifically, after configuring the multi-core processor architecture, first, according to the previously registered encrypted data set structure information, the data is initially distinguished according to the security level and data type. Then, corresponding computing load spaces are reserved for each core. During the allocation process, it is necessary to check the previously recorded multi-core utilization rate and compare the average CPU occupancy data for the past month. The average CPU occupancy rate is recorded daily from the first day to the 30th day, and the maximum and minimum values are statistically calculated to distinguish peak and off-peak periods. Then, combined with the importance level numbers of the security levels and the total amount of data, the maximum encrypted data unit volume that can be processed by a single core during peak periods is formulated. By comparing this maximum unit volume with the pre-established allocation upper limit, it is judged whether it is necessary to split high-load data into other cores in layers, and the existing storage I / O throughput records are checked. If it is found in the I / O throughput monitoring that the read / write rate of a certain core exceeds the set threshold of 500 MB per second, then continue to detect whether the processing time of this core within the previous 30 minutes reaches the average level. If it is detected that the processing time exceeds twice the previously set time, then transfer part of the data to be encrypted to the idle core. The 500 MB per second threshold is obtained based on the peak read / write speeds of the server in the past six months and is verified multiple times in combination with the previously collected application access logs. Each data level is allocated to different cores according to the above process, and the allocation results are recorded. Among them, low-sensitivity data is preferentially allocated to cores with lower resource occupancy, and high-sensitivity data is preferentially allocated to cores with shorter stable processing durations. Finally, summarize each allocation entry to complete the task allocation scheme.

[0111] Based on the previously obtained task allocation plan, an independent encryption execution process is carried out for each core. First, all data entries allocated to this core are retrieved, and for each entry, its security level is checked and the corresponding predetermined encryption algorithm is read. For example, in the core where AES-128 was confirmed previously, the corresponding key is read and encryption is performed. Then, the encrypted byte stream is compared with the size of the source data. If the increase exceeds 30% of the set value, it is marked that there may be duplicate encryption or abnormal operations. Then, this comparison process is recorded and the average time taken for encryption execution is continuously monitored. By reading the processing duration of the same type of data within the previous hour and comparing it numerically with the current encryption duration, if the encryption time of the same type of data on this core has exceeded the previously set threshold of 700 milliseconds, the operation order of this core is rearranged, and lightweight and low-sensitivity data entries are processed first. This 700-millisecond threshold is obtained by statistically calculating the average encryption time of the previous 300 tasks, and then the processing variation range of different encryption algorithms under this core is compared to refine this value. In this way of verifying each item one by one and reordering, all data is finally encrypted to obtain the encryption results of each core.

[0112] When summarizing the encryption results of each core, first read the list of completed encrypted entries from the execution records of each core previously, and verify the number of bytes of the encrypted data and the corresponding key version item by item. Then, the batch processing times of all entries are accumulated and compared to avoid a situation where a single core bears a data volume far exceeding that of other cores for too long. If it is found that the total processing duration allocated to a certain core differs by more than 50% of the set value, the historical execution log of this core is checked to further confirm whether it is due to the current high load or a large amount of data heterogeneity. This 50% balance threshold is obtained by statistically analyzing the multi-core allocation deviation situation in the past two weeks, refining the average value and standard deviation, and then making corrections. Subsequently, the encrypted byte stream output by each core is compared with the source data entries one by one to confirm that the content has been encrypted. If the matching degree reaches the total number of item entries registered in the database and there is no record of missed encryption, the summarized encrypted entries are merged in order and the encryption completion time is recorded to form an encrypted data set.

[0113] The steps to obtain the anomaly detection model are as follows:

[0114] Collect the encrypted data features in the real-time data stream, extract the data distribution and traffic trends to obtain the encrypted data features;

[0115] Based on the encrypted data features, use a support vector machine to construct a behavior model, and identify the distribution range of the encrypted features of normal data through the training process to generate an anomaly detection model.

