Real-time data stream classification and security policy self-adaption system based on AI model

Abstract

The invention belongs to the technical field of multi-source heterogeneous data processing and intelligent strategy self-adaption, and discloses a real-time data stream classification and security strategy self-adaption system based on an AI model, which comprises the following steps: acquiring a multi-source heterogeneous data stream, injecting five-dimensional semantic tags, complementing an implicit relationship among the tags through association reasoning, and generating a standardized enhanced data stream; the optimal AI model is matched to execute real-time data flow classification, credibility grading is carried out, and a candidate strategy set is generated through matching; matching an association rule through a rule relation graph, and combining system real-time state mirror image execution strategy influence chain rehearsal to generate a rehearsal verification strategy set; cross-domain transactions are packaged according to cross-domain transaction description specifications, and transaction execution states and physical feedback data are collected in real time through four-stage submission protocol execution; life cycle management is implemented through rule efficiency evaluation, and a rule evolution instruction and sample enhancement data are obtained by combining full-link auditing and are fed back to a preorder link to form a closed loop.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of multi-source heterogeneous data processing and intelligent strategy adaptation, more specifically, the present application relates to a real-time data stream classification and security policy adaptation system based on an AI model. BACKGROUND

[0002] With the deep digitalization of industrial internet, financial technology and other fields, multi-source heterogeneous data streams (device signals, network logs, business data, etc.) have experienced explosive growth, and there is an urgent need for real-time classification and dynamic security policy adaptation. However, such data protocols are diverse, complex in semantics, and need to adapt to dynamic scenarios (device load, compliance updates, etc.), and traditional static processing and policy mechanisms cannot achieve the full-link collaboration of "data-policy-execution", resulting in insufficient efficiency and security.

[0003] Existing solutions start from single-link optimization and have some limitations: the data processing link only focuses on format standardization, lacks semantic enhancement and association completion, and lacks feature support; the AI classification link relies on fixed models and single confidence evaluation, and the reliability is limited; the policy matching link is only based on simple label association, ignoring the conflict and dependency relationship between policies, which can easily cause execution logic contradictions; the cross-domain execution link lacks standardized packaging and strong consistency guarantee, and is prone to execution failure. SUMMARY

[0004] In order to overcome the above-mentioned defects of the prior art, in order to achieve the above-mentioned purposes, the present application provides the following technical scheme: a real-time data stream classification and security policy adaptation system based on an AI model, comprising: Data access and semantic enhancement unit: acquire multi-source heterogeneous data streams, perform hierarchical processing according to dynamic quality rules, inject five-dimensional semantic labels and complete the implicit relationship between labels through association reasoning, and generate standardized enhanced data streams; AI classification and candidate policy matching unit: based on the standardized enhanced data stream, match the optimal AI model and schedule the execution of real-time data stream classification, perform confidence grading through four-dimensional confidence evaluation, and generate a candidate policy set through double-condition policy rule base matching; Strategy pre-rehearsal optimization unit: based on the candidate policy set, match the association rules through the rule relationship graph, execute the strategy impact chain pre-rehearsal combined with the system real-time state mirror, and generate a pre-rehearsal verification policy set through multi-scenario optimization; Execution feedback unit: based on the pre-rehearsal verification policy set, encapsulate cross-domain transactions according to the cross-domain transaction description specification, execute through the four-phase commit protocol, and real-time collect transaction execution state and physical feedback data; Enhanced closed-loop unit: Based on transaction execution status and physical feedback data, lifecycle management is implemented through rule performance evaluation, samples are extracted to enhance the AI ​​model, and combined with full-link auditing, rule evolution instructions and sample enhancement data are obtained and fed back to the preceding links to form a closed loop.

[0005] Furthermore, the method of graded handling according to dynamic quality rules includes: It receives multi-source heterogeneous data streams, identifies the protocol type through an intelligent access gateway, and parses and converts them into standardized data streams. Based on dynamic quality rules that consider three dimensions—completeness, timeliness, and accuracy—the overall quality of standardized data streams is evaluated and classified. Based on the comprehensive quality classification, corresponding optimization processing is carried out through a graded handling mechanism to obtain a standardized data stream with optimized quality.

[0006] Furthermore, the generation method of the standardized enhanced data stream includes: Define a five-dimensional enhanced semantic tagging system encompassing basic, business, security, environmental, and physical dimensions; Based on the standardized data stream after quality optimization, load corresponding semantic tag value templates for different business scenarios; By using field-label mapping rules, initial semantic labels are added to the standardized data stream according to the five-dimensional enhanced semantic labeling system. The integrity of the semantic labels is verified and missing semantic labels are marked as to be completed. For missing items to be filled, the implicit relationships between the initial semantic tags and the missing items are filled in by a pre-built semantic association reasoning engine based on cross-dimensional reasoning rules; The completed semantic tags are integrated and encapsulated with the standardized data stream to generate a standardized enhanced data stream containing complete five-dimensional semantic tags.

[0007] Furthermore, the method of matching the optimal AI model and scheduling the execution of real-time data stream classification, and classifying credibility through four-dimensional credibility assessment, includes: Based on standardized enhanced data flow, data features and key semantic labels are parsed and extracted, a pre-built AI model library is called, and the optimal AI model is selected through a multi-condition decision tree. It is then scheduled to the target computing node, where real-time data stream classification is performed based on the extracted data features, and the classification labels and model confidence scores are output. Based on the classification results of the AI ​​model, the credibility of the model classification results is evaluated and graded using four dimensions: model confidence, historical consistency, semantic conformity, and environmental adaptability. By using a hierarchical processing pipeline to perform hierarchical optimization on different confidence levels, the final optimized classification result is obtained.

[0008] Furthermore, the method for generating the candidate strategy set includes: Based on the optimized classification results and associated key semantic tags, a dual-condition strategy mapping rule library with classification tags as the main condition and semantic tags as the auxiliary condition is invoked. The corresponding rule group in the rule base is located by the classification label and the two-condition strategy is mapped. Within the rule group, the semantic label is used to initially filter the rules that meet the conditions. The strategy priority of the strategies corresponding to the initial screening rules is evaluated, and the main strategy and alternative strategies are obtained by screening according to the strategy priority, and then integrated into a candidate strategy set.

[0009] Furthermore, the method of matching association rules through a rule relationship graph includes: Based on the candidate strategy set, the key attributes of each candidate strategy are parsed, and a pre-set rule relationship graph containing the full set of strategy relationships is invoked to map each candidate strategy to a candidate strategy node in the rule relationship graph. By matching key attributes, four types of associations—conflict, dependency, reinforcement, and redundancy—are extracted from the candidate strategy and rule relationship graph and used as relationship edges. For each candidate strategy node, first-order relation edges are retrieved to obtain directly associated strategies, and indirect associated strategies are derived through multi-order relation edges, forming a relation network with candidate strategies as the core.

[0010] Furthermore, the generation method of the pre-verification strategy set includes: By integrating real-time data from multiple sources to construct a real-time state image of the system, and based on a relationship network with candidate strategies as the core, the system simulates the chain reaction of candidate strategy execution through the real-time state image, records the pre-exercise report and marks conflicts, and obtains the pre-exercise results of the strategy influence chain. Based on the policy influence chain pre-simulation results, an independent simulation scenario is constructed for each candidate policy and related policies, and the priority score of each policy is obtained through multi-plan simulation. The conflict resolution rule base is invoked to eliminate conflict markers in the pre-rehearsal report. Then, by combining priority scores and secondary evaluation, the optimal primary / backup strategy without conflict is selected and integrated into a pre-rehearsal verification strategy set.

