A hybrid cloud-based information security management and control method and system

Abstract

The present invention relates to the field of information security technology, and in particular to an information security management and control method and system based on a hybrid cloud. The method includes: dividing data into multiple data blocks of unfixed size; obtaining attribute feature data of the data blocks and performing normalization processing, the attribute feature data including sensitivity, access frequency, business attributes and data block size; using a random forest model to determine the weight data of each attribute feature, constructing an interest matrix based on the attribute feature data and the weight data of the attribute features, and generating a judgment strategy based on the interest matrix to obtain a judgment strategy matrix; based on the judgment strategy matrix, judging the storage location of the corresponding data block. The present invention determines whether the data blocks should be stored in a private cloud or a public cloud by dividing the data into data blocks of different sizes and fusing multiple attribute features of the data blocks, thereby achieving more efficient and secure data management.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and in particular to a hybrid cloud-based information security management and control method and system. Background Art

[0002] In recent years, enterprises across various industries in my country have been leveraging emerging technologies such as cloud computing and artificial intelligence to improve productivity, innovation, and resource utilization during industrial transformation, driving changes in development models and laying a solid foundation for digital transformation. Cloud computing is a next-generation information technology and a fundamental tool for digital transformation. With the continuous advancement of cloud computing technology and the increasing demand for digital transformation, enterprise data has experienced explosive growth, and object storage has become an essential data storage method in many business scenarios. Against the backdrop of the rapid development of cloud computing technology, many public and private clouds have begun to offer a variety of distributed object storage services.

[0003] Initially, cloud computing operated solely within enterprise networks, raising relatively minor privacy and security concerns. However, as cloud computing has evolved, these issues have become a significant stumbling block to its widespread adoption. Currently, cloud service providers offer limited privacy and security protections to users, leading to a host of security issues. Summary of the Invention

[0004] In order to solve the above technical problems, the present invention proposes a hybrid cloud-based information security management and control method and system to solve at least one of the above technical problems.

[0005] This application provides a hybrid cloud information security management method, the method comprising:

[0006] Step S1, dividing the data into multiple data blocks of unfixed sizes by extracting data blocks of unfixed sizes;

[0007] Step S2: Acquire attribute characteristic data of the data block and perform normalization processing to obtain normalized attribute characteristic data values, wherein the attribute characteristic data includes sensitivity, access frequency, business attributes, and data block size;

[0008] Step S3: using a random forest model to determine weight data for each attribute feature, constructing a benefit matrix based on the attribute feature data values ​​and the weight data of the attribute features to obtain a benefit matrix for the attribute features, and generating a judgment strategy based on the benefit matrix to obtain a judgment strategy matrix;

[0009] Step S4: Based on the judgment strategy matrix, determine the storage location of the corresponding data block. If the element in the judgment strategy matrix is ​​greater than or equal to the element in the corresponding preset scoring threshold matrix, store the corresponding data block in the private cloud; otherwise, store it in the public cloud.

[0010] Step S5: monitor the changes in the attribute characteristics of the data block in real time, and dynamically adjust the weight and scoring threshold.

[0011] Preferably, step S1 includes:

[0012] Step S11: setting a random number and limiting the value range of the random number;

[0013] Step S12: using the random number sequence generated within the value range as the extraction position increment;

[0014] Step S13: Based on the current byte position plus the extraction position increment, the position of the next extracted byte is obtained until the position of the next extracted byte is larger than the size of the data block;

[0015] Step S14: extract the data between the current byte position and the position of the next extracted byte as a small data block, and the remaining data as a large data block.

[0016] Preferably, the step S2 includes:

[0017] identifying sensitive data in the data block using a regular expression, and classifying the sensitive data into low sensitivity, medium sensitivity, and high sensitivity based on a preset first scoring system;

[0018] Obtaining statistically the access frequency of each data block based on the access log of the database, and classifying the access frequency of the data block into low access frequency, medium access frequency, and high access frequency based on a preset second scoring system;

[0019] Based on predefined rules, a decision tree is used to classify business attributes into critical business and non-critical business;

[0020] The sensitive data, access frequency, business attributes and data block size are normalized using the Min-Max method. The specific formula is as follows:

[0021]

[0022] Among them, x is the attribute feature data value, 、 are the maximum and minimum values ​​of the attribute feature data values, is the normalized attribute feature data value.

