A computer system intrusion processing method, system and readable storage medium
By identifying important information and generating antonyms when a computer system is compromised, the problem of irrecoverable leaked information is solved, thus reducing information leakage and improving system security and privacy protection.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- SHENZHEN CHUANGZHICHENG TECH CO LTD
- Filing Date
- 2024-01-18
- Publication Date
- 2026-07-24
AI Technical Summary
Existing technologies, even if they disconnect the network to prevent further information leakage after a computer system is compromised, cannot recover the already leaked information, making the leakage of important information unavoidable.
By identifying important information being viewed, natural language processing techniques are used to filter out similar statements and generate antonyms to replace related statements in the computer system, misleading intruders and reducing the impact of information leakage.
It effectively reduces the loss of leaked information, improves system security, protects user privacy and sensitive information, and prevents potential intruders from obtaining valuable content.
Smart Images
Figure CN117909969B_ABST
Abstract
Description
Technical Field
[0001] This application belongs to the field of data processing, and in particular relates to a computer system intrusion handling method, system, and readable storage medium. Background Technology
[0002] Significant progress has been made in preventing computer system intrusion over the past few decades. With the widespread adoption of the internet and the rapid development of information technology, cybersecurity threats are constantly increasing, making the protection of computer systems from intrusion increasingly important. For example, password-based authentication, firewalls, and intrusion detection systems (IDS) can be used. However, some techniques can still bypass these protective measures. For instance, unknown users may exploit vulnerabilities in the operating system to inject malicious code or perform unauthorized operations to gain control of the computer and then access sensitive information.
[0003] In related technologies, after a computer system is compromised, the first step is to disconnect the network connection, then scan the computer, change passwords, update the operating system and applications, and strengthen firewall and security settings. System logs should also be reviewed to prevent intruders from accessing important information.
[0004] However, the aforementioned techniques are used to prevent the further theft of important files in a computer system after it has been compromised, through measures such as cutting off the network. But before the network is cut off, some important information in the computer system has already been viewed, leading to the leakage of important information. Even if the network is cut off, the consequences caused by the leaked information cannot be changed, and the losses that have already been incurred cannot be recovered. Summary of the Invention
[0005] This application provides a computer system intrusion handling method, system, and readable storage medium for reducing losses caused by leaked information.
[0006] In a first aspect, this application provides a computer system intrusion processing method, which, upon determining that a computer system has been intruded upon, identifies currently viewed important information; determines, based on the content currently displayed of the important information, a first text segment that has been viewed and other unviewed text segments, wherein the number of other text segments is one or more; identifies several important statements in the first text segment and several related statements in the other text segments that have a similarity greater than a preset threshold to the several important statements; processes the several important statements using natural language processing technology to obtain several antonyms that correspond one-to-one with the several important statements, wherein the several antonyms correspond one-to-one with the several related statements; and replaces the several related statements with the several antonyms that correspond one-to-one with them.
[0007] By employing the above technical solution, in the event of a computer system intrusion, the method identifies the currently viewed important information and, based on this information, determines the first section of text that has already been viewed and the remaining unviewed text. It then identifies related sentences in the other text that have a similarity greater than a preset threshold based on important sentences in the first section. Furthermore, this method utilizes natural language processing techniques to process these important sentences, generating corresponding antonyms and replacing them with their antonyms. This makes the semantics of the other text segments opposite to the semantics of the first section that has already been viewed, misleading the intruding user and thus reducing the loss caused by the leaked information.
[0008] In conjunction with some embodiments of the first aspect, in some embodiments, determining a number of important statements in the first text segment and a number of related statements in other text segments that have a similarity greater than a preset threshold to the important statements specifically includes: inputting the important statements and all statements in the other text segments into a sentence embedding model to obtain a number of first word vectors corresponding to the important statements and a number of second word vectors corresponding to all statements; calculating the similarity between the first word vectors and the second word vectors using a cosine similarity calculation method; and filtering out the important statements in the first text segment and the related statements in the other text segments that have a similarity greater than the preset threshold.
[0009] By employing the above technical solution, important sentences and all sentences from other texts are input into a sentence embedding model to obtain corresponding word vectors. The cosine similarity calculation method is then used to calculate the similarity between the first and second word vectors. Finally, important and related sentences with similarity greater than a preset threshold are selected. This improves the accuracy of identifying related sentences.
[0010] In conjunction with some embodiments of the first aspect, in some embodiments, natural language processing technology is used to process several important statements to obtain several antonyms that correspond one-to-one with the several important statements. Specifically, this includes: preprocessing the several important statements to obtain several preprocessed important statements; inputting the several preprocessed important statements into a natural language processing model to obtain several secondary processed important statements corresponding to the several preprocessed important statements; and postprocessing the several secondary processed important statements to obtain several antonyms.
