A computer software protection method based on learning network

Abstract

The present invention belongs to the technical field of software security. The present invention discloses a computer software protection method based on a learning network, comprising collecting software configuration data, software operation data, software environment data and user behavior data; preprocessing abnormal data in the software configuration data, software operation data, software environment data and user behavior data by an abnormality detection algorithm to obtain an abnormal comprehensive data set; constructing a software risk prediction model, inputting the abnormal comprehensive data set into the software risk prediction model, and predicting a software attack risk coefficient; comparing the predicted software attack risk coefficient with a preset software attack risk coefficient threshold to determine whether the software has an attack risk; if there is no attack risk, continuing to monitor the software operation status; if there is an attack risk, issuing an early warning instruction through a computer control terminal to automatically generate early warning information, thereby reducing the subjectivity and error rate of human judgment.

Description

Technical Field

[0001] The present invention relates to the technical field of software security, and more specifically, to a computer software protection method based on a learning network. Background Art

[0002] The patent application with the publication number CN116628691A discloses a computer software protection method based on a learning network, including: S1: obtaining software information in a computer to complete the classification of computer software types, classifying the computer software into a protection list and feeding it back to the user for confirmation, and building a basic learning network in the computer; S2: obtaining the data flow formed by the computer software through the network, and using this as a basis to monitor the computer software, sorting the importance of computer software with data flow communication according to a pre-selected time span and continuously updating the importance ranking of the software; the present invention detects the data flow generated by the software through network interaction, and when abnormal data information is found, manages the sending end and the computer to prevent the abnormal data information from affecting the software and computer programs, improves the security of software interaction, facilitates operation on its root cause to reduce its subsequent impact, and avoids the leakage of electronic software.

[0003] The existing software protection methods mainly have the following problems:

[0004] The neighbor point adjustment model was not considered, and all data points were judged using the same number of neighbor points, ignoring the differences between different data points or different data sets; the time factor was not introduced, and the law of data change could not be captured, which may cause the selection of the number of neighbor points to become no longer applicable during a long period of data collection, thus affecting the accuracy of anomaly detection; the normalization factor was not used to limit the impact of different feature types on the selection of the number of neighbor points, reducing the stability and reliability of the model;

[0005] Failure to use a double encryption mechanism may make data more easily decrypted by unauthorized third parties. Failure to consider calculating hash values ​​may result in data being tampered with during transmission or storage without detection. Failure to consider symmetric key encryption will make key distribution and management complex and unsafe. Without the support of a weighted model, the system may only be able to provide a fixed security configuration and cannot flexibly adjust security based on factors such as data sensitivity, transmission environment, or storage requirements. Failure to adjust the weights of each part based on actual needs may result in the encryption process being too complicated or inefficient, affecting system performance.

[0006] Without considering the complexity of the decryption process, the system may tend to adopt too high encryption strength, thereby increasing the consumption of computing resources and storage space and reducing system performance; without a dynamic adjustment mechanism, the system may not be able to flexibly adjust the encryption strategy according to changes in the environment or needs, thereby reducing its adaptability and flexibility.

[0007] In view of this, the present invention proposes a computer software protection method based on a learning network to solve the above problems. Summary of the invention

[0008] In order to overcome the above-mentioned defects of the prior art and to achieve the above-mentioned purpose, the present invention provides the following technical solution: a computer software protection method based on a learning network, comprising:

[0009] S1. Collect software configuration data, software operation data, software environment data and user behavior data;

[0010] S2. Preprocessing abnormal data in software configuration data, software operation data, software environment data and user behavior data by using an anomaly detection algorithm to obtain an abnormal comprehensive data set;

[0011] S3, construct a software risk prediction model, input the abnormal comprehensive data set into the software risk prediction model, and predict the software attack risk coefficient;

[0012] S4, comparing the predicted software attack risk coefficient with a preset software attack risk coefficient threshold to determine whether the software has an attack risk;

[0013] S5. If there is no risk of being attacked, continue to monitor the software running status; if there is a risk of being attacked, issue a warning instruction through the computer control terminal and automatically generate warning information;

[0014] S6. Configure firewall rules to encrypt software configuration data, software operation data, software environment data, and user behavior data through encryption algorithms; use the key library to manage and protect encryption keys, and decrypt through the key library when the risk is eliminated, allowing unencrypted data transmission.

[0015] Furthermore, the software configuration data includes the software configuration file, the software version number, the software installation path and the library that the software depends on; the software operation data includes the software process status, the software thread status, the memory occupancy rate, the memory usage, the CPU occupancy rate and the CPU usage;

[0016] Software environment data includes the operating system configuration on which the software runs, the hardware configuration on which the software runs, the network traffic on which the software runs, and the system load; user behavior data includes the user's login time, the user's login location, the user's operation type, the user's access files, and the frequency of use of software functions.

[0017] Furthermore, the method of preprocessing abnormal data in software configuration data, software operation data, software environment data and user behavior data by using an abnormality detection algorithm to obtain an abnormal comprehensive data set includes:

[0018] The obtained software configuration data, software operation data, software environment data and user behavior data are normalized by standard deviation, converted into standard normal distribution, and finally the normalized software configuration data, software operation data, software environment data and user behavior data are obtained, and integrated into a two-dimensional data matrix;

[0019] Each row of the matrix is ​​a data point, which contains the values ​​of all features in the software configuration data, software operation data, software environment data and user behavior data at a certain point in time; each column of the matrix is ​​a feature in the software configuration data, software operation data, software environment data and user behavior data;

[0020] S31. For each data point, calculate the The distance between neighboring data points: ;in, For the data points; For data points And its first Neighboring data points The distance between is the number of neighboring data points;

[0021] Adjust the number of neighboring data points by adjusting the model through neighboring points , the neighbor point adjustment model is: ;in, is the number of characteristic types of the data; is the data collection time; For characteristic species The influence coefficient of is the normalization factor of the feature type; The data collection time The influence coefficient of is the translation factor of data acquisition time;

[0022] Limit the normalization factor using the normalization factor limit formula Adjust the number of feature types The influence range of the normalization factor is as follows: ;in, Characteristic Type right The influence coefficient of is the index of the feature type; For all feature types The sum of squares of the influence coefficients;

[0023] Limit the formula by the translation factor The translation factor limiting formula is: ;in, is the earliest collection time in the data, i.e., the lower limit of the time range; is a positive number tending to 0;