[0023] Preferably, the step S3 includes:

[0024] The weight data of the attribute features are pre-processed and divided into a training set and a test set, wherein the training set is used to build a random forest model, and the test set is used to evaluate the performance of the model. After the random forest model training is completed, the importance scores of the attribute features are obtained as the weight data of the attribute features;

[0025] Multiplying the normalized attribute feature data value by the corresponding attribute feature weight data to obtain a weighted value for each attribute feature, and constructing an attribute feature interest matrix based on the weighted value;

[0026] The weighted values ​​of all the attribute features are added together to obtain the weighted values ​​of the attribute features after fusion of the data blocks, and a judgment strategy matrix for each data block is constructed based on the weighted values ​​of the attribute features after fusion of the data blocks.

[0027] Preferably, the step S4 includes:

[0028] Creating a scoring threshold matrix having the same dimensions as the judgment strategy matrix, wherein the elements of the scoring threshold matrix are pre-set;

[0029] Element-by-element comparison, traversing each element of the judgment strategy matrix and the preset scoring threshold matrix, and comparing them one by one;

[0030] If an element in the judgment strategy matrix is ​​greater than or equal to a corresponding element in the scoring threshold matrix, the data block corresponding to the element in the judgment strategy matrix should be stored in the private cloud; otherwise, the data block should be stored in the public cloud.

[0031] In a second aspect, the present invention provides a hybrid cloud-based data security management and control system, the system comprising:

[0032] The data segmentation module extracts data blocks of unfixed sizes and divides the data into multiple data blocks of unfixed sizes;

[0033] an attribute feature data acquisition module, which acquires the attribute feature data of the data block and performs normalization processing to obtain normalized attribute feature data values, wherein the attribute feature data includes sensitivity, access frequency, business attributes, and data block size;

[0034] A judgment strategy matrix generation module uses a random forest model to determine weight data for each attribute feature, constructs a benefit matrix based on the attribute feature data values ​​and the weight data of the attribute features to obtain a benefit matrix for the attribute features, and generates a judgment strategy based on the benefit matrix to obtain a judgment strategy matrix;

[0035] A decision module, based on the judgment strategy matrix, determines the storage location of the corresponding data block, and if an element in the judgment strategy matrix is ​​greater than or equal to an element in the corresponding preset scoring threshold matrix, stores the corresponding data block in the private cloud; otherwise, stores the corresponding data block in the public cloud;

[0036] The dynamic adjustment module is used to monitor the changes in the attribute characteristics of the data block in real time and dynamically adjust the weight and scoring threshold.

[0037] In a third aspect, an electronic device is provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, a hybrid cloud-based information security management method as provided in the first aspect is implemented.

[0038] The present invention aims to achieve more efficient and secure data management by segmenting data into randomly sized data blocks and obtaining multi-dimensional attribute characteristics of the data blocks, such as sensitivity, access frequency, business attributes, and data block size. A random forest model is used to determine weight data for each attribute characteristic. A benefit matrix is ​​constructed based on the attribute characteristic data values ​​and the attribute characteristic weight data to obtain the attribute characteristic benefit matrix. A judgment strategy is generated based on the benefit matrix to obtain a judgment strategy matrix. Based on the judgment strategy matrix, the storage location of the corresponding data block is determined. If an element in the judgment strategy matrix is ​​greater than or equal to an element in a corresponding preset scoring threshold matrix, the corresponding data block is stored in a private cloud; otherwise, it is stored in a public cloud. By segmenting data into data blocks of different sizes and integrating multiple attribute characteristics of the data blocks, the decision on whether the data blocks should be stored in a private cloud or a public cloud is made. Furthermore, by monitoring the changes in the attribute characteristics of the data blocks in real time, the weights and scoring thresholds are dynamically adjusted to obtain different judgment strategy matrices, ultimately achieving real-time changes in the storage location of the data blocks. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Other features, objects and advantages of the present application will become more apparent upon reading the detailed description of non-limiting embodiments made with reference to the following drawings:

