Distributed data security protection system and method adaptive to network environment

Abstract

The invention relates to the field of network security, and discloses a distributed data security protection system and method adaptive to a network environment. Comprising a self-adaptive protection strategy module, a distributed data processing module, an intelligent threat detection and response module, a data encryption and integrity protection module, a load balancing and resource scheduling module and a unified management and monitoring module which are in communication connection. The self-adaptive protection strategy module is used for dynamically generating and issuing a dynamic protection strategy according to the real-time threat data; and the distributed data processing module is used for deploying a plurality of independent nodes, executing a dynamic protection strategy and sharing attack response data across the nodes. By dynamically generating and adjusting the encryption strategy and the access control measure, the system can adaptively enhance the security protection capability according to the real-time network threat data, meanwhile, the efficient data processing performance is kept, and the security and efficiency requirements are effectively balanced.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, in particular to a distributed data security protection system and method self-adapting to network environment. BACKGROUND

[0002] With the rapid development of information technology, distributed systems have been widely used in various industries. They can realize distributed storage and processing of data, improve the processing capacity and reliability of the system. However, due to the characteristics of numerous nodes, complex network environment, and frequent data interaction, distributed systems face serious security threats such as DDoS attacks, SQL injection, data tampering, and information leakage.

[0003] Most existing data security protection systems use static protection strategies, which are difficult to adjust in real time according to dynamically changing network environments and attack patterns, and have limited protection effects. Existing fixed encryption algorithms and key rotation periods cannot cope with increasingly complex attack methods. When subjected to new attacks, the system often cannot respond effectively in a timely manner. Meanwhile, there is a lack of effective collaborative protection mechanism among nodes in the distributed system. When a node is attacked, other nodes cannot quickly share threat information and take appropriate protective measures, which can easily lead to the spread of attacks. In addition, in terms of load balancing and resource scheduling, existing technologies often only consider the load of nodes, ignoring security threat factors. When a node is attacked, resources cannot be reasonably allocated to ensure the normal operation and defense capabilities of the node. SUMMARY

[0004] To overcome the shortcomings of the prior art, the present application provides a distributed data security protection system and method self-adapting to network environment, which can dynamically generate protection strategies according to network traffic, user behavior, historical attack data, etc., realize collaborative work of each module, effectively cope with various network security threats, and protect the security of distributed data.

[0005] To achieve the above purpose, the present application realizes the following technical scheme: a distributed data security protection system self-adapting to network environment, comprising an adaptive protection strategy module, a distributed data processing module, an intelligent threat detection and response module, a data encryption and integrity protection module, a load balancing and resource scheduling module, and a unified management and monitoring module connected by communication; The adaptive protection strategy module is used to dynamically generate and issue dynamic protection strategies according to real-time threat data. The distributed data processing module deploys multiple independent nodes, executes dynamic protection strategies, and shares attack response data across nodes. The intelligent threat detection and response module: adopts a CNN+LSTM deep learning model to identify attack patterns in real time, and generates real-time threat data input to the adaptive protection strategy module; The data encryption and integrity protection module: dynamically switches encryption algorithms and adjusts encryption strategies based on real-time threat data and dynamic protection strategies; The load balancing and resource scheduling module: dynamically allocates resource weights according to node computing power, load rate, and threat coefficient; The unified management and monitoring module: real-time monitoring of the running state of the above modules, through the global view to show the current protection strategy of the adaptive protection strategy module, the working state of the distributed data processing module, the threat data identified by the intelligent threat detection and response module, the encryption state of the data encryption and integrity protection module, and the resource allocation of the load balancing and resource scheduling module.

[0006] Preferably, the dynamic protection strategy includes at least one of the following: Using different key lengths of AES algorithm and key rotation period; Enable or disable the transmission layer encryption protocol; Limit user access rights and add secondary authentication; Switching dual encryption algorithm combination on demand.

[0007] Preferably, the load balancing and resource scheduling module calculates the node resource weight by the following formula: : the resource weight of the first node; : the computing power of the first node; : the load rate of the first node, : the remaining load capacity of the first node; : the threat coefficient of the first node; : the total number of distributed data processing modules; : the index variable of the node.

[0008] Preferably, the real-time threat data includes one or more of attack behavior real-time data, network traffic real-time data, user behavior anomaly real-time data, and node state real-time data.