[0024] S32. Define data points of The distance neighborhood is: ;in, For data points of The set of data points in the distance neighborhood; Neighbor data points that meet the distance conditions;

[0025] S33, for data points Each neighbor data point , calculated with data points The reachable distance between: ;in, For data points With neighboring data points The reachable distance between For data points With The distance between neighboring data points; For data points With neighboring data points The actual distance between

[0026] S34. Define data points The local reachability density of is the inverse of the average reachability distance of points in its neighborhood: ;in, For data points The local reachable density of For data points of The number of data points in the distance neighborhood;

[0027] S35. For each data point , calculate its local anomaly factor through the local anomaly factor calculation formula; the local anomaly factor calculation formula is: ;in, For data points The local abnormal factor of Neighbor data points The local reachable density of

[0028] S36, presetting a local anomaly factor threshold, if the calculated local anomaly factor of the data point is less than or equal to the local anomaly factor threshold, then determining that the data point is a normal data point;

[0029] If the calculated data points If the local anomaly factor is greater than the local anomaly factor threshold, the data point is determined to be an abnormal data point;

[0030] S37. Extract all abnormal data points whose local abnormal factor values ​​are greater than a preset local abnormal factor threshold to form an abnormal comprehensive data set.

[0031] Furthermore, the method for constructing the software risk prediction model includes:

[0032] The data set is divided into a training set, a validation set, and a test set; the data set includes a historical anomaly comprehensive data set and the corresponding software attack risk coefficient; a software risk prediction model is constructed, and the software risk prediction model includes an input layer, a hidden layer, and an output layer; the hidden layer uses a ReLU activation function;

[0033] The input layer of the model is used to input the historical anomaly comprehensive data set, and the number of neurons in the input layer matches the number of features in the historical anomaly comprehensive data set; the output layer of the model is used to output the software attack risk coefficient, and the number of neurons in the output layer corresponds to the number of prediction targets, and the prediction value is output through one neuron; the software risk prediction model is a fully connected neural network model;

[0034] The mean absolute error is used as the loss function to measure the error between the model's predicted value and the actual value; the mean absolute error loss function is: ;in, is the mean absolute error; is the number of data sets; For the The true value of the software attack risk coefficient; For the The predicted value of the software attack risk coefficient;

[0035] Use the training set data to train the model and minimize the loss function using the Adam optimizer. Use the validation set to evaluate the performance of the model and tune the model's hyperparameters until the model performance no longer improves significantly or reaches the preset stopping condition.

[0036] The test set is used to evaluate the performance of the model in the prediction task, and the current abnormal comprehensive data set is input into the trained software risk prediction model to obtain the software attack risk coefficient.

[0037] Furthermore, the method for tuning the hyperparameters of the model includes:

[0038] The complexity of the model is limited by adding a sum of squares of weights to the mean absolute error loss function; the modified mean absolute error loss function is: ;in, is the regularization parameter; For the model Weight parameters; is the index of all weight parameters in the model;

[0039] Hyperparameters of the model Make adjustments: Select multiple Value, for each The model is trained and validated, the performance on the validation set is recorded, and the model with the best performance on the validation set is selected. value;

[0040] Adjust the model's hyperparameter Dropout ratio: select multiple Dropout ratios for experiments, train and validate the model for each Dropout ratio, record the performance on the validation set, and select the Dropout ratio with the best performance on the validation set.

[0041] Furthermore, the method of comparing the predicted software attack risk coefficient with a preset software attack risk coefficient threshold to determine whether the software has an attack risk includes:

[0042] If the predicted software attack risk coefficient is greater than or equal to the preset software attack risk coefficient threshold, it is determined that the software is at risk of being attacked;

[0043] If the predicted software attack risk coefficient is less than a preset software attack risk coefficient threshold, it is determined that the software does not have an attack risk.

[0044] Furthermore, if there is a risk of being attacked, a warning instruction is issued through a computer control terminal, and the method of automatically generating warning information includes:

[0045] The preset software attack risk factor threshold is further divided into a low risk factor threshold , medium risk factor threshold and high risk threshold ; The predicted software attack risk factor is recorded as ; The software is attacked by the risk factor Low risk threshold , medium risk factor threshold and high risk threshold Make comparison and determine the warning instruction level;

[0046] like , then the warning instruction is determined to be a low-risk warning instruction; if , then the warning instruction is determined to be a medium risk warning instruction; if , the warning instruction is determined to be a high-risk warning instruction, and different levels of warning information are automatically generated according to the warning instructions of different risks.

[0047] Furthermore, the method of configuring firewall rules and encrypting software configuration data, software operation data, software environment data and user behavior data by using an encryption algorithm includes:

[0048] S81. Use a random number generator to randomly generate two prime numbers and , and the number of bits of the two prime numbers is greater than 1024 bits, which is used to generate the first RSA key pair and calculate the prime numbers and The product of: ;in, is the modulus of the first key pair; is the multiplication sign;

[0049] Calculate the modulus of the first key pair using the Euler function calculation formula Euler function to determine the encryption index and mutually prime;

[0050] The Euler function calculation formula is: ;in, For the modulus Euler function of ;

[0051] Select Crypto Index , so that and and Coprime; Calculate decryption exponent , so that: ;in, For the Euler function Modulo operation of ; Crypto Index About the model The multiplicative inverse of ; is the congruence symbol;

[0052] Generate a key pair and ;

[0053] Use the random number generator to randomly generate two prime numbers again and , and the number of bits of the two prime numbers is greater than 1024 bits, which is used to generate the second RSA key pair and calculate the prime numbers and The product of: ;in, is the modulus of the second key pair;

[0054] Calculate the modulus of the second key pair Euler function of : ;in, For the modulus Euler function of ;

[0055] Select Crypto Index , so that and and Coprime; Calculate decryption exponent , so that: ;in, For the Euler function Modulo operation of ; Crypto Index About the model The multiplicative inverse of ;

[0056] Generate a key pair and ;

[0057] S82. The type of encrypted data includes software configuration data , software operation data , software environment data and user behavior data ;for , , and Each data in Add random padding data : ;in, is the data after random filling; For connection operation;

[0058] Calculate the hash value of each data through the hash function Keep data integrity;

[0059] S83. Generate a symmetric key through a random number generator , using a symmetric key The ASE encryption algorithm uses the encryption formula to encrypt data Encryption is performed; the encryption formula is: ;in, is the encrypted data; is the encryption function;

[0060] S84, Use Key Symmetric key To encrypt: ;in, is the encrypted symmetric key; To transfer the symmetric key Promote to Key Crypto Index The power of Take the mold;

[0061] S85, the encrypted data , hash value and the encrypted symmetric key The comprehensive encrypted ciphertext is formed through weighted fusion of weighted models;

[0062] The weighted model is: ;in, It is a comprehensive encrypted ciphertext; For encrypted data The weight factor of Hash value The weight factor of The encrypted symmetric key The weight factor of

[0063] S86. Design each weight factor in the weighted model and optimize the distribution of weight factors; configure firewall rules: First rule: unauthorized users cannot access encrypted keys and data; Second rule: the firewall verifies the hash value Check the integrity of the transmitted data.

