Information security data monitoring method and system based on encryption algorithm

Abstract

The invention relates to the technical field of information security data monitoring, and particularly discloses an information security data monitoring method and system based on an encryption algorithm, and the method comprises the steps: collecting an original information data byte stream, carrying out the wavelet domain feature enhancement preprocessing, carrying out the feature extraction, and obtaining environment sensor data; performing context-aware dynamic encryption by combining an information data block and an information feature matrix to obtain an information ciphertext and metadata, performing multi-modal ciphertext feature extraction, outputting a feature vector, performing federated collaborative anomaly detection, constructing a multi-factor confidence decision framework, and outputting an information access confidence score and an information access strategy. And adjusting a context-aware dynamic encryption mode. According to the method, the problems that the accuracy and recall rate of a detection model still need to be improved due to insufficient real-time performance of traditional data monitoring and difficulty in multi-source data fusion, and the information security data monitoring effect is influenced due to the occurrence of missing report or false report are solved.

Description

Technical Field

[0001] The present invention relates to the technical field of information security data monitoring, and specifically provides an information security data monitoring method and system based on an encryption algorithm. Background Technique

[0002] With the rapid development of information technology, data has become an important asset of enterprises and society. At the same time, network attack means are becoming increasingly complex and diverse, and data leakage incidents occur frequently. As one of the core technologies of information security, encryption algorithms can convert sensitive data into ciphertext form, so that even if it is stolen during storage and transmission, it is difficult for attackers to obtain its true content. With the continuous development of cryptography theory, various advanced encryption algorithms such as symmetric encryption algorithms (such as AES in information security data monitoring), asymmetric encryption algorithms (such as RSA in information security data monitoring), and hash algorithms (such as SHA-256 in information security data monitoring) have emerged continuously and have been widely used in the field of information security. This provides a solid technical foundation for information security data monitoring methods based on encryption algorithms. Information security data monitoring methods based on encryption algorithms can provide more direct and effective protection at the data level, ensuring the security and integrity of data regardless of where it is stored and how it is transmitted, and meeting the security requirements in complex network environments.

[0003] Nowadays, there are still some deficiencies in the research on information security data monitoring, specifically reflected in the insufficient real-time performance of traditional data monitoring and the difficulty of multi-source data fusion, resulting in the need to improve the accuracy and recall rate of detection models, and the occurrence of missed reports or false reports, which affects the effect of information security data monitoring. Summary of the Invention

[0004] Aiming at the deficiencies of the prior art, the present invention provides an information security data monitoring method and system based on an encryption algorithm, which can effectively solve the problems involved in the above background technique.

[0005] To achieve the above objectives, the present invention is implemented through the following technical solutions: In the first aspect of the present invention, an information security data monitoring method based on an encryption algorithm is provided, including the following steps: collecting the original information data byte stream and performing preprocessing to output the preprocessed information data block and information feature matrix; obtaining environmental sensor data, performing context-aware dynamic encryption in combination with the information data block and information feature matrix to obtain the information ciphertext and metadata and writing them into the security event log; extracting multi-modal ciphertext features based on the information ciphertext and metadata to output the feature vector; performing federated collaborative anomaly detection based on the feature vector to obtain the global anomaly probability and updated model parameters, and determining whether the global anomaly probability is written into the security event log; constructing a multi-factor confidence decision architecture, combining the global anomaly probability, and outputting the information access confidence score and information access policy; obtaining the environmental context and adjusting the encryption method of the context-aware dynamic encryption in combination with the global anomaly probability.

[0006] As a further method, collecting the original information data byte stream and performing preprocessing to output the preprocessed information data block and information feature matrix, the specific analysis process is as follows: Denote the original information data byte stream as , where i is the byte number of the original information data byte stream, i = 0, 1, 2, 3,... N, N is the total number of bytes of the original information data byte stream, is the original information data byte value, ; Perform 5-layer decomposition on the original information data byte stream based on the Daubechies-4 wavelet basis function to obtain the coefficient set: ; Among them, is the detail coefficient of the kth layer, k = 1, 2, 3, 4, 5, is the approximation coefficient of the 5th layer;

[0007] Perform inverse discrete wavelet reconstruction on the coefficient set to output the preprocessed information data block ; Calculate the energy ratio based on the coefficient set: ; Obtain the occurrence frequency of each original information data byte value and calculate the information entropy , denoted as the data sensitivity: ;

[0008] Output the information feature matrix : ; In the formula, is the standard deviation of the preprocessed noise, is the mean of the approximation coefficient of the 5th layer.

