A data security guarantee method based on intelligent alarm information management terminal

Abstract

The present invention relates to the field of data security technology, and discloses a data security method based on an intelligent alarm information management terminal, including: obtaining the work log of the management terminal, and analyzing to determine whether there is an abnormal situation; if there is an abnormal situation, generating alarm information according to the abnormal situation, and grading the urgency of the alarm information according to the abnormal situation to determine the urgency level of the alarm information; encrypting the alarm information according to the urgency level of the alarm information, and sending the encrypted alarm information to the authorized personnel of the management terminal; automatically triggering the corresponding response measures of the management terminal according to the urgency of the alarm information; decrypting the encrypted alarm information according to the authorization authority of the authorized personnel, and reading the alarm information, and changing or retaining the response measures according to the alarm information to achieve data security. Through the data encryption method and identity authentication mechanism, the risk of data leakage and false alarm is effectively prevented.

Description

Technical Field

[0001] The present invention relates to the technical field of data security, and in particular to a data security assurance method based on an intelligent alarm information management terminal. Background Art

[0002] With the rapid advancement of financial technology, the intelligent alarm system in the bank's security system plays an increasingly critical role. The intelligent alarm system needs to detect abnormal situations in real time and immediately issue an alarm when an abnormal situation is detected, effectively ensuring the safety and stable operation of financial institutions. However, with the deepening of intelligent alarm technology and the expansion of its application boundaries, especially in highly sensitive environments such as banks, unprecedented challenges have been posed to data security protection capabilities.

[0003] Although the current bank intelligent alarm system has made some progress in information management and transmission, ensuring the basic transmission of alarm information, its data protection measures are insufficient in the face of complex and ever-changing security threats. In particular, the recording and storage of traditional alarm information mostly rely on unencrypted or weak encryption mechanisms, which in a highly digitized banking operating environment can easily lead to data being intercepted and cracked during transmission and storage, increasing the risk of tampering and leakage. In addition, the lack of an effective identity authentication mechanism makes it possible for unauthorized users to access and operate the intelligent alarm information management terminal, increasing the security risk of the system. Therefore, there is an urgent need for a data security protection method based on the intelligent alarm information management terminal to achieve encryption of alarm information. Summary of the invention

[0004] The purpose of the present invention is to provide a data security protection method based on an intelligent alarm information management terminal to solve the problems that traditional alarm information recording methods mostly use unencrypted or weak encryption mechanisms, insufficient data security, and imperfect identity authentication mechanisms.

[0005] The present invention provides a data security guarantee method based on an intelligent alarm information management terminal, the method comprising:

[0006] Obtaining a work log of the management terminal, analyzing the work log, and determining whether there is an abnormality;

[0007] If there is an abnormal situation, an alarm message is generated according to the abnormal situation, and the emergency level of the alarm message is graded according to the abnormal situation to determine the emergency level of the alarm message;

[0008] Encrypting the alarm information according to the urgency level of the alarm information, and sending the encrypted alarm information to an authorized person of the management terminal;

[0009] Automatically trigger corresponding response measures of the management terminal according to the urgency of the alarm information;

[0010] The encrypted alarm information is decrypted according to the authorization authority of the authorized personnel, and the alarm information is read, and the response measures are changed or retained according to the alarm information to achieve data security protection.

[0011] In some embodiments of the present application, analyzing the work log to determine whether there is an abnormal situation includes:

[0012] Obtain the historical normal work log of the management terminal and the work requirements of the day;

[0013] Matching the work content of the work log with the work content of the historical normal work log one by one;

[0014] Extracting work content in the work log that does not match the historical normal work log to generate a first work log set;

[0015] Generate a set of predicted work content based on the work requirements of the day;

[0016] Matching the work content of the first work log set with the work content of the predicted work content set one by one;

[0017] The work contents in the first work log set that do not match the predicted work content set are extracted to generate an abnormal log set.