[0064] Furthermore, the method for designing the weight factors in the weighted model and optimizing the distribution of the weight factors includes:

[0065] Define an objective function that optimizes the distribution of weight factors: ;in, To measure the comprehensive encryption ciphertext Risk function for leakage risk; To measure the comprehensive encryption ciphertext Complexity function of decryption difficulty; is the risk function The weight coefficient of is the complexity function The weight coefficient of

[0066] The weight factor in the objective function is optimized using a weight factor update formula, where the weight factor update formula is: in, For the The weight factor after the iteration update; is the current weight factor; is the partial derivative of the objective function; is the weight factor The partial derivative of is the index of the weight factor; To control the rate at which the weight factor is updated each time;

[0067] The rate at which the weight factor is updated is controlled by the rate control formula Control is performed, and the rate control formula is: ;in, is the rate of controlling the post-weight factor; is the decay rate parameter; is the number of iterations; is the number of weight factors;

[0068] go through In the iteration, the weight factor update formula outputs the optimal weight factor, so that the objective function reaches the minimum value and the distribution of weight factors reaches the optimal value.

[0069] Furthermore, the method of using a key library to manage and protect encryption keys, decrypting through the key library when the risk is eliminated, and allowing unencrypted data transmission includes:

[0070] Use Azure Key Vault, a key vault management tool provided by Microsoft, to create and configure a key vault, generate and store encryption keys through Azure SDK, and configure and regularly update access control policies using Azure CLI; use Azure Monitor to monitor the use of the key vault in real time, and send activity logs to the Log Analytics workspace to identify abnormal operations;

[0071] A threshold of login times within a preset period of m is set. When the number of login times of a user reaches the threshold within the preset period of m, an alarm is automatically triggered, the IP address is automatically blocked, and unauthorized access to the key vault is prevented. After confirming that the risk has been resolved, the administrator initiates a decryption request, connects to the key vault through the Azure SDK, obtains the encryption key, and completes data decryption on the server side.

[0072] The technical effects and advantages of the computer software protection method based on a learning network of the present invention are as follows:

[0073] The present invention uses a neighbor point adjustment model to dynamically determine the number of neighbor points of each data point by considering factors such as the number of feature types of data and the data collection time, which helps to improve the accuracy and flexibility of anomaly detection; by introducing the time factor, the model can also consider the trend of data changes over time, so as to better adapt to non-static data sets, and help prevent the problem of improper selection of the number of neighbor points due to a large data collection time span; the normalization factor restriction formula ensures that the influence of the number of feature types on the number of neighbor points is within a reasonable range, thereby improving the stability and reliability of the model;

[0074] The data is encrypted using a randomly generated symmetric key combined with the AES encryption algorithm. The symmetric key itself is also encrypted using an RSA key pair, forming a double encryption mechanism that further improves security. A hash value is calculated for each type of data, which helps verify the integrity of the data during data transmission or storage. A weighted model is used to weight and fuse the encrypted data, hash value, and encrypted symmetric key into a comprehensive encrypted ciphertext. The weights of each part can be adjusted according to actual needs to adapt to different security needs and scenarios.

[0075] By defining an objective function that includes a risk function and a complexity function, the optimal balance can be found between the security of the encrypted ciphertext and the complexity of the decryption process, which helps to ensure data confidentiality while also taking into account system performance and resource efficiency. By optimizing the allocation of weight factors, resources can be reasonably allocated during the encryption and decryption process. The weight factor update formula based on the partial derivative of the objective function is used to dynamically adjust the value of the weight factor to gradually optimize the objective function, making the optimization process faster and reducing the waste of computing resources. BRIEF DESCRIPTION OF THE DRAWINGS

[0076] Figure 1 It is a flowchart of a computer software protection method based on a learning network;

[0077] Figure 2 The schematic diagram of the structure of a computer software protection system based on a learning network is shown in FIG. DETAILED DESCRIPTION

[0078] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0079] Example 1

[0080] See also Figure 1 As shown, the computer software protection method based on a learning network described in this embodiment includes:

[0081] S1. Collect software configuration data, software operation data, software environment data and user behavior data;

[0082] S2. Preprocessing abnormal data in software configuration data, software operation data, software environment data and user behavior data by using an anomaly detection algorithm to obtain an abnormal comprehensive data set;

[0083] S3, construct a software risk prediction model, input the abnormal comprehensive data set into the software risk prediction model, and predict the software attack risk coefficient;

[0084] S4, comparing the predicted software attack risk coefficient with a preset software attack risk coefficient threshold to determine whether the software has an attack risk;

[0085] S5. If there is no risk of being attacked, continue to monitor the software running status; if there is a risk of being attacked, issue a warning instruction through the computer control terminal and automatically generate warning information;

[0086] S6. Configure firewall rules to encrypt software configuration data, software operation data, software environment data, and user behavior data through encryption algorithms; use the key library to manage and protect encryption keys, and decrypt through the key library when the risk is eliminated, allowing unencrypted data transmission.

[0087] Software configuration data includes software configuration files, software version numbers, software installation paths, and libraries that the software depends on; software operation data includes software process status, software thread status, memory occupancy, memory usage, CPU occupancy, and CPU usage;

[0088] Software environment data includes the operating system configuration on which the software runs, the hardware configuration on which the software runs, the network traffic on which the software runs, and the system load; user behavior data includes the user's login time, the user's login location, the user's operation type, the user's access files, and the frequency of use of software functions.