[0009] As a further method, environmental sensor data is obtained, and context-aware dynamic encryption is performed by combining information data blocks and information feature matrices to obtain information ciphertext and metadata, which are then written into the security event log. The specific analysis process is as follows: Starting from Extract the data sensitivity And use it as the initial sensitivity weight of document d. When the initial sensitivity weight of document d is greater than the sensitivity threshold stored in the database, AES-CTR is enabled based on the environmental sensor data and information data blocks to encrypt document d; if the initial sensitivity weight of document d is not greater than the sensitivity threshold stored in the database, the sensitivity weight of document d is updated in real time based on the sensitivity weight dynamic update formula The sensitivity weight dynamic update formula is:

[0010] ;

[0011] ;

[0012] In the formula, is the frequency of document d, is the compensation constant, is the total number of documents processed by the system, is the cross-document correlation degree, is the term frequency vector of document d, When calculating the cross-document correlation degree, represents other documents in the set D of recently processed documents, is the document 's term frequency vector;

[0013] When the sensitivity weight of document d is greater than the sensitivity threshold stored in the database, AES-CTR is enabled based on the environmental sensor data and information data blocks to encrypt document d. If the sensitivity weight of document d is not greater than the sensitivity threshold stored in the database, then the sensitivity weight of document d continues to be updated .

[0014] As a further method, the environmental sensor data includes latitude, longitude, and Unix timestamp. AES-CTR is enabled based on the environmental sensor data and information data blocks to encrypt document d. The process is as follows: Environmental parameter encoding is performed on the latitude and longitude to generate a latitude-longitude hash value, and a modulo operation is performed on the Unix timestamp to generate a time hash value:

[0015] ;

[0016] ;

[0017] In the formula, Lat represents latitude, Lon represents longitude, is the latitude and longitude hash value generated by the SHA3 algorithm from latitude and longitude, and is the time hash value generated by the CRC32 algorithm after taking the modulo operation on the Unix timestamp;

[0018] XOR the system - preset base key byte - by - byte with the latitude and longitude hash value and the time hash value to generate a dynamic key : ; Construct a counter, including a randomly generated 12 - byte initialization vector and a 4 - byte counter value; Use the dynamic key to perform AES encryption on the current counter to generate a 16 - byte key stream block;

[0019] XOR the first 16 - byte key stream block of the pre - processed information data block byte - by - byte to obtain an encrypted 16 - byte data block, increment the last 4 bytes of the counter by 1 to form a new counter; Repeat to generate a new 16 - byte key stream block, and XOR the next 16 bytes of the pre - processed information data block with the new 16 - byte key stream block byte - by - byte until the pre - processed information data block is processed; Concatenate all the encrypted 16 - byte data blocks to obtain the information ciphertext;

[0020] Obtain the dynamic S - box offset , and record the dynamic S - box offset, the latitude and longitude hash value, the time hash value, and the current sensitivity weight of the document d as metadata : .

[0021] As a further method, based on the information ciphertext and metadata, perform multi - modal ciphertext feature extraction and output a feature vector. The specific analysis process is as follows: Count the frequency of each byte value in the information ciphertext and store it in a byte distribution vector H with a length of 256, , , where a is the byte number of the byte distribution vector H, is the byte value of the j - th byte of the information ciphertext, is the number of bytes with the byte value of in the information ciphertext, and A is equal to 256;

[0022] Based on calculate the normalized entropy value : ; Based on calculate the differential feature : , where B is the total number of bytes in the information ciphertext;

[0023] Input the ciphertext of the information into the LSTM network in a window of 64 bytes, and output the temporal features based on the ciphertext of the information , , represents the ciphertext data window from time step t−63 to time step t; Input the ciphertext of the information into the CNN convolution kernel in a window of 16 bytes, and output the local features based on the ciphertext of the information , ; In the formula, is the weight parameter of the CNN convolution kernel, is the bias parameter of the CNN convolution kernel, is the rectified linear unit function, is the byte offset by c positions starting from time step t in the ciphertext of the information;

[0024] Obtain the hidden features based on the dynamic S-box offset in the metadata :

[0025] ; In the formula, is the loop variable, is the right shift operator, is the bitwise AND operator, is 00001111 in binary;

[0026] Output the feature vector : .

[0027] As a further method, perform federated collaborative anomaly detection based on the feature vector to obtain the global anomaly probability and the updated model parameters. The specific analysis process is as follows: Standardize the feature vector to obtain the anomaly detection vector; Process the anomaly detection vector based on the multi-anomaly detection algorithm to generate multiple anomaly scores, and perform weighted summation to obtain the comprehensive anomaly score ; Determine the local anomaly probability as based on the locally stored anomaly score-anomaly probability mapping table; Obtain the dynamic weights of each node in the federated collaborative anomaly monitoring , aggregate the node parameters, and update the model parameters of node f based on the dynamic weights of each node to obtain the updated model parameters;

[0028] Calculate the anomaly probability based on the dynamic weights of each node :

[0029] ;

[0030] Among them, F is the total number of nodes in the federated collaborative anomaly monitoring, is the local abnormal probability of node f;

[0031] The abnormal probability Normalized as global anomaly probability .