[0018] In some embodiments of the present application, the alarm information is graded according to the abnormal situation to determine the urgency level of the alarm information, including:

[0019] A keyword library is preset, and the keyword library includes a number of keywords for managing terminal work, and the keywords have corresponding weights;

[0020] Extracting keywords of the work content in the abnormal log set according to the keyword library;

[0021] Determine the word frequency and inverse document frequency of the keyword, and obtain the TF-IDF value of each keyword according to the word frequency and inverse document frequency;

[0022] Determine the abnormal value of the abnormal log set according to the TF-IDF value of the keyword and the weight corresponding to the keyword;

[0023] The alarm information is graded for urgency according to the abnormal value of the abnormal log set to determine the urgency level of the alarm information.

[0024] In some embodiments of the present application, grading the urgency of the alarm information according to the abnormal value to determine the urgency level of the alarm information includes:

[0025] Presetting a first preset abnormal value, a second preset abnormal value, and a third preset abnormal value, wherein the first preset abnormal value, the second preset abnormal value, and the third preset abnormal value increase in sequence;

[0026] When the abnormal value of the abnormal log set is less than the first preset abnormal value, setting the emergency level of the alarm information to the first emergency level L1;

[0027] When the abnormal value of the abnormal log set is greater than or equal to the first preset abnormal value, and the abnormal value of the abnormal log set is less than the second preset abnormal value, setting the emergency level of the alarm information to the second emergency level L2;

[0028] When the abnormal value of the abnormal log set is greater than or equal to the second preset abnormal value, and the abnormal value of the abnormal log set is less than the third preset abnormal value, setting the emergency level of the alarm information to the third emergency level L3;

[0029] When the abnormal value of the abnormal log set is greater than or equal to the third preset abnormal value, the urgency level of the alarm information is set to a fourth urgency level L4, wherein L1<L2<L3<L4.

[0030] In some embodiments of the present application, encrypting the alarm information according to the urgency level of the alarm information includes:

[0031] Determining an encryption level of the alarm information according to the urgency level of the alarm information, and encrypting the alarm information according to the encryption level;

[0032] in,

[0033] When the urgency level of the alarm information is the first urgency level L1, the encryption level of the alarm information is determined to be the first encryption level;

[0034] When the urgency level of the alarm information is the second urgency level L2, determining the encryption level of the alarm information to be the second encryption level;

[0035] When the urgency level of the alarm information is the third urgency level L3, determining the encryption level of the alarm information to be the third encryption level;

[0036] When the urgency level of the alarm information is the fourth urgency level L4, the encryption level of the alarm information is determined to be the fourth encryption level.

[0037] In some embodiments of the present application, when the alarm information is encrypted according to the urgency level of the alarm information, a key for decrypting the encrypted alarm information is also generated, and the key is sent to a key pool;

[0038] The key pool is provided with different key pool levels;

[0039] The corresponding secret key is sent to the corresponding secret key pool according to the encryption level.

[0040] In some embodiments of the present application, decrypting the encrypted alarm information according to the authorization authority of the authorized personnel includes:

[0041] Authentication of the authorized personnel, including verification of the authorized personnel's account, password, and authorization authority;

[0042] If the authorized personnel account verification and the authorized personnel password verification are passed, and the authorized personnel's authorization authority reaches the corresponding key pool level, then log in to the key pool, obtain the corresponding key, and decrypt the encrypted alarm information;

[0043] If the authorized personnel account verification and the authorized personnel password verification are passed, and the authorized personnel's authorization authority does not reach the corresponding key pool level, they are not allowed to log in to the key pool.

[0044] In some embodiments of the present application, the encrypted alarm information includes the alarm time, alarm reason, alarm location, urgency level and encryption level.

[0045] In some embodiments of the present application, the method further includes:

[0046] When there are several encrypted alarm messages to be sent, determine whether the alarm causes in the encrypted alarm messages are consistent;

[0047] If they are consistent, the encrypted alarm information with the same alarm reason is determined to be similar alarm information;

[0048] Determine the alarm time interval of similar alarm information. If the alarm time interval is greater than the preset time interval, both encrypted alarm information are sent; if the alarm time interval is less than or equal to the preset time interval, the encrypted alarm information with the later alarm time is not sent.

[0049] In some embodiments of the present application, after generating the alarm information according to the abnormal situation, the method further includes:

[0050] The alarm information is stored in a storage unit of the management terminal to prevent data from being damaged or lost.