[0040] Figure 1 A hardware structure block diagram of a mobile terminal of a hybrid cloud-based information security management and control method according to an embodiment is shown;

[0041] Figure 2 A flowchart showing the steps of a hybrid cloud-based information security management and control method according to an embodiment is shown;

[0042] Figure 3 A flowchart showing step S3 of an embodiment is shown;

[0043] The purpose, features and advantages of the present invention will be further described with reference to the accompanying drawings and in conjunction with the embodiments. DETAILED DESCRIPTION

[0044] To make the purpose, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. It should be understood that the specific implementation methods described herein are only used to illustrate and explain the embodiments of the present application and are not used to limit the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0045] It should be noted that if the embodiments of the present application involve directional indications (such as up, down, left, right, front, back, etc.), such directional indications are only used to explain the relative position relationship, movement status, etc. between the various components under a certain specific posture (as shown in the accompanying drawings). If the specific posture changes, the directional indication will also change accordingly.

[0046] In addition, if there are descriptions involving "first", "second", etc. in the embodiments of the present application, the descriptions of "first", "second", etc. are only for descriptive purposes and cannot be understood as indicating or implying their relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of such features. In addition, the technical solutions between the various embodiments can be combined with each other, but they must be based on the fact that they can be implemented by ordinary technicians in this field. When the combination of technical solutions is contradictory or cannot be implemented, it should be deemed that such a combination of technical solutions does not exist and is not within the scope of protection required by this application.

[0047] The method embodiments provided in the embodiments of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Taking running on a mobile terminal as an example, Figure 1 This is a hardware structure diagram of a mobile terminal of a hybrid cloud-based information security management method according to an embodiment of the present invention. Figure 1 As shown, the mobile terminal may include one or more ( Figure 1 Only one is shown) a processor 102 (the processor 102 may include but is not limited to a microprocessor MCU or a programmable logic device FPGA and other processing devices) and a memory 104 for storing data. The mobile terminal may also include a transmission device 106 and an input / output device 108 for communication functions. It will be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the mobile terminal. Figure 1More or fewer components than shown, or with Figure 1 Different configurations shown.

[0048] The memory 104 can be used to store computer programs, for example, software programs and modules of application software, such as a computer program corresponding to a data information security protection method in an embodiment of the present invention. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, that is, implementing the above-mentioned method. The memory 104 may include a high-speed random access memory and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include a memory remotely located relative to the processor 102, and these remote memories may be connected to the mobile terminal via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0049] Transmission device 106 is used to receive or transmit data via a network. A specific example of the aforementioned network may include a wireless network provided by the mobile terminal's communications provider. In one embodiment, transmission device 106 includes a network interface controller (NIC), which can be connected to other network devices via a base station to enable communication with the Internet. In another embodiment, transmission device 106 may be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0050] A flow chart of a hybrid cloud-based information security management and control method according to an embodiment of the present application is shown in the attached figure. Figure 2 As shown, an embodiment of the present application provides an information security management and control method based on a hybrid cloud, which includes the following steps:

[0051] Step S1, dividing the data into multiple data blocks of unfixed sizes by extracting data blocks of unfixed sizes;

[0052] In this embodiment, the data segmentation mechanism divides the data into blocks on the client and encrypts and transmits them to the storage server on the network. This new mechanism separates data management and data ownership, and can prevent information leakage from third parties in the application.

[0053] The basic idea behind the data partitioning mechanism is to divide data into b blocks. Data can only be restored when a (a is less than or equal to b) blocks are complete. This means that even if any b blocks are lost or damaged, the original data can be restored, enhancing the reliability and availability of the mechanism. If fewer than a blocks are stolen, the original data cannot be restored, thus improving security.

