Artificial intelligence-based archive abnormal behavior analysis and early warning system

Abstract

This invention relates to the field of digital archives management technology, specifically to an artificial intelligence-based system for analyzing and warning of abnormal archive behavior. The invention uses a graph construction module to transform archive access logs into a relational topology graph; an attribute propagation module performs weighted transfer and accumulation of weights based on a graph traversal algorithm to calculate the cumulative relational index value of nodes; a connectivity retrieval module retrieves cross-regional links based on partition isolation rules; and an early warning output module generates early warning signals based on index values ​​and link status. This invention utilizes the flow mechanism of feature values ​​in a graph structure to aggregate minute risky behaviors within discrete long-term windows, accurately identifying complex abnormal patterns where a single operation may not violate regulations but the long-term cumulative risk exceeds the limit. This solves the problem that existing static statistical rules are unable to detect hidden logical violations, effectively reducing false alarms and false negatives.

Description

Technical Field

[0001] This invention relates to the field of digital archives management technology, specifically to an artificial intelligence-based system for analyzing and warning of abnormal archive behavior. Background Technology

[0002] Archival systems contain massive amounts of organizational secrets and historical records, making their security paramount. To prevent data breaches, unauthorized alteration, and unauthorized access, existing archival management systems typically incorporate log auditing and security monitoring functions, aiming to identify potential security threats through analysis of user behavior. Current technical solutions often employ rule-based matching or statistical threshold-based anomaly detection methods. These methods primarily collect behavioral data on archive creation and modification, calculating statistical indicators such as access frequency, download volume, and modification count, and setting corresponding security thresholds. When monitored indicators exceed preset thresholds, the system triggers an alert and uses algorithms such as decision trees to classify and evaluate abnormal behavior. This approach is effective in handling explicit, explosive violations.

[0003] However, the aforementioned methods still have significant limitations when facing complex and ever-changing file utilization scenarios. First, they heavily rely on static statistical thresholds and preset rules, lacking the ability to adapt to dynamic changes in user behavior. In practical applications, normal user business behavior fluctuates, and fixed thresholds easily lead to high false positive rates, increasing the investigation burden on administrators. Conversely, if the threshold is set too wide, attackers can easily use "low-frequency, slow" methods to covertly steal data, causing the system to miss detections. Second, existing methods mostly focus on discrete operation characteristics within a single time window, lacking contextual logic analysis of continuous user operation sequences. Insider threats or advanced persistent threats often manifest as a series of logically consistent but maliciously intended operation sequences, such as: first, extensive directory probing, then previewing small batches of sensitive files, and finally selectively exporting core data. Existing methods isolate these behaviors into isolated data points for detection; since no single operation triggers the statistical threshold, the system often judges them as "normal." This detection mechanism, which lacks temporal contextual analysis, struggles to identify complex abnormal behavior patterns with long-term dependencies and logical concealment, and is unable to effectively address unauthorized intents under legitimate permissions.

[0004] In summary, how to solve the problem that static statistical discrete access logs cannot identify complex abnormal data access patterns with logical concealment when performing anomaly detection, resulting in a high rate of false positives and false negatives for illegal logical operations under legitimate permissions, is a technical problem that urgently needs to be solved in this field.

[0005] To address this, an artificial intelligence-based system for analyzing and warning of abnormal behavior in archives is proposed. Summary of the Invention

[0006] The purpose of this invention is to provide an artificial intelligence-based system for analyzing and warning of abnormal behavior in archives. This invention uses a graph construction module to transform archive access logs into a relational topology graph; an attribute propagation module performs weighted transfer and accumulation of weights based on a graph traversal algorithm to calculate the cumulative relational index value of nodes; a connectivity retrieval module retrieves cross-regional links based on partition isolation rules; and an early warning output module generates early warning signals based on the index value and link status. This invention utilizes the flow mechanism of feature values ​​in the graph structure to aggregate minute risky behaviors within discrete long-term windows, accurately identifying complex abnormal patterns where a single operation may not violate regulations but the long-term cumulative risk exceeds the limit. This solves the problem that existing static statistical rules are unable to detect hidden logical violations, effectively reducing false positives and false negatives.

[0007] To achieve the above objectives, the present invention provides the following technical solution: An AI-based system for analyzing and warning of abnormal behavior in archives includes: Graph construction module: Obtains data access logs and entity attribute data from the archive database, structurally maps the access subject, access medium, and archive data objects into nodes of the graph, parses the operation type field and timestamp in the log, generates time-series association edges with weight attributes between nodes, and constructs an archive data association topology graph. Attribute propagation module: In the archive data association topology graph, the initial state value is set according to the security level attribute of the archive data object node. Based on the graph traversal algorithm, the weighted transfer operation of the weight is performed along the temporal association edge to calculate the flow and accumulation value of the state value from the archive data object node to the access subject node and access medium node with connection relationship, and update the cumulative association index value of the access subject node and access medium node. Connectivity retrieval module: Set partition isolation rules in the archive data association topology graph, divide the topology graph into logically disconnected data partitions, and perform path search based on the link relationship of time-series associated edges to retrieve whether there are cross-region links connecting different data partitions; Early warning output module: When the cumulative associated index value meets the preset numerical judgment conditions and at least one of the following conditions is found in the cross-regional link, an early warning signal is generated.

[0008] Preferably, specific methods for structurally mapping the access subject, access medium, and archive data objects as nodes in a graph include: Read the log fields of the archive database, extract the user's unique identifier, terminal physical address MAC, and archive group number, and establish one-to-one corresponding access subject node, access medium node, and archive data object node; and store the security classification label field in the archive data object node; Generate time-series association edges with weight attributes between nodes, including performing numerical mapping based on an operation weight mapping table: mapping metadata read operations to a first basic weight value, online preview operations to a second basic weight value, file download operations to a third basic weight value, and entity export operations to a fourth basic weight value; wherein the fourth basic weight value is greater than the third basic weight value, the third basic weight value is greater than the second basic weight value, and the second basic weight value is greater than the first basic weight value; and write the corresponding basic weight values ​​into the attribute fields of the time-series association edges.

[0009] Preferably, generating time-series related edges with weight attributes specifically includes: obtaining the time difference between the current system time and the operation occurrence time in the log; calculating the timeliness coefficient of the current operation using exponential decay logic based on a preset time half-life parameter; the timeliness coefficient monotonically decreases as the time difference increases, and its value ranges from zero to one; calculating the product of the basic weight value and the timeliness coefficient to obtain the effective weight of a single operation record; in the archive data association topology graph, if there are multiple operation records with different timestamps between two nodes, the effective weights of all records are linearly accumulated, and the sum is used as the aggregate edge weight connecting the two nodes to construct an archive data association topology graph containing the aggregate edge weight.