[0116] Specifically, to collect encrypted data features in real-time data streams, first continuously monitor each data packet transmitted in the network channel and extract the packet header information, packet length and encryption tag field, summarize the obtained encryption tag fields and combine them with the transmission rate records to form a preliminary data flow distribution, then check the arrival time and packet size ratio of each data packet one by one, and compare the ratio with the average range of the past seven days. For example, if it is detected that this ratio is usually between 0 and 50 in the past seven days, if the arrival time and size ratio of the current data packet exceeds 50, it is marked as a potential anomaly and continuously tracked. The monitoring of traffic trends relies on counting the number of encrypted data packets every five minutes. If If the statistical results show that the growth rate exceeds the set 30% and occurs three times in a row, it will be compared with the peak period alarm threshold recorded previously. The 30% increase is obtained by counting the historical range of the encrypted data volume per hour, calculating the median and then multiplying it by the corresponding coefficient. When this threshold is exceeded, the distribution focus of this period will be included in the subsequent feature extraction, and then all distribution indicators will be aggregated into an encrypted data distribution set, and the identification fields of the encryption algorithms will be compared based on the accumulated traffic records for one week. If it is found that the proportion of the same algorithm has soared to more than twice the usual level in a short period of time, the phenomenon will be appended to the data feature table, and finally the data distribution and traffic trends will be sorted out and merged into encrypted data features.

[0117] Based on the encrypted data features, when constructing the behavior model using the support vector machine method, the key length, encryption and decryption speed, and data packet arrival frequency are first selected from the encrypted data feature table recorded previously. These fields are used as the input required for model training and each record is labeled normal or suspicious. These labels are generated by comparing the security review results accumulated in the previous month with the corresponding data packet encryption information. Then, the training set and the test set are divided into eight to two ratios and the kernel function is used to map each field to a high-dimensional space. The training set is iteratively learned and the classification accuracy is calculated after each iteration. The accuracy of the previous iteration is compared to determine whether to continue training. The iteration is stopped when the classification accuracy stabilizes in a range higher than the previously determined benchmark value. The benchmark value is the average accuracy obtained after analyzing the normal data distribution in the past two months and a statistically verified confidence interval is added. Finally, the prediction performance of the model for various feature combinations is tested in the test set. If the accuracy is lower than the benchmark value, the corresponding training samples are supplemented and the iteration is repeated. When the classification accuracy of the model in the test set reaches the benchmark value and does not show a significant decrease, the model training is completed and an anomaly detection model is generated.

[0118] The steps to obtain abnormal behavior results are:

[0119] Based on the anomaly detection model and real-time monitoring data flow, the traffic fluctuation rate, time deviation and data distribution anomaly degree are obtained to generate a real-time anomaly feature parameter set;

[0120] Calculate the abnormal behavior score according to the real-time abnormal feature parameter set. The calculation formula is as follows:

[0121]

[0122] where A b is the abnormal behavior score, Q t is the current traffic rate, Q m is the model reference value of the traffic rate, F t is the data deviation factor, T b is the time interval of real-time monitoring, D t is the real-time data distribution eigenvalue, D m is the model reference value of the data distribution;

[0123] Based on the abnormal behavior score, analyze the abnormal behavior of traffic fluctuations or abnormal data distribution. Combine the change trend of the real-time data stream to judge the type and risk level of the abnormal behavior, and obtain the abnormal behavior result.

[0124] Specifically, based on the anomaly detection model and the real-time monitored data stream, first read the traffic changes of all data streams in the past three days from the existing monitoring records, organize them by hour, compare the amount of transmitted bytes per hour with that of the previous hour to obtain the traffic volatility, and then compare the arrival time of the encrypted data packets recorded per hour with the planned time point to calculate the time deviation. Compare the calculated time deviation value with the previously collected normal range. When it is found that the deviation value is higher than the preset threshold of 5 seconds set above, it is marked as abnormal. Subsequently, check each item of the encryption protocol type involved in the data distribution one by one. By statistically counting the TLS handshake success rate, the AES usage ratio, and the key exchange rate one by one, compare these statistics with the stable distribution situation of the previous week. When it is found that a certain indicator shows an obvious deviation exceeding 40%, it is identified as a relatively high degree of data distribution abnormality, and it is necessary to further link the log records to query the specific reason. This 40% is established by extracting the average value of the fluctuation range of the encryption protocol distribution within 90 days in the front and adding twice the standard deviation. When the volatility of each item, the time deviation, and the distribution abnormality value are finally confirmed, integrate them to form a real-time abnormal feature parameter set.