[0011] Furthermore, the method of encapsulating cross-domain transactions according to the cross-domain transaction description specification includes: Based on the pre-verification strategy set, the cross-domain transaction description specification is loaded, and then cross-domain transaction metadata containing unique identifiers and context is constructed. Sub-transactions are broken down and defined into four categories: network, physical, resource, and security. These sub-transactions are then integrated with cross-domain transaction metadata and encapsulated into a complete transaction package that can be executed across domains, using the structural framework of the cross-domain transaction description specification.

[0012] Furthermore, the method of executing the four-phase commit protocol and collecting transaction execution status and physical feedback data in real time includes: Based on the complete transaction package, sub-transactions are executed through a four-phase commit protocol of preparation, pre-execution, physical verification, and commit. Real-time tracking of various monitoring indicators during the execution of sub-transactions, integration to generate the final transaction execution status, and synchronous collection of physical feedback data.

[0013] Furthermore, the methods for obtaining the rule evolution instructions and sample enhancement data include: Based on transaction execution status and physical feedback data, a four-dimensional rule performance evaluation mechanism is constructed based on business objectives to conduct comprehensive performance evaluation and divide it into different levels, thereby managing the strategy lifecycle by level. By combining the end-to-end log auditing process, the root cause of the problem is located and a source tracing report is generated; the instructions for generating source tracing reports are evolved based on the performance evaluation results and the source tracing report generation rules. Simultaneously, abnormal data with classification errors and policy failures in the data stream are aggregated and cleaned to become sample augmentation data for the AI ​​model; The rule evolution instructions are pushed to the corresponding preceding steps, and the sample augmentation data is pushed to the AI ​​model for enhanced training.

[0014] The technical effects and advantages of the real-time data stream classification and security policy adaptive system based on AI model of this invention are as follows: This invention breaks through the limitations of traditional data processing, which only focuses on format conversion, by accessing multi-source data, handling quality classification, and injecting five-dimensional semantic tags and completing relationships. It endows data with deep semantic association information, provides feature support for subsequent steps, and improves the utilization value and adaptation accuracy of data. Secondly, by using dynamic optimal model scheduling and four-dimensional credibility assessment, the problems of static model selection and single credibility assessment in traditional models are solved. This ensures the reliability of classification results, adapts to different computing power environments, and balances classification accuracy and efficiency. Then, through rule relationship graph association matching and system state mirror simulation, the upgrade from single strategy matching to global association analysis was realized, avoiding strategy conflicts and resource competition, and improving the rationality and effectiveness of strategy execution. Next, by encapsulating cross-domain transaction specifications and using a four-phase commit protocol, the pain point of insufficient consistency in traditional cross-domain execution is solved, ensuring strong consistency and traceability of cross-network and cross-device transaction execution and reducing execution anomalies; Finally, by implementing performance evaluation and hierarchical management, extracting abnormal samples to enhance the AI ​​model, and conducting full-chain auditing, a closed-loop mechanism of "execution-evaluation-optimization" is constructed. This mechanism drives the continuous evolution of strategies and AI models based on actual feedback, enabling the system to dynamically adapt to changes in business scenarios and the environment, thereby improving overall adaptability and robustness. Attached Figure Description

[0015] Figure 1 This is a schematic diagram of the real-time data stream classification and security policy adaptive system based on an AI model according to the present invention. Figure 2 This is a schematic diagram illustrating the process of generating candidate policy sets in the AI-based real-time data stream classification and security policy adaptive system of the present invention. Figure 3 This is a schematic diagram of the real-time data stream classification and security policy adaptive method based on an AI model according to the present invention. Detailed Implementation

[0016] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0017] Example 1 Please see Figure 1 and Figure 2 As shown in this embodiment, the real-time data stream classification and security policy adaptive system based on an AI model includes: Data access and semantic enhancement unit: acquires multi-source heterogeneous data streams, performs hierarchical processing according to dynamic quality rules, injects five-dimensional semantic labels, and completes the implicit relationships between labels through association reasoning to generate standardized enhanced data streams; AI classification and candidate strategy matching unit: Based on standardized enhanced data stream, it matches the optimal AI model and schedules the real-time data stream classification, performs credibility grading through four-dimensional credibility assessment, and generates candidate strategy sets through matching with a two-condition strategy rule base. Strategy Pre-play Optimization Unit: Based on the candidate strategy set, it matches associated rules through rule relationship graph, combines the real-time state mirror of the system to perform strategy impact chain pre-play, and generates a pre-play verification strategy set through multi-plan optimization; Execution Feedback Unit: Based on the pre-verification strategy set, it encapsulates cross-domain transactions according to the cross-domain transaction description specification, executes them through the four-phase commit protocol, and collects transaction execution status and physical feedback data in real time; Enhanced closed-loop unit: Based on transaction execution status and physical feedback data, lifecycle management is implemented through rule performance evaluation, samples are extracted to enhance the AI ​​model, and combined with full-link auditing, rule evolution instructions and sample enhancement data are obtained and fed back to the preceding links to form a closed loop.