[0009] Preferably, the processing logic of each data node in the distributed data processing module is associated with the adaptive protection strategy module and the intelligent threat detection and response module. When an attack is detected, the data node will respond immediately according to the dynamic protection strategy issued by the adaptive protection strategy module.

[0010] Preferably, the load balancing and resource scheduling module allocates computing resources to nodes with high weights based on the calculated resource weights.

[0011] Preferably, the adaptive protection strategy module performs: calculating an encryption strength adjustment coefficient by formula : : encryption strength adjustment coefficient; 、 、 : weight coefficient, representing the importance of attack probability, network traffic coefficient, and historical threat coefficient in encryption strength adjustment; : attack probability; : network traffic coefficient; : historical threat coefficient.

[0012] Preferably, according to value interval triggers four-level encryption strategy: When <0.3: use AES-128 algorithm, key 24-hour rotation, only encrypt sensitive fields; 0.3≤ <0.6: use AES-192+TLS1.3, full-field encryption and enable secondary verification; 0.6≤ <0.8: use AES-256 storage encryption, and pass through fingerprint and face dual-factor biometric authentication; ≥0.8: use AES-256 superimposed SM4 double encryption, unnecessary user permission freezing.

[0013] A distributed data security protection method for adaptive network environment, comprising the following steps: S1. The intelligent threat detection and response module sends the attack mode to the adaptive protection strategy module, and synchronizes the information of the attacked node to all distributed data processing modules; S2. The adaptive protection strategy module calculates the encryption strength adjustment coefficient according to the received attack mode, combined with the historical attack data and current network traffic of the node, and then generates dynamic protection strategies, and distributes these strategies to all distributed data processing modules; S3. The attacked node in the distributed data processing module immediately enhances the encryption strength of local data according to the new dynamic protection strategy, and other nodes improve the vigilance of similar attack traffic according to the shared security data, while assisting the attacked node to share part of the data processing task and reduce its load pressure. S4. The data encryption and integrity protection module replaces the encryption strategy of the attacked node according to the instructions of the adaptive protection strategy module and the real-time threat data of the intelligent threat detection and response module; S5. The load balancing and resource scheduling module recalculates the resource weights of each node according to the changes of the threats of the attacked node.

[0014] Preferably, the following steps are further included: S6. The unified management and monitoring module tracks the response actions of all the above modules in real time, records the protection strategy adjustment time, node resource change situation and encryption state update result.

[0015] The application provides a distributed data security protection system and method for adaptive network environment. The following beneficial effects are provided: 1. The application generates and adjusts encryption strategies and access control measures dynamically, so that the system can adaptively enhance the security protection capability according to real-time network threat data, while maintaining efficient data processing performance, effectively balancing the security and efficiency requirements.

[0016] 2. The application uses a cooperative response mechanism based on distributed nodes, so that when a single node is attacked, other nodes can quickly share threat data and share the load, avoiding system overall paralysis caused by single point failure, and significantly improving the disaster recovery and recovery capability under network attack.

[0017] 3. The application uses the closed-loop feedback of the intelligent threat detection and response module and the strategy execution module combined with artificial intelligence, realizes the full-automatic protection process from attack identification, strategy optimization to resource scheduling, reduces the manual intervention delay, and greatly shortens the response time of new unknown threats. BRIEF DESCRIPTION OF DRAWINGS

[0018] Figure 1 The system architecture diagram of the application is shown in the figure; Figure 2 The flowchart of the application is shown in the figure. DETAILED DESCRIPTION

[0019] The technical solutions in the embodiments of the application will be described below with reference to the drawings in the specification of the application. Obviously, the described embodiments are only part of the embodiments of the application, not all the embodiments. Based on the embodiments in the application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the application.

[0020] Embodiment: Please refer to the attached Figure 1This invention provides a distributed data security protection system for an adaptive network environment, including an adaptive protection strategy module, a distributed data processing module, an intelligent threat detection and response module, a data encryption and integrity protection module, a load balancing and resource scheduling module, and a unified management and monitoring module. Each module interacts with data through a standardized interface protocol. The adaptive protection strategy module generates real-time threat data by analyzing information such as network traffic, user behavior, and historical attack data. Real-time threat data includes one or more of the following: real-time attack behavior data, real-time network traffic data, real-time abnormal user behavior data, and real-time node status data. Based on this, a dynamic protection strategy is generated. The generation of the protection strategy is based on feedback from other modules. According to the attack patterns identified by the intelligent threat detection and response module, encryption strength, access control policies, etc. are adjusted. After the protection strategy is generated, it is transmitted to each data processing node in real time to ensure the consistency of the dynamic protection strategy.