[0125] The advantage of the formula is that it incorporates the deviation degree between the current traffic rate and the model reference value, the influence of the data deviation factor within the monitoring time interval, and the difference degree of the real-time data distribution eigenvalue into a comprehensive metric, and can reflect the comprehensive intensity of the current network traffic anomaly in numerical form;

[0126] Q tThe acquisition steps of are as follows: for the current traffic rate, read the total number of transmitted bytes every five minutes and convert it into the number of bytes per second on average. After recording this value, compare it with the previous cycle and retain the value of the latest cycle. After denoising and weighted averaging of nearly 120 records, take the average transmission rate of a certain five-minute section as Q t , where Q t = 280;

[0127] Q m The acquisition steps of are as follows: the model reference value of the traffic rate is obtained by refining the network operation monitoring data of the past seven days. Filter out the traffic average value in the stage without abnormal behavior, and obtain Q after multiple segmented statistics m = 220;

[0128] F t The acquisition steps of are as follows: the data deviation factor is comprehensively considered based on various parameters such as the recent abnormal rate of the encryption protocol, encryption duration, and the number of decryption verification errors. Select the part that can best reflect the immediate difference as the weight summation, and finally obtain F t = 6. The specific process is to record the number of decryption verification errors in segments within the last three days and combine it with the encryption duration distribution curve to calculate a deviation cumulative value, and then normalize it after weighting with various parameters;

[0129] T b The acquisition steps of are as follows: the time interval of real-time monitoring is executed through the previously set ten-minute interval, which is determined with reference to the server resource utilization rate and inspection frequency, and is selected as T after multiple actual measurements b = 10;

[0130] D t and D m The acquisition steps of are as follows: D t is the current real-time data distribution characteristic value, which is calculated by monitoring the proportion of TLS handshake requests, AES negotiation times, and other encryption flag bits. The proportion is statistically 1.3 within the last hour and is set as D after correction in combination with the key exchange success rate t = 1.3, D m is the model reference value of the data distribution, which is selected as D after repeated comparison with the previously stored anomaly-free sample data m = 1.0;

[0131] Calculation process:

[0132] First step, substitute the above parameters:

[0133] |Q t -Q m | 2 = |280 - 220| 2 = 60 2= 3600

[0134]

[0135] |D t -D m | = |1.3 - 1.0| = 0.3

[0136] ln(1 + 0.3) = ln(1.3) ≈ 0.26236

[0137] Step 2: Add the above calculation results:

[0138] 3600 + 3.6 + 0.26236 = 3603.86236

[0139] Step 3: Take the square root of it:

[0140]

[0141] This result indicates that the abnormal behavior score is approximately 60.03, indicating that the current traffic rate has significant fluctuations compared to the baseline value and the data distribution characteristics deviate from the model average. When the score value is greater than 30, it often indicates a certain degree of network anomaly, and it is necessary to strengthen monitoring or take corresponding risk disposal measures in the subsequent process. If it is lower than 10, it indicates that the network traffic state is basically stable and there is no need for additional inspection.

[0142] Based on the abnormal behavior score, first read the current score value from the previously generated real-time abnormal feature parameter set, and compare it with the previously statistically determined network abnormal level classification criteria. For example, when comparing the distribution of all abnormal behavior scores in the past 30 days in the previous text, it was extracted that scores in the range of 10 to 50 mainly corresponded to mild abnormalities, scores in the range of 50 to 80 mainly corresponded to moderate abnormalities, and scores above 80 corresponded to high abnormalities. This level classification was based on sorting out various traffic fluctuation and data distribution abnormal cases in the past month and setting interval thresholds. For example, when the score exceeded 50 but did not exceed 80, it was included in the moderate abnormal type, and if the score was greater than 80, it was classified into the high abnormal type. Subsequently, track the traffic fluctuation information corresponding to the score result, view the transmission rate curve in the last hour and compare it with the previously recorded reference bandwidth interval, which was obtained by combining the normal traffic mean and three times the standard deviation in the past two weeks. When it was found that there was a continuous segment where the transmission rate exceeded this interval, further trace factors such as the access source address and encryption method through the registered network logs, and then perform superposition analysis on the data distribution abnormal indicators. For example, check whether the number of encryption and decryption requests increased synchronously in the same time period and compare it with the preset threshold of 100 encryption and decryption requests per minute set previously. This threshold was selected based on the mean statistics in a week and considering the peak and valley distribution. When it was detected three times in a row that the threshold was exceeded, this behavior was determined to be frequent encryption and decryption abnormality. After superimposing the score value with these abnormal features, perform type determination. For example, if the traffic increased significantly but the encryption and decryption rate was stable, it was regarded as bandwidth abnormality, and if the traffic increased and encryption and decryption abnormality occurred simultaneously, it was classified as high-risk abnormality. Finally, output the corresponding abnormal behavior result in combination with the risk level judgment result.