[0089] Software configuration data is obtained by directly querying the operating system; software operation data is obtained by querying the task manager; software environment data is obtained by querying the operating system configuration; user behavior data is obtained through software log records;

[0090] Methods for preprocessing abnormal data in software configuration data, software operation data, software environment data, and user behavior data by using an anomaly detection algorithm to obtain an abnormal comprehensive data set include:

[0091] The obtained software configuration data, software operation data, software environment data and user behavior data are normalized by standard deviation, converted into standard normal distribution, and finally the normalized software configuration data, software operation data, software environment data and user behavior data are obtained, and integrated into a two-dimensional data matrix;

[0092] Each row of the matrix is ​​a data point, which contains the values ​​of all features in the software configuration data, software operation data, software environment data and user behavior data at a certain point in time; each column of the matrix is ​​a feature in the software configuration data, software operation data, software environment data and user behavior data;

[0093] S31. For each data point, calculate the The distance between neighboring data points: ;in, For the data points; For data points And its first Neighboring data points The distance between is the number of neighboring data points;

[0094] Adjust the number of neighboring data points by adjusting the model through neighboring points , the neighbor point adjustment model is: ;in, is the number of characteristic types of the data; is the data collection time; For characteristic species The influence coefficient of is the normalization factor of the feature type, which is used to adjust the number of feature types. The impact of within reasonable limits; The data collection time The influence coefficient of is the shift factor of the data acquisition time, to prevent Negative or zero values ​​appear during calculations;

[0095] For example, the data has 10 features, the data collection time is 100 units of time, and the feature type is The influence coefficient 1, the normalization factor of the feature type is 5, the data collection time is The influence coefficient =0.5, the translation factor of the data acquisition time is 1; then the number of neighboring data points ;

[0096] Limit the normalization factor using the normalization factor limit formula Adjust the number of feature types The influence range of the normalization factor is as follows: ;in, Characteristic Type right The influence coefficient of is the index of the feature type; For all feature types The sum of squares of the influence coefficients;

[0097] The normalization process uses all feature types The sum of squares is used as the denominator. This sum of squares makes the larger The value will not dominate too much; the normalization factor after limiting The value ensures that the contribution of all feature types is homogenized, even if the The value is originally large, and it will not appear too prominent after normalization; this process limits the excessive influence of certain feature types and ensures that the model can fairly consider each feature combination, making it more robust and reasonable when adjusting the number of neighbor points;

[0098] Limit the formula by the translation factor The translation factor limiting formula is: ;in, is the earliest collection time in the data, i.e., the lower limit of the time range; is a positive number tending to 0, used to ensure Always a positive number;

[0099] This formula ensures that Always positive to avoid negative or zero values ​​in calculations. The value of will not be too large to avoid excessive impact on time calculation;

[0100] S32. Define data points of The distance neighborhood is: ;in, For data points of The set of data points in the distance neighborhood; Neighbor data points that meet the distance conditions;

[0101] S33, for data points Each neighbor data point , calculated with data points The reachable distance between: ;in, For data points With neighboring data points The reachable distance between For data points With The distance between neighboring data points; For data points With neighboring data points The actual distance between

[0102] S34. Define data points The local reachability density of is the inverse of the average reachability distance of points in its neighborhood: ;in, For data points The local reachable density of For data points of The number of data points in the distance neighborhood;

[0103] S35. For each data point , calculate its local anomaly factor through the local anomaly factor calculation formula; the local anomaly factor calculation formula is: ;in, For data points The local abnormal factor of Neighbor data points The local reachable density of

[0104] S36, presetting a local anomaly factor threshold, if the calculated local anomaly factor of the data point is equal to the local anomaly factor threshold, it means that the density of the data point is similar to the density of its neighboring data points, then the data point is determined to be a normal data point;

[0105] If the calculated data points If the local anomaly factor is greater than the local anomaly factor threshold, it means that the density of the point is less than the density of its neighboring data points, and the data point is determined to be an abnormal data point;

[0106] If the calculated local anomaly factor of a data point is less than the local anomaly factor threshold, it means that the density of the point is greater than the density of its neighboring data points, and the data point is determined to be a normal point;

[0107] S37. Extract all abnormal data points whose local abnormal factor values ​​are greater than a preset local abnormal factor threshold to form an abnormal comprehensive data set.

[0108] The method for constructing a software risk prediction model includes:

[0109] The data set is divided into a training set, a validation set, and a test set; the data set includes a historical anomaly comprehensive data set and the corresponding software attack risk coefficient; a software risk prediction model is constructed, and the software risk prediction model includes an input layer, a hidden layer, and an output layer; the hidden layer uses a ReLU activation function;

[0110] The input layer of the model is used to input the historical anomaly comprehensive data set, and the number of neurons in the input layer matches the number of features in the historical anomaly comprehensive data set; the output layer of the model is used to output the software attack risk coefficient, and the number of neurons in the output layer corresponds to the number of prediction targets, and the prediction value is output through one neuron; the software risk prediction model is a fully connected neural network model;

[0111] The mean absolute error is used as the loss function to measure the error between the model's predicted value and the actual value; the mean absolute error loss function is: ;in, is the mean absolute error; is the number of data sets; For the The true value of the software attack risk coefficient; For the The predicted value of the software attack risk coefficient;

[0112] Use the training set data to train the model and minimize the loss function using the Adam optimizer. Use the validation set to evaluate the performance of the model and tune the model's hyperparameters until the model performance no longer improves significantly or reaches the preset stopping condition.

[0113] The test set is used to evaluate the performance of the model in the prediction task, and the current abnormal comprehensive data set is input into the trained software risk prediction model to obtain the software attack risk coefficient.

[0114] Methods for tuning model hyperparameters include:

[0115] The complexity of the model is limited by adding a sum of squares of weights to the mean absolute error loss function; the modified mean absolute error loss function is: ;in, is the regularization parameter; For the model Weight parameters; is the index of all weight parameters in the model;

[0116] Hyperparameters of the model Make adjustments: Select multiple Value, for each The model is trained and validated, the performance on the validation set is recorded, and the model with the best performance on the validation set is selected. value;

[0117] Adjust the model's hyperparameter Dropout ratio: select multiple Dropout ratios for experiments, train and validate the model for each Dropout ratio, record the performance on the validation set, and select the Dropout ratio with the best performance on the validation set.