[0021] The distributed data processing module executes data processing tasks according to the security policies provided by the adaptive protection strategy module. Each node not only processes local data independently, but also shares security data and dynamic protection strategies with other nodes in real time. The processing logic of each data node is associated with the adaptive protection strategy module and the intelligent threat detection and response module: if an attack is detected, the node will respond immediately according to the dynamic protection strategy issued by the adaptive protection strategy module.

[0022] The intelligent threat detection and response module utilizes machine learning and artificial intelligence technologies to monitor and analyze network traffic and data behavior in real time. The output of the intelligent threat detection and response module is the immediate identification of security threats. It works closely with the adaptive protection strategy module to provide data input on attack patterns. The identification results of the intelligent threat detection and response module not only affect the adjustment of protection strategies, but are also synchronized to the distributed data processing module in real time so that data nodes can respond to emergencies based on the latest threat data. The intelligent threat detection and response module adopts a CNN+LSTM model. The training dataset contains at least 100,000+ attack samples, including 10 categories such as DDoS and SQL injection, and 500,000+ normal samples, which are divided into training and test sets in a 7:3 ratio. The model parameters are: CNN layer, 2 convolutional layers, 32 / 64 filters, 3×3 kernel size; LSTM layer, 1 layer, 64 neurons; fully connected layer, 128 neurons; 50 iterations; and the model is fine-tuned with new samples every 7 days.

[0023] The data encryption and integrity protection module adopts a dynamic encryption strategy. The system encrypts data in the data transmission and storage process and adjusts the encryption strategy in combination with the security threat data provided by the intelligent threat detection and response module. For example, if a certain type of attack is detected, the data encryption and integrity protection module will automatically enhance the data encryption strength or replace the encryption algorithm. At the same time, it is also responsible for checking the data integrity. If the data is tampered with during transmission, the system will notify other modules and take remedial measures.

[0024] The load balancing and resource scheduling module balances the system load according to network traffic, node performance, and protection needs. The load balancing and resource scheduling module not only schedules node resources according to real-time traffic, but also considers security information provided by the intelligent threat detection and response module. For example, if a node is under attack, the module will schedule more computing resources to the node to ensure that the overall performance of the system is not affected while handling security threats.

[0025] The unified management and monitoring module not only monitors the system running state, but also provides a global view, displaying information such as the health status, response time, threat data, and encryption state of each module. The unified management and monitoring module can reconfigure the adaptive protection strategy module according to the latest attack patterns provided by the intelligent threat detection and response module, and notify the distributed data processing module to adjust. The unified management and monitoring module also provides real-time log recording and alarm functions to ensure that administrators can respond quickly when an exception occurs.

[0026] The relationship between the modules is close and interdependent. The adaptive protection strategy module and the intelligent threat detection and response module interact with each other. The attack intelligence provided by the intelligent threat detection and response module directly affects the adjustment of the protection strategy, while the adaptive protection strategy module provides a unified protection standard for the data processing nodes. The security, load balancing, and performance of the distributed data processing module depend on the real-time feedback of the protection strategy and the intelligent threat detection and response module. The encryption strategy of the data encryption and integrity protection module is dynamically adjusted based on the security intelligence provided by the intelligent threat detection and response module; The intelligent threat detection and response module identifies attack patterns in real time through a 10-second sliding window, synchronizes structured data to the adaptive protection strategy module; the adaptive protection strategy module calculates an encryption strength adjustment coefficient based on the attack pattern, generates a dynamic strategy and issues it to the distributed data processing module through the RabbitMQ message queue, the strategy message is marked with priority, and the emergency level message is transmitted through a dedicated channel; the data processing node executes the strategy and shares security data with other nodes every 30 seconds; the data encryption and integrity protection module adjusts the encryption strength in real time according to the strategy; the load balancing and resource scheduling module collects node load information every 5 seconds and optimizes resource allocation; the unified management and monitoring module realizes global monitoring and abnormal alarm by polling each module state interface every second.