[0032] As a further method, it is determined whether the global abnormal probability is written into the security event log. The specific analysis process is as follows: Compare with the global anomaly probability threshold stored in the database; if the global anomaly probability is not less than the global abnormal probability threshold, then write it into the security event log; if the global abnormal probability If the probability is less than the global anomaly probability threshold, it will not be written into the security event log.

[0033] As a further method, a multi-factor confidence decision framework is constructed, combined with the global abnormal probability, to output the information access confidence score and information access strategy. The specific analysis process is as follows: The form of the multi-factor confidence decision framework is:

[0034] ;

[0035] ;

[0036] in, Access confidence signals for information output by a multi-factor confidence decision architecture, is the global abnormal probability, is a data sensitive item, e is a natural constant, is the adjustment factor, is the critical sensitivity point, is the IP address difference, is the difference of geographical location information;

[0037] The information access strategy is: compare the information access confidence signal with the information access confidence threshold stored in the database; if the information access confidence signal is higher than the information access confidence threshold, allow information access; if the information access confidence signal is not higher than the information access confidence threshold, verify the information access confidence twice.

[0038] As a further method, the environmental context is obtained and combined with the global abnormal probability to adjust the encryption method of context-aware dynamic encryption. The specific analysis process is: obtaining environmental context, including operation frequency and number of threat intelligence; obtaining data sensitivity , operation frequency, threat intelligence volume and data sensitivity Perform weighted summation to obtain the environmental risk coefficient RE; obtain the comprehensive risk coefficient R:

[0039] , where is the global exception probability, is 's weight factor;

[0040] Determine the encryption method of context-aware dynamic encryption below based on the comprehensive risk factor-encryption method policy table stored in the database.

[0041] The second aspect of the present invention provides an information security data monitoring system based on an encryption algorithm, including an information data preprocessing module, a perception dynamic encryption module, a feature vector output module, a global exception probability acquisition module, a confidence score output module, and an encryption method adjustment module, where: The information data preprocessing module is used to collect the original information data byte stream and perform preprocessing, and output the preprocessed information data block and information feature matrix; The perception dynamic encryption module is used to obtain environmental sensor data, perform context-aware dynamic encryption in combination with the information data block and the information feature matrix, obtain the information ciphertext and metadata, and write them into the security event log; The feature vector output module is used to perform multi-modal ciphertext feature extraction based on the information ciphertext and metadata, and output the feature vector; The global exception probability acquisition module is used to perform federated collaborative anomaly detection based on the feature vector, obtain the global exception probability and the updated model parameters, and determine whether the global exception probability is written into the security event log; The confidence score output module is used to construct a multi-factor confidence decision architecture, and combine the global exception probability to output the information access confidence score and the information access policy; The encryption method adjustment module is used to obtain the environmental context and combine the global exception probability to adjust the encryption method of the context-aware dynamic encryption.

[0042] Compared with the prior art, the embodiments of the present invention have at least the following advantages or beneficial effects:

[0043] (1) By providing an information security data monitoring method and system based on an encryption algorithm, the present invention performs wavelet domain feature enhancement preprocessing and feature extraction on the original information data byte stream, which can highlight the key features of the data, improve the quality and usability of the data. Combining environmental sensor data, information data blocks and information feature matrices for context-aware dynamic encryption enables the encryption process to be adaptively adjusted according to specific environmental and data characteristics, improving the pertinence and effectiveness of encryption. Outputting feature vectors through multi-modal ciphertext feature extraction can describe the ciphertext from multiple angles, capture the information contained in the ciphertext more comprehensively, and thus improve the accuracy and reliability of detection.

[0044] (2) By performing federated collaborative anomaly detection based on feature vectors, the present invention can utilize the data of multiple participants for joint detection without revealing data privacy, giving full play to the advantages of distributed computing. The obtained global anomaly probability can more comprehensively reflect the security situation in the entire system, and the updated model parameters help continuously optimize the detection model and improve the detection performance. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] The present invention will be further described with reference to the accompanying drawings. However, the embodiments in the drawings do not constitute any limitation to the present invention. For those of ordinary skill in the art, other drawings can also be obtained based on the following drawings without creative efforts.

[0046] Figure 1 It is a schematic flowchart of the method steps of the present invention.

[0047] Figure 2 It is a schematic diagram of the connection of the system modules of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0048] Next, the technical solutions in the embodiments of the present invention will be clearly and completely described in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts belong to the scope of protection of the present invention.

[0049] Referring to Figure 1 As shown, the first aspect of the present invention provides an information security data monitoring method based on an encryption algorithm, including: collecting the original information data byte stream and performing preprocessing, and outputting the preprocessed information data block and information feature matrix.