[0051] Compared with the prior art, the beneficial effect of the present invention is that the abnormal situation is determined by analyzing the work log, the alarm information is generated, the alarm information is encrypted according to the urgency level, and the corresponding key is generated. The key is obtained and decrypted according to the authorization authority of the authorized personnel to read the content of the alarm information. Through the data encryption method and identity authentication mechanism, the risk of data leakage and false alarm is effectively prevented, and the data is prevented from being tampered with during network transmission. And by storing and backing up the data of the alarm information, the availability and fault tolerance of the data are improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings in the following description are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0053] Figure 1 It is a flow chart of a data security assurance method based on an intelligent alarm information management terminal of the present invention. DETAILED DESCRIPTION

[0054] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0055] like Figure 1 As shown, the present invention provides a data security protection method based on an intelligent alarm information management terminal, the method comprising:

[0056] S1, obtaining a work log of a management terminal, analyzing the work log, and determining whether there is an abnormality.

[0057] S2: If an abnormal situation exists, an alarm message is generated according to the abnormal situation, and the emergency level of the alarm message is graded according to the abnormal situation to determine the emergency level of the alarm message.

[0058] S3, encrypting the alarm information according to the urgency level of the alarm information, and sending the encrypted alarm information to the authorized personnel of the management terminal.

[0059] S4, automatically triggering corresponding response measures of the management terminal according to the urgency of the alarm information.

[0060] S5, decrypting the encrypted alarm information according to the authorization authority of the authorized personnel, reading the alarm information, and changing or retaining the response measures according to the alarm information to achieve data security protection.

[0061] The present invention determines whether an abnormal situation occurs by analyzing the work log of the management terminal, generates alarm information based on the abnormal situation, encrypts the alarm information and generates a corresponding key, obtains the key according to the authority level of the authorized personnel, decrypts the encrypted alarm information, obtains the content of the alarm information, and changes and adjusts the response measures.

[0062] In some embodiments of the present application, the bank work log is analyzed to determine whether there is an abnormal situation, including: obtaining the historical normal work log of the bank management terminal and the business work requirements of the day; matching the work content of the work log with the work content of the historical normal work log one by one; extracting the work content in the work log that does not match the historical normal work log to generate a first work log set; generating a predicted work content set based on the work requirements of the day; matching the work content of the first work log set with the work content of the predicted work content set one by one; extracting the work content in the first work log set that does not match the predicted work content set to generate an abnormal log set.

[0063] In this embodiment, the work log of the bank includes working hours, work procedures and operation contents. The acquired work log is matched with the historical normal work log of the bank management terminal. When the work content of the historical normal work log is consistent with the work content of the work log, it means that the work content is normal work content. When the work content of the historical normal work log is inconsistent with the work content of the work log, it means that the work content is abnormal work content. The work log corresponding to the abnormal work content is extracted to generate the first work log set. The predicted work content set is generated from the work requirements of the management terminal for the day, and the work content in the predicted work content set is matched with the work content of the first work log set. The work logs that fail to match are extracted to generate the abnormal log set.

[0064] In some embodiments of the present application, the alarm information is graded for urgency according to the abnormal situation, and the urgency level of the alarm information is determined, including: a keyword library is preset, the keyword library includes several keywords for the work of the bank management terminal, and the keywords are preset with weights according to the degree of impact on the business; keywords of the work content in the abnormal log set are extracted according to the keyword library; the word frequency and inverse document frequency of the keywords are determined, and the TF-IDF value of each keyword is obtained according to the word frequency and inverse document frequency; the abnormal value of the abnormal log set is determined according to the TF-IDF value of the keyword and the weight corresponding to the keyword; the alarm information is graded for urgency according to the abnormal value of the abnormal log set, and the urgency level of the alarm information is determined, so as to ensure that the bank can respond to various potential risk events promptly and appropriately, and enhance the accuracy and timeliness of risk management and response.