[0018] The methods for tiered handling based on dynamic quality rules include: The system receives raw data from four types of data sources as a multi-source heterogeneous data stream through hardware interfaces (such as industrial bus interfaces, Ethernet ports, and wireless modules) and software interfaces (such as APIs and message queue subscriptions). These sources include industrial sensors (such as reactor temperature sensors (4-20mA analog signals) and motor vibration sensors (digital pulse signals)), network devices (such as switch traffic logs (NetFlow protocol) and firewall blocking records), business systems (such as ERP order data and MES production work orders), and physical monitors (such as workshop temperature and humidity monitors (Modbus protocol) and equipment power supply status monitors (OPC-UA protocol)). The incoming data is stored in a temporary buffer and automatically given a unique initial ID for end-to-end tracking. The protocol type is identified by calling the industry-standard protocol adaptive parsing matrix (i.e., protocol classification matrix) through the intelligent access gateway; An exemplary protocol parsing method is as follows: extract the data frame of the original data, parse the data frame header (such as Modbus slave address + function code, TCP / IP source port + protocol field) as the data frame feature; match the data frame feature with the built-in mainstream protocol fingerprint database (including field length, check bit rules, key fields, etc.) (if the matching degree is ≥ the preset matching threshold (such as 90%), the protocol is confirmed); if the matching fails (such as unknown protocol), it is marked as pending parsing and a manual intervention process is triggered (the original features of the unidentified data are recorded synchronously for updating the fingerprint database); After confirming the protocol, the corresponding protocol parser is invoked to parse and convert the data into a standardized data stream. Specifically, key information is extracted from the raw data (such as "register address" and "value" in Modbus data frames, and "source IP" and "destination port" in TCP / IP packets); the extracted fields are mapped to the system's general data template (i.e., uniformly formatted as "timestamp, data source ID, field name, field value, and unit"), and the data types are uniformly converted to string and numeric types. For the transformed standardized data stream, dynamic quality rules are defined, including integrity indicators, timeliness indicators, and accuracy indicators; The integrity index is calculated by comparing the field missing information of the actual data with the preset data template (i.e., the required field template, with different templates for different data sources, such as the temperature sensor template which contains required fields such as "time stamp, temperature value, and device ID"). The index is then calculated as (1 - number of missing required fields / total number of required fields) as the quantitative value of the integrity index (for example, if one of the three required fields is missing, the quantitative value is approximately 0.67). Timeliness index: Extract the data generation timestamp (e.g., sensor acquisition time) and the gateway reception timestamp (system time when the gateway receives the data), and take the difference between the two as the transmission delay. Based on the preset maximum delay tolerance threshold, take the difference between the maximum delay tolerance threshold and twice the transmission delay as the quantified value of the timeliness index (if the difference is negative, the quantified value is recorded as 0). For example, if the maximum delay tolerance threshold is 100ms, then the timeliness index = max(0, 100 - delay ms × 2). If the delay is 10ms, the quantified value of the timeliness index = 80 points; if the delay is 50ms, the quantified value of the timeliness index = 0 points. Accuracy index: Call the benchmark value library (a database that stores data such as equipment calibration values, historical averages, and process standard values, such as the normal temperature benchmark value of the reactor being 80℃±5℃); take (1-deviation rate) as the quantified value of the accuracy index (deviation rate = |measured value - benchmark value| / benchmark value, for example: measured value 85℃, benchmark 80℃, deviation rate = 6.25%, quantified value ≈ 0.94); Based on the dynamic weights preset for the business scenario (default: completeness 50%, timeliness 30%, accuracy 20%, which can be adjusted through rule configuration or expert experience, such as prioritizing accuracy for financial data, with the weight adjusted to 30%), the three quantitative values ​​are weighted and integrated to obtain the comprehensive quality, which is then divided into different quality levels using the threshold segmentation method. Based on the comprehensive quality classification, corresponding actions will be taken through a tiered handling mechanism. The tiered handling mechanism involves calling the corresponding preset methods for different quality levels to perform the appropriate processing. For example: Overall quality < 0.6 (low quality data): Trigger a retransmission command. The gateway sends a retransmission request to the data source and sets a maximum number of retries, such as 3 times. If the maximum number of retries is reached and the retransmission still fails to meet the standard, the data is marked as invalid (and will not participate in subsequent processing). 0.6 ≤ Overall Quality < 0.8 (Medium Quality Data): The overall quality is linearly mapped to a correction coefficient (e.g., 0.6 → 0.8, 0.79 → 0.9). The correction coefficient is associated with the data ID and used to adjust the weights in subsequent semantic label generation and AI classification (e.g., the data analysis weight of a correction coefficient of 0.8 is reduced by 20%). A "Quality Level: Medium" label is added to the data header to indicate that it should be used with caution in subsequent steps. Overall quality ≥ 0.8 (high-quality data): The data does not require additional processing. A "quality level: excellent" label is added, and the data is quickly pushed to the subsequent semantic label injection stage through the buffer. To reduce latency, high-quality data can occupy the gateway transmission bandwidth first.

[0019] Standardized methods for generating enhanced data streams include: The system invokes a pre-defined five-dimensional semantic tag framework, defining a five-dimensional enhanced semantic tag system with basic, business, security, environmental, and physical dimensions as its core, including the fields and generation rules for each dimension; The basic dimensions include: data source fingerprint (such as sensor unique ID), acquisition time sequence, format fingerprint (verification value after data standardization) and protocol type (such as Modbus / OPC-UA), and the field values ​​are directly extracted from the standardized data stream; Business dimensions include business process ID (such as production work order number), business stage (such as start-up, steady state, shutdown), criticality level (core and non-core), and business value (divided into 1-10 points). Based on data source association, the business knowledge graph built according to industry experience is automatically matched (such as "reactor sensor" associated with "chemical production process ID"). Security dimensions include sensitivity levels (high, medium, and low), compliance requirements (such as Cybersecurity Classified Protection 2.0 or GDPR), risk correlation (such as the correlation with data breach risk), and security baseline (normal data fluctuation range). The initial values ​​of these can be preset according to the data source type (such as "high" sensitivity level for "financial transaction data" by default). Environmental dimensions include network status (bandwidth and latency), device load (CPU and memory usage), topology location (edge ​​computing nodes or cloud computing nodes), and resource status (used to determine whether computing power is sufficient). These are obtained synchronously through a real-time monitoring interface (e.g., edge nodes push device load data every 10ms). Physical dimension: includes associated equipment (such as reactor number), physical constraints (such as temperature limit of 100℃), control dependencies (such as dependent on the on / off state of valve A), and safety thresholds (such as pressure critical value of 0.8MPa), matched from the company's equipment database (such as the physical constraint parameters of "vibration sensor" associated with "motor model M300"); For different business scenarios (such as chemical industry and finance), load the corresponding semantic tag value templates (such as the physical dimension of chemical industry focuses on "pressure and temperature", and the security dimension of financial industry focuses on "compliance terms"). Traverse the standardized data stream after quality optimization, and add initial semantic tags to the standardized data stream according to the field-tag mapping rules and the five-dimensional enhanced semantic tag system; The field-tag mapping rules are as follows: For basic dimensions, fields such as data source ID, timestamp, format validation value, and protocol type are directly extracted from the standardized data stream and filled into the corresponding tags; business and physical dimensions are injected in batches through a preset association table of "data source-business-device" (e.g., "sensor ID=S1001→business process ID=P2025→associated device=reactor R5"); and security and environmental dimensions are injected in combination with real-time data (e.g., the "device load" of the environmental dimension is taken from the real-time value of the monitoring system). Check if any of the tags added to each dimension are missing (such as "data source fingerprint" in the basic dimension and "security threshold" in the physical dimension, which are required fields). Mark missing items as to be completed and trigger the association reasoning process. The associative reasoning process is as follows: For missing items to be filled, the implicit relationships between the initial semantic tags and the missing items are filled in by a pre-built semantic associative reasoning engine based on cross-dimensional reasoning rules; Specifically, the system activates the pre-built semantic association reasoning engine and loads the pre-defined cross-dimensional reasoning rules (extracted from business scenarios based on expert experience). Exemplary cross-dimensional inference rules: Rule 1: If the business dimension = "reactor temperature monitoring" and the physical dimension = "pressure = 0.7MPa", then the safety dimension = "sensitivity level = high" and the environmental dimension = "network status = high reliability transmission required". Rule 2: If the security dimension = "compliance requirement = GDPR" and the business dimension = "cross-border data transmission", then the environment dimension = "resource status = requires encrypted computing power support"; Rule 3: If the physical dimension = "control dependency = valve A" and the environmental dimension = "equipment load = 90%", then the business dimension = "critical level = core" (because valve control failure has a significant impact when the load is too high); For missing items in the initial semantic labels, the semantic association reasoning engine matches multiple relevant rules for cross-validation and obtains the corresponding rule confidence (within the range of 0-1). The completion result is generated by weighting the rule confidence (e.g., rule 1 has a confidence of 0.9, rule 2 has a confidence of 0.8, and the highest weighted value is taken). If the reasoning result conflicts with the initial semantic label (e.g., the initial security level is "low", but the reasoning results in "high"), the conflict arbitration rules preset based on expert experience (e.g., "physical constraint related labels have priority > business labels") are invoked to correct the error and ensure that the label logic is consistent. The completed semantic tags and standardized data streams are integrated and encapsulated in the format of data ontology + tags to generate a standardized enhanced data stream containing complete five-dimensional semantic tags. Then, based on the topological location tags of the environment dimension, the standardized enhanced data stream is pushed to the corresponding computing nodes (e.g., edge node data is pushed to the local AI classification module, and core business data is synchronized to the cloud for backup).