[0054] The data segmentation process can be found in the attached Figure 3 Specifically, the data segmentation includes:

[0055] Step S11: setting a random number and limiting the value range of the random number;

[0056] In this embodiment, different programming languages ​​have different random functions. For example, in JavaScript, you can use the Math.random() function to generate random numbers. In Java, you can use the java.util.Random class to generate random numbers. In C++, you can use <cstdlib>and <ctime>Libraries to generate random numbers;

[0057] Step S12: using the random number sequence generated within the value range as the extraction position increment;

[0058] In this implementation, the entire process is to use random numbers to adjust the position of the element being drawn after generating them. For example, suppose you want to randomly draw an element from an array of length 100, but the position of each draw is not fixed, but has a random offset. For example, first determine a range, such as 0 to 99, and then generate a random number, such as 5. Then the position of the element being drawn is the current position plus 5, so you can draw elements in a loop;

[0059] Step S13: Based on the current byte position plus the extraction position increment, the position of the next extracted byte is obtained until the position of the next extracted byte is larger than the size of the data block;

[0060] In this embodiment, the current byte position is first determined: assuming there is a starting position representing the current position in the data block; a position increment is extracted: based on the random number sequence, a random number in the random number sequence is used as the position increment. For example, assuming the current byte position is current_pos and the extraction position increment is increment, the position of the next byte to be extracted is next_pos = current_pos + increment. The current byte position is updated: current_pos is updated to next_pos, and next_pos is checked to see if it is within the valid range of the data block (i.e., next_pos < data block size). The above process (generating increments, updating positions, and checking ranges) is repeated until next_pos exceeds the size of the data block. If next_pos exceeds the size of the data block, the extraction process is terminated.

[0061] Step S14: extract the data between the current byte position and the position of the next extracted byte as a small data block, and the remaining data as a large data block.

[0062] In this embodiment, the data between the current byte position and the next extracted byte position is extracted as a small data block, and the remaining data is used as a large data block. Assume there is a data block of N bytes, the current byte position is current_pos, and the next extracted byte position is next_pos. Then, the size of the small data block should be next_pos - current_pos bytes, and the size of the large data block should be N - (next_pos - current_pos) bytes.

[0063] Data segmentation technology allows for data separation. High data security is achieved by storing data in blocks, preventing attackers from obtaining complete metadata to retrieve all data blocks and recover the large data block. Therefore, data segmentation further ensures the privacy and security of cloud data.

[0064] Step S2: Acquire attribute characteristic data of the data block and perform normalization processing to obtain normalized attribute characteristic data values, wherein the attribute characteristic data includes sensitivity, access frequency, business attributes, and data block size;

[0065] In this embodiment, regular expressions are used to identify sensitive data in the data block, and based on a preset first scoring system, the sensitive data is classified into low sensitivity, medium sensitivity, and high sensitivity;

[0066] First, clarify the types of sensitive data that need to be identified, such as: Personally Identifiable Information (PII): ID number, passport number, social security number, etc. Contact information: phone number, email address, address, etc. Financial information: credit card number, bank account number, transaction record, etc. Health information: medical records, medical records, etc. Preset the first scoring system: According to the nature and leakage risk of sensitive data, it is divided into three sensitivity levels: Low sensitivity: low leakage risk and small impact. For example, partially public contact information. Medium sensitivity: leakage may have a certain impact on individuals or organizations. For example, partial fields of an ID number. High sensitivity: leakage may cause serious losses to individuals or organizations. For example, a complete ID number, credit card number, etc. According to different sensitive data types, write corresponding regular expressions, traverse the content in the data block, and use regular expressions to match sensitive data.

[0067] Obtaining statistically the access frequency of each data block based on the access log of the database, and classifying the access frequency of the data block into low access frequency, medium access frequency, and high access frequency based on a preset second scoring system;

[0068] In this embodiment, the access log records the access information of the data blocks in the database, including timestamp, visitor, operation type and data block identifier, etc.; determine the log format: understand the structure of the access log and identify the location and meaning of each field. Extract the data block identifier: extract the data block identifier corresponding to each access record from the log for subsequent statistics. Read the access log one by one and update the corresponding counter according to the data block identifier. Count the number of times each data block is accessed within a specific time period, such as daily, weekly or monthly; set thresholds: set low, medium and high access frequency thresholds based on the preset second scoring system. For example: low access frequency: less than 10 times a day; medium access frequency: 10 to 100 times a day; high access frequency: more than 100 times a day.