[0065] In this embodiment, TF-IDF (term frequency–inverse document frequency) is a weight calculation method widely used in information retrieval and data analysis to enhance the intelligent analysis capability of alarm host operation logs. TF-IDF stands for term frequency and inverse document frequency. This technology can accurately quantify the unique value of a single word in a specific operation log, especially the importance of identifying key activities in large and complex alarm host operation records. In specific practice, we first build a customized keyword library, which carefully includes a series of keywords closely related to the operation of the alarm host, such as "arming", "disarming", "bypass", "zone alarm", etc. These keywords are directly related to the daily operation of the bank's alarm equipment. By calculating the TF-IDF value of the keywords contained in each operation content in the abnormal log set, combined with the business sensitivity weight of the keywords themselves, we can accurately evaluate the degree of abnormality of each log. This evaluation process is highly refined and can identify those abnormal and prominent operation behaviors in a specific context, providing a scientific basis for the bank's security monitoring. Furthermore, based on these calculated abnormal values, the system adaptively sets the urgency level of the alarm information, ensuring that the bank can quickly focus on the most urgent risk events, effectively prevent potential financial fraud or operational errors, and maintain the security and stability of the bank system and the security of customer funds. The application of this methodology not only improves the bank's risk identification efficiency in the big data environment, but also lays a solid foundation for building an intelligent and automated security early warning system.

[0066] In some embodiments of the present application, the alarm information is graded according to the abnormal value to determine the urgency level of the alarm information, including: presetting a first preset abnormal value, a second preset abnormal value, and a third preset abnormal value, wherein the first preset abnormal value, the second preset abnormal value, and the third preset abnormal value increase in sequence; when the abnormal value of the abnormal log set is less than the first preset abnormal value, the urgency level of the alarm information is set to a first urgency level L1; when the abnormal value of the abnormal log set is greater than or equal to the first preset abnormal value, and the abnormal value of the abnormal log set is less than the second preset abnormal value, the urgency level of the alarm information is set to a second urgency level L2; when the abnormal value of the abnormal log set is greater than or equal to the second preset abnormal value, and the abnormal value of the abnormal log set is less than the third preset abnormal value, the urgency level of the alarm information is set to a third urgency level L3; when the abnormal value of the abnormal log set is greater than or equal to the third preset abnormal value, the urgency level of the alarm information is set to a fourth urgency level L4, wherein L1<L2<L3<L4.

[0067] In this embodiment, a direct correlation principle is established, that is, the increase in abnormal values ​​is positively correlated with the urgency level of the alarm information, which means that the higher the abnormality of the detected log, the higher the corresponding alarm urgency level. By presetting a number of preset abnormal values, the relationship between the abnormal values ​​of the abnormal log set and the preset abnormal values ​​is determined, and the corresponding urgency level is determined. Among them, the preset abnormal value can be set according to experience, or it can be set according to specific experiments or historical data. In specific operations, the system will first calculate the abnormal value of each log in the abnormal log set, and then compare these calculation results with the preset abnormal threshold matrix. This matrix defines in detail the specific urgency levels corresponding to different abnormal value intervals, such as slight abnormality, medium risk, high urgency and extreme urgency. Through this mapping relationship, the system can quickly and accurately determine the urgency level of each abnormal log, ensuring that the bank can respond immediately to events that may pose a major threat to financial security, customer trust and even institutional reputation. This method not only enhances the decision-making efficiency of the bank in dealing with abnormal situations, but also ensures the pertinence and effectiveness of the response measures, and builds a solid line of defense for maintaining the stable operation of the banking system and preventing financial risks.

[0068] In some embodiments of the present application, the alarm information is encrypted according to the urgency level of the alarm information, including: determining the encryption level of the alarm information according to the urgency level of the alarm information, and encrypting the alarm information according to the encryption level; wherein, when the urgency level of the alarm information is a first urgency level L1, the encryption level of the alarm information is determined to be the first encryption level; when the urgency level of the alarm information is a second urgency level L2, the encryption level of the alarm information is determined to be the second encryption level; when the urgency level of the alarm information is a third urgency level L3, the encryption level of the alarm information is determined to be the third encryption level; when the urgency level of the alarm information is a fourth urgency level L4, the encryption level of the alarm information is determined to be the fourth encryption level.

[0069] In this embodiment, after the urgency level of the alarm information is determined, it is necessary to determine the corresponding encryption level based on the urgency level and encrypt the alarm information to ensure that the alarm information is protected from unauthorized interception and illegal decryption during transmission and storage, thereby effectively curbing the risk of information being maliciously tampered with or leaked.