[0010] Preferably, the weighted pass operation performed specifically includes: Traverse all nodes in the archival data association topology graph and construct node state vectors; for archival data object nodes, if the security level is public, the node's state value is initialized to zero; if the security level is confidential, the node's state value is initialized to a preset initial risk potential value according to the security level; for access subject nodes and access medium nodes, the state value is initialized to zero; the security levels include secret, confidential, and top secret; construct a sparse adjacency matrix based on the connection structure of the archival data association topology graph; perform global strength mapping on the aggregate weights of temporal association edges: traverse the entire graph and obtain the maximum observed value of the aggregate edge weights within the historical statistical period; divide the aggregate weight of each temporal association edge by the maximum observed value to obtain the strength transfer coefficient with a value between zero and one; fill the corresponding elements of the sparse adjacency matrix with the strength transfer coefficient to form a risk strength transfer matrix; in the iterative calculation, the high aggregate weights generated by high-frequency operations can be directly converted into a higher proportion of risk potential transfer; iterative propagation calculation: utilize... The node state vector is multiplied using the risk intensity transfer matrix. In each iteration, for each access subject node and / or access medium node, a weighted sum of risk potential energy transmitted from all predecessor neighbor nodes is calculated based on the intensity transfer coefficient, and the weighted sum is marked as an intermediate state value. Source value re-injection and damping constraints: the intermediate state value is multiplied by a preset damping coefficient, and the initial risk potential energy value of the archive data object node is added back to the calculation result of the archive data object node. The final calculated value is used as the new state value of the node after this iteration. The iterative propagation calculation, source value re-injection, and damping constraints are repeatedly executed, and the change in Euclidean distance of the node state vector between the two iterations is calculated. When the change is less than a preset convergence threshold and the number of iterations reaches a preset maximum number of iterations, the iteration stops. The value in the finally converged node state vector is used as the cumulative association index value of each access subject node and access medium node and stored and updated.

[0011] Preferably, the partition isolation rules set in the connectivity retrieval module specifically include: Extract the department attribute of the node; pre-set a logical isolation rule table containing mutually exclusive department identifier pairs; during path search, compare the department attribute of the starting node of the current traversal path with that of the current node in real time; if the attribute values ​​of the two belong to mutually exclusive pairs in the logical isolation rule table, then determine that the current node is logically unreachable relative to the starting node, and no longer extend the search path to that node, thereby dividing the graph structure into disconnected data partitions at the logical topology level.

[0012] Preferably, the path search and cross-regional link search performed by the connectivity retrieval module specifically include: Select a data object node with a confidentiality level as the search source, and select a set of access subject nodes that should be logically isolated from the data object node as the target domain. Starting from the search source, perform a depth-first search in the data association topology graph. During the search, set a maximum hop count limit parameter, and only search topology paths whose path length is not greater than the maximum hop count limit parameter. In the search path, identify whether there is an intermediate node with the attribute "access medium". If a path presents a topology structure of "search source - access subject A - access medium B - access subject C", and access subject C belongs to the target domain, then this path is determined to be a shared medium jump link. In the search path, identify whether there is an intermediate node with the attribute "access subject". If a path presents a topology structure of "search source - access medium A - access subject B - access medium C - access subject D", and access subject D belongs to the target domain, then this path is determined to be an account-shared jump link. Mark all identified shared medium jump links and account-shared jump links as the cross-region links, and extract all node IDs and edge weight information involved in the links.

[0013] Preferably, the numerical judgment condition in the early warning output module adopts dynamic threshold calculation based on extreme value statistical theory: Periodically read the cumulative association index values ​​of all access subject nodes and access medium nodes to construct an index value sample set; calculate the mean and standard deviation of the index value sample set; fit the tail data of the top 5% of the index value sample set using the generalized Pareto distribution function to estimate the tail risk distribution parameters of the sample set; based on the fitted tail risk distribution parameters, calculate the quantile value corresponding to the preset false alarm rate level; set the quantile value as the current dynamic threshold; when the cumulative association index value of any access subject node and / or access medium node is greater than the dynamic threshold, it is determined that the numerical judgment condition is met.

[0014] Compared with the prior art, the beneficial effects of the present invention are as follows: 1. This invention achieves effective aggregation and identification of concealed abnormal behaviors by constructing an archival data association topology graph and an attribute propagation mechanism. The system maps discrete access subjects, access media, and archival data objects as graph nodes, and uses weighted transfer operations with time decay logic to allow risk feature values ​​to flow and accumulate along the temporal association edges in the graph structure. This mechanism can effectively aggregate minor risk behaviors that are scattered within a long time window and do not violate regulations in a single operation at the node level, thereby accurately identifying complex abnormal patterns with long-range dependencies and logical concealment, solving the problem of difficulty in detecting illegal intentions under legitimate permissions such as "low-frequency and slow" access.

[0015] 2. This invention introduces a cross-regional link retrieval technology based on logical isolation rules, significantly improving the ability to detect indirect unauthorized access. By setting partition isolation rules and executing a restricted depth-first search, the system can identify "stepping stone" paths connecting different logical data partitions, including "shared medium stepping stones" using public terminals and "account-sharing stepping stones" using shared accounts. This design enables the system not only to monitor direct unauthorized access but also to deeply mine and warn of complex attack paths that attempt to bypass departmental isolation restrictions through intermediate media or intermediate identities, strengthening the security of logical boundaries in file management.

[0016] 3. This invention employs a dynamic threshold calculation method based on extreme value statistics theory, improving the adaptability and accuracy of early warning judgment. The system uses a generalized Pareto distribution function to fit the tail data of the cumulative associated index values, thereby estimating the dynamic threshold based on the risk distribution characteristics of actual business data, rather than relying on fixed empirical values. This method enables the system to automatically adapt to fluctuations in business behavior, effectively reducing the false alarm rate caused by changes in normal business volume while maintaining sensitivity to high-risk abnormal behavior, thus achieving a more scientific and intelligent risk early warning. Attached Figure Description

[0017] Figure 1 A schematic diagram of the structure of an artificial intelligence-based archive abnormal behavior analysis and early warning system provided in an embodiment of the present invention; Figure 2 This is a flowchart of the weighted transfer operation provided in an embodiment of the present invention; Figure 3 A flowchart of cross-region link retrieval provided for embodiments of the present invention. Detailed Implementation

[0018] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0019] Please see Figures 1 to 3 This invention provides an artificial intelligence-based system for analyzing and warning of abnormal behavior in archives. The technical solution is as follows: An AI-based system for analyzing and warning of abnormal behavior in archives includes: Graph construction module: Obtains data access logs and entity attribute data from the archive database, structurally maps the access subject, access medium, and archive data objects into nodes of the graph, parses the operation type field and timestamp in the log, generates time-series association edges with weight attributes between nodes, and constructs an archive data association topology graph. Attribute propagation module: In the archive data association topology graph, the initial state value is set according to the security level attribute of the archive data object node. Based on the graph traversal algorithm, the weighted transfer operation of the weight is performed along the temporal association edge to calculate the flow and accumulation value of the state value from the archive data object node to the access subject node and access medium node with connection relationship, and update the cumulative association index value of the access subject node and access medium node. Connectivity retrieval module: Set partition isolation rules in the archive data association topology graph, divide the topology graph into logically disconnected data partitions, and perform path search based on the link relationship of time-series associated edges to retrieve whether there are cross-region links connecting different data partitions; Early warning output module: When the cumulative associated index value meets the preset numerical judgment conditions and at least one of the following conditions is found in the cross-regional link, an early warning signal is generated.