[0069] Based on predefined rules, a decision tree is used to classify business attributes into critical business and non-critical business;

[0070] In this embodiment, the service attributes of the parsed data are described. Service attributes refer to characteristics or properties related to the service, for example:

[0071] Business type (such as order processing, customer inquiries, payment transactions, etc.). Business amount involved. Business impact (such as the number of customers and departments involved). Business urgency (such as whether it is a real-time transaction or a high-priority task). Choose an appropriate algorithm based on business needs. Common decision tree algorithms include ID3 (based on information gain), C4.5 (based on information gain ratio), and CART (based on the Gini index). Predefined business rules are integrated into a trained decision tree model. The business attribute data to be classified is then input into the trained decision tree model, which then outputs "critical business" or "non-critical business."

[0072] Assume the following business attribute data, see Table 1:

[0073]

[0074] Table 1

[0075] Through the decision tree model, the following classification rules can be generated:

[0076] If the amount is > 500,000 yuan, it is "critical business";

[0077] If the processing time is < 2 hours and the number of customers involved is > 500, it is "business critical";

[0078] Other situations are "non-critical business";

[0079] The sensitive data, access frequency, business attributes and data block size are normalized using the Min-Max method. The specific formula is as follows:

[0080]

[0081] Among them, x is the attribute feature data value, 、 are the maximum and minimum values ​​of the attribute feature data values, is the normalized attribute feature data value.

[0082] In this implementation, all attribute characteristics of the data are collected. Sensitive data: The scores of all sensitive data are collected, such as low, medium, and high sensitivity, which are quantified as numerical values ​​(such as 1, 2, and 3). Access frequency: The access frequency of each data block is collected, which may be classified as low, medium, and high, and quantified as numerical values ​​(such as 1, 2, and 3). Business attributes: The classification results of business attributes are collected, such as critical business (1) and non-critical business (0). Data block size: The size of each data block is collected, usually in bytes.

[0083] Then, the Min-Max normalization formula is applied to normalize sensitive data, access frequency, business attributes and data block size.

[0084] Step S3: using a random forest model to determine weight data for each attribute feature, constructing a benefit matrix based on the attribute feature data values ​​and the weight data of the attribute features to obtain a benefit matrix for the attribute features, and generating a judgment strategy based on the benefit matrix to obtain a judgment strategy matrix;

[0085] In this embodiment, normalized attribute feature data (sensitive data, access frequency, business attributes, and data block size) is fed into a random forest model to train the model. Through model training, the random forest model automatically calculates the importance score of each attribute feature based on its contribution to the model's predictions. The interest matrix combines the normalized attribute feature data with feature weights to reflect each feature's contribution to the final decision. For example, the normalized attribute feature data is as follows (see Table 2):

[0086]

[0087] Table 2

[0088] The feature weights calculated by the random forest model are as follows: sensitive data: 0.3, access frequency: 0.4, business attributes: 0.2, data block size: 0.1; the final benefit matrix of attribute features is as shown in Table 3:

[0089]

[0090] Table 3

[0091] Multiplying the normalized attribute feature data value by the corresponding attribute feature weight data to obtain a weighted value of each attribute feature, then adding all the attribute feature weighted values ​​to obtain the attribute feature weighted value after the data block is fused, and constructing the attribute feature interest matrix of each data block based on the attribute feature weighted value after the data block is fused;

[0092] Based on the attribute feature benefit matrix, a judgment strategy matrix is ​​generated. See Table 4 below for details:

[0093]

[0094] Table 4

[0095] Step S4: Based on the judgment strategy matrix, determine the storage location of the corresponding data block. If the element in the judgment strategy matrix is ​​greater than or equal to the element in the corresponding preset scoring threshold matrix, store the corresponding data block in the private cloud; otherwise, store it in the public cloud.

[0096] In this embodiment, a scoring threshold matrix having the same dimension as the judgment strategy matrix is ​​created, wherein the elements of the scoring threshold matrix are preset; an element-by-element comparison is performed, traversing each element of the judgment strategy matrix and the preset scoring threshold matrix, and performing a one-to-one comparison; if an element in the judgment strategy matrix is ​​greater than or equal to the corresponding element in the scoring threshold matrix, the data block corresponding to the element in the judgment strategy matrix should be stored in the private cloud; otherwise, the data block should be stored in the public cloud.