[0070] In some embodiments of the present application, when the alarm information is encrypted according to the urgency level of the alarm information, a key for decrypting the encrypted alarm information is also generated, and the key is sent to a key pool; the key pool is set with different key pool levels; the corresponding key is sent to the corresponding key pool according to the encryption level.

[0071] In this embodiment, when the alarm information is encrypted, a corresponding secret key for decryption is generated at the same time, and the secret key is stored in a key pool with a key pool level, so that it is convenient to enter the key pool according to the authorization authority and obtain the secret key. As mentioned above, enhanced security measures are taken for the alarm information, that is, when the information is encrypted, the corresponding decryption key is automatically generated, and these keys are properly stored in a key pool with a key pool level. This design is intended to ensure that the storage of keys is both safe and orderly. Each level of the key pool corresponds to a different authorization level, so that legally authorized personnel can smoothly access and use the required key to decrypt the alarm information according to their authority level. This not only strengthens the confidentiality of the alarm data and prevents unauthorized access, but also optimizes the internal work process, ensuring that in an emergency, the bank's security management personnel can efficiently and compliantly obtain sensitive information, respond to potential financial security threats in a timely manner, and maintain the overall security and stability of the bank system.

[0072] In some embodiments of the present application, the encrypted alarm information is decrypted according to the authorization authority of the authorized personnel, including: comprehensive identity authentication of the authorized personnel of the bank, including authorization personnel account verification, authorization personnel password verification, and authorization authority verification; if the authorization personnel account verification and the authorization personnel password verification are passed, and the authorization authority of the authorized personnel reaches the corresponding key pool level, then log in to the key pool, obtain the corresponding key, and decrypt the encrypted alarm information; if the authorization personnel account verification and the authorized personnel password verification are passed, and the authorization authority of the authorized personnel does not reach the corresponding key pool level, then logging into the key pool is not allowed.

[0073] In this embodiment, when the authorized personnel log in to the secret key pool, verification is required, that is, the account number, password, and authorization authority of the authorized personnel are verified. When all are verified, the corresponding secret key pool can be entered to obtain the secret key. If the account number and password are verified, but the authorization authority is not enough to enter the corresponding secret key pool, the authorized personnel are prevented from logging in to the secret key pool. As mentioned above, in the banking environment, this operation of logging in to the secret key pool adds an additional security threshold. Even if the staff successfully passes the account number and password verification, if their authorization authority fails to meet the secret key pool access conditions corresponding to the encryption level of the alarm information, the system will automatically reject their access request, effectively preventing personnel with insufficient authority from accessing sensitive information, and further strengthening the defense line of bank information security. In short, this design of the bank system ensures that only personnel with full authorization can legally and safely access and process encrypted alarm information after strict multi-layer verification, maintaining the confidentiality and integrity of bank data.

[0074] In some embodiments of the present application, the encrypted alarm information includes the alarm time, alarm reason, alarm location, urgency level and encryption level.

[0075] In some embodiments of the present application, the method also includes: when there are several encrypted alarm messages to be sent, determining whether the alarm causes in the encrypted alarm messages are consistent; if they are consistent, determining that the encrypted alarm messages with consistent alarm causes are similar alarm messages; determining the alarm time interval of the similar alarm messages, if the alarm time interval is greater than the preset time interval, both encrypted alarm messages are sent; if the alarm time interval is less than or equal to the preset time interval, the encrypted alarm message with a later alarm time is not sent.

[0076] In this embodiment, repeated alarm suppression is provided. When two identical alarm messages need to be sent, the time interval between the two alarm messages is determined. If the time interval is too short, that is, the time interval is less than the preset time interval, the second alarm message is not sent to avoid frequent repeated alarms. As described above, in the embodiment of the bank application scenario, the system is configured with a repeated alarm control mechanism to optimize the efficiency of alarm management and reduce unnecessary interference. The specific operation is as follows: When the system detects that two alarm signals with the same content are ready to be sent, the system will automatically analyze the time difference between the two alarm records. If the time interval between the two alarm messages does not reach the set minimum interval threshold, that is, the actual time interval is shorter than the threshold pre-defined by the bank, the system will actively suppress the sending of the second identical alarm, thereby effectively preventing excessive repetition and frequent interruptions of alarm notifications, ensuring that the alarm system in the bank's operating environment can respond to real risks in a timely manner, while maintaining the efficiency and accuracy of notifications, optimizing resource utilization and improving user experience.