[0020] Matching the optimal AI model and scheduling the real-time data stream classification, with credibility grading through four-dimensional credibility assessment, includes the following methods: Based on standardized enhanced data streams, data features and key semantic tags are parsed and extracted. Data features (i.e., features of the data ontology), such as "temperature and pressure numerical sequences" of industrial sensors and "message feature vectors" of network data, are converted into input formats (such as tensors and vectors) that can be recognized by AI models through feature engineering techniques (such as sliding window extraction of time-series features and word vector conversion of text features). Key semantic tags focus on extracting "resource requirements" (i.e., requirements for resource status, such as computing power ≥ 2 cores and latency ≤ 20ms) and "topological location" from the environmental dimension, as well as "critical level" from the business dimension, as the basis for model scheduling decisions. The system calls a pre-built AI model library (a database storing various models pre-trained using common training methods, including lightweight CNNs, Transformers, and traditional machine learning models; each model must be associated with metadata such as "applicable scenarios, computing power requirements, accuracy, and latency"), and then performs preliminary filtering based on extracted key semantic tags: If the topology is located at an edge computing node and the resource requirement is low computing power, then lightweight models (such as MobileNet and simplified LSTM) are selected, while high computing power models (such as Transformer with more than 1 billion parameters) are excluded. If the business is critical to the level of "core" and the latency requirement is "≤10ms", then models with fast inference speed (such as latency <8ms) and accuracy ≥95% (such as optimized ResNet-18) are preferred. After the initial screening, the optimal AI model is selected through model matching and multi-condition decision tree. Example logic: If the data type is "time series vibration signal", the resource requirement is "edge low computing power", and the accuracy requirement is ≥90%, then the model is selected as "lightweight CNN (e.g., 5 million parameters, 5ms latency)". Send a model loading command to the target computing node (edge ​​or cloud computing node), instantiate the selected AI model (if the computing node has cached the model, call it directly to reduce loading time), and push the processed data features to the model input interface; AI models perform real-time data stream classification based on data features (such as anomaly classification of time-series data and threat type identification of network packets), and output classification labels (such as specific categories such as "device normal", "data leakage risk", and "benign traffic") and model confidence (a probability value between 0 and 1, such as a confidence of 0.85 for classification as "data leakage risk", which reflects the model's self-confidence in the classification results). Based on the classification results of the AI ​​model, the following four dimensions are used as indicators for the credibility assessment: model confidence (directly using the raw probability value output by the AI ​​model (e.g., 0.85)), historical consistency (retrieving classification results from multiple (e.g., 100) similar data (based on the business dimension "business process ID" and the basic dimension "data source fingerprint"), calculating the consistency rate with the current result (i.e., the ratio of consistent results to the total number, e.g., 85 out of 100 consistent results result in 0.85), semantic conformity (comparing the degree of matching between the classification result and the business label and physical label, e.g., the matching degree between the classification "equipment abnormality" and the physical label "pressure = 0.9MPa (exceeding the preset threshold, e.g., 0.8MPa)" is 1.0, resulting in 1.0; if they do not match, points are deducted according to the degree of deviation), and environmental adaptability (e.g., assessing the applicability of the current environment (network latency, equipment load, etc.) to the AI ​​model (e.g., the model's accuracy is stable when the load is <70%, the current load is 65%, resulting in 0.9; the load is 90%, resulting in 0.6)). Then, the four-dimensional indicators are weighted and fused to evaluate the credibility of the model classification results. The results are then classified into high credibility (e.g., ≥80%), medium credibility (e.g., 60%-79%), and low credibility (e.g., <60%) using a threshold segmentation method. The classification pipeline is used to optimize different confidence levels to obtain the final optimized classification results. For high credibility, the classification result is directly marked as "credible," skipping additional verification and proceeding to the subsequent policy mapping stage. For medium credibility, a rule completion mechanism is triggered, calling a preset business scenario rule base (e.g., "if classified as 'network anomaly' and with low semantic compliance, then supplement with 'port traffic characteristics' for secondary verification") to correct the classification result before proceeding to the subsequent policy mapping stage. For low credibility, it is marked as pending review, and the data and classification result details are pushed to the manual review platform. If the review classification result is correct, it proceeds to the subsequent policy mapping stage; if the review classification result is incorrect, it is stored as an error result and does not proceed to the subsequent policy mapping stage. Finally, the correct and incorrect review results are recorded for optimizing subsequent classification logic.

[0021] The methods for generating candidate strategy sets include: Based on the optimized classification results and associated key semantic tags, a dual-condition strategy mapping rule library with classification tags as the main condition and semantic tags as the auxiliary condition is invoked. The dual-condition policy mapping rule base has a core structure of main condition + auxiliary condition → policy combination. Each rule includes a main condition (mandatory, directly associated with category tags (e.g., category = data leakage risk, category = abnormal equipment vibration)), auxiliary conditions (optional, supplementary constraints based on semantic tags (e.g., "business = cross-border finance, physical = reaction vessel, security = GDPR")), and policy combination (the specific security policy triggered when the condition is met (e.g., "strengthened identity verification + real-time encryption + blockchain evidence storage", "rate limiting protection + backup switching + operation and maintenance alarm"), which includes the execution object, operation instructions, and priority base value (range 1-10 points)). To improve matching efficiency, the dual-condition strategy mapping rule base is indexed by category tags (e.g., "data leakage risk" corresponds to rule group G1, and "abnormal equipment vibration" corresponds to rule group G2) to quickly locate candidate rule groups; Based on the classification label, the corresponding rule group in the dual-condition strategy mapping rule base (such as the "data leakage risk" category matching rule group G1) is used to filter out rules that do not meet the main condition. Then, within the rule group, rules that meet the conditions are initially selected according to the semantic label matching degree (semantic label matching degree = number of auxiliary conditions met / total number of auxiliary conditions × 100%). Example 1: Category "Data Breach Risk" + Business "Financial Cross-border" + Security "GDPR", matching rule "Category = Data Breach Risk + Business = Financial Cross-border + Security = GDPR → Strategy A" (100% match); Example 2: If the auxiliary conditions are partially matched (e.g., only "Business = Financial Cross-border" is satisfied, but "Security = GDPR" is not satisfied), the match rate is 66.7%, and it is included in the candidate but its importance is reduced; if no completely matching rule is found, the rule generalization mechanism is triggered, the most similar rule is called (e.g., the category labels are the same, and the auxiliary conditions partially overlap), and it is marked that the rule needs to be manually supplemented to avoid missing strategies; For the corresponding strategies mapped by the rules after initial screening, the risk level and business impact are extracted, and the resource consumption and execution time are extracted from the real-time monitoring equipment. The risk level, business impact, resource consumption and execution time are weighted and fused, and the fused value is multiplied by the priority base value in the strategy combination to obtain the strategy priority. The strategies are arranged in descending order of priority. The first strategy is taken as the primary strategy, and the second and third strategies are taken as candidate strategies. They are integrated to form a candidate strategy set, which includes information such as the strategy ID, execution object, core operation and strategy priority of each strategy. Each strategy also includes preset trigger conditions, execution steps and expected effects.