[0020] Example 1:

[0021] This embodiment is applied to a police file management scenario. In daily operation, it faces the hidden risk of internal personnel using legitimate permissions to hoard unauthorized data, or low-level personnel indirectly stealing high-level files through shared terminals. To address the problem that existing threshold-based rules cannot identify such complex logical anomalies, this system is deployed on the institute's private cloud server to monitor and analyze all file access logs in real time.

[0022] As one embodiment of the present invention, refer to Figure 1 A schematic diagram of the structure of an AI-based archive abnormal behavior analysis and early warning system, referring to... Figure 2 The flowchart for weighted pass calculation is shown below. Figure 3 Cross-region link retrieval flowchart.

[0023] Furthermore, specific methods for structurally mapping the access subject, access medium, and archival data objects as nodes in a graph include: Read the log fields of the archive database, extract the user's unique identifier, terminal physical address MAC, and archive group number, and establish one-to-one corresponding access subject node, access medium node, and archive data object node; and store the security classification label field in the archive data object node; Generate time-series association edges with weight attributes between nodes, including performing numerical mapping based on an operation weight mapping table: mapping metadata read operations to a first basic weight value, online preview operations to a second basic weight value, file download operations to a third basic weight value, and entity export operations to a fourth basic weight value; wherein the fourth basic weight value is greater than the third basic weight value, the third basic weight value is greater than the second basic weight value, and the second basic weight value is greater than the first basic weight value; and write the corresponding basic weight values ​​into the attribute fields of the time-series association edges.

[0024] Specifically, during the system initialization phase, the entity alignment unit first accesses the background log stream of the document management system. For example, the system reads a log record showing that "User ID: RD_User_057" operated on "Document Number: XX.pdf" on "Terminal: MAC_A8-60-B6-XX-XX". The entity alignment unit queries the LDAP directory and asset table, mapping "RD_User_057" to the access subject node, "MAC_A8-60-B6-XX-XX" to the access medium node, and "XX.pdf" to the document data object node, and automatically associates it with the "Confidential" tag 2 in the document's metadata. Subsequently, the edge attribute quantification unit processes the operation behavior according to preset strict quantification standards: the system identifies the user's operation behavior code as "entity export" (such as printing or saving to a USB flash drive). According to the operation weight mapping table, this behavior is judged as the highest risk level and mapped to the fourth basic weight value, specifically set to 1.0; if the operation is only "file download" to the local hard drive, it is mapped to the third basic weight value of 0.8; if it is "online preview" without logging to the local hard drive, it is mapped to the second basic weight value of 0.5; if it is only "metadata reading" to view attributes, it is mapped to the first basic weight value of 0.23. Finally, the system generates a directed temporal association edge between the access subject node and the archive data object node, and writes the weight value of 1.0 into the attribute field of the edge, completing the accurate transformation from unstructured logs to structured graph data.

[0025] This invention breaks down the fragmented nature of traditional log auditing by unifying users, terminal devices, and archive files into graph nodes, laying a topological foundation for subsequent correlation analysis. In particular, by using an operation weight mapping table to differentiate the values ​​of behaviors with varying sensitivities, the system can distinguish the potential risk intensity of different operations from the source. This allows subsequent risk propagation calculations to accurately reflect the degree of harm caused by the behavior, avoiding the confusion between high-risk leak attempts and routine browsing behavior, and significantly improving the accuracy of risk quantification.

[0026] The graph construction module also includes a semantic association construction unit: extracting the text content of all archival data object nodes and calculating the semantic similarity between archives using a natural language processing model; when the semantic similarity between two archival data object nodes is greater than a preset semantic threshold, a semantic association edge is generated between the two archival data object nodes; and a one-way transmission constraint mechanism based on the security level potential difference is introduced: the basic weight of the semantic association edge is set as the product of the semantic similarity value and a preset influence factor. When performing the weighted transfer operation, the system first compares the security level attributes of the nodes at both ends of the association; if the security level of the source node is higher than that of the target node, the weight of the semantic association edge is multiplied by a preset attenuation coefficient (e.g., 0.01) to suppress the ineffective diffusion of high-risk potential energy to low-security level nodes; if the security level of the source node is lower than or equal to that of the target node, the basic weight remains unchanged. Thus, while allowing the horizontal diffusion of state values, it prevents false alarms caused by occasional similarity between the content of low-security and high-security documents, and then redirects the data to the access subject node. The preset impact factor ranges from 0.5 to 0.8, with the specific value depending on the business's sensitivity to content association risks. The purpose of this setting is to reduce the weight of semantic similarity (values ​​between 0 and 1), making the weight of the associated edges generated by it slightly lower than that generated by entity operations (such as file downloads with a weight of 0.8). This ensures that the dominant factor in risk propagation remains physical operations, while content association serves only as an auxiliary and reinforcing channel for risk transmission, avoiding excessive false alarm noise due to document template similarities, etc.

[0027] Specifically, the document text is input into the BERT model, and the vector at the [CLS] position of the last layer output is extracted as the semantic feature vector of the document. The cosine similarity formula is used to calculate the cosine value of the angle between the two feature vectors, which is used as the semantic similarity value. For example, the system analysis found that although "AXX.pdf" and "BXX.doc" are completely isolated in storage paths, their text vector cosine similarity is 0.9. The system then establishes a "semantic association edge" between these two documents in the graph, with a weight of 0.8. Suppose a user with only ordinary permissions first legally downloads the "shell blueprint". Since this node is connected to the "alloy recipe" through the semantic edge, the risk value is transmitted to the "alloy recipe" node through the semantic edge and is in a latent state centered on it. When the user subsequently attempts to access the "alloy recipe", due to the superimposed risk potential energy from before, its cumulative association index value will quickly exceed the threshold.

[0028] This invention overcomes the limitations of traditional log analysis, which relies solely on physical operation paths, by constructing a semantic association network for archives. Its beneficial effects lie in its ability to endow the system with the capacity to "understand content," enabling risk weights to be laterally transmitted between content-related but physically isolated archives. This effectively solves the problem of attackers evading detection using "divide and conquer" or "dispersed acquisition" strategies, allowing discrete access behaviors targeting the same sensitive topic to resonate within the graph, significantly improving the identification rate of logically concealed theft.

[0029] Furthermore, generating time-series related edges with weight attributes specifically includes: obtaining the time difference between the current system time and the operation occurrence time in the log; calculating the timeliness coefficient of the current operation using exponential decay logic based on a preset time half-life parameter; the timeliness coefficient monotonically decreases as the time difference increases, and its value ranges from zero to one; calculating the product of the basic weight value and the timeliness coefficient to obtain the effective weight of a single operation record; in the archive data association topology graph, if there are multiple operation records with different timestamps between two nodes, the effective weights of all records are linearly accumulated, and the sum is used as the aggregate edge weight connecting the two nodes to construct an archive data association topology graph containing the aggregate edge weight.