[0050] The specific analysis process is as follows: Denote the original information data byte stream as , where i is the byte number of the original information data byte stream, i = 0, 1, 2, 3,... N, N is the total number of bytes of the original information data byte stream, is the original information data byte value, ; perform 5-layer decomposition on the original information data byte stream based on the Daubechies-4 wavelet basis function to obtain the coefficient set: ; where, is the detail coefficient of the kth layer, k = 1, 2, 3, 4, 5, is the approximation coefficient of the 5th layer;

[0051] Perform inverse discrete wavelet reconstruction on the coefficient set to output the preprocessed information data block ; perform energy ratio based on the coefficient set Calculation: ; Obtain the occurrence frequencies of the byte values of each original information data, and calculate the information entropy , denoted as data sensitivity: ;

[0052] Output the information feature matrix : ; Wherein, is the standard deviation of the noise after preprocessing (obtain the highest frequency coefficient in the coefficient set, calculated based on the MAD method), is the mean value of the approximation coefficients of the 5th layer.

[0053] After collecting the original information data byte stream, through wavelet domain feature enhancement preprocessing, select the Daubechies-4 wavelet basis function for 5-layer decomposition, which can decompose the data into different frequency levels. This helps to remove noise and highlight key features. The preprocessed information data block obtained through discrete inverse wavelet reconstruction is cleaner and has more obvious features compared with the original data, providing a better basis for subsequent analysis.

[0054] Calculate the energy ratio of the detail coefficients of each layer to the approximation coefficients of the 5th layer, which can reflect the contribution degree of different frequency components to the data and characterize the data features from the energy perspective. Calculate the information entropy as a measure of data sensitivity, which can reflect the uncertainty and complexity of the data. Combine these features into an information feature matrix to comprehensively describe the data from multiple dimensions, providing rich and valuable information for subsequent anomaly detection, encryption strategy formulation, etc.

[0055] The processed data block and feature matrix can be used both in context-aware dynamic encryption to better protect the data in combination with other data; and can also be used in subsequent operations such as anomaly detection. Different features can meet the requirements of different security analysis links, improving the effectiveness and flexibility of the entire information security monitoring system.

[0056] Obtain environmental sensor data, perform context-aware dynamic encryption in combination with the information data block and the information feature matrix, and obtain the information ciphertext and metadata and write them into the security event log.

[0057] The specific analysis process is as follows: Extract from the data sensitivity and use it as the initial sensitivity weight of the document d. When the initial sensitivity weight of the document d is greater than the sensitivity threshold stored in the database, encrypt the document d using AES-CTR based on the environmental sensor data and the information data block; if the initial sensitivity weight of the document d is not greater than the sensitivity threshold stored in the database, update the sensitivity weight of the document d in real time based on the sensitivity weight dynamic update formula , the sensitivity weight dynamic update formula is:

[0058] ;

[0059] ;

[0060] Wherein, is the frequency of document d, is the compensation constant, is the total number of documents processed by the system, is the cross-document correlation degree, is the term frequency vector of document d, represents other documents in the set D of recently processed documents when calculating the cross-document correlation degree, is the document 's term frequency vector;

[0061] When the sensitivity weight of document d is greater than the sensitivity threshold stored in the database, AES-CTR is enabled to encrypt document d based on the environmental sensor data and the information data block. If the sensitivity weight of document d is not greater than the sensitivity threshold stored in the database, the sensitivity weight of document d continues to be updated.

[0062] The environmental sensor data includes latitude, longitude, and Unix timestamp. AES-CTR is enabled to encrypt document d based on the environmental sensor data and the information data block. The process is as follows: The latitude and longitude are encoded with environmental parameters to generate a latitude-longitude hash value, and the Unix timestamp is modulo-operated to generate a time hash value:

[0063] ;

[0064] ;

[0065] Wherein, Lat represents latitude, Lon represents longitude, is the latitude-longitude hash value generated by the latitude and longitude through the SHA3 algorithm, is the time hash value generated by modulo-operating the Unix timestamp and then using the CRC32 algorithm;

[0066] The preset basic key of the system is bitwise XORed with the latitude-longitude hash value and the time hash value to generate a dynamic key : ; A counter is constructed, including a randomly generated 12-byte initialization vector and a 4-byte counter value; The current counter is AES-encrypted using the dynamic key to generate a 16-byte key stream block;

[0067] XOR the first 16 - byte key stream block of the pre - processed information data block byte - by - byte to obtain an encrypted 16 - byte data block. Increment the last 4 bytes of the counter by 1 to form a new counter; repeat to generate a new 16 - byte key stream block, and XOR the next 16 bytes of the pre - processed information data block with the new 16 - byte key stream block byte - by - byte until the pre - processed information data block is completely processed; concatenate all the encrypted 16 - byte data blocks to obtain the information ciphertext;

[0068] Obtain the dynamic S - box offset and record the dynamic S - box offset, the longitude - latitude hash value, the time hash value, and the current sensitivity weight of document d as metadata : .

[0069] Determine the initial weight according to the information entropy in the information feature matrix, calculate the sensitivity weight in combination with the cross - document correlation degree, and enable AES - CTR encryption when the weight exceeds the threshold. This method can flexibly judge the sensitivity of data based on the characteristics of the data itself and its association with other documents, encrypt truly sensitive data with high strength, and while ensuring security, it does not consume excessive resources on encrypting non - sensitive data.