[0077] In some embodiments of the present application, after generating the alarm information according to the abnormal situation, it also includes: storing the alarm information in a storage unit of the management terminal to prevent data damage and loss.

[0078] In this embodiment, the alarm information is stored before being sent, wherein the storage structure uses redundant backup and error checking code (such as CRC or Checksum) to realize the backup of the alarm information to prevent data damage or accidental loss. As described above, in the embodiment of this bank application, in order to enhance the reliable preservation and disaster recovery capabilities of information, the alarm information will adopt a high-level storage strategy before transmission. In specific implementation, the storage architecture of the alarm information is constructed by combining the redundant backup mechanism of the financial industry standard with powerful error detection technology, such as cyclic redundancy check (CRC) or more extensive checksum (Checksum). This design not only ensures multiple backups of the alarm data to prevent data loss caused by single point failures, but also timely discovers and corrects potential data corruption problems through the integrated error checking function, thereby further consolidating the integrity and availability of the alarm information under the strict security and compliance requirements of the bank, and providing solid data support for the bank's emergency response and risk management.

[0079] Finally, it should be noted that the above embodiments are only used to illustrate the technical solution of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that they can still modify or replace the technical solution of the present invention with equivalents, and these modifications or equivalent replacements cannot cause the modified technical solution to deviate from the spirit and scope of the technical solution of the present invention.

[0080] The system provided in the above embodiment is only illustrated by the division of the above functional modules. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the modules or steps in the embodiments of the present invention can be decomposed or combined. For example, the modules in the above embodiment can be combined into one module, or further divided into multiple sub-modules to complete all or part of the functions described above. The names of the modules and steps involved in the embodiments of the present invention are only for distinguishing the modules or steps, and are not regarded as improper limitations of the present invention.

[0081] Those skilled in the art should be able to appreciate that the modules and method steps of each example described in conjunction with the embodiments disclosed herein can be implemented with electronic hardware, computer software or a combination of the two, and the programs corresponding to the software modules and method steps can be placed in random access memory (RAM), internal memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disks, removable disks, CD-ROMs, or any other form of storage medium known in the technical field. In order to clearly illustrate the interchangeability of electronic hardware and software, the composition and steps of each example have been generally described in the above description according to the function. Whether these functions are performed in electronic hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of the present invention.

Claims

1. A data security assurance method based on an intelligent alarm information management terminal, characterized in that: The method comprises: Obtaining a work log of the management terminal, analyzing the work log, and determining whether there is an abnormality; If there is an abnormal situation, an alarm message is generated according to the abnormal situation, and the alarm message is graded according to the abnormal situation to determine the emergency level of the alarm message; Encrypting the alarm information according to the urgency level of the alarm information, and sending the encrypted alarm information to an authorized person at the management terminal; Automatically trigger corresponding response measures of the management terminal according to the urgency of the alarm information; Decrypt the encrypted alarm information according to the authorization authority of the authorized personnel, read the alarm information, and modify or retain the response measures according to the alarm information to achieve data security protection; Analyze the work log to determine whether there are any abnormal conditions, including: Obtain the historical normal work log of the management terminal and the work requirements of the day; Matching the work content of the work log with the work content of the historical normal work log one by one; Extracting work contents in the work log that are inconsistent with the historical normal work log to generate a first work log set; Generate a set of predicted work content based on the work requirements of the day; Matching the work content of the first work log set with the work content of the predicted work content set one by one; Extracting work contents in the first work log set that do not match the predicted work content set to generate an abnormal log set; The work log includes working hours, work procedures and operation contents; Encrypting the alarm information according to the urgency level of the alarm information includes: determining the encryption level of the alarm information according to the urgency level of the alarm information, and encrypting the alarm information according to the encryption level.

2. The data security guarantee method based on the intelligent alarm information management terminal according to claim 1 is characterized in that: The emergency level of the alarm information is graded according to the abnormal situation to determine the emergency level of the alarm information, including: A keyword library is preset, and the keyword library includes keywords for managing terminal work, and the keywords have corresponding weights; Extracting keywords of the work content in the abnormal log set according to the keyword library; Determine the word frequency and inverse document frequency of the keyword, and obtain the TF-IDF value of each keyword according to the word frequency and inverse document frequency; Determine the abnormal value of the abnormal log set according to the TF-IDF value of the keyword and the weight corresponding to the keyword; The alarm information is graded for urgency according to the abnormal value of the abnormal log set to determine the urgency level of the alarm information.