[0097] Specifically, a pre-set scoring threshold matrix is ​​used to compare the elements in the judgment strategy matrix to determine the storage location of the data block. Confirm that the judgment strategy matrix and the preset scoring threshold matrix have the same dimensions to ensure that the total benefit value of each data block has a corresponding threshold for comparison. Comparing the judgment strategy matrix with the preset scoring threshold matrix For each data block, compare the elements in the judgment strategy matrix with the corresponding elements in the preset scoring threshold matrix: If the element in the judgment strategy matrix is ​​greater than or equal to the element in the preset scoring threshold matrix: store the data block in the private cloud. Otherwise: store the data block in the public cloud. For example: See the table below for the preset scoring threshold matrix:

[0098]

[0099] Table 5

[0100] Comparison results: Data block 1: 0.62 ≥ 0.6, data block 1 is stored in the private cloud; data block 2: 0.34 < 0.4, data block 2 is stored in the public cloud; data block 3: 0.84 ≥ 0.8, data block 2 is stored in the private cloud. Finally, the storage location of each data block is recorded for subsequent management and auditing.

[0101] Step S5: monitor the changes in the attribute characteristics of the data block in real time, and dynamically adjust the weight and scoring threshold.

[0102] In this embodiment, the attributes that need to be monitored are clearly defined, such as sensitivity, access frequency, business attributes, and data block size. Data Collection and Preprocessing: Data Collection: Collects attribute feature data of data blocks in real time, possibly through log records, sensors, or other data sources. Data Cleaning: Addresses missing values ​​and outliers to ensure data quality. Normalization: Normalizes feature data of different dimensions to the same range to facilitate subsequent analysis. Real-time Feature Analysis: Feature Extraction: Extracts useful feature information from the raw data. Feature Change Detection: Detects changing trends or abnormal fluctuations in feature values ​​using statistical methods or machine learning algorithms. Model Selection: Selects a machine learning model suitable for real-time updates, such as online random forests or incremental learning algorithms. Model Training and Update: Dynamically updates model parameters based on real-time data to adapt to changes in data distribution. Dynamic Adjustment of Weights and Scoring Thresholds: Weight Adjustment: Dynamically adjusts the weights of each attribute feature based on the model's feature importance score. Threshold Adjustment: Adjusts the scoring threshold based on real-time feature changes to adapt to the new data distribution. Monitoring and Feedback Mechanism: Real-time Monitoring: Continuously monitors changes in the attribute features of data blocks and the performance of the model. Feedback adjustment: Based on monitoring results, timely adjust model parameters and strategies to ensure system stability and accuracy.

[0103] In an embodiment of the present application, data is segmented into data blocks of random sizes, and multi-dimensional attribute characteristics of the data blocks, such as sensitivity, access frequency, business attributes, and data block size, are obtained. A random forest model is used to determine the weight data of each attribute characteristic. A benefit matrix is ​​constructed based on the attribute characteristic data values ​​and the weight data of the attribute characteristics to obtain the benefit matrix of the attribute characteristics. A judgment strategy is generated based on the benefit matrix to obtain a judgment strategy matrix. Based on the judgment strategy matrix, the storage location of the corresponding data block is determined. If the elements in the judgment strategy matrix are greater than or equal to the elements in the corresponding preset scoring threshold matrix, the corresponding data block is stored in a private cloud, otherwise, it is stored in a public cloud. By segmenting data into data blocks of different sizes and integrating multiple attribute characteristics of the data blocks, it is determined whether the data blocks should be stored in a private cloud or a public cloud, thereby achieving more efficient and secure data management. In addition, by monitoring the changes in the attribute characteristics of the data blocks in real time, the weights and scoring thresholds are dynamically adjusted to obtain different judgment strategy matrices, ultimately achieving real-time changes in the storage location of the data blocks.