[0070] The dynamic key generation combines longitude - latitude and timestamp information, generates intermediate values through different hash algorithms, and then performs operations with the base key. Since the key is related to the real - time environment and time, it increases the randomness and variability of the key, making it difficult for attackers to predict and crack the key, and improving the security of the encryption system.

[0071] The output metadata includes information such as the dynamic S - box offset, the geographical location hash value, the timestamp hash value, and the sensitivity weight. These metadata provide rich information for subsequent data tracking, decryption, and security auditing, facilitating understanding of the environment and sensitivity of data during encryption, and enabling traceability and analysis in case of security problems.

[0072] Based on the information ciphertext and metadata, perform multi - modal ciphertext feature extraction and output the feature vector.

[0073] The specific analysis process is as follows: Count the frequency of each byte value in the information ciphertext and store it in the byte distribution vector H of length 256, , , where a is the byte number of the byte distribution vector H, is the byte value of the j - th byte of the information ciphertext, is the number of bytes with the byte value of in the information ciphertext, and A is equal to 256;

[0074] Based on Calculate the normalized entropy value : ; Based on Calculate the differential feature : , where B is the total number of bytes in the information ciphertext;

[0075] Input the information ciphertext into the LSTM network with a 64-byte window, and output the temporal feature based on the information ciphertext , , represents the ciphertext data window from time step t−63 to time step t; Input the information ciphertext into the CNN convolution kernel with a 16-byte window, and output the local feature based on the information ciphertext , ; In the formula, is the weight parameter of the CNN convolution kernel, is the bias parameter of the CNN convolution kernel, is the rectified linear unit function, is the byte offset c positions from time step t in the information ciphertext;

[0076] Obtain the hidden feature based on the dynamic S-box offset in the metadata :

[0077] ; In the formula, is the loop variable, is the right shift operator, is the bitwise AND operator, is 00001111 in binary;

[0078] Output the feature vector : .

[0079] Through statistical feature calculation, the byte distribution law and information entropy of the ciphertext can be characterized as a whole, and the data distribution characteristics of the ciphertext can be understood. Differential feature calculation can reflect the change situation between ciphertext bytes and help to discover the local change law of ciphertext data. These statistical features provide basic and comprehensive information for ciphertext analysis.

[0080] Using the LSTM network to process the ciphertext data of a 64-byte window can effectively capture the dependence relationship and context information of the ciphertext in the time series. For ciphertext data with temporal characteristics, LSTM can mine the potential patterns and laws in it and improve the understanding and representation ability of ciphertext features.

[0081] The CNN convolutional kernel processes a 16-byte window and can automatically extract local features in the ciphertext, such as specific byte combination patterns, etc. The weight sharing and local connection characteristics of the convolutional operation make it efficient and targeted in processing ciphertext data, and can quickly discover local key features in the ciphertext.

[0082] Analyzing the dynamic S-box offset in the metadata to generate hidden features makes full use of the additional information in the encryption process. These hidden features may contain important information related to the characteristics of the encryption algorithm, which helps to analyze the security and encryption status of the ciphertext more deeply, increasing the dimension and depth of feature extraction.

[0083] Based on the feature vector, perform federated collaborative anomaly detection to obtain the global anomaly probability and the updated model parameters, and determine whether the global anomaly probability is written to the security event log.

[0084] The specific analysis process is as follows: Normalize the feature vector to obtain the anomaly detection vector; process the anomaly detection vector based on multiple anomaly detection algorithms (such as Isolation Forest, One-Class SVM, Autoencoder) to generate multiple anomaly scores, and perform weighted summation to obtain the comprehensive anomaly score ; determine the local anomaly probability as based on the anomaly score - anomaly probability mapping table stored locally; obtain the dynamic weights of each node in the federated collaborative anomaly monitoring , aggregate the parameters of each node, and update the model parameters of node f based on the dynamic weights of each node to obtain the updated model parameters;

[0085] Calculate the anomaly probability based on the dynamic weights of each node : :

[0086] ;

[0087] where F is the total number of nodes in the federated collaborative anomaly monitoring, is the local anomaly probability of node f;

[0088] Normalize the anomaly probability and denote it as the global anomaly probability .

[0089] Compare the global anomaly probability with the global anomaly probability threshold stored in the database; if the global anomaly probability is not less than the global anomaly probability threshold, write it to the security event log; if the global anomaly probability is less than the global anomaly probability threshold, do not write it to the security event log.

[0090] In the mode of federated learning, each node does not need to share the original data. It only needs to upload parameters to participate in model training and aggregation. While realizing anomaly detection, it avoids the risk of privacy leakage during data transmission and sharing, meeting the needs of different data owners for data security and privacy protection.