[0118] The method of comparing the predicted software attack risk coefficient with the preset software attack risk coefficient threshold to determine whether the software has an attack risk includes:

[0119] If the predicted software attack risk coefficient is greater than or equal to the preset software attack risk coefficient threshold, it is determined that the software is at risk of being attacked;

[0120] If the predicted software attack risk coefficient is less than a preset software attack risk coefficient threshold, it is determined that the software does not have an attack risk.

[0121] If there is a risk of being attacked, a warning instruction is issued through a computer control terminal. The method of automatically generating warning information includes:

[0122] The preset software attack risk factor threshold is further divided into a low risk factor threshold , medium risk factor threshold and high risk threshold ; The predicted software attack risk factor is recorded as ; The software is attacked by the risk factor Low risk threshold , medium risk factor threshold and high risk threshold Make comparison and determine the warning instruction level;

[0123] like , then the warning instruction is determined to be a low-risk warning instruction; if , then the warning instruction is determined to be a medium risk warning instruction; if , the warning instruction is determined to be a high-risk warning instruction, and different levels of warning information are automatically generated according to the warning instructions of different risks.

[0124] For example, the predicted risk factor value of software being attacked is 0.75, and the preset risk factor threshold is as follows: Low risk factor threshold 0.3, medium risk factor threshold 0.6, high risk factor threshold The predicted risk factor 0.75 is compared with the preset threshold value. Since 0.6<0.75<0.9, the warning instruction is determined to be a high-risk warning instruction.

[0125] Methods for configuring firewall rules and encrypting software configuration data, software operation data, software environment data, and user behavior data through encryption algorithms include:

[0126] S81. Use a random number generator to randomly generate two prime numbers and , and the number of bits of the two prime numbers is greater than 1024 bits, which is used to generate the first RSA key pair and calculate the prime numbers and The product of: ;in, is the modulus of the first key pair; is the multiplication sign;

[0127] Calculate the modulus of the first key pair using the Euler function calculation formula Euler function to determine the encryption index and mutually prime;

[0128] The Euler function calculation formula is: ;in, For the modulus Euler function of ;

[0129] Select Crypto Index , so that and and Coprime; Calculate decryption exponent , so that: ;in, For the Euler function Modulo operation of ; Crypto Index About the model The multiplicative inverse of ; is the congruence symbol;

[0130] Generate a key pair and ;

[0131] For example, suppose two prime numbers are chosen =61 and =53, calculate the modulus and Euler function , ; ;

[0132] Select a Crypto Index ,For example =17, ensure , calculate the decryption index , so that: , The decryption index is 2753. It is the multiplicative inverse of 17 with respect to 3120.

[0133] Use the random number generator to randomly generate two prime numbers again and , and the number of bits of the two prime numbers is greater than 1024 bits, which is used to generate the second RSA key pair and calculate the prime numbers and The product of: ;in, is the modulus of the second key pair;

[0134] Calculate the modulus of the second key pair Euler function of : ;in, For the modulus Euler function of ;

[0135] Select Crypto Index , so that and and Coprime; Calculate decryption exponent , so that: ;in, For the Euler function Modulo operation of ; Crypto Index About the model The multiplicative inverse of ;

[0136] Generate a key pair and ;

[0137] S82. The type of encrypted data includes software configuration data , software operation data , software environment data and user behavior data ;for , , and Each data in Add random padding data : ;in, is the data after random filling; For connection operation;

[0138] By adding random padding data , increase the randomness of data to prevent pattern leakage; pattern leakage means that when processing or encrypting data, certain data patterns may expose the structure or content of the original data, making the data no longer secure; for example, when encrypting data, if the length of the data block is inconsistent, the pattern information of the data may be leaked.

[0139] Calculate the hash value of each data through the hash function Keep data integrity;

[0140] By calculating and storing the hash value of each data (including the data after random padding is added), after the data is transmitted or stored, the hash value of the received data can be recalculated and compared with the previously stored hash value to verify whether the data has been tampered with during transmission or storage. If the two hash values ​​are the same, it means that the data remains intact and has not been tampered with during transmission or storage; if they are different, it means that the data may have been tampered with, thereby maintaining the integrity of the data;

[0141] S83. Generate a symmetric key through a random number generator , using a symmetric key The ASE encryption algorithm uses the encryption formula to encrypt data Encryption is performed; the encryption formula is: ;in, is the encrypted data; is the encryption function;

[0142] S84, Use Key Symmetric key To encrypt: ;in, is the encrypted symmetric key; To transfer the symmetric key Promote to Key Crypto Index The power of Take the mold;

[0143] S85, the encrypted data , hash value and the encrypted symmetric key The comprehensive encrypted ciphertext is formed through weighted fusion of weighted models;

[0144] The weighted model is: ;in, It is a comprehensive encrypted ciphertext; For encrypted data The weight factor of Hash value The weight factor of The encrypted symmetric key The weight factor of

[0145] S86. Design each weight factor in the weighted model and optimize the distribution of weight factors; configure firewall rules: First rule: unauthorized users cannot access encrypted keys and data; Second rule: the firewall verifies the hash value Check the integrity of the transmitted data.

[0146] The methods for designing the weight factors in the weighted model and optimizing the allocation of the weight factors include:

[0147] Define an objective function that optimizes the distribution of weight factors: ;in, To measure the comprehensive encryption ciphertext Risk function for leakage risk; To measure the comprehensive encryption ciphertext Complexity function of decryption difficulty; is the risk function The weight coefficient of is the complexity function The weight coefficient of

[0148] The weight factor in the objective function is optimized using a weight factor update formula, where the weight factor update formula is: in, For the The weight factor after the iteration update; is the current weight factor; is the partial derivative of the objective function; is the weight factor The partial derivative of is the index of the weight factor; To control the rate at which the weight factor is updated each time;

[0149] If the partial derivative is positive, it means increasing the weight factor Will increase the value of the objective function, so the weight factor needs to be reduced ; If the partial derivative is negative, it means to increase the weight factor Will reduce the value of the objective function, so the weight factor needs to be increased .

[0150] The rate at which the weight factor is updated is controlled by the rate control formula Control is performed, and the rate control formula is: ;in, is the rate of controlling the post-weight factor; is the decay rate parameter; is the number of iterations; is the number of weight factors;

[0151] As the number of iterations The rate at which the weight factor increases It will gradually decrease to prevent the excessive weight factor rate from causing unstable jumps;

[0152] go through In the iteration, the weight factor update formula outputs the optimal weight factor, so that the objective function reaches the minimum value and the distribution of weight factors reaches the optimal value.