[0011] By employing the above technical solution, important statements are preprocessed to obtain preprocessed important statements. Then, by inputting into a natural language processing model, the preprocessed important statements are transformed into secondary-processed important statements. Next, the secondary-processed important statements undergo post-processing to obtain antonyms. This effectively transforms important statements into corresponding antonyms, improving the accuracy of obtaining antonyms.
[0012] In conjunction with some embodiments of the first aspect, in some embodiments, the important statements are preprocessed to obtain several preprocessed important statements, specifically including: dividing the important statements into several corresponding words; determining several stop words among the several words according to a preset stop word list; deleting several stop words among the several words to obtain several used words; and recombining the several used words to obtain several preprocessed important statements corresponding to the important statements.
[0013] By employing the above technical solution, important sentences are divided into corresponding words, and a preset stop word list is used to determine stop words. By deleting stop words, usable words are obtained, and these usable words are then recombine to obtain the preprocessed important sentences. The beneficial effect of this step is that by removing stop words, interference from noise and redundant information is reduced, making the important sentences more concise and accurate.
[0014] In conjunction with some embodiments of the first aspect, in some embodiments, post-processing is performed on several key statements of the next processing to obtain several antonyms, specifically including: deleting repeated words from several key statements of the next processing to obtain several concise key statements of the next processing; using a syntax parse tree to adjust the grammatical structure of several concise key statements of the next processing to obtain several adjusted key statements of the next processing; replacing several adjusted key statements of the next processing with synonyms according to a preset dictionary to obtain several replaced key statements of the next processing; performing text smoothing processing on several replaced key statements of the next processing to obtain several smooth key statements of the next processing; and performing language correction on several smooth key statements of the next processing to obtain several antonyms.
[0015] By employing the above technical solution, repetitive words are removed from the secondary processed important sentences to obtain concise secondary processed important sentences. Then, a syntax tree is used to adjust the grammatical structure, resulting in adjusted secondary processed important sentences. Next, synonym replacement is performed on the adjusted secondary processed important sentences according to a preset dictionary, resulting in replaced secondary processed important sentences. Finally, text smoothing processing is applied to the replaced secondary processed important sentences to obtain smoothed secondary processed important sentences. Then, language correction is performed on the smoothed secondary processed important sentences to finally obtain antonyms. This further improves the accuracy and coherence of important sentences. Through operations such as removing repetitive words, adjusting the grammatical structure, replacing synonyms, text smoothing, and language correction, the secondary processed important sentences become clearer, more grammatically correct, and have better expressive effects. Thus, the processed antonyms can more accurately reflect the meaning of the original important sentences, providing more targeted guiding information, making the semantics of other text segments opposite to the semantics of the first text segment already viewed, misleading intruding viewers, and reducing the losses caused by leaked information.
[0016] In conjunction with some embodiments of the first aspect, in some embodiments, determining the first text segment that has been viewed and other text segments that have not been viewed based on the content currently displayed of the important information specifically includes: determining the page currently displayed on the computer screen; determining the first text segment that has been viewed based on the page; and determining the text segments in the important information other than the first text segment as other text segments.
[0017] By employing the above technical solution, the page currently displayed on the computer screen can be accurately determined, and the first text segment that has been viewed can be identified based on that page. In this way, the system can track the user's browsing behavior, identify important information viewed by the user, and process it. Simultaneously, this method can also identify text segments other than the first unviewed segment, providing an accurate data foundation for subsequent processing.
[0018] In conjunction with some embodiments of the first aspect, in some embodiments, after replacing the plurality of related statements with the plurality of antonyms that correspond one-to-one with them, the method further includes: if it is determined that the computer system has not been compromised, replacing the plurality of antonyms with the plurality of related statements that correspond one-to-one with them.
[0019] By employing the above technical solution, when the computer system is determined not to have been compromised, several related statements can be replaced with their corresponding antonyms. This confuses and interferes with potential intruders, preventing them from obtaining genuine and important information. Simultaneously, the use of antonyms enhances system security, preventing potential intruders from extracting valuable content from the acquired information. This approach effectively protects user privacy and sensitive information, reducing losses caused by leaked information.
[0020] Secondly, embodiments of this application provide a computer system intrusion processing system, which includes: an important information determination module, used to determine the currently viewed important information when it is determined that the computer system has been intruded;
[0021] The text segment determination module is used to determine the first text segment that has been viewed and other text segments that have not been viewed based on the content currently displayed for this important information. The number of other text segments is one or more.
[0022] The statement determination module is used to determine several important statements in the first text segment and several related statements in other text segments that correspond one-to-one with the important statements and have a similarity greater than a preset threshold.
[0023] The statement processing module is used to process several important statements using natural language processing technology to obtain several antonyms that correspond one-to-one with the important statements, and the antonyms correspond one-to-one with the related statements.