[0022] Methods of matching association rules using rule relationship graphs include: Based on the candidate policy set, the key attributes of each candidate policy are analyzed, including the executing entity (such as edge node firewall, reactor controller), core operation (such as encrypted transmission, valve flow restriction, permission freezing), resource requirements (such as "requires 20% CPU usage", "bandwidth ≥ 10Mbps"), and associated semantic tags (such as business = financial transaction, security = data encryption). Call the pre-built rule relationship graph containing all policy associations. The rule relationship graph uses the unique policy mapped to each rule as a node and describes the node association with four types of relationship edges. These include conflicting relationships (Policy A ↔ Policy B): the execution of two policies can lead to contradictions (e.g., "allow data transmission" versus "block data transmission"); dependency relationships (Policy A → Policy B): the execution of Policy A requires the successful execution of Policy B as a prerequisite (e.g., "encrypted storage" depends on "key generation"); reinforcement relationships (Policy A + Policy B): the coordinated execution of two policies can improve effectiveness (e.g., "authentication" + "device fingerprint verification" enhances security); and redundancy relationships (Policy A ≈ Policy B): the functions of two policies overlap (e.g., "IP blacklist blocking" and "port blocking" target the same threat). Each relation edge is assigned a weight value (ranging from 0 to 1) to reflect the strength of the association (e.g., a weight of 0.9 for core business dependencies and 0.6 for non-core business dependencies). The weight can be dynamically assigned based on historical execution data. Map each candidate strategy in the candidate strategy set to a candidate strategy node in the rule relationship graph; By matching key attributes, four types of associations—conflict, dependency, reinforcement, and redundancy—are extracted among other strategies in the relationship graph between candidate strategies and rules, which are used as the relationship edges of candidate strategies. For each candidate policy node, retrieve the first-order relation edges (directly associated policies) to obtain the directly associated policies; For example: the main policy "encrypted transmission" (policy node X) retrieves the dependency policy node Y ("key generation"), the reinforcement policy node Z ("integrity verification"), and the conflict policy node W ("plaintext transmission"); Indirect association strategies are derived through multi-level relational edges (e.g., if X depends on Y and Y depends on Z, then X indirectly depends on Z), forming a relational network centered on candidate strategies.

[0023] The methods for generating the pre-testing and verification strategy set include: Integrate multi-source real-time data to build a real-time system status image, including network topology (including policy node connection relationships, link bandwidth and latency), device load (including CPU and memory utilization, remaining computing power), service traffic (including current data transmission volume, critical service response time), and security status (including activated policy list, real-time threat alarms). Based on the relationship network with candidate strategies as the core, the chain reaction of candidate strategy execution is simulated through real-time system state mirroring, the pre-drill reports of each candidate strategy are recorded and conflicts are marked, and the pre-drill results of the strategy influence chain are obtained. The specific process is as follows: Input candidate policies → activate associated rules (executed in the order of policy priority) → calculate changes in resource consumption (e.g., CPU utilization increases from 60% to 75%) → assess the impact on business performance (e.g., response time increases by 5ms) → detect potential conflicts (e.g., policy X conflicts with the currently activated policy W) → generate a pre-drill report. For conflicts discovered during the rehearsal (such as insufficient resources or mutually exclusive rules), mark the conflicts and record the conflict type (such as resource conflict or logical conflict) and related nodes (such as policy node X and policy node W conflict). Based on the policy influence chain simulation results and the real-time system state mirror, an independent simulation scenario is constructed for each candidate policy and related policies (including directly related and indirectly related policies). The entire process execution (from policy activation to final effect feedback) is simulated through multi-scenario simulation, yielding four types of quantitative indicators, including: Simulate risk level (the probability of risks that may be triggered after the strategy is executed (such as the reduction rate of data leakage risk, the probability of equipment failure)), simulate business impact (positive or negative impact on core business (such as "increased transaction success rate" or "percentage decrease in production efficiency")), simulate resource consumption (quantified values ​​of computing power, bandwidth, storage and other resources used during execution) and simulate execution time (total time from strategy triggering to completion). Calculate the difference between 1 and the simulated resource consumption ratio (the simulated resource consumption ratio is an inverse indicator; the lower the consumption, the higher the score), and calculate the difference between 1 and the simulated execution time ratio (the simulated execution time ratio is an inverse indicator; the shorter the execution time, the higher the score). Standardize these two differences and the quantitative values ​​of simulated risk level and simulated business impact to the 0-1 range respectively, and then perform weighted fusion to obtain the priority score of each strategy. For the conflict markers in the rehearsal report, the pre-set conflict resolution rule base is invoked to match the corresponding resolution strategy and eliminate the conflict markers in the rehearsal report; Example conflict resolution rule base: Resource conflicts (such as two strategies competing for the same computing power): adopt the rule of giving priority to the higher priority strategy, reserve resources for the high priority strategy, and adjust the low priority strategy to an idle node or delay its execution. Logical conflicts (such as two mutually exclusive strategy operations, such as "allow transmission" and "block transmission"): decide based on the importance of the business scenario (the core business-related strategy of the business scenario takes priority), or merge strategies (such as "transmit after encryption" to replace the mutually exclusive operation). Dependency conflict (e.g., strategy A depends on strategy B, but B fails to execute): triggers the "alternative dependency chain" (e.g., if strategy A fails, strategy C is called as an alternative dependency). The resolved strategy is re-performed locally (only verifying the conflicting aspects). If the conflict still exists, the resolution rules are escalated (e.g., manual intervention to adjust the resource allocation plan) until the conflict is eliminated. Combining priority scores and secondary evaluation, the conflict-optimized strategies are arranged in descending order of priority scores, and the top few (e.g., 2-3, which are candidates for the main strategy and alternative strategies) are retained. Then, through a second evaluation, supplementary evaluation is conducted from three aspects, including environment adaptability (whether the strategy matches the current system topology (e.g., the strategy for edge computing nodes needs to be adapted to the computing power of edge computing nodes)), compliance (whether it meets the compliance requirements in the security dimension label (e.g., GDPR, Information Security Protection 2.0)) and historical effectiveness (searching the historical execution success rate of the strategy in similar scenarios (success rate ≥90% is preferred)). The two best primary and backup strategies without conflicts are selected, with the best strategy serving as the primary strategy and the second strategy serving as the backup strategy. The selected primary and backup strategies are integrated into a pre-rehearsal and verification strategy set, which includes strategy ID, execution steps (including the order of strategy invocation) and strategy-related information (such as resource allocation scheme, conflict avoidance mechanism and expected effect indicators).

[0024] The methods for encapsulating cross-domain transactions according to the cross-domain transaction description specification include: Based on the pre-rehearsal verification strategy set, a pre-defined cross-domain transaction description specification is loaded to clarify the mandatory framework for transaction encapsulation, including the transaction metadata area (used to identify the uniqueness of the transaction and its context (such as transaction ID, associated strategy ID, initiation timestamp, timeout threshold (i.e., the threshold used to determine whether a timeout has occurred), and maximum number of retry attempts)), sub-transaction partitions (divided into four types of sub-transactions according to the execution domain, each type of sub-transaction must include the execution subject, operation instructions, parameter range, expected state and dependency conditions), and coordination rules area (defining the execution order between sub-transactions (such as "resource sub-transactions must be executed before network sub-transactions") and failure linkage mechanisms (such as "if a security sub-transaction fails, an overall rollback is triggered")). Then, based on the business scenarios associated with the strategy (such as chemical industry and finance), the corresponding sub-transaction templates are loaded (such as the device constraint parameters of the physical sub-transaction in the chemical industry scenario and the encryption algorithm parameters of the security sub-transaction in the financial industry scenario). Based on the cross-domain transaction description specification, cross-domain transaction metadata containing unique identifiers and context is constructed through the generation of basic metadata and the supplementation of context metadata. Among them, the basic metadata generation automatically generates a unique transaction ID (format: policy ID + timestamp + random number), associates it with the policy ID and the initiating node ID (such as "cloud scheduling center"), sets the timeout threshold (for example, the default is 30 seconds, which is shortened to 10 seconds for core business) and the maximum number of retries (the default is 3 times); the context metadata supplement extracts key information from the five-dimensional semantic tags, such as "business dimension = financial cross-border → metadata adds 'compliance tag = GDPR'", "physical dimension = reactor → metadata adds 'equipment type = pressure vessel'", to provide a basis for subsequent execution verification; The transactions are broken down and defined into four categories: network, physical, resource, and security. Specifically: Network sub-transactions, focusing on data transmission and communication control, include: Execution entities: Network entities such as routers, switches, and firewalls; Exemplary operation instructions: such as "Establish an encrypted tunnel (IPSec protocol)" and "Limit the traffic rate of port 22 to ≤10Mbps"; Exemplary parameter constraints: such as tunnel encryption key validity period = 8 hours, traffic limit accuracy ±5%; Physical sub-transactions, which are control operations for physical devices, include: Execution subject: physical devices such as sensors, actuators, and industrial controllers (such as PLCs); exemplary operation instructions: such as "adjust the reactor temperature to 80℃" and "reduce the motor speed by 10%"; exemplary parameter constraints: such as temperature adjustment error ≤ ±1℃, and speed change rate ≤ 5% / second (to avoid equipment impact). Resource sub-transactions are responsible for the allocation of resources such as computing power, storage, and bandwidth, and include: Execution entities: resource manager, cloud server, edge node; Exemplary operation instructions: such as "reserve 2 CPU cores + 2GB memory for encryption task" and "allocate 10Mbps bandwidth for data synchronization"; Exemplary parameter constraints: such as resource reservation duration = policy execution cycle + 5 minutes (reservation buffer).