[0153] Use the keystore to manage and protect encryption keys. When the risk is eliminated, decryption is performed through the keystore. Methods that allow unencrypted data transmission include:

[0154] Use Azure Key Vault, a key vault management tool provided by Microsoft, to create and configure a key vault, generate and store encryption keys through Azure SDK, and configure and regularly update access control policies using Azure CLI; use Azure Monitor to monitor the use of the key vault in real time, and send activity logs to the Log Analytics workspace to identify abnormal operations;

[0155] A threshold of login times within a preset period of m is set. When the number of login times of a user reaches the threshold within the preset period of m, an alarm is automatically triggered, the IP address is automatically blocked, and unauthorized access to the key vault is prevented. After confirming that the risk has been resolved, the administrator initiates a decryption request, connects to the key vault through the Azure SDK, obtains the encryption key, and completes data decryption on the server side.

[0156] The preset software attack risk coefficient threshold is set by the staff, and different software attack risk coefficients are collected through the computer management terminal, and the average value of multiple software attack risk coefficients is taken as the preset software attack risk coefficient threshold; similarly, the threshold of the number of logins within a preset m period of time is set.

[0157] This embodiment uses the neighbor point adjustment model to dynamically determine the number of neighbor points of each data point by considering factors such as the number of feature types of data and the data collection time, which helps to improve the accuracy and flexibility of anomaly detection; by introducing the time factor, the model can also consider the trend of data changes over time, so as to better adapt to non-static data sets, and help prevent the problem of improper selection of the number of neighbor points due to a large data collection time span; the normalization factor restriction formula ensures that the influence of the number of feature types on the number of neighbor points is within a reasonable range, thereby improving the stability and reliability of the model;

[0158] The data is encrypted using a randomly generated symmetric key combined with the AES encryption algorithm. The symmetric key itself is also encrypted using an RSA key pair, forming a double encryption mechanism that further improves security. A hash value is calculated for each type of data, which helps verify the integrity of the data during data transmission or storage. A weighted model is used to weight and fuse the encrypted data, hash value, and encrypted symmetric key into a comprehensive encrypted ciphertext. The weights of each part can be adjusted according to actual needs to adapt to different security needs and scenarios.

[0159] By defining an objective function that includes a risk function and a complexity function, the optimal balance can be found between the security of the encrypted ciphertext and the complexity of the decryption process, which helps to ensure data confidentiality while also taking into account system performance and resource efficiency. By optimizing the allocation of weight factors, resources can be reasonably allocated during the encryption and decryption process. The weight factor update formula based on the partial derivative of the objective function is used to dynamically adjust the value of the weight factor to gradually optimize the objective function, making the optimization process faster and reducing the waste of computing resources.

[0160] Example 2

[0161] See also Figure 2 As shown, the part not described in detail in this embodiment is described in Example 1, which provides a computer software protection system based on a learning network, including:

[0162] Data collection module, used to collect software configuration data, software operation data, software environment data and user behavior data;

[0163] A data processing module is used to pre-process the abnormal data in the software configuration data, software operation data, software environment data and user behavior data through an abnormality detection algorithm to obtain an abnormal comprehensive data set;

[0164] The risk coefficient prediction module is used to build a software risk prediction model, input the abnormal comprehensive data set into the software risk prediction model, and predict the software attack risk coefficient;

[0165] The risk assessment module is used to compare the predicted software attack risk coefficient with the preset software attack risk coefficient threshold to determine whether the software has an attack risk;

[0166] The monitoring and early warning module is used to take corresponding measures according to the risk assessment results. If there is no risk of attack, the software operation status will continue to be monitored; if there is a risk of attack, an early warning instruction will be issued through the computer control terminal to automatically generate early warning information;

[0167] The software protection module is used to configure firewall rules and encrypt software configuration data, software operation data, software environment data and user behavior data through encryption algorithms; use the key library to manage and protect encryption keys, decrypt them through the key library when the risk is eliminated, and allow unencrypted data transmission.

[0168] Since the electronic device introduced in this embodiment is an electronic device used to implement a computer software protection method based on a learning network in the embodiment of the present application, based on the computer software protection method based on a learning network introduced in the embodiment of the present application, a person skilled in the art can understand the specific implementation of the electronic device of the present embodiment and its various variations, so how the electronic device implements the method in the embodiment of the present application is not described in detail here. As long as a person skilled in the art implements the electronic device used in the computer software protection method based on a learning network in the embodiment of the present application, it belongs to the scope of protection of this application.

[0169] The above formulas are all dimensionless and numerical calculations. The formula is a formula for the most recent real situation obtained by collecting a large amount of data and performing software simulation. The preset parameters and thresholds in the formula are set by technicians in this field according to actual conditions.

[0170] The above is only a preferred embodiment of the present invention, and the protection scope of the present invention is not limited to the above embodiments. All technical solutions under the concept of the present invention belong to the protection scope of the present invention. It should be pointed out that for ordinary technical users in this technical field, some improvements and modifications without departing from the principle of the present invention should also be regarded as the protection scope of the present invention.