[0024] The statement replacement module is used to replace several related statements with several corresponding antonyms.
[0025] Thirdly, embodiments of this application provide a computer system intrusion handling system, the system comprising: one or more processors and a memory; the memory is coupled to the one or more processors, the memory being used to store computer program code, the computer program code including computer instructions, the one or more processors calling the computer instructions to cause the system to perform the method described in the first aspect and any possible implementation thereof.
[0026] Fourthly, embodiments of this application provide a computer-readable storage medium including instructions that, when executed on a system, cause the system to perform the method described in the first aspect and any possible implementation thereof.
[0027] One or more technical solutions provided in the embodiments of this application have at least the following technical effects or advantages:
[0028] 1. This application provides a method for handling computer system intrusion. Upon determining that a computer system has been intruded upon, the method identifies currently viewed important information and, based on this information, determines the first section of text that has already been viewed and other unviewed text. Based on important statements in the first section of text, related statements in other texts with a similarity greater than a preset threshold are obtained. Furthermore, this method utilizes natural language processing techniques to process these important statements, obtaining their corresponding antonyms, and replacing the related statements with their antonyms. This makes the semantics of other text sections opposite to the semantics of the first section that has already been viewed, misleading the intruder and reducing the loss caused by leaked information.
[0029] 2. This application provides a method for processing computer system intrusions. It obtains concise secondary processing important statements by deleting repetitive words. Then, it adjusts the grammatical structure using a parse tree to obtain adjusted secondary processing important statements. Next, it replaces the adjusted statements with synonyms according to a pre-defined dictionary to obtain replaced secondary processing important statements. Finally, it smooths the text of the replaced statements to obtain smoothed secondary processing important statements. Then, it performs language correction on the smoothed statements to finally obtain antonyms. This further improves the accuracy and coherence of important statements. Through operations such as deleting repetitive words, adjusting the grammatical structure, replacing synonyms, smoothing text, and correcting language, the secondary processing important statements become clearer, grammatically correct, and have better expressive effects. Thus, the processed antonyms more accurately reflect the meaning of the original important statements, providing more targeted guiding information. This can make the semantics of other text segments opposite to the semantics of the first text segment already viewed, misleading intruders and reducing the losses caused by leaked information.
[0030] 3. This application provides a method for handling computer system intrusion. When a computer system is determined not to have been intruded upon, several related statements can be replaced with their corresponding antonyms. This confuses and interferes with potential intruders, preventing them from obtaining genuine and important information. Simultaneously, the use of antonyms can improve system security, preventing potential intruders from extracting valuable content from the obtained information. This approach effectively protects user privacy and sensitive information, reducing losses caused by leaked information. Attached Figure Description
[0031] Figure 1 This is a flowchart illustrating a computer system intrusion handling method according to an embodiment of this application.
[0032] Figure 2 This is a flowchart illustrating another computer system intrusion handling method in the embodiments of this application.
[0033] Figure 3 This is a schematic diagram of the functional module structure of a computer system intrusion handling system provided in an embodiment of this application.
[0034] Figure 4 This is a schematic diagram of the physical device structure of a computer system intrusion handling system provided in an embodiment of this application. Detailed Implementation
[0035] The terminology used in the following embodiments of this application is for the purpose of describing particular embodiments only and is not intended to be limiting of this application. As used in the specification and appended claims of this application, the singular expressions “a,” “an,” “the,” “the,” “the,” and “this” are intended to include the plural expressions as well, unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used in this application refers to any or all possible combinations including one or more of the listed items.
[0036] Hereinafter, the terms "first" and "second" are used for descriptive purposes only and should not be construed as implying or suggesting relative importance or implicitly indicating the number of indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature, and in the description of the embodiments of this application, unless otherwise stated, "multiple" means two or more.
[0037] Significant progress has been made in preventing computer system intrusion over the past few decades. With the widespread adoption of the internet and the rapid development of information technology, cybersecurity threats are constantly increasing, making the protection of computer systems from intrusion increasingly important. For example, password-based authentication, firewalls, and intrusion detection systems (IDS) can be used. However, some techniques can still bypass these protective measures. For instance, unknown users may exploit vulnerabilities in the operating system to inject malicious code or perform unauthorized operations to gain control of the computer and then access sensitive information.
[0038] In related technologies, after a computer system is compromised, the first step is to disconnect the network connection, then scan the computer, change passwords, update the operating system and applications, and strengthen firewall and security settings. System logs should also be reviewed to prevent intruders from accessing important information.
[0039] However, the aforementioned techniques are used to prevent the further theft of important files in a computer system after it has been compromised, through measures such as cutting off the network. But before the network is cut off, some important information in the computer system has already been viewed, leading to the leakage of important information. Even if the network is cut off, the consequences caused by the leaked information cannot be changed, and the losses that have already been incurred cannot be recovered.