[0025] Security sub-transactions ensure the security of the operation process and include: Execution entities: Security modules such as key management system, identity authentication server, and audit log module; Exemplary operation instructions: such as "generate temporary encryption key (AES-256)" and "force verification of administrator fingerprint + password"; Exemplary parameter constraints: such as key validity period = 1 hour, and operation permissions are locked after 3 authentication failures; The metadata and four types of sub-transactions are integrated according to the cross-domain transaction description specification framework, namely the transaction metadata area + sub-transaction partition + coordination rule area, to generate a complete transaction package that can be executed across domains. It can be encapsulated in Extensible Markup Language (XML) or Protocol Buffers format to ensure that cross-domain nodes can be parsed. Finally, perform format and logic checks on the complete transaction package; Among them, format validation checks whether it conforms to the transaction description specification (such as whether the required fields of the sub-transaction are missing and whether the parameter format is correct); logic validation verifies the coordination between sub-transactions (such as whether the "reserved CPU" of the resource sub-transaction meets the "encrypted computing power requirement" of the security sub-transaction) and the compatibility of operation instructions with physical constraints (such as whether the "temperature adjustment instruction" is within the allowable range of the device). If the verification fails, return to optimize the primary / backup strategy selection; if the verification passes, add a completion mark and push to the subsequent four-stage submission protocol execution stage.

[0026] The methods for real-time collection of transaction execution status and physical feedback data through the four-phase commit protocol include: Based on the complete transaction package, the pre-execution preparation is parsed and completed. First, the execution environment is initialized, and it is verified whether each computing node meets the resource requirements of the sub-transaction (such as whether the bandwidth of the network sub-transaction meets the standard, and whether the physical sub-transaction device is online). If a computing node does not meet the standard, it is switched to a preset backup computing node. Then, the transaction information is synchronized, and the transaction ID, the execution subject of the sub-transaction (such as edge computing node, physical device), and the coordination rules (i.e. the execution order of the sub-transactions in the coordination rule area) are synchronized to the participating computing nodes (this can be achieved through a distributed message queue to ensure consistency). After complete pre-execution preparation, sub-transactions are executed through a four-phase commit protocol consisting of preparation, pre-execution, physical verification, and commit. The preparation phase involves the following steps: A transaction coordinator (e.g., a cloud-based scheduling center) sends a readiness instruction to each sub-transaction execution entity, along with operational details of the sub-transaction (e.g., "encrypted tunnel parameters" for network sub-transactions, "temperature regulation thresholds" for physical sub-transactions). Each execution entity checks its own status (e.g., resource availability, permission matching). If ready, it returns a response agreeing to execution (including its own ID and preparation completion timestamp); otherwise, it returns a rejection response (with a reason given). The transaction coordinator aggregates responses. If all entities agree to execution, the process enters the pre-execution phase. If any execution entity rejects the request, it is marked as a preparation failure, triggering a retry (a maximum retry limit needs to be set, e.g., a maximum of 3 retries). Pre-execution phase: The transaction coordinator sends pre-execution instructions to each execution entity according to the coordination rules. The execution entities perform operations but do not submit the final results (e.g., the physical sub-transaction only calculates the temperature regulation path and does not actually drive the executor); each execution entity records the operation process data and returns whether the pre-execution is successful or failed (including failure nodes and error codes); the transaction coordinator verifies whether the logic between sub-transactions is satisfied (e.g., the "key generation successful" of the security sub-transaction must precede the "encrypted transmission" of the network sub-transaction). If not satisfied, the pre-execution is terminated and the transaction is repackaged. Physical verification phase: For physical sub-transactions (such as equipment control), the executing entity (such as the actuator) performs the actual operation according to the pre-execution result (such as "adjusting the reactor temperature to 80℃"), and simultaneously collects real-time physical feedback data (such as current temperature and pressure) through sensors; then, multi-dimensional verification is performed, including accuracy verification (whether the deviation between physical data and expected values ​​is within the preset threshold (such as temperature adjustment error ≤ ±1℃)), safety verification (whether the operation triggers physical constraint alarms (such as whether the pressure exceeds the 0.8MPa safety threshold)), and timing verification (whether the operation completion time is within the timeout threshold of the transaction metadata (such as core business ≤ 10 seconds)); if all verifications pass, a "physical execution valid" signal is returned; otherwise, it is marked as "physical anomaly" (such as "temperature overshoot to 85℃"), triggering a partial rollback (only undoing the physical sub-transaction operation). Commit Phase: The transaction coordinator summarizes the pre-execution results (all successful) and physical verification results (valid). If both are satisfied, a commit instruction is sent to all subjects. Each executing subject confirms that the operation is finally effective (e.g., network sub-transaction saves tunnel configuration, security sub-transaction activates key) and updates the local transaction status to complete. If any phase fails (e.g., pre-execution timeout, physical verification error), the transaction coordinator sends a rollback instruction, and each subject undoes the executed steps (e.g., network sub-transaction closes temporary tunnel, physical sub-transaction restores device initial state), and records the rollback reason and process log. The transaction coordinator collects commit or rollback confirmations from all executors and generates a unified transaction status ("success", "failure - rollback complete", or "failure - partial rollback"). Real-time tracking of various monitoring metrics during the execution of sub-transactions, including performance metrics (sub-transaction response time, node resource utilization (including CPU and memory), network latency), security metrics (encryption status (whether the key is valid), access permission records (whether there are any abnormal operations), and audit log integrity), and physical metrics (equipment operating parameters (including temperature, pressure, and speed parameters), and actuator action feedback (such as the actual valve opening degree)). If the indicators exceed the preset normal thresholds (such as CPU utilization suddenly increasing to 90% or physical pressure exceeding the safe value), a graded alarm will be triggered (mild → automatic system adjustment, severe → push to the operation and maintenance terminal), and the execution of related sub-transactions will be suspended simultaneously. Integrate the final state of the transaction (success or failure) with the execution logs of each stage to generate the final transaction execution state. At the same time, combine the physical feedback data and associate it with the transaction ID and the execution strategy ID, and push all the associated data to the subsequent lifecycle management stage.