[0030] The method employs exponential decay logic to calculate the timeliness coefficient of the current operation. Specifically, the calculation logic is as follows: using the numerical value 2 as the base, and using the negative of the ratio of the current operation's time difference to a preset time half-life parameter as the exponent, the result of the power operation is used as the timeliness coefficient; alternatively, using the natural constant e as the base, and using the product of a negative decay constant and the time difference as the exponent, the calculation ensures that the timeliness coefficient decays rapidly and non-linearly with increasing time difference, and is strictly constrained within the range of zero to one.

[0031] Specifically, considering the time-sensitive nature of user behavior risks, violations from a year ago should have a lower impact on current risk assessments than violations today. The system sets a reference timestamp as the current system scan time and a time half-life parameter of 7 days (168 hours), meaning that the impact of an operation halves every 7 days. Assume the system detects a user's "file download" operation (base weight 0.8) on a "confidential" file that occurred 3 days ago. The system first calculates the time difference as 72 hours. Then, using exponential decay logic, the system calculates the current timeliness coefficient to be approximately 0.74. At this point, the final dynamic weight value of this time-series related edge is no longer the original 0.8, but is corrected to 0.8 × 0.74 = 0.592. If the user performed 5 different types of operations on the same file within the past week, the system will calculate the decayed weights of these 5 operations separately and linearly accumulate them. For example, if the accumulated result is 2.85, this value will be used as the weight of the aggregate edge connecting the user node and the file node.

[0032] This invention utilizes exponential decay logic to dynamically "forget" outdated historical interactions, while retaining the cumulative effect of high-frequency interactions through the calculation of "aggregated edge weights." This means that if a user hasn't accessed a file for a long time, their connection weight will naturally approach zero; conversely, intensive operations within a short period will cause the weight to rapidly accumulate. This mechanism allows the risk model to adaptively focus on current active threats while preserving the background baseline formed by historical behavior, effectively reducing false alarms caused by the accumulation of historical data and ensuring that early warning resources are concentrated on truly urgent security events.

[0033] Furthermore, the weighted pass operation performed specifically includes: The system iterates through all nodes in the archive data association topology graph and constructs a node state vector. For archive data object nodes, if the security level is public, the node's state value is initialized to zero; if the security level is confidential, the node's state value is initialized to a preset initial risk potential value according to the security level. For access subject nodes and access medium nodes, the state value is initialized to zero. The security levels include secret, confidential, and top secret. Specifically, the system performs the following mapping according to the security level: the initial risk potential value corresponding to secret-level archives is 20.0; the initial risk potential value corresponding to confidential-level archives is 50.0; and the initial risk potential value corresponding to top-secret-level archives is 100.0. The initial risk potential value is determined through the relative relationship between security levels and the weight of the security risk level they represent, ensuring that archives with higher security levels generate a stronger risk potential transfer intensity during risk propagation.

[0034] A sparse adjacency matrix is ​​constructed based on the connection structure of the topological graph associated with archival data. Global strength mapping is performed on the aggregated weights of temporally related edges: the entire graph is traversed to obtain the maximum observed value of the aggregated edge weights within a historical statistical period; the historical statistical period is a fixed time window, preferably the past 30 days. During global strength mapping, the system traverses all aggregated edge weight records with timestamps within the statistical period to find the maximum observed value. When there are no operation records within the statistical period, the system uses the maximum observed value of the previous period as a reference to ensure the continuity of the strength transfer coefficient calculation. For system initialization or when historical data is insufficient, the system can use a preset benchmark maximum weight (recommended to be 100.0) for normalization, and then dynamically adjust it after accumulating sufficient historical data. Divide the aggregated weight of each temporally related edge by the maximum observed value to obtain the strength transfer coefficient, which takes a value between zero and one. Fill the corresponding elements of the sparse adjacency matrix with the strength transfer coefficient to form the risk strength transfer matrix. In the iterative calculation, the high aggregated weight generated by high-frequency operations can be directly converted into a higher proportion of risk potential energy transfer. Iterative propagation calculation: Perform matrix multiplication on the node state vector using the risk strength transfer matrix. In each iteration, for each accessing subject node and / or accessing medium node, calculate the weighted sum of the risk potential energy transmitted from all predecessor neighbor nodes based on the strength transfer coefficient, and mark the weighted sum as the intermediate state value. Source value re-injection and damping constraints: Multiply the intermediate state value by a preset damping coefficient, and add the initial risk potential value of the archive data object node back into the calculation result of the archive data object node. Use the calculated final value as the new state value of the node after this iteration. Repeat the iterative propagation calculation, source value re-injection, and damping constraints to calculate the change in Euclidean distance of the node state vector between the two iterations. Stop the iteration when either the change is less than a preset convergence threshold or the number of iterations reaches a preset maximum number of iterations. Use the value in the finally converged node state vector as the cumulative association index value of each access subject node and access medium node and update the storage. The preset convergence threshold ranges from [value missing]. to The basis for setting this numerical range lies in the computational efficiency of the balancing algorithm and the accuracy of risk propagation: if the convergence threshold is set too large (e.g., greater than...), it will cause problems. Iterative calculations may terminate prematurely before the risk potential energy has fully transferred to deeply connected nodes (such as indirect contacts after multiple hops), leading to underreporting of latent risks; if the convergence threshold is set too low (e.g., less than...), it may also lead to underreporting of latent risks. While achieving extremely high numerical accuracy, this approach leads to an exponential increase in the number of iterations, significantly consuming server computing resources and contributing very little to the final risk ranking. Therefore, selecting this range ensures a sufficiently stable risk distribution result within a limited time window (e.g., second-level response time). The preset maximum number of iterations ranges from 20 to 50, preferably 30. This value is set based on the convergence test of graph theory algorithms on typical archival data association topology graphs, where the algorithm typically stabilizes around 20 iterations. Setting an upper limit of 50 iterations prevents the program from entering an infinite loop in the special case of oscillating subgraphs, while balancing the consumption of computing resources with the accuracy of the results.

[0035] The node state vector is a one-dimensional real number array, the length of which is equal to the total number of current nodes in the archive data association topology graph, and each dimension corresponds to the risk potential state value of a node. The sparse adjacency matrix is ​​a two-dimensional sparse matrix constructed in the order of node numbers. Preferably, it adopts a compressed sparse row or compressed sparse column storage format to reduce memory usage. The row index and column index of the matrix correspond to the node order in the above node state vector, and the matrix elements are the strength transfer coefficients between corresponding node pairs. When the node set is added or deleted, the system uniformly reconstructs the node index and sparse matrix structure after the preset statistical period ends, keeping the matrix dimension unchanged within a statistical period to ensure that the iterative propagation operation converges in a fixed-dimensional space.