[0040] This application provides a computer system intrusion handling method, system, and readable storage medium to reduce losses caused by leaked information. The application scenario is when an unknown user remotely controls the computer system, intrudes, and then opens and browses various files on the computer to find and access important information. The following is a combination of... Figure 1The present application describes a computer system intrusion handling method according to an embodiment of the present application:
[0041] Please see Figure 1 This is a flowchart illustrating a computer system intrusion handling method in an embodiment of this application.
[0042] S101. If it is determined that the computer system has been compromised, identify the important information currently being viewed;
[0043] In the application scenario of this application, it is assumed that a computer system has been compromised by an unknown user through remote control. First, it is necessary to determine whether the computer system has been remotely controlled. This can be done by checking the computer's remote login records to see if any unauthorized remote login activity exists. The system's security logs or the logs of the remote login tool should be checked for suspicious login attempts or unknown login sessions. Once it is confirmed that the computer system has been remotely controlled, the next goal is to determine the important information currently being viewed. Generally, after a computer is remotely controlled, the intruder will control the computer to open various files to search for and browse important information. How to determine the important information being viewed will be described below.
[0044] For example, suppose an intruder successfully gains remote access to a computer system and opens a file named "Company Financial Statements." This file contains crucial information such as the company's financial data, revenue, and expenses. Viewing this information could lead to serious data leaks and losses. Therefore, confirming that the "company financial statements" are the crucial information being viewed is essential.
[0045] S102. Based on the content of the currently displayed important information, determine the first text segment that has been viewed and the other text segments that have not been viewed;
[0046] The computer system determines the first text segment that has been viewed and the other text segments that have not been viewed based on the content of the currently displayed important information. Specifically: it determines the page that is currently displayed on the computer screen; it determines the first text segment that has been viewed based on the page; and it determines the other text segments in the important information that are not the first text segment.
[0047] The first section that has been viewed and the remaining unviewed sections are determined based on the currently displayed content. Building on the previous example, suppose the computer screen displays the first page of a "Company Financial Statements" document. In this case, the content of the first page will be identified as the first section that has been viewed. The other pages or paragraphs will be identified as the remaining unviewed sections.
[0048] S103. Determine several important sentences in the first text segment and several related sentences in other text segments that have a similarity greater than a preset threshold to the several important sentences.
[0049] The computer system identifies several important sentences in a first text segment and several related sentences in other text segments whose similarity to these important sentences exceeds a preset threshold. Specifically, the system inputs the important sentences and all sentences in the other text segments into a sentence embedding model to obtain several first word vectors corresponding to the important sentences and several second word vectors corresponding to all the sentences. The similarity between these first and second word vectors is calculated using cosine similarity. The system then filters out the important sentences in the first text segment and their corresponding related sentences in the other text segments whose similarity exceeds the preset threshold. This sentence embedding model maps sentences to a continuous vector space; it is also called a sentence representation model or sentence vectorization model. Its goal is to convert natural language sentences into fixed-dimensional vector representations to capture the semantic and contextual information of sentences, facilitating sentence-level semantic analysis and comparison by computers. Inputting important sentences and all sentences in other texts into the sentence embedding model yields corresponding word vectors. Cosine similarity is a commonly used similarity metric used to compare the similarity between two vectors. In the text domain, cosine similarity is often used to measure the semantic similarity between texts.
[0050] The method for calculating cosine similarity is as follows:
[0051] Suppose we have two vectors A and B with the same dimension. Cosine similarity can be obtained by dividing the inner product of the two vectors by the product of their moduli:
[0052] cosine_similarity(A,B) = (A·B) / (||A|| * ||B||)
[0053] Where A·B represents the inner product of vectors A and B, and ||A|| and ||B|| represent the magnitudes of vectors A and B (i.e., the lengths of the vectors, which can be obtained by taking the square root of the sum of their squares).
[0054] The cosine similarity value ranges from -1 to 1. The closer the value is to 1, the more similar the vectors are; the closer the value is to -1, the less similar the vectors are; and the closer the value is to 0, the lower the similarity between the vectors is.
[0055] Building on the previous example, suppose a key statement in the first passage is "The company's net profit for this quarter was $1 million." We need to find related statements in other passages that have a similarity greater than a preset threshold. For example, another passage might contain a statement with high similarity: "The company's net revenue for the first quarter of this year met expectations."
[0056] S104. Process several important statements using natural language processing techniques to obtain several antonyms that correspond one-to-one with the important statements.
[0057] The computer system uses Natural Language Processing (NLP) techniques to process several important statements, generating a series of antonyms that correspond one-to-one with these important statements. NLP is a field that studies the interaction between human language and computers, aiming to enable computers to understand, process, and generate natural language text or speech. NLP combines computer science, artificial intelligence, and linguistics, striving to enable computers to perform various tasks using human language as input and output. How NLP techniques generate antonyms will be described below and will not be elaborated upon here.