[0027] In actual operation, the intelligent threat detection and response module first monitors and analyzes network traffic and data behavior in real time, and when there is abnormal network packet transmission, the module identifies that this may be an attack behavior through machine learning algorithm, determines the attack pattern, inputs the attack pattern data to the adaptive protection strategy module, and synchronizes the identification result to the distributed data processing module in real time; Specifically, it includes: S1. Value calculation After the adaptive protection strategy module receives the attack pattern information, it combines network traffic, user behavior, historical attack data, etc., and calculates the encryption strength adjustment coefficient through the formula , wherein : Encryption strength adjustment coefficient, used to dynamically adjust the data encryption strength, the larger the value, the higher the encryption strength.

[0028] , , : Weight coefficient, representing the importance of attack probability, network traffic coefficient, and historical threat coefficient in encryption strength adjustment, and satisfying .

[0029] : Attack probability, indicating the possibility of the system being attacked, the value range is usually 0 to 1, and the attack probability value is output by the intelligent threat detection and response module through real-time inference on collected data.

[0030] : Network traffic coefficient, reflecting the influence of the current network traffic on the encryption strength, taking values related to network traffic conditions, obtaining real-time CPU usage, memory occupancy, network bandwidth utilization, data packet retransmission rate, and abnormal traffic proportion of each distributed node through the load balancing and resource scheduling module, and normalizing the above indicators respectively.

[0031] : Historical threat coefficient, based on the system's past security threat situation, reflecting the influence of historical attacks on the current encryption strategy, calculating the coefficient through the historical attack event number, average attack duration, and data loss caused by attacks obtained from the full-link log data of the unified management and monitoring module.

[0032] In a specific embodiment, the attack probability , the network traffic coefficient , the historical threat coefficient , the weight coefficient , , , the encryption strength adjustment coefficient is: According to the coefficient, the adaptive protection strategy module generates dynamic protection strategies, such as enhancing encryption strength and adjusting access control strategies, and transmits the protection strategies to each distributed data processing module in real time; the specific rules are as follows: When < 0.3, corresponding to "basic level" encryption: using AES-128 algorithm, key rotation every 24 hours, only encrypting sensitive fields in transmission such as user password, bank card number, etc., non-sensitive data not encrypted, and allowing all authenticated users to access resources within their permission range, only limiting sensitive operations for anonymous users, login authentication method is "username + password"; When 0.3 ≤ < 0.6, corresponding to "advanced level" encryption: upgrading to AES-192 algorithm, key rotation period shortened to 12 hours, encrypting all transmission data, and enabling transmission layer TLS1.3 protocol to prevent man-in-the-middle attacks, and adding "secondary verification" for high-privilege users, limiting single IP single day data download volume ≤10GB, and prohibiting batch operations outside working hours; When 0.6 ≤ When the value is less than 0.8, the corresponding "Advanced" encryption is enabled: the AES-256 algorithm is enabled, the key is rotated every 6 hours, and field-level encryption is performed on the stored data in addition to transmission encryption. The encryption key is generated and managed by the Hardware Security Module (HSM). User login requires dual authentication of "password + biometrics (fingerprint / face)". Sensitive resources are only allowed to be accessed by internal network IPs. External IPs need to be redirected through VPN + bastion host. The entire operation is recorded and audited. when When the value is ≥0.8, the corresponding "urgent level" encryption is adopted: AES-256+SM4 dual encryption algorithm is used, that is, AES-256 encryption is used first, and then SM4 encryption is used for secondary encryption. The key is rotated every hour. At the same time, the data check value, including the hash result, is also encrypted to prevent the check value from being tampered with. The access permissions of non-essential users are temporarily frozen, and only 3-5 core administrator accounts are retained. Access to sensitive resources requires approval from two administrators respectively. At the same time, all external API interfaces are closed, and only local console operations are allowed. And according to Value calculation → Key generation → Encryption execution → Strength verification execution S2. Dynamic Key Generation Key length varies The value changes dynamically; the core formula is: in: The actual effective key length of the current encryption algorithm (in bits); The base key length corresponding to the encryption level (e.g., AES-192) Bit); and The corresponding encryption level Lower and upper limits of the value range (e.g., "advanced" encryption) , ), specifically when When using the AES-192 algorithm, That is, the actual effective key length is 64 bits, whichever comes first. The value gradually increases and approaches the upper limit of 192 bits.