[0091] Updating the model parameters after each federated aggregation enables the model to continuously adapt to new data features and distribution changes. As time goes by and data accumulates continuously, the model can be continuously optimized, maintaining an efficient detection ability for abnormal situations and adapting to complex and changeable information security environments.

[0092] Comparing the global anomaly probability with the threshold to decide whether to write to the security event log avoids recording too much meaningless information and reduces the log storage overhead. Only recording abnormal situations that may truly have security problems facilitates security personnel to quickly locate and handle potential security events, improving the efficiency of information security management.

[0093] The multi-factor confidence decision architecture is in the form of:

[0094] ;

[0095] ;

[0096] Among them, is the information access confidence signal output by the multi-factor confidence decision architecture, is the global anomaly probability, is the data sensitive item, e is the natural constant, is the adjustment factor, is the sensitivity critical point, is the IP address difference degree, is the geographical location information difference degree;

[0097] The information access policy is: comparing the information access confidence signal with the information access confidence threshold stored in the database; if the information access confidence signal is higher than the information access confidence threshold, information access is allowed; if the information access confidence signal is not higher than the information access confidence threshold, the information access confidence is verified again.

[0098] Combining multiple factors such as the global anomaly probability, data sensitivity, user credentials, historical log information, and the IP address and geographical location of the information access environment, comprehensively evaluate the security of information access. It changes the limitations of single-factor evaluation, can more accurately judge the credibility of access requests, and reduces the risk of misjudgment.

[0099] By calculating the sensitivity terms, the evaluation strategy is flexibly adjusted according to the different data sensitivities. For high-sensitivity data, more stringent access conditions are set; for low-sensitivity data, they are relatively loose. While ensuring data security, the usage requirements of different data are taken into account, improving the applicability of the system.

[0100] Collect the IP address and geographical location information of the information access environment, evaluate the environmental difference degree, and can timely detect abnormal access environments, such as unfamiliar IPs or situations with excessive location changes. This helps to prevent access from untrusted environments and enhance the security of the information system in complex network environments.

[0101] Compare the calculated information access confidence signal with the threshold to make a clear access decision. For access requests with high confidence, fast access is allowed to improve work efficiency; for requests with low confidence, secondary verification is performed to further ensure data security, achieving a balance between security and convenience.

[0102] Obtain the environmental context and combine the global anomaly probability to adjust the encryption method of context-aware dynamic encryption.

[0103] The specific analysis process is as follows: Obtain the environmental context, specifically including the operation frequency and the number of threat intelligence; obtain the data sensitivity , and perform weighted summation on the operation frequency, the number of threat intelligence, and the data sensitivity to obtain the environmental risk coefficient RE; obtain the comprehensive risk coefficient R:

[0104] , where is the global anomaly probability, is 's weight factor;

[0105] Determine the encryption method of context-aware dynamic encryption based on the comprehensive risk coefficient-encryption method strategy table stored in the database.

[0106] Combining the environmental context (operation frequency, number of threat intelligence) and the global anomaly probability, the encryption key strength can be dynamically adjusted according to the actual security situation. When the operations are frequent or the threat intelligence increases and the anomaly probability rises, the encryption strength is enhanced in a timely manner; otherwise, it is appropriately reduced, so that the encryption strategy always fits the current environment and effectively responds to the changing security risks.

[0107] Referring to Figure 2 as shown, the second aspect of the present invention provides an information security data monitoring system based on an encryption algorithm, including an information data preprocessing module, a perception dynamic encryption module, a feature vector output module, a global anomaly probability acquisition module, a confidence score output module, and an encryption method adjustment module.

[0108] The information data preprocessing module is used to collect the original information data byte stream and perform preprocessing, and output the preprocessed information data block and information feature matrix; the perception dynamic encryption module is used to obtain environmental sensor data, perform context-aware dynamic encryption in combination with the information data block and information feature matrix, obtain the information ciphertext and metadata and write them into the security event log; the feature vector output module is used to perform multi-modal ciphertext feature extraction based on the information ciphertext and metadata, and output the feature vector; the global anomaly probability acquisition module is used to perform federated collaborative anomaly detection based on the feature vector, obtain the global anomaly probability and the updated model parameters, and determine whether the global anomaly probability is written into the security event log; the confidence score output module is used to construct a multi-factor confidence decision architecture, and combine the global anomaly probability to output the information access confidence score and information access policy; the encryption method adjustment module is used to obtain the environmental context and combine the global anomaly probability to adjust the encryption method of the context-aware dynamic encryption.

[0109] The above content is only an example and explanation of the structure of the present invention. Those skilled in the art of the present technology can make various modifications or supplements to the described specific embodiments or use similar methods to replace them. As long as they do not deviate from the structure of the invention or exceed the scope defined by this claim book, they shall fall within the protection scope of the present invention.