Claims

1. A computer software protection method based on a learning network, characterized in that: include: S1. Collect software configuration data, software operation data, software environment data and user behavior data; S2. Preprocessing abnormal data in software configuration data, software operation data, software environment data and user behavior data by using an anomaly detection algorithm to obtain an abnormal comprehensive data set; S3, construct a software risk prediction model, input the abnormal comprehensive data set into the software risk prediction model, and predict the software attack risk coefficient; S4, comparing the predicted software attack risk coefficient with a preset software attack risk coefficient threshold to determine whether the software has an attack risk; S5. If there is no risk of being attacked, continue to monitor the software running status; if there is a risk of being attacked, issue a warning instruction through the computer control terminal and automatically generate warning information; S6. Configure firewall rules and encrypt software configuration data, software operation data, software environment data and user behavior data through encryption algorithms; Use the keystore to manage and protect encryption keys. When the risk is eliminated, decryption is performed through the keystore to allow unencrypted data transmission. The method of preprocessing abnormal data in software configuration data, software operation data, software environment data and user behavior data by using an abnormality detection algorithm to obtain an abnormal comprehensive data set includes: The obtained software configuration data, software operation data, software environment data and user behavior data are normalized by standard deviation, converted into standard normal distribution, and finally the normalized software configuration data, software operation data, software environment data and user behavior data are obtained, and integrated into a two-dimensional data matrix; Each row of the matrix is ​​a data point, which contains the values ​​of all features in the software configuration data, software operation data, software environment data and user behavior data at a certain point in time; each column of the matrix is ​​a feature in the software configuration data, software operation data, software environment data and user behavior data; S31. For each data point, calculate the distance between the data point and the kth nearest neighbor data point: d k (x i )=min{d(x i ,x (k) )}; where x i is the i-th data point; d(x i ,x (k) ) is the data point x i and its kth nearest neighbor data point x (k) The distance between them; k is the number of neighboring data points; The number k of neighboring data points is adjusted by the neighboring point adjustment model, and the neighboring point adjustment model is: Among them, F is the characteristic type of data; T is the data collection time; α is the influence coefficient of the characteristic type on k; β is the normalization factor of the characteristic type; γ is the influence coefficient of the data collection time on k; δ is the translation factor of the data collection time; The normalization factor limiting formula is used to limit the influence range of the normalization factor β on the number of feature types k; the normalization factor limiting formula is: Among them, α b is the influence coefficient of the feature type on k; b is the index of the feature type; is the sum of the squares of the influence coefficients of all feature types on k; The range of δ is limited by the translation factor limiting formula, and the translation factor limiting formula is: δ = max(-T min +ε,0); where T min is the earliest collection time in the data, i.e., the lower limit of the time range; ε is a positive number tending to 0; S32. Define data point x i The k-distance neighborhood of is: N k (x i )={x j |d(x i ,x j )≤d k (x i )} Among them, N k (x i ) is the data point x i The set of data points in the k-distance neighborhood of x; j Neighbor data points that meet the distance conditions; S33, for data point x i Each neighbor data point x j , calculated with the data point x i The reachable distance between: rd k (x i ,x j )=max{d k (x j ),d(x i ,x j )}; where rd k (x i ,x j ) is the data point x i With neighboring data point x j The reachable distance between k (x j ) is the data point x j The distance between the kth nearest neighbor data point; d(x i ,x j ) is the data point x i With neighboring data point x j The actual distance between S34. Define data point x i The local reachability density of is the inverse of the average reachability distance of points in its neighborhood: ; Among them, lrd k (x i ) is the data point x i The local reachable density of |N k (x i )| is the data point x i The number of data points in the k-distance neighborhood of ; S35. For each data point x i , calculate its local anomaly factor through the local anomaly factor calculation formula; the local anomaly factor calculation formula is: ; Among them, LOF k (x i ) is the data point x i Local outlier factor; lrd k (x j ) is the neighbor data point x j The local reachable density of S36, presetting a local anomaly factor threshold, if the calculated local anomaly factor of the data point is less than or equal to the local anomaly factor threshold, then determining that the data point is a normal data point; If the calculated data point x i If the local anomaly factor is greater than the local anomaly factor threshold, the data point is determined to be an abnormal data point; S37, extracting all abnormal data points whose local abnormal factor values ​​are greater than a preset local abnormal factor threshold to form an abnormal comprehensive data set; The method of configuring firewall rules and encrypting software configuration data, software operation data, software environment data and user behavior data by using an encryption algorithm includes: S81, using a random number generator to randomly generate two prime numbers p1 and q1, and the number of bits of the two prime numbers is greater than 1024 bits, for generating a first RSA key pair, and calculating the product of the prime numbers p1 and q1: m1=p1×q1; wherein m1 is the modulus of the first key pair; × is the multiplication sign; Calculate the Euler function of the modulus m1 of the first key pair using the Euler function calculation formula, and determine that the encryption exponent e1 and φ(m1) are mutually prime; The Euler function calculation formula is: φ(m1)=(p1-1)×(q1-1); wherein φ(m1) is the Euler function of modulus m1; Select the encryption exponent e1, so that 1<e1<φ(m1) and e1 and φ(m1) are mutually prime; calculate the decryption exponent d1, so that: e1×d1≡1modφ(m1); where modφ(m1) is the modulus operation of the Euler function φ(m1); d1 is the multiplicative inverse element of the encryption exponent e1 with respect to the modulus φ(m1); ≡ is the congruence symbol; Generate key pairs (e1,m1) and (d1,m1); Use a random number generator to randomly generate two prime numbers p2 and q2 again, and the number of bits of the two prime numbers is greater than 1024 bits, which are used to generate the second RSA key pair, and calculate the product of the prime numbers p2 and q2: m2=p2×q2; where m2 is the modulus of the second key pair; Calculate the Euler function of the modulus m2 of the second key pair: φ(m2)=(p2-1)×(q2-1); where φ(m2) is the Euler function of modulus m2; Select the encryption exponent e2, so that 1<e2<φ(m2) and e2 and φ(m2) are mutually prime; calculate the decryption exponent d2, so that: e2×d2≡1modφ(m2); where modφ(m2) is the modulus operation of the Euler function φ(m2); d2 is the multiplicative inverse element of the encryption exponent e2 with respect to the modulus φ(m2); Generate key pairs (e2,m2) and (d2,m2); S82, the types of encrypted data include software configuration data M1, software operation data M2, software environment data M3 and user behavior data M4; for each data M1, M2, M3 and M4 c Add random padding data r c :M′ c =M c ||r c ; where M′ c is the data after random filling;|| is the connection operation; Calculate the hash value H of each data through the hash function c Keep data integrity; S83, generate a symmetric key K through a random number generator, use the symmetric key K and the ASE encryption algorithm to encrypt the data M′ through an encryption formula c Encryption is performed; the encryption formula is: U′ c =AES K (M′ c ), where U′ c is the encrypted data; AES is the encryption function; S84. Use the key (e1, m1) to encrypt the symmetric key K: Among them, U K is the encrypted symmetric key; To raise the symmetric key K to the power of the encryption exponent e1 of the key (e1, m1), and modulo the modulus m1; S85, the encrypted data U' c 、Hash value H c and the encrypted symmetric key U K The comprehensive encrypted ciphertext is formed through weighted fusion of weighted models; The weighted model is: U Z =U′ c ·σ1+H c ·σ2+U K ·σ2; where U Z is the comprehensive encrypted ciphertext; σ1 is the encrypted data U′ c The weight factor; σ2 is the hash value H c The weight factor; σ3 is the encrypted symmetric key U K The weight factor of S86. Design each weight factor in the weighted model and optimize the distribution of weight factors; configure firewall rules: first rule: unauthorized users cannot access encrypted keys and data; second rule: the firewall verifies the hash value H c Check the integrity of the transmitted data; The method for designing the weight factors in the weighted model and optimizing the distribution of the weight factors includes: Define an objective function that optimizes the distribution of weight factors: f(σ1,σ2,σ3)=ρ1·Rx(U Z )+ρ2·Ce(U Z ); Among them, Rx(U Z ) is used to measure the comprehensive encrypted ciphertext U Z The risk function of leakage risk; Ce(U Z ) is used to measure the comprehensive encrypted ciphertext U Z The complexity function of the decryption difficulty; ρ1 is the risk function Rx(U Z ) weight coefficient; ρ2 is the complexity function Ce(U Z )’s weight coefficient; The weight factor in the objective function is optimized using a weight factor update formula, where the weight factor update formula is: in, is the weight factor after the tth iteration update; σ o is the current weight factor; is the partial derivative of the objective function; is the weight factor σ o The partial derivative of; o is the index of the weight factor; η is the rate at which the weight factor is updated each time; The rate η of updating the weight factor is controlled by the rate control formula, and the rate control formula is: Among them, η′ is the rate of the weight factor after control; μ is the decay rate parameter; t is the number of iterations; N is the number of weight factors; After t iterations, the weight factor update formula outputs the optimal weight factor, so that the objective function reaches the minimum value and the weight factor distribution reaches the optimal value; The method of using a key library to manage and protect encryption keys, decrypting through the key library when the risk is eliminated, and allowing unencrypted data transmission includes: Use Azure Key Vault, a key vault management tool provided by Microsoft, to create and configure a key vault, generate and store encryption keys through the Azure SDK, and use the Azure CLI to configure and regularly update access control policies; use Azure Monitor to monitor the use of the key vault in real time, and send activity logs to the Log Analytics workspace to identify abnormal operations; A threshold of login times within a preset period of m is set. When the number of login times of a user reaches the threshold within the preset period of m, an alarm is automatically triggered, the IP address is automatically blocked, and unauthorized access to the key vault is prevented. After confirming that the risk has been resolved, the administrator initiates a decryption request, connects to the key vault through the Azure SDK, obtains the encryption key, and completes data decryption on the server side.