[0033] AES-256+SM4 dual encryption algorithm composition: in: Plaintext data; The key for the AES-256 algorithm is 256 bits, and is composed of... Formula combination Value generation; SM4 algorithm key, 128 bits, based on node hardware feature code and value hash generation; AES-256 encryption process, output intermediate ciphertext; SM4 encryption process, secondary encryption of intermediate ciphertext, output final ciphertext .

[0034] The formula specifies the execution order and key association of double encryption, ensuring encryption strength can be verified by mathematical logic.

[0035] To verify whether the encryption strength meets the value corresponding to the level requirements, the check formula is as follows: Wherein is the key length threshold value corresponding to the , bits. When , it is determined that the encryption strength meets the standard; otherwise, the key regeneration process is triggered until the threshold requirement is met. After supplementing the core encryption algorithm formula, the scheme forms a complete closed loop from "value calculation key generation encryption execution strength verification", which not only can more accurately control the dynamic change of encryption strength with value, but also provides a quantifiable verification standard for the effectiveness of the encryption strategy.

[0036] The distributed data processing module executes data processing tasks according to the received security policy. Each node shares security data and dynamic protection policy with other nodes in real time while processing local data. When a node receives attack identification results and new protection policies, it immediately adjusts its data processing logic and performs data processing and security protection according to the new protection policy.

[0037] The data encryption and integrity protection module adopts a dynamic encryption strategy, adjusts the encryption strategy according to the security threat data provided by the intelligent threat detection and response module and the protection policy generated by the adaptive protection policy module. In the process of data transmission and storage, the data is encrypted, and a hash function The hash value of the data is calculated, and the data integrity is verified by comparing the hash values of the sending end and the receiving end, : The hash value of data M, which is the unique identifier obtained after the hash calculation of data M, is used to verify the data integrity.

[0038] : The original data that needs to be hashed.

[0039] and : A large prime number, a fixed parameter used in hash calculation, to ensure the uniqueness and security of the hash value.

[0040] Specifically, the sender performs hash calculation on the data M to obtain H(M), and sends M and H(M) to the receiver. After receiving the data, the receiver recalculates the hash value H'(M) of M. If H'(M) is inconsistent with H(M), it means that the data has been tampered with during transmission. The system will immediately notify other modules such as the intelligent threat detection and response module, adaptive protection policy module, etc., and take remedial measures such as interrupting data transmission, resending data, etc. The load balancing and resource scheduling module is always concerned about network traffic, node performance, and security information provided by the intelligent threat detection and response module. In a specific embodiment, there are three distributed data processing modules in the system, namely node 1, node 2, and node 3. After detection, the computing power of node 1 C1 = 100, the load rate L1 = 0.3, and the threat coefficient T1 = 0.5; the computing power of node 2 C2 = 80, the load rate L2 = 0.4, and the threat coefficient T2 = 0.3; the computing power of node 3 C3 = 120, the load rate L3 = 0.2, and the threat coefficient T3 = 0.2. According to the node resource weight formula : The resource weight of the first node determines the proportion of the node in the system resource allocation. The higher the weight, the more resources it obtains.

[0041] : The computing power of the first node reflects the hardware and software performance of the node in processing data and responding to security threats.

[0042] : The load rate of the first node indicates the current load degree of the node, represents the remaining load capacity of the node.

[0043] : The threat coefficient of the first node reflects the severity of the security threat currently faced by the node. The greater the threat, the higher the coefficient value.

[0044] : The total number of distributed data processing modules.

[0045] ​​​​: Index variable of the node, used to traverse all nodes for summation calculation.

[0046] First, calculate the denominator part: The denominator sum is 105 + 62.4 + 115.2 = 282.6 Then the resource weight of each node is: According to the calculated resource weight, the load balancing and resource scheduling module will allocate more computing resources to the nodes with higher weight, especially when the threat coefficient of the node is high. By increasing resource allocation, it ensures that the node can maintain good processing performance when facing potential attacks, while avoiding the node occupying too much unnecessary resources due to relatively low load and threat conditions, thereby achieving balanced overall load and efficient use of resources. The unified management and monitoring module monitors the running state of the entire system in real time, and displays the current protection strategy of the adaptive protection strategy module, the working state of the distributed data processing module, the threat data identified by the intelligent threat detection and response module, the encryption state of the data encryption and integrity protection module, and the resource allocation of the load balancing and resource scheduling module, etc.