3. The data security guarantee method based on the intelligent alarm information management terminal according to claim 2 is characterized in that: The emergency level of the alarm information is graded according to the abnormal value to determine the emergency level of the alarm information, including: Presetting a first preset abnormal value, a second preset abnormal value, and a third preset abnormal value, wherein the first preset abnormal value, the second preset abnormal value, and the third preset abnormal value increase in sequence; When the abnormal value of the abnormal log set is less than the first preset abnormal value, setting the emergency level of the alarm information to the first emergency level L1; When the abnormal value of the abnormal log set is greater than or equal to the first preset abnormal value, and the abnormal value of the abnormal log set is less than the second preset abnormal value, setting the emergency level of the alarm information to the second emergency level L2; When the abnormal value of the abnormal log set is greater than or equal to the second preset abnormal value, and the abnormal value of the abnormal log set is less than the third preset abnormal value, setting the emergency level of the alarm information to the third emergency level L3; When the abnormal value of the abnormal log set is greater than or equal to the third preset abnormal value, the urgency level of the alarm information is set to a fourth urgency level L4, wherein L1<L2<L3<L4.

4. The data security guarantee method based on the intelligent alarm information management terminal according to claim 3 is characterized in that: Encrypting the alarm information according to the urgency level of the alarm information includes: Determining an encryption level of the alarm information according to the urgency level of the alarm information, and encrypting the alarm information according to the encryption level; in, When the urgency level of the alarm information is the first urgency level L1, the encryption level of the alarm information is determined to be the first encryption level; When the urgency level of the alarm information is the second urgency level L2, determining the encryption level of the alarm information to be the second encryption level; When the urgency level of the alarm information is the third urgency level L3, determining the encryption level of the alarm information to be the third encryption level; When the urgency level of the alarm information is the fourth urgency level L4, the encryption level of the alarm information is determined to be the fourth encryption level.

5. The data security guarantee method based on the intelligent alarm information management terminal according to claim 4 is characterized in that: When the alarm information is encrypted according to the urgency level of the alarm information, a key for decrypting the encrypted alarm information is also generated, and the key is sent to a key pool; The key pool is provided with different key pool levels; The corresponding secret key is sent to the corresponding secret key pool according to the encryption level.

6. The data security guarantee method based on the intelligent alarm information management terminal according to claim 5 is characterized in that: Decrypt the encrypted alarm information according to the authorization authority of the authorized personnel, including: Authentication of the authorized personnel, including verification of the authorized personnel's account, password, and authorization authority; If the authorized personnel account verification and the authorized personnel password verification are passed, and the authorized personnel's authorization authority reaches the corresponding key pool level, then log in to the key pool, obtain the corresponding key, and decrypt the encrypted alarm information; If the authorized personnel account verification and the authorized personnel password verification are passed, and the authorized personnel's authorization authority does not reach the corresponding key pool level, they are not allowed to log in to the key pool.

7. The data security guarantee method based on the intelligent alarm information management terminal according to claim 6 is characterized in that: The encrypted alarm information includes alarm time, alarm reason, alarm location, urgency level and encryption level.

8. The data security guarantee method based on the intelligent alarm information management terminal according to claim 7 is characterized in that: The method further comprises: When there are two encrypted alarm messages to be sent, determine whether the alarm causes in the encrypted alarm messages are consistent; If they are consistent, the encrypted alarm information with the same alarm reason is determined to be similar alarm information; Determine the alarm time interval of similar alarm information. If the alarm time interval is greater than the preset time interval, both encrypted alarm information are sent; if the alarm time interval is less than or equal to the preset time interval, the encrypted alarm information with the later alarm time is not sent.

9. The data security guarantee method based on the intelligent alarm information management terminal according to claim 1 is characterized in that: After generating the alarm information according to the abnormal situation, it also includes: The alarm information is stored in a storage unit of the management terminal to prevent data from being damaged or lost.

Images