[0143] The steps for obtaining the encryption intensity adjustment record are as follows:

[0144] Based on the abnormal behavior result, extract the risk indicators associated with the encryption policy, including the frequency of tampering attempts, the intensity of traffic abnormality, and the deviation of data integrity, to obtain the risk assessment input parameter set;

[0145] According to the risk assessment input parameter set, calculate the risk level score, and the calculation formula is:

[0146]

[0147] Among them, R s is the risk level score, P a is the frequency of tampering attempts, T r is the time window length, F d is the current traffic abnormality intensity, F m is the model reference traffic intensity, D a is the deviation of data integrity;

[0148] Dynamically adjust the current encryption according to the risk level score. When the risk level score exceeds the preset risk threshold, upgrade the encryption algorithm strength to obtain an encryption strength adjustment record.

[0149] Specifically, based on the abnormal behavior results, first screen out the entries containing tampering attempt information, traffic detection data, and integrity verification results from the previously obtained encryption-related monitoring records. Arrange these entries in the order of their occurrence time, and compare the number of occurrences of each entry in the most recent seven days. Then, compare the tampering attempt frequency in each entry with the mean value within this range. For example, if the mean value is approximately 5 times per day and there are more than 20 tampering attempts on a certain day, it is determined that it conforms to the previously set high-frequency threshold for tampering. This high-frequency threshold is obtained by combining the tampering behavior statistics of the previous three months, counting the daily distribution of tampering attempt times and taking the mean value plus twice the standard deviation, and the result is agreed upon as this threshold. Then, compare the difference between the abnormal traffic intensity and the historical normal traffic. For example, select the interval between the traffic mean value and the maximum value in the same period of the past month. If the current traffic shows abnormal phenomena of being too high or too low within a unit hour, record its corresponding abnormal amplitude and check whether it is higher than a 30% increment. This increment definition process is determined by calculating the traffic fluctuation amplitude in the recent month, selecting the median, and adding an appropriate interval value. Subsequently, it is also necessary to check the data integrity deviation term. For each encrypted data, perform decryption verification. If the verification value after decryption is inconsistent with the original record for several consecutive times, integrate these results and extract the data integrity deviation ratio within this time period. Compare it with the previously established 5% threshold. This 5% is set based on the error probability measurement results of the security department for previous encryption systems. When the deviation ratio is greater than 5%, it is marked as deviation exceeding the limit and added to the final parameter set to be evaluated. Combine all these bases, gather all the records, and summarize risk indicators such as tampering attempt frequency, traffic abnormal intensity, and data integrity deviation to finally obtain a risk assessment input parameter set.

[0150] The advantage of the formula is that it combines three aspects: tampering attempt frequency, traffic abnormal intensity, and data integrity deviation, and combines square, absolute value, and logarithmic operations under the constraint of the time window length, enabling the risk level score to more sensitively reflect the impact of high-frequency attacks and large-scale traffic anomalies on the system;

[0151] P a The acquisition steps of are as follows: Statistically analyze all tampering behavior warnings within the past 24 hours, extract the time periods and frequencies of tampering events in the network audit records, compare with the tampering baseline frequency during normal time periods, accumulate this value through consecutive multi-day log records and perform cleaning, and finally obtain after removing false alarms caused by configuration updates. a = 12;

[0152] T r The acquisition steps of T are as follows: The time window length comes from the shortest analysis interval during the security patrol of this system. After the staff measures the average number of logs and the patrol efficiency, T is selected r = 24, indicating a 24-hour window;

[0153] F d The acquisition steps of F are as follows: The current traffic anomaly intensity refers to the deviation degree between the traffic peak within the recent 12 hours and the baseline. After summarizing the monitoring results per hour and comparing them with the previous normal distribution, the deviation amount is extracted and quantified into a single value to obtain F d = 0.8;