[0058] Based on the previous example, suppose we process the aforementioned important statement "The company's net profit for this quarter is $1 million" to obtain a corresponding antonym: "The company's net profit for this quarter is a loss of $200,000".
[0059] S105. Replace several related statements with several antonyms that correspond one-to-one with them.
[0060] The computer system replaces several statements related to important statements with corresponding antonyms.
[0061] Building on the previous example, the statement "The company's net profit for this quarter is $1 million" can be replaced with its antonym: "Upon verification, the figure of $1 million in net profit for this quarter is inaccurate. The actual figure is a loss of $200,000, due to errors in data usage by the finance department." It's important to note that replacing the antonym is not merely a literal substitution; the antonym must maintain logical coherence and persuasiveness within its context.
[0062] S106. If it is determined that the computer system has not been compromised, replace several antonyms with several related statements that correspond to them one by one.
[0063] Once the computer system confirms the end of remote control, it replaces several antonyms with corresponding related statements.
[0064] Based on the previous example, assuming that the computer system has not been compromised, it is necessary to restore the previously replaced negated statements to their original counterparts. That is, replace "After verification, the company's net profit for this quarter is $1 million, which is inaccurate. The actual figure is a loss of $200,000 because the finance department used some data incorrectly" with "The company's net profit for this quarter is $1 million."
[0065] The above embodiments have the following beneficial effects:
[0066] In cases where a computer system has been compromised, the method identifies the currently viewed important information and, based on this information, determines the first section of text that has already been viewed and the remaining unviewed text. It then identifies relevant sentences in the other text that have a similarity greater than a preset threshold based on key statements in the first section. Furthermore, the method utilizes natural language processing techniques to process these key statements, generating corresponding antonyms and replacing them with their antonyms. This makes the semantics of the remaining text segments opposite to those of the first section, misleading the intruder and reducing the loss caused by leaked information.
[0067] This method can accurately determine the page currently displayed on the computer screen and identify the first text segment that has been viewed based on that page. In this way, the system can track the user's browsing behavior, identify important information viewed by the user, and process it. Simultaneously, this method can also identify text segments other than the first unviewed segment, providing an accurate data foundation for subsequent processing.
[0068] Important sentences and all sentences from other texts are input into a sentence embedding model to obtain corresponding word vectors. The cosine similarity method is then used to calculate the similarity between the first and second word vectors. Important and related sentences with similarity greater than a preset threshold are then selected. This improves the accuracy of identifying related sentences.
[0069] When a computer system is determined not to have been compromised, several related statements can be replaced with their corresponding antonyms. This confuses and interferes with potential intruders, preventing them from obtaining genuine and important information. Simultaneously, the use of antonyms can enhance system security, preventing potential intruders from extracting valuable content from the information they obtain. This approach effectively protects user privacy and sensitive information, reducing the losses caused by leaked information.
[0070] In step S104, natural language processing techniques are used to process several important statements to obtain several antonyms that correspond one-to-one with the important statements. The following section combines... Figure 2, describe another computer system intrusion processing method in the embodiments of the present application:
[0071] Please refer to Figure 2 , which is a schematic flowchart of another computer system intrusion processing method in the embodiments of the present application.
[0072] S201. Divide several important statements into corresponding several words;
[0073] The computer system divides several important statements into corresponding several words. Taking the application scenario as an example, assume that the intruder successfully enters the computer system through remote control and browses important information on the computer desktop. One of the important statements is "The company's financial statements show that the net profit this quarter has increased by 20%". We can divide this statement into several words, such as "company", "financial statements", "this quarter", "net profit", "increase", and "20%".
[0074] S202. Determine several stop words in the several words according to a preset stop word list;
[0075] The computer system determines and marks the stop words in the several words according to the preset stop word list. Based on the previous example, assume that the preset stop word list contains common stop words such as "of", "has", "is", etc. The computer system marks these stop words, such as marking "of" and "has" in "The net profit this quarter has increased by 20%" as stop words.
[0076] S203. Delete several stop words in the several words to obtain several used words;
[0077] The computer system deletes the stop words in the several words to obtain several used words.
[0078] Based on the previous example, the computer system deletes the stop words "of" and "has" in "The net profit this quarter has increased by 20%" to obtain the used words "this quarter", "net profit", "increase", and "20%".
[0079] S204. Recombine several used words to obtain several preprocessed important statements corresponding to the several important statements;
[0080] The computer system recombines several used words to obtain several preprocessed important statements corresponding to the several important statements. Based on the previous example, according to the used words "this quarter", "net profit", "increase", and "20%", the preprocessed important statement can be obtained: "This quarter net profit increases 20%".
[0081] S205. Input several preprocessed important statements into the natural language processing model to obtain several processing important statements corresponding to the preprocessed important statements.