Claims

1. An information security data monitoring method based on encryption algorithm, characterized in that: The following steps are involved: Collect the original information data byte stream and preprocess it, and output the preprocessed information data block and information feature matrix; Acquire environmental sensor data, combine information data blocks and information feature matrices for context-aware dynamic encryption, obtain information ciphertext and metadata, and write them into the security event log; Based on the information ciphertext and metadata, multimodal ciphertext feature extraction is performed to output feature vectors; Perform federated collaborative anomaly detection based on feature vectors to obtain global anomaly probability and updated model parameters, and determine whether the global anomaly probability should be written into the security event log; Construct a multi-factor confidence decision framework, combine the global abnormal probability, and output information access confidence score and information access strategy; Obtain environmental context and combine it with the global anomaly probability to adjust the encryption method of context-aware dynamic encryption.

2. The information security data monitoring method based on encryption algorithm according to claim 1 is characterized in that: Collect the original information data byte stream and preprocess it, output the preprocessed information data block and information feature matrix, the specific analysis process is: The original information data byte stream is recorded as , where i is the byte number of the original information data byte stream, i=0,1,2,3,...N, N is the total number of bytes of the original information data byte stream, is the original information data byte value, ; Based on the Daubechies-4 wavelet basis function, the original information data byte stream is decomposed into 5 layers to obtain the coefficient set: ;in, is the detail coefficient of the kth layer, k=1,2,3,4,5, is the fifth-layer approximation coefficient; The coefficient set Discrete inverse wavelet reconstruction outputs preprocessed information data blocks ; Energy ratio based on coefficient set calculate: ; Get the frequency of occurrence of each byte value of the original information data and calculate the information entropy , denoted as data sensitivity: ; Output information feature matrix : ； In the formula, is the standard deviation of the noise after preprocessing, is the mean of the fifth layer approximation coefficients.

3. The information security data monitoring method based on encryption algorithm according to claim 2 is characterized in that: Acquire environmental sensor data, combine information data blocks and information feature matrices for context-aware dynamic encryption, obtain information ciphertext and metadata, and write them into the security event log. The specific analysis process is as follows: from Extracting data sensitivity and use it as the initial sensitivity weight of document d. When the initial sensitivity weight of document d is greater than the sensitivity threshold stored in the database, AES-CTR is enabled to encrypt document d based on the environmental sensor data and the information data block. If the initial sensitivity weight of document d is not greater than the sensitivity threshold stored in the database, the sensitivity weight of document d is updated in real time based on the sensitivity weight dynamic update formula , the dynamic update formula of sensitivity weight is: ； ； In the formula, is the frequency of document d, is the compensation constant, is the total number of documents processed by the system, is the cross-document relevance, is the term frequency vector of document d, When calculating the cross-document relevance, it represents other documents in the recently processed document set D. For Documentation The word frequency vector of ; When the sensitivity weight of document d When the sensitivity weight is greater than the sensitivity threshold stored in the database, AES-CTR is enabled to encrypt document d based on the environmental sensor data and information data block. If the sensitivity weight of document d is If the sensitivity weight of document d is not greater than the sensitivity threshold stored in the database, then continue to update the sensitivity weight of document d. .

4. The information security data monitoring method based on encryption algorithm according to claim 3 is characterized in that: The environmental sensor data includes latitude, longitude and Unix timestamp. AES-CTR is enabled to encrypt the document d based on the environmental sensor data and the information data block. The process is as follows: The latitude and longitude are encoded by environmental parameters to generate longitude and latitude hash values, and the time hash value is generated after performing modulo operation on the Unix timestamp: ； ； In the formula, Lat represents latitude, Lon represents longitude, It is the longitude and latitude hash value generated by the latitude and longitude through the SHA3 algorithm. The time hash value is generated by performing a modulo operation on the Unix timestamp and then using the CRC32 algorithm; The system default basic key Perform byte-by-byte XOR with the latitude and longitude hash value and the time hash value to generate a dynamic key : ; Construct a counter, including a randomly generated 12-byte initialization vector and a 4-byte counter value; Use dynamic key for current counter Perform AES encryption and generate a 16-byte key stream block; The preprocessed information data block The first 16-byte key stream block is XORed byte by byte to obtain the encrypted 16-byte data block, and the last 4 bytes of the counter are increased by 1 to form a new counter; Repeatedly generate new 16-byte key stream blocks and append the preprocessed information data blocks to the The next 16 bytes are XORed byte by byte with the new 16-byte keystream block until the preprocessed information data block Processing completed; All encrypted 16-byte data blocks are concatenated to obtain the information ciphertext; Get dynamic S-box offset , record the dynamic S-box offset, latitude and longitude hash value, time hash value and the current sensitivity weight of document d as metadata : 。 5. The information security data monitoring method based on encryption algorithm according to claim 4 is characterized in that: Based on the information ciphertext and metadata, multimodal ciphertext feature extraction is performed and feature vectors are output. The specific analysis process is as follows: The frequency of occurrence of each byte value in the statistical information ciphertext is stored in a byte distribution vector H of length 256. , , where a is the byte number of the byte distribution vector H, is the byte value of the jth byte of the information ciphertext, The byte value in the information ciphertext is The number of bytes, A is equal to 256; based on Calculate the normalized entropy value : ; based on Calculate differential features : , where B is the total number of bytes in the information ciphertext; The ciphertext is input into the LSTM network with a window of 64 bytes, and the time series features based on the ciphertext are output. , , represents the ciphertext data window from time step t−63 to time step t; The ciphertext is input into the CNN convolution kernel with a window of 16 bytes, and the local features based on the ciphertext are output. , ; In the formula, is the weight parameter of the CNN convolution kernel, is the bias parameter of the CNN convolution kernel, is a linear rectification function, is the byte in the ciphertext that is offset by c positions starting from time step t; Obtaining hidden features based on dynamic S-box offsets in metadata : ； In the formula, is the loop variable, is the right shift operator, is the bitwise AND operator, is 00001111 in binary; Output feature vector : .