[0104] The embodiment of the present application also provides a hybrid cloud-based data security management and control system, the system comprising: a data segmentation module for segmenting data into multiple data blocks of unfixed sizes by extracting data blocks of unfixed sizes;

[0105] an attribute feature data acquisition module, which acquires the attribute feature data of the data block and performs normalization processing to obtain normalized attribute feature data values, wherein the attribute feature data includes sensitivity, access frequency, business attributes, and data block size;

[0106] The judgment strategy matrix generation module uses a random forest model to determine the weight data of each attribute feature, constructs a benefit matrix based on the attribute feature data value and the weight data of the attribute feature to obtain the benefit matrix of the attribute feature, and generates a judgment strategy based on the benefit matrix to obtain a judgment strategy matrix; the decision module judges the storage location of the corresponding data block based on the judgment strategy matrix, and if the element in the judgment strategy matrix is ​​greater than or equal to the element in the corresponding preset scoring threshold matrix, the corresponding data block is stored in the private cloud, otherwise, it is stored in the public cloud; the dynamic adjustment module is used to monitor the changes in the attribute characteristics of the data block in real time and dynamically adjust the weight and scoring threshold.

[0107] An embodiment of the present application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, the hybrid cloud-based data security management method as described above is implemented.

[0108] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Furthermore, the present application may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0109] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0110] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0111] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0112] In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0113] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0114] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can be implemented using any method or technology for information storage. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change RAM (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic disk storage or other magnetic storage devices, or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include transitory computer-readable media, such as modulated data signals and carrier waves.

[0115] It should also be noted that the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, commodity, or apparatus comprising a series of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, commodity, or apparatus. In the absence of further limitations, an element defined by the phrase "comprising a..." does not preclude the presence of other identical elements in the process, method, commodity, or apparatus comprising the element.

[0116] The above are merely embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application should all be included within the scope of the claims of the present application.< / ctime> < / cstdlib>

Claims

1. A data security management and control method based on hybrid cloud, characterized in that: The method comprises: Step S1, dividing the data into multiple data blocks of unfixed sizes by extracting data blocks of unfixed sizes; Step S2: Acquire attribute characteristic data of the data block and perform normalization processing to obtain normalized attribute characteristic data values, wherein the attribute characteristic data includes sensitivity, access frequency, business attributes, and data block size; Step S3: using a random forest model to determine weight data for each attribute feature, constructing a benefit matrix based on the attribute feature data values ​​and the weight data of the attribute features to obtain a benefit matrix for the attribute features, and generating a judgment strategy based on the benefit matrix to obtain a judgment strategy matrix; Step S4: Based on the judgment strategy matrix, determine the storage location of the corresponding data block. If the element in the judgment strategy matrix is ​​greater than or equal to the element in the corresponding preset scoring threshold matrix, store the corresponding data block in the private cloud; otherwise, store it in the public cloud. Step S5: monitor the changes in the attribute characteristics of the data block in real time, and dynamically adjust the weight data and scoring threshold; The step S3 comprises: The weight data of the attribute features are pre-processed and divided into a training set and a test set, wherein the training set is used to build a random forest model, and the test set is used to evaluate the performance of the model. After the random forest model training is completed, the importance scores of the attribute features are obtained as the weight data of the attribute features; Multiplying the normalized attribute feature data value by the corresponding attribute feature weight data to obtain a weighted value for each attribute feature, and constructing an attribute feature interest matrix based on the weighted value; Adding the weighted values ​​of all the attribute features to obtain the weighted values ​​of the attribute features after the data blocks are fused, and constructing a judgment strategy matrix for each data block based on the weighted values ​​of the attribute features after the data blocks are fused; Step S1 includes: Step S11: setting a random number and limiting the value range of the random number; Step S12: generating a random number sequence within the value range, and using the random numbers in the random number sequence as extraction position increments; Step S13: Based on the current byte position plus the extraction position increment, the position of the next extracted byte is obtained until the position of the next extracted byte is larger than the size of the data block; Step S14: extract the data between the current byte position and the position of the next extracted byte as a small data block, and the remaining data as a large data block.

2. The method according to claim 1, characterized in that The step S2 includes: identifying sensitive data in the data block using a regular expression, and classifying the sensitive data into low sensitivity, medium sensitivity, and high sensitivity based on a preset first scoring system; Obtaining statistically the access frequency of each data block based on the access log of the database, and classifying the access frequency of the data block into low access frequency, medium access frequency, and high access frequency based on a preset second scoring system; Based on predefined rules, a decision tree is used to classify business attributes into critical business and non-critical business; The sensitive data, access frequency, business attributes and data block size are normalized using the Min-Max method. The specific formula is as follows: ， in, is the attribute feature data value, 、 are the maximum and minimum values ​​of the attribute feature data values, is the normalized attribute feature data value.