[0027] The methods for obtaining rule-based evolutionary instructions and sample augmentation data include: Based on the transaction execution status and physical feedback data, synchronously retrieve historical data from the entire chain (including processing records of each preceding stage, rule matching logs, and strategy execution trajectories) to parse out the required core information, including performance evaluation indicators (strategy execution success rate (ratio of successful times to total times), physical indicator deviation rate (ratio of the absolute difference between the actual value and the expected value to the expected value), average resource consumption (such as CPU and bandwidth usage), compliance compliance rate (the percentage of times that comply with security and business specifications)) and abnormal case identifiers (marking cases of incorrect classification (cases where the classification results of the optimized AI model do not match the actual feedback), strategy failure cases (cases where execution failed and rollback was ineffective), and residual strategy conflict cases (cases where strategy conflicts were not fully resolved)). Based on actual business objectives and scenarios, a four-dimensional rule effectiveness evaluation mechanism is constructed to comprehensively evaluate the effectiveness of the executed strategies; The four-dimensional rule effectiveness evaluation mechanism includes four evaluation dimensions: execution effectiveness (based on a strategy execution success rate ≥ execution success threshold (e.g., 90%), with 1 point deducted for each 1% below the threshold (maximum score 100 points)), resource efficiency (calculating the ratio of actual resource consumption to estimated value; a ratio ≤ 1 earns 100 points (i.e., resource consumption does not exceed the estimate), with 20 points deducted for each 0.1 exceeding the estimate), security compliance (checking whether the execution process violates security dimension labels (e.g., encryption standards, access control); 30 points are deducted for each violation, with a maximum score of 100 points), and business adaptability (evaluating the positive impact of the strategy on core business (e.g., improved production efficiency, reduced risk); 0 points for no positive impact, and 100 points for significant improvement). The final comprehensive effectiveness score is then obtained through weighted fusion and divided into different levels using a threshold segmentation method. For example, a score ≥ 80 indicates high efficiency, 60-79 indicates medium efficiency, and < 60 indicates low efficiency. Furthermore, the lifecycle of a strategy is managed in tiers based on its different levels of effectiveness. Among them, the high-efficiency strategy is to retain it in the reserved active strategy library and automatically trigger parameter optimization (such as fine-tuning the execution threshold based on physical feedback, such as improving the temperature regulation accuracy of the reactor from ±1℃ to ±0.5℃). Medium efficiency strategy: Transfer to the reserved strategy library to be optimized, generate manual adjustment suggestions (such as "the priority of resource sub-transactions needs to be increased"), and re-enter the strategy matching process for verification after adjustment; Inefficient strategy: Mark as a candidate for elimination. If it is inefficient in multiple consecutive evaluations (e.g., 3 times), it will be removed from the dual-condition strategy mapping rule base and the reason for elimination will be recorded simultaneously (e.g., "incompatible with the physical constraints of the new equipment"). The strategy after hierarchical management automatically generates a new version and associates it with optimization records; By combining end-to-end logging (processing logs recorded synchronously at each stage of processing), the process of each stage is audited, including the data access stage (checking the accuracy of standardized transformation, such as whether the protocol parsing is missing fields), the tagging and classification stage (verifying the rationality of the AI ​​model's classification credibility assessment and the semantic tag completion logic, such as whether the inference engine misjudges the relationship), and the strategy and execution stage (tracing rule matching deviations (such as whether a better strategy was missed) and the responsibility of computing nodes for transaction execution failures (such as insufficient resources of edge computing nodes)). For problems discovered during the audit, the root cause of the problem is located by tracing back through the process (for example, the data features of the AI ​​model do not include the vibration frequency features of the new equipment), and a source tracing report is generated. Based on the performance evaluation results and the source tracing report, rule evolution instructions are generated, including strategy optimization instructions (such as "adjusting the auxiliary condition weights of the dual-condition strategy mapping rule"), model iteration instructions (such as "supplementing the AI ​​model with the 'new device vibration frequency' feature and retraining the classifier"), and process adaptation instructions (such as "adding '5G device' related strategy nodes to the rule relationship graph"). Simultaneously, case data of classification errors and policy failures are collected, and valid samples are extracted, including classification error samples (data whose classification labels do not match the actual physical feedback (e.g., classified as "equipment is normal" but the actual vibration exceeds the standard), and five-dimensional semantic labels are synchronously associated with policy execution results) and policy failure samples (complete link data of execution failure (e.g., "encrypted transmission policy failed due to key generation failure"), including rule matching logs and conflict handling records); the valid samples are cleaned and labeled, and duplicate data (such as consecutive identical anomalies of the same device) are removed. They are labeled according to problem type (classification error or policy failure) + root cause (e.g., missing model features, rule conflict) as sample augmentation data for AI models; The rule evolution instructions are pushed to the corresponding preceding stages, and the sample augmentation data is pushed to the AI ​​model for enhanced training; at the same time, the results of this lifecycle management are recorded as the basis for optimization of the next round of data access, forming a complete closed loop.

[0028] Example 2 Please see Figure 3 As shown, for parts not described in detail in this embodiment, please refer to the description in Embodiment 1. A real-time data stream classification and security policy adaptive method based on an AI model is provided, including: S1: Acquire multi-source heterogeneous data streams, process them hierarchically according to dynamic quality rules, inject five-dimensional semantic labels, and complete the implicit relationships between labels through association reasoning to generate standardized enhanced data streams; S2: Based on standardized enhanced data streams, match the optimal AI model and schedule the real-time data stream classification, perform credibility grading through four-dimensional credibility assessment, and generate candidate strategy sets through matching with a dual-condition strategy rule base. S3: Based on the candidate strategy set, the associated rules are matched through the rule relationship graph, and the influence chain of the execution strategy is pre-drilled by combining the real-time state image of the system and the best of multiple contingency plans is selected to generate a pre-drilled verification strategy set; S4: Based on the pre-verification strategy set, encapsulate cross-domain transactions according to the cross-domain transaction description specification, execute them through the four-phase commit protocol, and collect transaction execution status and physical feedback data in real time. S5: Based on transaction execution status and physical feedback data, implement lifecycle management through rule performance evaluation, extract samples to enhance the AI ​​model, and combine full-link audit to obtain rule evolution instructions and sample enhancement data, which are then fed back to the preceding links to form a closed loop.

[0029] Example 3 This embodiment discloses an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the operation mode of the AI ​​model-based real-time data stream classification and security policy adaptive system described above.

[0030] Since the electronic device described in this embodiment is the one used to implement the AI-based real-time data stream classification and security policy adaptive method in the embodiments of this application, those skilled in the art can understand the specific implementation and various variations of the electronic device in this embodiment based on the AI-based real-time data stream classification and security policy adaptive method described in the embodiments of this application. Therefore, how the electronic device implements the method in the embodiments of this application will not be described in detail here. Any electronic device used by those skilled in the art to implement the AI-based real-time data stream classification and security policy adaptive method in the embodiments of this application falls within the scope of protection of this application.

[0031] The above formulas are all dimensionless calculations. The formulas are derived from software simulations based on a large amount of collected data to obtain the most recent real-world results. The preset parameters and thresholds in the formulas are set by those skilled in the art according to the actual situation.

[0032] The above description is merely a preferred embodiment of the present invention, and the scope of protection of the present invention is not limited to the above embodiments. All technical solutions falling within the scope of the present invention's concept are within the scope of protection of the present invention. It should be noted that for users of ordinary technical skills, any improvements and modifications made without departing from the principles of the present invention should also be considered within the scope of protection of the present invention.