[0047] When the intelligent threat detection and response module detects a new type of attack pattern, it will synchronize this information to the unified management and monitoring module, which will reconfigure the adaptive protection strategy module according to this latest attack pattern, such as instructing it to adjust the encryption algorithm for this new attack pattern. At the same time, the unified management and monitoring module notifies all distributed data processing modules to update the local dynamic protection strategy to deal with the new attack. In addition, the unified management and monitoring module will record the process in real time, and if there are abnormal situations such as node response timeout, encryption strategy adjustment failure, etc. during the process, the unified management and monitoring module will immediately trigger the alarm function, and notify the administrator through sound, pop-up window, etc. so that the administrator can intervene in time.

[0048] In a specific embodiment, a distributed data security protection method for adaptive network environment, Based on the above-mentioned distributed data security protection method, the following steps are included: S1. The intelligent threat detection and response module sends attack patterns such as attack traffic characteristics and attack frequency to the adaptive protection strategy module, and synchronizes the information of the node under attack to all distributed data processing modules.

[0049] S2. The adaptive protection strategy module, based on the received attack patterns, combined with the node's historical attack data and current network traffic, calculates a higher encryption strength adjustment coefficient using the encryption strength adjustment coefficient formula. The system generates protection policies to enhance the encryption strength of the node's data and restrict access from abnormal IPs. These policies are then distributed to all distributed data processing modules, with a focus on ensuring that the protection policies of the attacked nodes are updated. If a node does not return confirmation within 5 seconds, the policy is automatically resent up to 3 times. If it still fails, the node is marked as "policy synchronization failed," and the unified management and monitoring module immediately pops up an alarm, including the node ID and the reason for the failure. If no confirmation is received within 1 minute, the administrator is called and an SMS is sent.

[0050] S3. In the distributed data processing module, the attacked node immediately enhances the encryption strength of its local data according to the new protection strategy and intercepts connection requests initiated by abnormal IPs; other nodes, based on shared security data, increase their vigilance against similar attack traffic and assist the attacked node in sharing some data processing tasks to reduce its load pressure.

[0051] S4. The data encryption and integrity protection module changes the encryption strategy of the attacked node based on the instructions of the adaptive protection strategy module and the real-time threat data of the intelligent threat detection and response module. It adopts a more difficult-to-crack encryption method and strengthens the integrity verification of the data transmission process of the node to prevent data from being tampered with or stolen during transmission.

[0052] S5. The load balancing and resource scheduling module recalculates the resource weights of each node based on the increased threat coefficient of the attacked node, and schedules some of the computing resources originally allocated to other nodes to the attacked node, thereby improving its data processing and attack defense capabilities and ensuring that the overall system performance is not seriously affected. S6. The unified management and monitoring module tracks the response actions of all the above modules in real time, recording information such as the time of protection policy adjustment, changes in node resources, and encryption status update results. If the load on the attacked node remains too high or the attack is not effectively contained, the unified management and monitoring module will promptly issue an alarm, reminding the administrator to take further measures, such as manually blocking the attack source or temporarily adding backup nodes.

[0053] Through this close collaboration between the modules, the system can quickly and effectively respond to various network security threats, fully demonstrating the highly interconnected and interdependent nature of the modules in this invention, and ensuring the system's security, stability, and efficiency.

[0054] While embodiments of the application have been shown and described, it is to be understood that the embodiments described are merely exemplary of the principles and application of the present application. Numerous modifications and adaptions can be effected without departing from the spirit and scope of the present application, which is not limited to the exact construction and arrangement described. It is intended, therefore, to cover all modifications and adaptions that fall within the scope of the claims and their equivalents.