3. The method according to claim 1, characterized in that The step S4 comprises: Creating a scoring threshold matrix having the same dimensions as the judgment strategy matrix, wherein the elements of the scoring threshold matrix are pre-set; Element-by-element comparison, traversing each element of the judgment strategy matrix and the preset scoring threshold matrix, and comparing them one by one; If an element in the judgment strategy matrix is ​​greater than or equal to a corresponding element in the scoring threshold matrix, the data block corresponding to the element in the judgment strategy matrix should be stored in the private cloud; otherwise, the data block should be stored in the public cloud.

4. A data security management and control system based on hybrid cloud, characterized in that: The system comprises: The data segmentation module extracts data blocks of unfixed sizes and divides the data into multiple data blocks of unfixed sizes; an attribute feature data acquisition module, which acquires the attribute feature data of the data block and performs normalization processing to obtain normalized attribute feature data values, wherein the attribute feature data includes sensitivity, access frequency, business attributes, and data block size; A judgment strategy matrix generation module uses a random forest model to determine weight data for each attribute feature, constructs a benefit matrix based on the attribute feature data values ​​and the weight data of the attribute features to obtain a benefit matrix for the attribute features, and generates a judgment strategy based on the benefit matrix to obtain a judgment strategy matrix; A decision module, based on the judgment strategy matrix, determines the storage location of the corresponding data block, and if an element in the judgment strategy matrix is ​​greater than or equal to an element in the corresponding preset scoring threshold matrix, stores the corresponding data block in the private cloud; otherwise, stores the corresponding data block in the public cloud; A dynamic adjustment module, configured to monitor changes in the attribute characteristics of the data block in real time and dynamically adjust the weight data and scoring threshold; The judgment strategy matrix generation module includes: The weight data of the attribute features are pre-processed and divided into a training set and a test set, wherein the training set is used to build a random forest model, and the test set is used to evaluate the performance of the model. After the random forest model training is completed, the importance scores of the attribute features are obtained as the weight data of the attribute features; Multiplying the normalized attribute feature data value by the corresponding attribute feature weight data to obtain a weighted value for each attribute feature, and constructing an attribute feature interest matrix based on the weighted value; Adding the weighted values ​​of all the attribute features to obtain the weighted values ​​of the attribute features after the data blocks are fused, and constructing a judgment strategy matrix for each data block based on the weighted values ​​of the attribute features after the data blocks are fused; The data segmentation module includes: Set a random number and limit the value range of the random number; Using a random number sequence generated within the value range as a sampling position increment; Based on the current byte position plus the extraction position increment, obtaining the position of the next extracted byte until the position of the next extracted byte is larger than the size of the data block; The data between the current byte position and the position of the next extracted byte are extracted as small data blocks, and the remaining data are used as large data blocks.

5. The system according to claim 4, characterized in that The attribute feature data acquisition module includes: identifying sensitive data in the data block using a regular expression, and classifying the sensitive data into low sensitivity, medium sensitivity, and high sensitivity based on a preset first scoring system; Obtaining statistically the access frequency of each data block based on the access log of the database, and classifying the access frequency of the data block into low access frequency, medium access frequency, and high access frequency based on a preset second scoring system; Based on predefined rules, a decision tree is used to classify business attributes into critical business and non-critical business; The sensitive data, access frequency, business attributes and data block size are normalized using the Min-Max method. The specific formula is as follows: ， in, is the attribute feature data value, 、 are the maximum and minimum values ​​of the attribute feature data values, is the normalized attribute feature data value.

6. The system according to claim 4, characterized in that The decision module includes: The decision module determines the storage location of the corresponding data block based on the judgment strategy matrix. If the element in the judgment strategy matrix is ​​greater than or equal to the element in the corresponding preset scoring threshold matrix, the corresponding data block is stored in the private cloud; otherwise, it is stored in the public cloud.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the hybrid cloud-based data security management method provided in any one of claims 1 to 3 is implemented.

Images