[0082] A computer system inputs several preprocessed key statements into a natural language processing (NLP) model, which then processes them to obtain several secondary key statements. Based on the previous example, we input the preprocessed key statement "Net profit increased by 20% this quarter" into the NLP model for processing, resulting in the secondary key statement: "Net income increased by 20% this quarter." A NLP model is a type of computational model used to process and understand natural language text. NLP models use techniques such as machine learning and deep learning to automatically process and analyze text for various tasks, such as text classification, named entity recognition, sentiment analysis, and machine translation. Inputting several preprocessed key statements into the NLP model yields several secondary key statements corresponding to those preprocessed key statements.
[0083] S206. Delete repeated words in several important processing statements to obtain several concise important processing statements;
[0084] The computer system removes repeated words from several secondary processing important statements to obtain concise secondary processing important statements. Based on the previous example, if there are repeated words in the secondary processing important statements, such as "Net income increased by 20% this quarter, and the performance this quarter was good," then the computer system will remove the repeated words to obtain the concise secondary processing important statement: "Net income increased by 20% this quarter, and the performance was good."
[0085] S207. Use a syntax parse tree to adjust the syntax structure of several concise secondary processing important statements to obtain several adjusted secondary processing important statements.
[0086] Computer systems use parse trees to adjust the syntactic structure of several concise, secondary-processing important statements, resulting in adjusted secondary-processing important statements. Building on the previous example, suppose the concise secondary-processing important statement is "Net income increased by 20% this quarter, performance was good." The computer system can use a parse tree to adjust this statement, such as to "Performance was good, net income increased by 20% this quarter." The purpose of using parse trees is to provide a structured representation of a given sentence or text for better understanding and analysis of its syntactic structure. A parse tree is a tree-like structure that reflects the grammatical relationships and syntactic structure between words in a sentence. In other words, it adjusts the sentence structure to ensure that the generated text is grammatically more correct.
[0087] S208. Based on the preset dictionary, several important statements in the adjustment process are replaced with synonyms to obtain several important statements in the replacement process.
[0088] The computer system uses a preset dictionary to perform synonym replacements on several adjusted secondary processing important statements, resulting in replaced secondary processing important statements. Based on the previous example, suppose the adjusted secondary processing important statement is "Performance was good, and net income increased by 20% this quarter." In step S208, we can use the preset dictionary to replace certain words with their synonyms, such as replacing "performance" with "achievements," resulting in the replaced secondary processing important statement: "Performance was good, and net income increased by 20% this quarter."
[0089] S209. Perform text smoothing on several important statements of the replacement processing to obtain several important statements of the smoothed processing.
[0090] The computer system performs text smoothing on several key sentences undergoing substitution processing, resulting in several smoothed key sentences. For example, language model interpolation can be used: a hybrid language model approach combines the generated text with a pre-trained language model. The generated text is smoothed by calculating the sum or weighted average of the probabilities of the generated text and the language model, improving its fluency and coherence. A hybrid language model refers to combining multiple different pre-trained language models or model architectures to build a more powerful and comprehensive language model. It leverages the strengths and characteristics of different models to improve the performance of language understanding and generation.
[0091] Based on the previous example, suppose the replaced secondary important statement is "Performance was good, and net income increased by 20% this quarter". The computer system can perform text smoothing, such as adjusting word order and adding conjunctions, to obtain the smoothed secondary important statement: "Net income increased by 20% this quarter, and performance was good".
[0092] S210. Perform language correction on several important statements in the smoothing process to obtain several antonyms.
[0093] The computer system performs language correction on several smoothed important sentences, generating several antonyms. This correction can be based on pre-trained language models: using pre-trained language models (such as GPT or BERT) to correct grammatical errors and illogical points in the generated text. The generated text is then input into the language model, which evaluates and corrects the text. A language model is a general-purpose language model obtained through self-supervised learning on large-scale text data. It is a deep learning-based model that learns the statistical laws and semantic representations of language to understand and generate natural language text.
[0094] Based on the previous example, suppose the smoothed sub-processing important statement is "Net income increased by 20% this quarter, and the performance was good." The computer system performs language correction on this statement, such as adjusting tense and correcting grammatical errors, to obtain the antonymous sub-processing important statement: "Net income decreased by 20% this quarter, and the performance was poor."
[0095] The above embodiments have the following beneficial effects:
[0096] Important statements are preprocessed to obtain preprocessed important statements. Then, these are input into a natural language processing model to transform them into secondary important statements. Next, these secondary important statements undergo post-processing to obtain antonyms. This effectively transforms important statements into corresponding antonyms, improving the accuracy of the antonyms obtained.