[0154] F m The acquisition steps of F are as follows: The model baseline traffic intensity is obtained by statistically analyzing the normal traffic in the same period of the previous week. After calculating the mean value of the collected data, it is denoted as F m = 0.5;

[0155] D a The acquisition steps of D are as follows: The data integrity deviation is obtained according to the proportion of error decryption events detected within the above time window. Each time a decryption verification fails, the failure rate is incorporated into the deviation cumulative value and normalized, and D is obtained after comparing with the historical average mismatch rate a = 0.2;

[0156] Calculation process:

[0157] First step, substitute the above parameters:

[0158]

[0159] |F d -F m | = |0.8 - 0.5| = 0.3

[0160]

[0161] ln(1 + 0.04) = ln(1.04) ≈ 0.03922

[0162] Second step, add the above calculation results:

[0163] 6 + 0.3 + 0.03922 = 6.33922

[0164] Third step, take the square root of it:

[0165]

[0166] The result shows that the current risk level score is approximately 2.52, indicating that the combined impact of the tampering frequency, traffic anomaly degree, and data integrity deviation monitored within this time window is still in a range slightly above medium. Usually, it will be compared with the previously defined score threshold. If this value exceeds 3, it means the risk is relatively high and the encryption algorithm strength needs to be upgraded immediately. If the score is below 1, it indicates that the state is basically stable and the existing encryption strategy can continue to be used.

[0167] According to the risk level score, dynamically adjust the current encryption. First, read the just calculated risk level score value and compare it with the previously defined score threshold range. If the score value is between 2 and 3, it is marked as a medium risk. If the detected value exceeds 3, it is regarded as a high risk. When it is determined to be a high risk, it is necessary to check the data interaction volume in the last hour and the number of tampering warnings during this time, and compare the number of tampering warnings with the average daily warning value in the past month to determine whether it is currently in an attack-intensive period. If it exceeds twice the average daily warning value, it is confirmed to be in a high-risk stage. Then, analyze the traffic peak situation. By comparing the range where the traffic of the local server does not exceed 500MB every 5 minutes under normal conditions, when it is detected that it exceeds 500MB this time, it is determined that the traffic peak far exceeds the usual level. The corresponding operation is to upgrade the encryption algorithm strength and record this change action. When recording this change action, the encryption algorithm list will be read to confirm whether to select a higher-bit algorithm, such as switching from AES-192 to AES-256. If the score value is below 1, the encryption level remains unchanged and the current state is recorded as a safe state. Integrate this series of detection and adjustment processes into the encryption strength adjustment record.

[0168] The above is only the preferred embodiment of the present invention, and it is not used to limit the present invention in other forms. Any person skilled in the art may use the disclosed technical content to make changes or modifications into equivalent embodiments with equivalent changes and apply them to other fields. However, as long as it does not depart from the technical solution content of the present invention, any simple modification, equivalent change, and modification made to the above embodiments based on the technical essence of the present invention still fall within the protection scope of the technical solution of the present invention.

Claims

1. A method for encrypting and transmitting student data, characterized in that: The following steps are involved: Collect student data, including personal information and academic performance, and classify the student data into different security levels based on data sensitivity. Each security level is marked as a security level to obtain a level marking result. Based on the level marking results, an encryption algorithm is specified for each security level to obtain an encryption algorithm matching list; Using the encryption algorithm matching list, encryption is implemented for each security level, and the personal information encryption and academic performance encryption are processed separately to obtain an encrypted data set; the encrypted data set uses a multi-core processor architecture to parallelize the encryption tasks and process different data levels through different processing cores; Using machine learning to monitor data streams in real time, detecting deviations from normal encrypted data models, and obtaining an anomaly detection model; based on the anomaly detection model, combined with real-time monitoring of data streams, analyzing abnormal behaviors, and obtaining abnormal behavior results; According to the abnormal behavior result, the encryption strength is dynamically adjusted to obtain an encryption strength adjustment record.