2. A computer software protection method based on a learning network according to claim 1, characterized in that: The software configuration data includes the software configuration file, the software version number, the software installation path and the library that the software depends on; the software operation data includes the software process status, the software thread status, memory occupancy rate, memory usage, CPU occupancy rate and CPU usage; Software environment data includes the operating system configuration on which the software runs, the hardware configuration on which the software runs, the network traffic on which the software runs, and the system load; user behavior data includes the user's login time, the user's login location, the user's operation type, the user's access files, and the frequency of use of software functions.

3. A computer software protection method based on a learning network according to claim 2, characterized in that: The method for constructing the software risk prediction model includes: The data set is divided into a training set, a validation set, and a test set; the data set includes a historical anomaly comprehensive data set and the corresponding software attack risk coefficient; a software risk prediction model is constructed, and the software risk prediction model includes an input layer, a hidden layer, and an output layer; the hidden layer uses a ReLU activation function; The input layer of the model is used to input the historical anomaly comprehensive data set, and the number of neurons in the input layer matches the number of features in the historical anomaly comprehensive data set; the output layer of the model is used to output the software attack risk coefficient, and the number of neurons in the output layer corresponds to the number of prediction targets, and the prediction value is output through one neuron; the software risk prediction model is a fully connected neural network model; The mean absolute error is used as the loss function to measure the error between the model's predicted value and the actual value; the mean absolute error loss function is: Among them, MAE is the mean absolute error; n is the number of data sets; y i′ is the true value of the risk coefficient of the i′th software being attacked; is the predicted value of the risk coefficient of attack of the i′th software; Use the training set data to train the model and minimize the loss function using the Adam optimizer. Use the validation set to evaluate the performance of the model and tune the model's hyperparameters until the model performance no longer improves significantly or reaches the preset stopping condition. The test set is used to evaluate the performance of the model in the prediction task, and the current abnormal comprehensive data set is input into the trained software risk prediction model to obtain the software attack risk coefficient.

4. A computer software protection method based on a learning network according to claim 3, characterized in that: The method for tuning the hyperparameters of the model includes: The complexity of the model is limited by adding a sum of squares of weights to the mean absolute error loss function; the modified mean absolute error loss function is: ; where λ is the regularization parameter; ω l is the lth weight parameter in the model; l is the index of all weight parameters in the model; Adjust the model's hyperparameter λ: select multiple λ values, train and validate the model for each λ value, record the performance on the validation set, and select the λ value with the best performance on the validation set; Adjust the model's hyperparameter Dropout ratio: select multiple Dropout ratios for experiments, train and validate the model for each Dropout ratio, record the performance on the validation set, and select the Dropout ratio with the best performance on the validation set.

5. A computer software protection method based on a learning network according to claim 4, characterized in that: The method of comparing the predicted software attack risk coefficient with a preset software attack risk coefficient threshold to determine whether the software has an attack risk includes: If the predicted software attack risk coefficient is greater than or equal to the preset software attack risk coefficient threshold, it is determined that the software is at risk of being attacked; If the predicted software attack risk coefficient is less than a preset software attack risk coefficient threshold, it is determined that the software does not have an attack risk.

6. A computer software protection method based on a learning network according to claim 5, characterized in that: If there is a risk of being attacked, a warning instruction is issued through a computer control terminal, and the method of automatically generating warning information includes: The preset software attack risk coefficient threshold is further divided into a low risk coefficient threshold θ1, a medium risk coefficient threshold θ2 and a high risk coefficient threshold θ3; the predicted software attack risk coefficient is recorded as γ; the software attack risk coefficient γ is compared with the low risk coefficient threshold θ1, the medium risk coefficient threshold θ2 and the high risk coefficient threshold θ3 respectively to determine the warning instruction level; If θ1<γ<θ2, the warning instruction is determined to be a low-risk warning instruction; if θ2<γ<θ3, the warning instruction is determined to be a medium-risk warning instruction; if γ>θ3, the warning instruction is determined to be a high-risk warning instruction, and different levels of warning information are automatically generated according to warning instructions of different risks.

Images