[0097] Important sentences are divided into corresponding words, and stop words are identified using a pre-defined stop word list. By deleting stop words, usable words are obtained, and these usable words are then recombine to obtain preprocessed important sentences. The beneficial effect of this step is that by removing stop words, noise and redundant information are reduced, making important sentences more concise and accurate.
[0098] By removing repeated words from the secondary processing important sentences, a concise secondary processing important sentence is obtained. Then, the grammatical structure is adjusted using a parse tree to obtain an adjusted secondary processing important sentence. Next, synonym replacement is performed on the adjusted secondary processing important sentence according to a preset dictionary to obtain a replaced secondary processing important sentence. Finally, text smoothing is performed on the replaced secondary processing important sentence to obtain a smoothed secondary processing important sentence. Then, language correction is performed on the smoothed secondary processing important sentence to finally obtain an antonym. This further improves the accuracy and coherence of the important sentences. Through operations such as removing repeated words, adjusting the grammatical structure, replacing synonyms, text smoothing, and language correction, the secondary processing important sentences are made clearer, more grammatically correct, and have a better expressive effect. In this way, the processed antonym can more accurately reflect the meaning of the original important sentence, provide more targeted guiding information, and make the semantics of other text segments opposite to the semantics of the first text segment that has been viewed, thus misleading intruders and reducing the loss caused by the already leaked information.
[0099] The system in this application embodiment is described below from a module perspective:
[0100] Please see Figure 3 This is a schematic diagram of the functional module structure of a computer system intrusion handling system provided in an embodiment of this application.
[0101] The system includes:
[0102] The important information determination module 301 is used to determine the important information currently being viewed when it is determined that the computer system has been compromised;
[0103] The text segment determination module 302 is used to determine the first text segment that has been browsed and other text segments that have not been browsed based on the content currently displayed for the important information. The number of other text segments is one or more.
[0104] The statement determination module 303 is used to determine several important statements in the first text segment and several related statements in other text segments that correspond one-to-one with several important statements whose similarity to several important statements is greater than a preset threshold.
[0105] The statement processing module 304 is used to process several important statements using natural language processing technology to obtain several antonyms that correspond one-to-one with the several important statements, and the several antonyms correspond one-to-one with the several related statements.
[0106] The statement replacement module 305 is used to replace several related statements with several corresponding antonyms.
[0107] The system in the embodiments of this application has been described above from the perspective of modular functional entities. The system in the embodiments of this application will now be described below from the perspective of hardware processing. Please refer to [link / reference needed]. Figure 4 This is a schematic diagram of the physical device structure of a computer system intrusion processing system provided in an embodiment of this application.
[0108] It should be noted that, Figure 4 The structure of the system shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of the present invention.
[0109] like Figure 4 As shown, the server includes a Central Processing Unit (CPU) 401, which can perform various appropriate actions and processes based on a program stored in Read-Only Memory (ROM) 402 or a program loaded from storage portion 408 into Random Access Memory (RAM) 403, such as performing the method described in the above embodiment. The RAM 403 also stores various programs and data required for system operation. The CPU 401, ROM 402, and RAM 403 are interconnected via a bus 404. An Input / Output (I / O) interface 405 is also connected to the bus 404.
[0110] The following components are connected to I / O interface 405: input section 406 including a camera, infrared sensor, etc.; output section 407 including a liquid crystal display (LCD) and speakers, etc.; storage section 408 including a hard disk, etc.; and communication section 409 including a network interface card such as a LAN (Local Area Network) card and a modem, etc. Communication section 409 performs communication processing via a network such as the Internet. Drive 410 is also connected to I / O interface 405 as needed. Removable media 411, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., are installed on drive 410 as needed so that computer programs read from it can be installed into storage section 408 as needed.
[0111] In particular, according to embodiments of the present invention, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of the present invention include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing computer programs for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication section 409, and / or installed from removable medium 411. When the computer program is executed by central processing unit (CPU) 401, it performs the various functions defined in the present invention.
[0112] It should be noted that the computer-readable medium shown in the embodiments of the present invention can be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), flash memory, optical fiber, portable compact disc read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In the present invention, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In the present invention, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, wherein a computer-readable computer program is carried. The transmitted data signal can take many forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof.
[0113] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. Each block in a flowchart or block diagram may represent a module, segment, or portion of code, which contains one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.
[0114] In another aspect, the present invention also provides a computer-readable storage medium, which may be included in the system described in the above embodiments; or it may exist independently and not assembled into the system. The storage medium carries one or more computer programs that, when executed by a processor of a system, cause the system to implement the methods provided in the above embodiments.
[0115] The above-described embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit it. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.
[0116] As used in the above embodiments, depending on the context, the term "when..." can be interpreted as meaning "if...", "after...", "in response to determining...", or "in response to detecting...". Similarly, depending on the context, the phrase "when determining..." or "if (the stated condition or event) is interpreted as meaning "if determining...", "in response to determining...", "when (the stated condition or event) is detected", or "in response to detecting (the stated condition or event)".