2. The method for encrypting and transmitting student data according to claim 1, characterized in that: The steps for obtaining the hierarchical marking results are: Collect students' personal information and academic performance, extract data types, data volumes, sensitivity weights, and interactive dependencies, and establish an initial data matrix. The rows of the initial data matrix represent different data types, and the columns represent characteristic parameter values, generating initial data matrix results. According to the initial data matrix results, the classification score value is calculated, and the calculation formula is: Among them, C i is the classification score of data item i, x i is the degree of interaction dependence of data item i, y i is the data volume parameter, z i is the sensitivity weight, w i is the weight factor corresponding to the data type, u i is the sensitivity label of data item i, v i For the sensitivity mark u i The standard threshold for association, k i is the constraint factor of the data type; According to the classification score value, the data is divided into different security levels according to the preset classification threshold rule to obtain a level labeling result.

3. The method for encrypting and transmitting student data according to claim 1, characterized in that: The steps for obtaining the encryption algorithm matching list are as follows: Based on the hierarchical marking results, the encryption algorithm strength is calculated using the following formula: Among them, E i represents the strength of the encryption algorithm selected for level i, α is the adjustment coefficient of the security requirement level of level i, and L i is the safety requirement level, γ is the sensitivity of adjusting the response to the sensitivity deviation, S i is the sensitivity index of level i, T is the sensitivity threshold; According to the encryption algorithm strength, an encryption algorithm is assigned to each security level, and AES-128, AES-192 or AES-256 is selected according to the encryption algorithm strength to obtain an encryption algorithm matching list.

4. The method for encrypting and transmitting student data according to claim 1, characterized in that: The steps for obtaining the encrypted data set are: Based on the encryption algorithm matching list, an encryption algorithm is selected for each security level to obtain an encryption scheme corresponding to the security level; Based on the encryption scheme corresponding to the security level, encrypt the personal information and academic performance data sets to obtain encrypted personal information data sets and academic performance data sets; The encrypted personal information data set and academic achievement data set are integrated to form a unified encrypted data set.

5. The method for encrypting and transmitting student data according to claim 1, characterized in that: The encrypted data set uses a multi-core processor architecture to parallelize the encryption tasks. The specific steps of processing different data levels through different processing cores are as follows: Configure a multi-core processor architecture to distribute the encrypted data set to multiple processing cores, with each core responsible for processing different data levels in parallel to obtain a task allocation plan; Based on the task allocation scheme, each processing core independently processes the allocated data level using a predetermined encryption algorithm, performs encryption operations, and obtains encryption results of each core; Summarize the encryption results of each core to form an encrypted data set.

6. The method for encrypting and transmitting student data according to claim 1, characterized in that: The steps for obtaining the anomaly detection model are: Collect encrypted data features in real-time data streams, extract data distribution and traffic trends, and obtain encrypted data features; Based on the encrypted data features, a behavior model is constructed using a support vector machine, and the distribution range of the encrypted features of normal data is identified through a training process to generate an anomaly detection model.

7. The method for encrypting and transmitting student data according to claim 1, characterized in that: The steps for obtaining the abnormal behavior result are: Based on the anomaly detection model and real-time monitoring data flow, the flow fluctuation rate, time deviation and degree of data distribution anomaly are obtained to generate a real-time anomaly feature parameter set; According to the real-time abnormal feature parameter set, the abnormal behavior score is calculated, and the calculation formula is: Among them, A b Score abnormal behavior, Q t is the current traffic rate, Q m is the model reference value of the flow rate, F t is the data deviation factor, T b is the time interval of real-time monitoring, D t is the real-time data distribution characteristic value, D m is the model benchmark value of the data distribution; Based on the abnormal behavior score, the abnormal behavior of traffic fluctuation or abnormal data distribution is analyzed, and the type and risk level of the abnormal behavior are determined in combination with the change trend of the real-time data flow to obtain the abnormal behavior result.

8. The method for encrypting and transmitting student data according to claim 1, characterized in that: The steps for obtaining the encryption strength adjustment record are: Based on the abnormal behavior results, extract risk indicators associated with the encryption policy, including tampering attempt frequency, traffic anomaly intensity, and data integrity deviation, to obtain a risk assessment input parameter set; According to the risk assessment input parameter set, the risk level score is calculated using the following formula: Among them, R s is the risk level score, P a is the tampering attempt frequency, T r is the time window length, F d is the current traffic anomaly intensity, F m is the model benchmark flow intensity, D a is data integrity deviation; According to the risk level score, the current encryption is dynamically adjusted. When the risk level score exceeds a preset risk threshold, the encryption algorithm strength is upgraded to obtain an encryption strength adjustment record.

Images