Claims

1. A real-time data stream classification and security policy adaptive system based on an AI model, characterized in that, include: Data access and semantic enhancement unit: acquires multi-source heterogeneous data streams, performs hierarchical processing according to dynamic quality rules, injects five-dimensional semantic labels, and completes the implicit relationships between labels through association reasoning to generate standardized enhanced data streams; AI classification and candidate strategy matching unit: Based on standardized enhanced data stream, it matches the optimal AI model and schedules the real-time data stream classification, performs credibility grading through four-dimensional credibility assessment, and generates candidate strategy sets through matching with a two-condition strategy rule base. Strategy Pre-play Optimization Unit: Based on the candidate strategy set, it matches associated rules through rule relationship graph, combines the real-time state mirror of the system to perform strategy impact chain pre-play, and generates a pre-play verification strategy set through multi-plan optimization; Execution Feedback Unit: Based on the pre-verification strategy set, it encapsulates cross-domain transactions according to the cross-domain transaction description specification, executes them through the four-phase commit protocol, and collects transaction execution status and physical feedback data in real time; Enhanced closed-loop unit: Based on transaction execution status and physical feedback data, lifecycle management is implemented through rule performance evaluation and combined with full-link auditing to obtain rule evolution instructions and sample enhancement data, which are then fed back to the preceding links to form a closed loop.

2. The real-time data stream classification and security policy adaptive system based on an AI model according to claim 1, characterized in that, The method of graded handling according to dynamic quality rules includes: It receives multi-source heterogeneous data streams, identifies the protocol type through an intelligent access gateway, and parses and converts them into standardized data streams. Based on dynamic quality rules that consider three dimensions—completeness, timeliness, and accuracy—the overall quality of standardized data streams is evaluated and classified. Based on the comprehensive quality classification, corresponding optimization processing is carried out through a graded handling mechanism to obtain a standardized data stream with optimized quality.

3. The real-time data stream classification and security policy adaptive system based on an AI model according to claim 2, characterized in that, The methods for generating the standardized enhanced data stream include: Define a five-dimensional enhanced semantic tagging system encompassing basic, business, security, environmental, and physical dimensions; Based on the standardized data stream after quality optimization, load corresponding semantic tag value templates for different business scenarios; By using field-label mapping rules, initial semantic labels are added to the standardized data stream according to the five-dimensional enhanced semantic labeling system. The integrity of the semantic labels is verified and missing semantic labels are marked as to be completed. For missing items to be filled, the implicit relationships between the initial semantic tags and the missing items are filled in by a pre-built semantic association reasoning engine based on cross-dimensional reasoning rules; The completed semantic tags are integrated and encapsulated with the standardized data stream to generate a standardized enhanced data stream containing complete five-dimensional semantic tags.

4. The real-time data stream classification and security policy adaptive system based on an AI model according to claim 3, characterized in that, The method of matching the optimal AI model and scheduling the execution of real-time data stream classification, and classifying credibility through four-dimensional credibility assessment, includes: Based on standardized enhanced data flow, data features and key semantic labels are parsed and extracted, a pre-built AI model library is called, and the optimal AI model is selected through a multi-condition decision tree. It is then scheduled to the target computing node, where real-time data stream classification is performed based on the extracted data features, and the classification labels and model confidence scores are output. Based on the classification results of the AI ​​model, the credibility of the model classification results is evaluated and graded using four dimensions: model confidence, historical consistency, semantic conformity, and environmental adaptability. By using a hierarchical processing pipeline to perform hierarchical optimization on different confidence levels, the final optimized classification result is obtained.

5. The real-time data stream classification and security policy adaptive system based on an AI model according to claim 4, characterized in that, The candidate strategy set is generated in the following ways: Based on the optimized classification results and associated key semantic tags, a dual-condition strategy mapping rule library with classification tags as the main condition and semantic tags as the auxiliary condition is invoked. The corresponding rule group in the rule base is located by the classification label and the two-condition strategy is mapped. Within the rule group, the semantic label is used to initially filter the rules that meet the conditions. The strategy priority of the strategies corresponding to the initial screening rules is evaluated, and the main strategy and alternative strategies are obtained by screening according to the strategy priority, and then integrated into a candidate strategy set.

6. The real-time data stream classification and security policy adaptive system based on an AI model according to claim 5, characterized in that, The method of matching association rules through a rule relationship graph includes: Based on the candidate strategy set, the key attributes of each candidate strategy are parsed, and a pre-set rule relationship graph containing the full set of strategy relationships is invoked to map each candidate strategy to a candidate strategy node in the rule relationship graph. By matching key attributes, four types of associations—conflict, dependency, reinforcement, and redundancy—are extracted from the candidate strategy and rule relationship graph and used as relationship edges. For each candidate strategy node, first-order relation edges are retrieved to obtain directly associated strategies, and indirect associated strategies are derived through multi-order relation edges, forming a relation network with candidate strategies as the core.

7. The real-time data stream classification and security policy adaptive system based on an AI model according to claim 6, characterized in that, The methods for generating the pre-testing and verification strategy set include: By integrating real-time data from multiple sources to construct a real-time state image of the system, and based on a relationship network with candidate strategies as the core, the system simulates the chain reaction of candidate strategy execution through the real-time state image, records the pre-exercise report and marks conflicts, and obtains the pre-exercise results of the strategy influence chain. Based on the policy influence chain pre-simulation results, an independent simulation scenario is constructed for each candidate policy and related policies, and the priority score of each policy is obtained through multi-plan simulation. The conflict resolution rule base is invoked to eliminate conflict markers in the pre-rehearsal report. Then, by combining priority scores and secondary evaluation, the optimal primary / backup strategy without conflict is selected and integrated into a pre-rehearsal verification strategy set.

8. The real-time data stream classification and security policy adaptive system based on an AI model according to claim 7, characterized in that, The methods for encapsulating cross-domain transactions according to the cross-domain transaction description specification include: Based on the pre-verification strategy set, the cross-domain transaction description specification is loaded, and then cross-domain transaction metadata containing unique identifiers and context is constructed. Sub-transactions are broken down and defined into four categories: network, physical, resource, and security. These sub-transactions are then integrated with cross-domain transaction metadata and encapsulated into a complete transaction package that can be executed across domains, using the structural framework of the cross-domain transaction description specification.

9. The real-time data stream classification and security policy adaptive system based on an AI model according to claim 8, characterized in that, The method of executing the four-phase commit protocol and collecting real-time transaction execution status and physical feedback data includes: Based on the complete transaction package, sub-transactions are executed through a four-phase commit protocol of preparation, pre-execution, physical verification, and commit. Real-time tracking of various monitoring indicators during the execution of sub-transactions, integration to generate the final transaction execution status, and synchronous collection of physical feedback data.

10. The real-time data stream classification and security policy adaptive system based on an AI model according to claim 9, characterized in that, The method of obtaining the rule evolution instructions and sample augmentation data include:, Based on transaction execution status and physical feedback data, a four-dimensional rule performance evaluation mechanism is constructed based on business objectives to conduct comprehensive performance evaluation and divide it into different levels, thereby managing the strategy lifecycle by level. By combining the end-to-end log auditing process, the root cause of the problem is located and a source tracing report is generated; the instructions for generating source tracing reports are evolved based on the performance evaluation results and the source tracing report generation rules. Simultaneously, abnormal data with classification errors and policy failures in the data stream are aggregated and cleaned to become sample augmentation data for the AI ​​model; The rule evolution instructions are pushed to the corresponding preceding steps, and the sample augmentation data is pushed to the AI ​​model for enhanced training.

Images