[0117] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product. This computer program product includes one or more computer instructions. When these computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium accessible to a computer or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid-state drive), etc.
[0118] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. This program can be stored in a computer-readable storage medium, and when executed, it can include the processes described in the above method embodiments. The aforementioned storage medium includes various media capable of storing program code, such as ROM or random access memory (RAM), magnetic disks, or optical disks.
Claims
1. A method for handling computer system intrusion, characterized in that, include: If it is determined that the computer system has been compromised, identify the important information currently being viewed; Based on the content currently displayed for important information, the first text segment that has been viewed and other unviewed text segments are determined. The number of other text segments is one or more, specifically including: Determine the page currently displayed on the computer screen; The first text segment that has been viewed is determined based on the page described; The text segments other than the first text segment in the important information are identified as other text segments; Identify several important statements in the first text segment and several related statements in the other text segments that have a similarity greater than a preset threshold to the several important statements; Natural language processing technology is used to process several important statements to obtain several antonyms that correspond one-to-one with the important statements, and the antonyms correspond one-to-one with the related statements. Replace several related statements with several antonyms that correspond one-to-one with them; If it is determined that the computer system has not been compromised, the antonyms are restored to their corresponding related statements.
2. The method according to claim 1, characterized in that, The step of determining a number of important statements in the first text segment and a number of related statements in the other text segments that have a similarity greater than a preset threshold to the number of important statements specifically includes: Input several important sentences and all sentences in the other text segments into the sentence embedding model to obtain several first word vectors corresponding to the several important sentences and several second word vectors corresponding to all sentences; The cosine similarity calculation method is used to calculate the similarity between several first word vectors and several second word vectors; Select several important statements from the first text segment whose similarity is greater than a preset threshold, and several related statements from the other text segments that correspond to each other.
3. The method according to claim 1, characterized in that, The process of processing the aforementioned important statements using natural language processing techniques to obtain a number of antonyms that correspond one-to-one with the aforementioned important statements specifically includes: Several important statements are preprocessed to obtain several preprocessed important statements; Inputting several of the preprocessed important statements into a natural language processing model yields several processing important statements corresponding to the preprocessed important statements. Post-processing is performed on several important statements from the previous processing to obtain several antonyms.
4. The method according to claim 3, characterized in that, The preprocessing of several important statements yields several preprocessed important statements, specifically including: Divide the aforementioned important statements into corresponding words; Based on a preset list of stopped words, determine a number of stopped words from among the aforementioned words; By deleting some of the stop words from the aforementioned words, a number of words in use are obtained; By recombining the aforementioned words, several preprocessed important statements corresponding to the aforementioned important statements are obtained.
5. The method according to claim 3, characterized in that, The post-processing of several key statements in the previous processing to obtain several antonyms specifically includes: By deleting repeated words from several of the important statements in the secondary processing, a number of concise important statements in the secondary processing are obtained. The syntax structure of several concise secondary processing important statements is adjusted using a syntax parse tree to obtain several adjusted secondary processing important statements. Based on a preset dictionary, several important statements in the adjustment process are replaced with synonyms to obtain several replaced important statements in the adjustment process. Several important statements in the replacement secondary processing are subjected to text smoothing processing to obtain several important statements in the smoothed secondary processing. Language correction is performed on several important statements in the smoothing subprocess to obtain several antonyms.
6. A computer system intrusion handling system, characterized in that, include: The important information identification module is used to identify important information currently being viewed when it is determined that the computer system has been compromised. The text segment determination module is used to determine, based on the content currently displayed of the important information, a first text segment that has been viewed and other text segments that have not been viewed, wherein the number of other text segments is one or more; it is also used to determine the page currently displayed on the computer screen; determine the first text segment that has been viewed based on the page; and determine the text segments in the important information other than the first text segment as other text segments; The statement determination module is used to determine several important statements in the first text segment and several related statements in the other text segments that correspond one-to-one with the several important statements whose similarity to the several important statements is greater than a preset threshold. The statement processing module is used to process the important statements using natural language processing technology to obtain a number of antonyms that correspond one-to-one with the important statements, and the antonyms correspond one-to-one with the related statements. The statement replacement module is used to replace several related statements with several antonyms that correspond one-to-one with them; it is also used to restore several antonyms to several related statements that correspond one-to-one with them when it is determined that the computer system has not been compromised.
7. A computer system intrusion handling system, characterized in that, include: One or more processors and memory; The memory is coupled to the one or more processors, the memory being used to store computer program code, the computer program code including computer instructions, the one or more processors invoking the computer instructions to cause the system to perform the method as described in any one of claims 1-5.
8. A computer-readable storage medium comprising instructions, characterized in that, When the instructions are executed on the system, the system performs the method as described in any one of claims 1-5.