6. The information security data monitoring method based on encryption algorithm according to claim 1 is characterized in that: Based on the feature vector, the federated collaborative anomaly detection is performed to obtain the global anomaly probability and updated model parameters. The specific analysis process is as follows: For the feature vector Perform standardization to obtain anomaly detection vector; The anomaly detection vector is processed based on the multi-anomaly detection algorithm to generate multiple anomaly scores, and then the weighted sum is performed to obtain the comprehensive anomaly score. ; Based on the locally stored anomaly score-anomaly probability mapping table, the local anomaly probability is determined as ; Get the dynamic weight of each node in the federated collaborative anomaly monitoring , aggregate the parameters of each node, based on the dynamic weight of each node Update the model parameters of node f to obtain updated model parameters; Based on the dynamic weight of each node Calculating the probability of anomaly : ； Where F is the total number of nodes for federated collaborative anomaly monitoring, is the local abnormal probability of node f; The abnormal probability Normalized as global anomaly probability .

7. The information security data monitoring method based on encryption algorithm according to claim 6 is characterized in that: Determine whether the global abnormal probability is written into the security event log. The specific analysis process is as follows: The global anomaly probability Compare with the global anomaly probability threshold stored in the database; If the global abnormal probability If it is not less than the global abnormal probability threshold, it will be written into the security event log; If the global abnormal probability If the probability is less than the global anomaly probability threshold, it will not be written into the security event log.

8. The information security data monitoring method based on encryption algorithm according to claim 1 is characterized in that: Construct a multi-factor confidence decision architecture, combine the global abnormal probability, and output the information access confidence score and information access strategy. The specific analysis process is as follows: The multi-factor confidence decision architecture is as follows: ； ； in, Access confidence signals for information output by a multi-factor confidence decision architecture, is the global abnormal probability, is a data sensitive item, e is a natural constant, is the adjustment factor, is the sensitivity critical point, is the IP address difference, is the difference of geographical location information; The information access policy is: comparing the information access confidence signal to an information access confidence threshold stored in a database; If the information access confidence signal is higher than the information access confidence threshold, the information access is allowed; If the information access confidence signal is not higher than the information access confidence threshold, the information access confidence is verified again.

9. The information security data monitoring method based on encryption algorithm according to claim 1 is characterized in that: The environmental context is obtained and combined with the global abnormal probability to adjust the encryption method of context-aware dynamic encryption. The specific analysis process is as follows: Obtain environmental context, including operation frequency and threat intelligence count; Get data sensitivity , operation frequency, threat intelligence volume and data sensitivity Perform weighted summation to obtain the environmental risk coefficient RE; Get the comprehensive risk factor R: ,in, is the global abnormal probability, for The weight factor of The encryption method of the following perceived dynamic encryption is determined based on the comprehensive risk factor-encryption method strategy table stored in the database.

10. An information security data monitoring system based on encryption algorithm, applied to an information security data monitoring method based on encryption algorithm according to any one of claims 1 to 9, characterized in that: It includes information data preprocessing module, perception dynamic encryption module, feature vector output module, global abnormal probability acquisition module, confidence score output module and encryption mode adjustment module, among which: The information data preprocessing module is used to collect the original information data byte stream and preprocess it, and output the preprocessed information data block and information feature matrix; The perceptual dynamic encryption module is used to obtain environmental sensor data, combine the information data block and the information feature matrix to perform context-aware dynamic encryption, obtain information ciphertext and metadata, and write them into the security event log; The feature vector output module is used to extract multimodal ciphertext features based on the information ciphertext and metadata, and output a feature vector; The global anomaly probability acquisition module is used to perform federated collaborative anomaly detection based on feature vectors, obtain the global anomaly probability and updated model parameters, and determine whether the global anomaly probability is written into the security event log; The confidence score output module is used to construct a multi-factor confidence decision framework, combine the global abnormal probability, and output the information access confidence score and information access strategy; The encryption mode adjustment module is used to obtain the environmental context and adjust the encryption mode of the context-aware dynamic encryption in combination with the global abnormality probability.

Images