Claims

1. A distributed data security protection system that self-adapts to network environments, characterized by: The adaptive protection strategy module, the distributed data processing module, the intelligent threat detection and response module, the data encryption and integrity protection module, the load balancing and resource scheduling module, and the unified management and monitoring module are connected by communication. The adaptive protection strategy module is configured to dynamically generate and issue a dynamic protection strategy according to real-time threat data. The distributed data processing module is configured to deploy multiple independent nodes, execute the dynamic protection strategy, and share attack response data across nodes. The intelligent threat detection and response module is configured to use a CNN+LSTM deep learning model to identify attack patterns in real time and generate real-time threat data to input into the adaptive protection strategy module. The data encryption and integrity protection module is configured to dynamically switch encryption algorithms and adjust encryption strategies based on real-time threat data and dynamic protection strategies. The load balancing and resource scheduling module is configured to dynamically allocate resource weights based on node computing capacity, load rate, and threat coefficient. The unified management and monitoring module is configured to monitor the running state of the above modules in real time, and display the current protection strategy of the adaptive protection strategy module, the working state of the distributed data processing module, the threat data identified by the intelligent threat detection and response module, the encryption state of the data encryption and integrity protection module, and the resource allocation of the load balancing and resource scheduling module through a global view.

2. The distributed data security system for adaptive network environment of claim 1, wherein: The dynamic protection strategy includes at least one of the following: Using different key lengths of AES algorithm and key rotation period; Enabling or disabling transport layer encryption protocol; Limiting user access rights and adding secondary authentication; Switching dual encryption algorithm combination on demand.

3. The distributed data security system for adaptive network environment of claim 1, wherein: The load balancing and resource scheduling module calculates the node resource weight by the following formula: : Resource weight of the th node; : Computing power of the th node; : Load rate of the th node, : Remaining load capacity of the th node; : Threat coefficient of the th node; : Total number of distributed data processing modules; : Index variable of the node.

4. The distributed data security system for adaptive network environment of claim 1, wherein: The real-time threat data includes one or more of attack behavior real-time data, network traffic real-time data, user behavior anomaly real-time data, and node state real-time data.

5. The distributed data security system for adaptive network environment of claim 1, wherein: The processing logic of each data node in the distributed data processing module is associated with the adaptive protection strategy module and the intelligent threat detection and response module. When an attack is detected, the data node will respond immediately according to the dynamic protection strategy issued by the adaptive protection strategy module.

6. The distributed data security system for adaptive network environment of claim 3, wherein: The load balancing and resource scheduling module allocates computing resources to nodes with high weights based on the calculated resource weights.

7. The distributed data security system for adaptive network environment of claim 1, wherein: The adaptive protection strategy module performs: calculating the encryption strength adjustment coefficient by formula : : encryption strength adjustment coefficient; , , : weight coefficient, respectively representing the importance of attack probability, network traffic coefficient, and historical threat coefficient in encryption strength adjustment; : attack probability; : network traffic coefficient; : historical threat coefficient.

8. The distributed data security system for adaptive network environment of claim 7, wherein: According to Value interval triggers a four-level encryption policy: When <0.3: AES-128 algorithm is used, the key is rotated every 24-48 hours, and only sensitive fields are encrypted; 0.3≤ <0.6: AES-192 + TLS1.3, full field encryption with 2nd factor authentication 0.6≤ <0.8: AES-256 storage encryption with dual-factor biometric authentication via fingerprint and facial recognition; ≥ 0.8: AES-256 superimposed SM4 double encryption, unnecessary user permissions freeze.

9. A distributed data security protection method of adaptive network environment, based on the distributed data security protection system of adaptive network environment of any one of claims 1-8, characterized in that: The method includes the following steps: S1. The intelligent threat detection and response module sends the attack pattern to the adaptive protection strategy module and synchronizes the information that the node is attacked to all distributed data processing modules; S2. The adaptive protection strategy module calculates the encryption strength adjustment coefficient according to the received attack mode, in combination with the historical attack data and the current network traffic of the node , and further generates dynamic protection strategies, and distributes these strategies to all distributed data processing modules; S3. The attacked node in the distributed data processing module immediately enhances the encryption strength of local data according to the new dynamic protection strategy, and other nodes improve the alertness to similar attack traffic based on shared security data, while assisting the attacked node to share part of the data processing task and reduce the load pressure; S4. The data encryption and integrity protection module changes the encryption strategy of the attacked node according to the instructions of the adaptive protection strategy module and the real-time threat data of the intelligent threat detection and response module; S5. The load balancing and resource scheduling module recalculates the resource weights of each node according to the changes in the threat of the attacked node.

10. The method of claim 9, wherein: The method further includes the following steps: S6. The unified management and monitoring module tracks the response actions of all the above modules in real time, records the protection policy adjustment time, node resource change situation and encryption state update results.

Images