[0036] The damping constraint is specifically implemented using a dynamic damping calculation method based on the difference in access level potential. The system pre-sets the access level values ​​of the accessing entity node and the security level values ​​of the archive data object node. During iterative calculations, for each propagation path from the archive data object node to the accessing entity node, the level difference between the two is calculated. The damping coefficient is dynamically adjusted based on this level difference. When the access level value of the accessing entity node is less than the security level value of the archive data object node, the throughput of the damping coefficient is increased, resulting in low-loss transmission of abnormal characteristic values. When the access level value of the accessing entity node is greater than or equal to the security level value of the archive data object node, the throughput of the damping coefficient is decreased, accelerating the dissipation of abnormal characteristic values. By introducing a dynamic damping mechanism based on the difference in access level potential, "contextual awareness" in risk assessment is achieved. This not only significantly reduces the false alarm rate caused by normal, high-frequency operations by high-privilege personnel, but more importantly, it maintains extremely high sensitivity to unauthorized access by low-privilege personnel. Through a low-loss transmission mechanism, it ensures that even minor unauthorized attempts generate significant risk responses within the system. The specific numerical mapping and calculation method is as follows: The file security classification level is mapped to an integer sequence, for example, Secret is set to the value 2, Confidential to the value 3, and Top Secret to the value 4; the access subject's permission level is mapped to a homogeneous integer sequence, for example, ordinary users are set to the value 1, personnel with access to classified information are set to the value 3, and core management personnel are set to the value 4. The basis for this setting is to construct a computable scalar space, allowing the potential difference between permissions and security classification levels to be directly quantified. Specifically, in the calculation, the access subject node's permission level value is subtracted from the file data object node's security classification level value to obtain the level difference. When the level difference is less than zero, it indicates a 'low-authority, high-secrecy' access characteristic (where the permission level is lower than the security classification level), and the system increases the damping coefficient's pass rate to ensure low-loss transmission of the risk characteristic value; when the level difference is greater than or equal to zero, it indicates that the permission level covers the security classification level, constituting compliant access, and the system decreases the damping coefficient's pass rate to accelerate the dissipation of the risk characteristic value.

[0037] Specifically, this system utilizes a variant of the PageRank algorithm to simulate the flow of risk in the graph. First, initialization is performed. Assuming there is a node in the graph labeled "Top Secret" containing a blueprint of a certain engine model, the system identifies its security level and initializes its state value (i.e., risk potential) to 100.0, while the initial state values ​​of all ordinary user nodes and PC terminal nodes are set to 0. The system constructs a sparse adjacency matrix based on the connectivity of the entire graph, normalizing the weights of aggregated edges to transition probabilities. For example, if user A downloaded the blueprint, the edge weight is larger, resulting in a higher risk transition probability. Matrix multiplication is then performed. In the first iteration, the 100 risk points of the "Top Secret" blueprint node flow along the associated edges to users A and B who previously visited it. Assuming user A frequently downloads the blueprint, they gain 60 risk points, while user B only previews it, gaining 10. A damping coefficient is introduced (its value ranges from 0.8 to 0.95, preferably 0.85). This means that in each propagation, only 85% of the risk value is retained, while the remaining 15% simulates natural dissipation to prevent the value from amplifying infinitely in the closed-loop path; the above calculation is repeated. As iterations proceed, the risk value flows not only from the archive to the user, but also from the user to the terminal device they use. For example, a printer node frequently used by user A may accumulate a risk value of up to 40 points after the third iteration. When the change in the Euclidean distance of the whole graph node state vector calculated in two consecutive iterations is less than 0.001, the system determines convergence and stops calculation. At this point, the final value that each user and terminal node holds is their cumulative association index value.

[0038] This invention achieves "contagion" analysis of risk through this iterative risk potential propagation mechanism, moving beyond a singular focus on individual nodes to quantify the transmission effect of risk across the network. Even if a user doesn't directly violate regulations, their cumulative association index value will increase if they frequently access high-risk files or use terminal devices contaminated by high-risk individuals. This holistic perspective can keenly capture hidden risks accumulated through piecemeal or incremental actions, significantly enhancing the ability to detect advanced persistent threats or slow internal data breaches.

[0039] Furthermore, the partition isolation rules set in the connectivity retrieval module specifically include: Extract the department attribute of the node; pre-set a logical isolation rule table containing mutually exclusive department identifier pairs; during path search, compare the department attribute of the starting node of the current traversal path with that of the current node in real time; if the attribute values ​​of the two belong to mutually exclusive pairs in the logical isolation rule table, then determine that the current node is logically unreachable relative to the starting node, and no longer extend the search path to that node, thereby dividing the graph structure into disconnected data partitions at the logical topology level.

[0040] Specifically, strict logical walls exist between different departments. The system first extracts metadata, identifying that file nodes belong to "Department XX," while certain access subject nodes belong to "Department ZZ." The administrator defines mutual exclusion rules in the logical isolation rule table: {"XX" <-> "ZZ"}. When the connectivity retrieval module performs path searches on the graph, the system generates dynamic subgraph isolation masks. Suppose the search algorithm attempts to start from a drawing of "Department XX" and search for potential leakage paths along associated edges. When the traversal path extends to a user node with the attribute of "Department YY," the subgraph mask is immediately triggered. The system checks and finds that the attributes of the current node match the mutual exclusion rule with the attributes of the starting node. Therefore, the node is forcibly marked as "logically unreachable," and the search algorithm is prohibited from continuing through this node.

[0041] This invention effectively eliminates paths that are connected in the graph topology but are meaningless or permitted in business logic through partitioning and isolation rules, thereby significantly reducing computational load and false alarms. For example, without this rule, graph algorithms might find associated paths with excessively large diameters, leading to divergent risk analysis. Through logical masks, the system limits anomaly detection to specific business security domains or compliance boundaries, ensuring that retrieved cross-regional links truly represent abnormal behavior that violates business isolation restrictions, enhancing the targeted nature and practical value of early warnings.

[0042] Furthermore, the path search and cross-regional link search performed by the connectivity retrieval module specifically include: Select a data object node with a confidentiality level as the search source, and select a set of access subject nodes that should be logically isolated from the data object node as the target domain. Starting from the search source, perform a depth-first search in the data association topology graph. During the search, set a maximum hop count limit parameter, and only search topology paths whose path length is not greater than the maximum hop count limit parameter. In the search path, identify whether there is an intermediate node with the attribute "access medium". If a path presents a topology structure of "search source - access subject A - access medium B - access subject C", and access subject C belongs to the target domain, then this path is determined to be a shared medium jump link. In the search path, identify whether there is an intermediate node with the attribute "access subject". If a path presents a topology structure of "search source - access medium A - access subject B - access medium C - access subject D", and access subject D belongs to the target domain, then this path is determined to be an account-shared jump link. Mark all identified shared medium jump links and account-shared jump links as the cross-region links, and extract all node IDs and edge weight information involved in the links.

[0043] The maximum hop count limit parameter ranges from 2 to 5 hops, preferably 3 hops, to balance the detection range of abnormal paths with computational efficiency. When a path matching one of the two springboard link patterns is found during the search, the system immediately records the link and continues searching for other possible paths to ensure that all abnormal propagation paths meeting the criteria are discovered. For links with very low weights (such as aggregate weights less than the preset minimum weight threshold of 0.1), the system may choose not to report them to avoid excessive low-value warnings.

[0044] Specifically, to detect covert indirect leaks, the system periodically performs in-depth investigations. The system identifies a core classified file S as the source and sets the target domain as the set of nodes belonging to all "outsourced personnel" and "non-classified administrative personnel." Starting from this file node, the system performs a restricted depth-first search, setting a maximum hop limit of 3 hops, meaning it only focuses on interpersonal or device connections within 3 steps. The search reveals a path: File (source) — Read by personnel A (with permissions) — Associated with a public printer P (access medium) — Read by outsourced personnel B (target domain). System analysis reveals that this path structure conforms to the characteristics of "source — subject A — medium B — subject C," and subject C belongs to a controlled target domain. The system immediately determines this to be a "shared medium springboard link," meaning that outsourced personnel may have obtained classified information through a public printer. The system also discovers another path: File (source) — Stored by medium T — Logged in by subject A — A then logs in to an external laptop M (medium) — This laptop is used by unauthorized user C (target domain). This constitutes a complex chain of "source point - medium - subject - medium - subject", which is identified as an "account sharing springboard link"; the system outputs all node IDs and weights of the above two links as a complete evidence chain.

[0045] This invention defines two typical topology templates: "media springboard" and "identity springboard." This allows for the precise identification of behaviors that bypass access control by using public devices (such as printers and scanners) as intermediaries, or by borrowing accounts or using multiple terminals. This graph pattern matching-based detection capability fills the gap in traditional auditing's monitoring of complex "human-machine-human" interaction chains, significantly improving the detection rate of internal negligence or deliberate evasion.

[0046] Furthermore, the numerical judgment conditions in the early warning output module adopt dynamic threshold calculation based on extreme value statistical theory: Periodically read the cumulative association index values ​​of all access subject nodes and access medium nodes to construct an index value sample set; calculate the mean and standard deviation of the index value sample set; fit the tail data of the top 5% of the index value sample set using the generalized Pareto distribution function to estimate the tail risk distribution parameters of the sample set; based on the fitted tail risk distribution parameters, calculate the quantile value corresponding to the preset false alarm rate level; set the quantile value as the current dynamic threshold; when the cumulative association index value of any access subject node and / or access medium node is greater than the dynamic threshold, it is determined that the numerical judgment condition is met.

[0047] Estimating the tail risk distribution parameters of the sample set specifically refers to iteratively solving the shape and scale parameters of the generalized Pareto distribution using the maximum likelihood estimation method. The dynamic threshold is calculated based on the fitted parameters, specifically according to the inverse cumulative distribution function: the current dynamic threshold equals the location parameter plus the ratio of the scale parameter to the shape parameter multiplied by an adjustment coefficient; the adjustment coefficient is the ratio of the total number of samples to the number of samples exceeding the threshold multiplied by a preset false alarm rate level, then the shape parameter is raised to a negative exponent, and the result is subtracted by a value. The preset false alarm rate level is typically set to 0.01% to 1%, preferably 0.1%. This range is based on the application characteristics of extreme value statistics theory in security audit scenarios: mathematically, this parameter corresponds to the tail probability of the generalized Pareto distribution function, specifically defined as: the probability that the cumulative association index value of any node is greater than the current dynamic threshold equals the preset false alarm rate. If this value is set too high (e.g., greater than 1%), it means the system tolerates a high probability of false alarms, which could lead to a large number of normal, high-frequency business operations on the edge being misjudged as abnormal, causing "alarm fatigue" for security operations personnel. If this value is set too low (e.g., less than 0.01%), the calculated dynamic threshold will be too extreme. Although this greatly reduces false alarms, it may miss some less intense but still threatening covert attacks (false negatives). Therefore, selecting around 0.1% as a benchmark is a statistical balance between ensuring sensitivity to low-probability, high-risk events and maintaining acceptable operational costs.

[0048] Specifically, the system no longer uses fixed thresholds (such as "alarms for downloads exceeding 50 times per day"), but instead establishes an adaptive baseline. Every morning, the system reads the cumulative association index values ​​of 2,000 user nodes across the entire network to construct a sample set. Assuming most users' index values ​​are between 0 and 10, but a very small number of high-frequency users have higher values, the system calculates the mean and standard deviation, then extracts the top 5% of the sample data (e.g., those with index values ​​greater than 40). This "long-tail" data is fitted using a generalized Pareto distribution function to estimate shape and scale parameters. Based on the acceptable false alarm rate set by the administrator (e.g., 0.1%), the system calculates the dynamic threshold for the day as 85.5 based on the fitted curve. That afternoon, if a user's cumulative association index value spikes to 92.0 due to a sudden surge in the export of confidential documents, exceeding the daily threshold of 85.5, the system immediately determines that the numerical condition is met and triggers an alarm.

[0049] This invention utilizes extreme value statistics theory to set dynamic thresholds. By fitting only the tail-end extreme data, the system can accurately describe the fuzzy boundary between normal but high-frequency data and true anomalies in the business environment. This means that the threshold automatically fluctuates with the level of business activity—during the year-end archiving peak, when overall activity is high, the threshold automatically rises to avoid widespread false alarms; during normal off-peak periods, the threshold automatically decreases to ensure sensitivity to sudden anomalies. The application of this statistical method gives the system strong environmental adaptability, significantly reducing the burden on operations personnel to manually adjust thresholds.

[0050] As an optional embodiment, the system also includes an exception subgraph storage and backtracking module: The abnormal subgraph storage and backtracking module is configured such that when the early warning output module generates an early warning signal, the access subject node or access medium node that triggers the early warning, or the node in the detected cross-regional link, is used as the central anchor point. In the topology graph of the archived data association, all neighboring nodes and associated edges centered on the central anchor point and within a preset backtracking depth range are extracted to form an abnormal evidence subgraph; the preset backtracking depth range is set to 2 to 3 hops. This value is based on the principle of "six degrees of separation" and the principle of decreasing evidence relevance: in abnormal behavior analysis, the direct neighbors (1 hop) of the central anchor point and the strong related parties of the neighbors (2 hops) constitute the core evidence chain (such as the "human-machine-human" structure), covering more than 90% of direct causal relationships; the relevance of nodes exceeding 3 hops decreases exponentially and the amount of data increases exponentially, and introducing too many irrelevant nodes will interfere with the auditor's judgment.

[0051] The abnormal evidence subgraph is serialized into JSON or adjacency list format, and labeled with a warning timestamp and event ID. It is then stored independently in the evidence database. The evidence database is physically isolated from the original archive data association topology graph and is used for subsequent audit backtracking and evidence solidification.

[0052] Furthermore, a hybrid detection engine is constructed, which runs in parallel a rule matching engine based on static features and an anomaly detection model based on graph computation. The rule matching engine is used to detect hard violations that violate a preset security baseline, while the anomaly detection model is used to detect hidden anomalies that exceed the cumulative associated index value limit. When either engine triggers a detection hit, the metadata of the risk event is extracted, and a corresponding handling strategy is matched based on a preset expert knowledge base. The handling strategies include account banning, permission downgrading, secondary verification, and manual audit suggestions. A structured alarm report containing the risk level, triggering reason, and recommended handling suggestions is generated and pushed to the management terminal.

[0053] Based on the access relationships in the archival data association topology graph, a co-occurrence relationship graph among access subjects is constructed. A community detection algorithm is used to divide the co-occurrence relationship graph into several behavioral communities. The sum of the cumulative association index values ​​of all access subject nodes within each behavioral community is calculated as the community risk index. When the community risk index exceeds a preset gang risk threshold, a collaborative anomaly warning is generated for all members within that behavioral community. Through community detection and risk aggregation technology, the problem of single-point detection being unable to cope with distributed attacks is solved. Its beneficial effect is that it elevates the observation perspective from the individual to the group dimension. In practical cases, internal leaks are often caused by multiple people conspiring together, or attackers controlling multiple zombie accounts to download fragments. This solution can keenly capture the clustering characteristics of these accounts in the graph structure, forming a strong group risk signal by accumulating weak individual signals, thereby effectively identifying the fragmented, collaborative gang behavior. The preset gang risk threshold is dynamically set based on the size characteristics of the behavioral community. Specifically, considering that gang attacks typically have the characteristic of "breaking down into smaller parts" (i.e., the risk value of a single member may be lower than the single-point alarm line, but the overall risk density of the community is abnormally high), this threshold should be positively correlated with the number of nodes contained in the community. In a preferred embodiment, the calculation logic of the preset gang risk threshold is as follows: multiply the number of access subject nodes contained in the community (i.e., gang size) by the current dynamic threshold for a single access subject and the preset collaborative risk coefficient, and the product is the gang risk threshold. The dynamic threshold is calculated using the aforementioned extreme value statistical theory and serves as a baseline reference line; the collaborative risk coefficient is used to adjust the sensitivity to gang aggregation, and its value is preferably between 0.6 and 0.8. The rationale behind this setting is that if the collaborative risk coefficient is set to 1, it is equivalent to simply adding up the individual alarm thresholds of all members in the community, making it difficult to detect hidden gangs. However, by introducing a coefficient less than 1, it is equivalent to reducing the tolerance for the average risk value when calculating the gang threshold, thereby enabling the keen detection of abnormal behavior communities that, although the average risk of members has not reached the individual threshold, have already shown significant clustering characteristics.

[0054] The system also includes a visualization analysis and interaction module, which performs the following steps: reading the structural data of the archive data association topology map and rendering a dynamic map view based on the Force-Atlas layout algorithm; overlaying and rendering a heat map layer on the map according to the access frequency and association weight of each archive data object node, using color depth to represent the popularity and risk concentration areas of the archives; reading historical risk data within the time window and drawing a risk trend map, which includes the fluctuation curve of the cumulative association index value and the time distribution bar chart of warning events; and providing a drill-down analysis interaction interface, which expands to display the detailed attributes of the node, the list of neighbor relationships, and the associated historical operation logs when a selection command for a node in the map is received.

[0055] This embodiment achieves effective aggregation and identification of concealed abnormal behaviors by constructing a topological graph of archive data association and an attribute propagation mechanism. The system maps discrete access subjects, access media, and archive data objects to graph nodes, and uses weighted transfer operations of feature values ​​to allow risks to flow and accumulate in the graph structure. This mechanism can effectively aggregate minor risk behaviors that are scattered over a long time window and do not violate regulations in a single operation at the node level, thereby accurately identifying complex abnormal patterns with long-range dependencies and logical concealment. This effectively solves the problem that traditional static thresholds cannot detect illegal intentions under legitimate permissions, such as "low-frequency and slow" behaviors.

[0056] Example 2:

[0057] This embodiment details the application of an AI-based archive anomaly behavior analysis and early warning system in archive management. It focuses on how the system utilizes the partitioning and isolation technology of the connectivity retrieval module, path retrieval technology against springboard attacks, and dynamic threshold technology based on extreme value statistics to construct an intelligent anti-leakage defense line adapted to high dynamics and high adversarial situations.

[0058] As one embodiment of the present invention, refer to Figure 1 A schematic diagram of the structure of an AI-based archive abnormal behavior analysis and early warning system, referring to... Figure 2 The flowchart for weighted pass calculation is shown below. Figure 3 Cross-region link retrieval flowchart.

[0059] In the initial stage of system deployment, the graph construction module first connected to the log auditing interface. The system performed entity alignment operations, standardizing complex elements into graph nodes: mapping each person's digital certificate ID to an access subject node, and marking its department and rank in the node attributes; mapping XX terminals, self-service kiosks, office computers, and printers to access media nodes, recording their physical location and MAC address; mapping electronic case files, recorder audio and video, and intelligence reports to archival data object nodes, and synchronously reading their security classification attributes.

[0060] Based on this, the system generates weighted temporal-series related edges. Considering timeliness, the system introduces time-series decay calculation. For example, if person A accessed a case file three months ago, the corresponding edge weight, after exponential decay calculation, contributes negligibly to the current risk value. If person A accessed the case file intensively in the past 24 hours, the timeliness coefficient is close to 1, and these operations will generate high-weighted aggregated edges. For high-risk operations such as exporting to removable storage media or printing out paper documents, the system assigns them the highest fourth basic weight value in the edge attribute quantification unit, because such behavior means that the data has escaped the control of the electronic fence, and the potential risk is far higher than online browsing.

[0061] The connectivity retrieval module plays a crucial role here, setting strict partitioning and isolation rules. The system has a pre-defined logical isolation rule table that clearly defines mutually exclusive conflicting interests. When the system runs the full-graph path search algorithm in the background, the subgraph mask filtering mechanism takes effect in real time. Suppose person B attempts to retrieve clues related to a case. Although he is physically connected to the database, at the logical level of the graph, when the search path attempts to extend from person B's node to the core intelligence node belonging to team XX, the system detects that the departmental attribute triggers a mutual exclusion rule. The subgraph mask immediately marks the intelligence node as a logical black hole, forcibly cutting off the search path. This mechanism ensures that even if the physical network is interconnected, the data partitions of different departments are strictly isolated in the topology of abnormal behavior analysis, thereby avoiding cross-departmental erroneous associations when the algorithm calculates risk propagation and reducing false alarms.

[0062] During an operation, Personnel C from Team XX printed a plan in the general printing room. This printer, being a shared facility, was mapped as a high-centrality access medium node. Subsequently, Personnel D also operated on the same printer (e.g., scanning or printing unrelated documents). Conventional auditing failed to detect any anomalies because both had printer access privileges. However, the system's connectivity retrieval module, performing a restricted depth-first search, captured the following topology: [File Source: Plan] -> [Access Subject: Personnel C] -> [Access Medium: Shared Printer] -> [Access Subject: Personnel D]. Although Personnel D did not directly access the capture plan, the graph structure showed that he shared the same physical medium with Personnel C, who possessed core secrets, within a very short time window. Considering that Personnel D belonged to the "target domain," the system determined this to be a shared medium springboard link, indicating a potential risk of leftover printouts, cache theft, or verbal disclosure by Personnel C.

[0063] The system also detected another abnormal pattern. Personnel E had permission to assist in querying basic information but lacked access to core case files. A graph search revealed: [File Source: Core Case Files] → [Access Medium: Dedicated Terminal T1] → [Access Subject: Team Leader F] → [Access Medium: Mobile Terminal M2] → [Access Subject: Personnel E]. Analysis showed that Team Leader F operated on the case files on Dedicated Terminal T1, while Team Leader D's account also logged into Mobile Terminal M2, and Personnel E's account subsequently left activity logs on Mobile Terminal M2. This five-hop link of "Source—Media—Subject—Media—Subject" highly likely indicates that Team Leader F improperly lent their mobile terminal to Personnel E, or that Personnel E stole the team leader's terminal for operation. The system marked this as an "Account Sharing Jump Link" and issued a warning.

[0064] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. An artificial intelligence-based system for analyzing and warning of abnormal behavior in archives, characterized in that: include: Graph construction module: Obtains data access logs and entity attribute data from the archive database, structurally maps the access subject, access medium, and archive data objects into nodes of the graph, parses the operation type field and timestamp in the log, generates time-series association edges with weight attributes between nodes, and constructs an archive data association topology graph. Attribute propagation module: In the archive data association topology graph, the initial state value is set according to the security level attribute of the archive data object node. Based on the graph traversal algorithm, the weighted transfer operation of the weight is performed along the temporal association edge. The flow and accumulation value of the state value from the archive data object node to the access subject node and access medium node with connection relationship is calculated, and the cumulative association index value is generated and updated. Connectivity retrieval module: Set partition isolation rules, divide the topology graph into logically disconnected data partitions, and perform path search based on the link relationship of time-series associated edges to retrieve whether there are cross-region links connecting different data partitions; Early warning output module: When the cumulative associated index value meets the preset numerical judgment conditions and at least one of the following conditions is found in the cross-regional link, an early warning signal is generated.

2. The artificial intelligence-based archive abnormal behavior analysis and early warning system according to claim 1, characterized in that, The specific methods for structurally mapping access subjects, access media, and archival data objects into nodes of a graph include: reading the log fields of the archival database, extracting the user's unique identifier, terminal physical address MAC, and archival group number, establishing corresponding access subject nodes, access media nodes, and archival data object nodes, and storing the security classification label field in the archival data object nodes; Generate time-series related edges with weight attributes between nodes, including performing numerical mapping based on an operation weight mapping table: mapping metadata reading operations to a first basic weight value, online preview operations to a second basic weight value, file download operations to a third basic weight value, and entity export operations to a fourth basic weight value; wherein the fourth basic weight value decreases sequentially from the first basic weight value; and the corresponding basic weight values ​​are written into the attribute fields of the time-series related edges.

3. The artificial intelligence-based archive abnormal behavior analysis and early warning system according to claim 1, characterized in that, Generating time-series related edges with weight attributes specifically includes: obtaining the time difference between the current system time and the operation occurrence time in the log; calculating the timeliness coefficient of the current operation using exponential decay logic based on a preset time half-life parameter; the timeliness coefficient monotonically decreases as the time difference increases, and its value ranges from zero to one; calculating the product of the basic weight value and the timeliness coefficient to obtain the effective weight of a single operation record; in the archive data association topology graph, if there are multiple operation records with different timestamps between two nodes, the effective weights of all records are linearly accumulated, and the sum is used as the aggregate edge weight connecting the two nodes to construct an archive data association topology graph containing the aggregate edge weight.

4. The artificial intelligence-based archive abnormal behavior analysis and early warning system according to claim 1, characterized in that, The weighted propagation operation specifically includes: traversing the nodes in the archival data association topology graph and constructing node state vectors; initializing the state values ​​of classified archival data object nodes to preset initial risk potential values; initializing the state values ​​of public-level archival data object nodes, access subject nodes, and access medium nodes to zero; constructing a sparse adjacency matrix based on the topology graph connection structure; obtaining the maximum observed value of the aggregated edge weights within the historical period, dividing the aggregated weights of the temporal association edges by the maximum observed value to obtain the intensity propagation coefficient, and filling it into the sparse adjacency matrix to form a risk intensity propagation matrix; and performing iterative propagation calculations: using the risk intensity propagation matrix to perform matrix operations on the node state vectors. Multiplication operation; calculate the weighted sum of the risk potential energy transmitted from the predecessor neighbor node based on the strength transmission coefficient, and mark it as an intermediate state value; damping constraint: multiply the intermediate state value by the preset damping coefficient, and add the initial risk potential energy value of the archive data object node back into the calculation result, and use the final value as the new state value; repeat the iterative propagation calculation and damping constraint, and calculate the change in Euclidean distance of the node state vector in the two iterations; the preset numerical judgment condition is: when the change in Euclidean distance is less than the preset convergence threshold and the number of iterations reaches the preset maximum number of iterations, the iteration stops; use the value in the node state vector as the cumulative association index value.

5. The artificial intelligence-based archive abnormal behavior analysis and early warning system according to claim 1, characterized in that, The partitioning isolation rules set in the connectivity retrieval module specifically include: extracting the department attribute of a node; pre-setting a logical isolation rule table containing mutually exclusive department identifier pairs; during path search, comparing the department attribute of the starting node of the current traversal path with that of the current node in real time; if the attribute values ​​of the two belong to mutually exclusive pairs in the logical isolation rule table, then the current node is determined to be logically unreachable relative to the starting node, and the search path is no longer extended to that node, thus dividing the graph structure into mutually disconnected data partitions at the logical topology level.

6. The artificial intelligence-based archive abnormal behavior analysis and early warning system according to claim 1, characterized in that, The path search and cross-region link search performed by the connectivity retrieval module specifically include: selecting archive data object nodes with confidentiality attributes as search source nodes, and selecting a set of access subject nodes that should be logically isolated from the archive data object nodes as the target domain; starting from the search source node, setting a maximum hop count limit parameter, and searching for a topology path whose length is not greater than the maximum hop count limit parameter; identifying whether there are intermediate nodes with the attribute of access medium in the search path; if the path presents a topology structure of "search source node—access subject A—access medium B—access subject C", and access subject C belongs to the target domain, then the path is determined to be a shared medium jump link; identifying whether there are intermediate nodes with the attribute of access subject; if the path presents a topology structure of "search source node—access medium A—access subject B—access medium C—access subject D", and access subject D belongs to the target domain, then the path is determined to be an account-shared jump link; marking the identified shared medium jump links and account-shared jump links as the cross-region links, and extracting all node IDs and edge weight information involved in the links.

7. The artificial intelligence-based archive abnormal behavior analysis and early warning system according to claim 1, characterized in that, The specific numerical judgment criteria include: periodically reading the cumulative association index values ​​of all access subject nodes and access medium nodes to construct an index value sample set; calculating the mean and standard deviation of the index value sample set; fitting the data of the top 5% of values ​​in the index value sample set using the generalized Pareto distribution function to estimate the tail risk distribution parameters; calculating the quantile values ​​corresponding to the preset false alarm rate level based on the tail risk distribution parameters; setting the quantile values ​​as the current dynamic threshold; and determining that the numerical judgment criteria are met when the cumulative association index value of any access subject node and / or access medium node is greater than the dynamic threshold.

Images