Document security management methods, systems, electronic devices, media, and program products

Abstract

This application discloses a file security management method, system, electronic device, medium, and program product, relating to the field of network security. It discloses a financial middleware server control method, including: acquiring network traffic data and user behavior data sent by a website server; inputting the network traffic data and user behavior data into a pre-trained artificial intelligence (AI) security model to obtain anomaly detection parameters and risk scores; determining a dynamic key generation factor based on the anomaly detection parameters and risk scores; generating a working key based on the dynamic key generation factor and a preset master key; and sending the working key to the website server, wherein the website server uses the working key as the latest working key to encrypt the target file corresponding to the file request, obtaining an encrypted file, and sending the encrypted file to the user terminal. This application improves file security during file transmission.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a file security management method, system, electronic device, and computer storage medium. Background Technology

[0002] Currently, to ensure file transfer security, the main methods involve obfuscating and compressing files (such as JavaScript files) to prevent the source code from being easily read and understood. This is often done using publicly available JavaScript obfuscation and compression tools, such as UglifyJS (a JavaScript code compression tool) and Terser (a JavaScript code compressor). However, these tools have certain drawbacks. For example, the key generated by the JavaScript obfuscation and compression tool remains unchanged for a long time, making it a static key. If this static key is compromised during an attack, the JavaScript file can be leaked, thus reducing the security of file transfer. Summary of the Invention

[0003] The main objective of this invention is to provide a front-end application access method, system, electronic device, and computer storage medium, aiming to solve the technical problem of how to improve file security during file transfer.

[0004] To achieve the above objectives, this application provides a file security management method applied to a key management system, comprising:

[0005] Obtain network traffic data and user behavior data sent by the website server;

[0006] The network traffic data and user behavior data are input into a pre-trained AI security model to obtain anomaly detection parameters and risk scores.

[0007] The dynamic key generation factor is determined based on the anomaly detection parameters and risk score.

[0008] A working key is generated based on the dynamic key generation factor and the preset master key;

[0009] The working key is sent to the website server, which uses the working key as the latest working key to encrypt the target file corresponding to the file request, obtains an encrypted file, and sends the encrypted file to the user terminal.

[0010] In one embodiment, the step of determining the dynamic key generation factor based on the anomaly detection parameters and risk score includes:

[0011] The anomaly detection parameters, the risk score, the preset environmental parameters, and random noise are subjected to nonlinear combination processing to generate a dynamic key generation factor.

[0012] In one embodiment, prior to the step of determining the dynamic key generation factor based on the anomaly detection parameters and risk score, the method includes:

[0013] The network traffic data and the user behavior data are checked to see if they meet preset update conditions, wherein the preset update conditions include at least one of the network traffic data and the user behavior data, which matches preset abnormal traffic data;

[0014] If the preset update conditions are met, then the step of determining the dynamic key generation factor based on the anomaly detection parameters and risk score is executed;

[0015] If the preset update conditions are not met, continue with the steps of obtaining network traffic data and user behavior data sent by the website server.

[0016] In one embodiment, the method further includes:

[0017] Determine the training data, wherein the training data includes training samples and sample labels, the training samples include historical network traffic data and historical user behavior data, and the sample labels include historical anomaly detection parameters and historical risk scores;

[0018] The training samples are input into a preset AI security model for model training, and the prediction results are output. The loss function value is determined based on the sample labels, the prediction results, and the loss function corresponding to the AI ​​security model.

[0019] The AI ​​security model is updated with model parameters based on the loss function value until the trained AI security model meets the preset training termination condition, thus obtaining a pre-trained AI security model. The model parameter update includes the update of the fine-tuning layer parameters in the AI ​​security model.

[0020] Furthermore, to achieve the above objectives, this application also provides a file security management method applied to a website server, the method comprising:

[0021] Real-time monitoring of network traffic and user behavior data;

[0022] The network traffic data and user behavior data are sent to the key management system, which processes the network traffic data and user behavior data according to the AI ​​security model to obtain anomaly detection parameters and risk scores, and generates a working key based on the dynamic key generation factor determined by the anomaly detection parameters and risk scores and the preset master key, and sends the working key to the website server.

[0023] Obtain the working key sent by the key management system, and use the working key as the latest working key to encrypt the target file corresponding to the file request to obtain the encrypted file. The user sends the file request to the website server.

[0024] The encrypted file is sent to the user terminal, whereby the user terminal decrypts the encrypted file.

[0025] In one embodiment, after the step of sending the network traffic data and user behavior data to the key management system, the method includes:

[0026] If no working key is received from the key management system within a preset time period, then all stored historical working keys are retrieved.

[0027] The storage time corresponding to each historical working key is determined, and the historical working key corresponding to the storage time closest to the current time is determined as the latest working key. The file corresponding to the file request is encrypted according to the latest working key, and the encrypted file is sent to the user terminal.

[0028] Furthermore, to achieve the above objectives, embodiments of this application provide a file security management system, which includes a key management system and a website server.

[0029] The website server is used to monitor network traffic data and user behavior data in real time, and send the network traffic data and user behavior data to the key management system.

[0030] The key management system is used to acquire network traffic data and user behavior data sent by the website server; input the network traffic data and user behavior data into a pre-trained AI security model to obtain anomaly detection parameters and risk scores; determine a dynamic key generation factor based on the anomaly detection parameters and risk scores; generate a working key based on the dynamic key generation factor and a preset master key; and send the working key to the website server.

[0031] The website server is used to obtain the working key sent by the key management system, use the working key as the latest working key to encrypt the target file corresponding to the file request, and obtain an encrypted file; the encrypted file is sent to the user terminal, wherein the user terminal that sent the file request decrypts the encrypted file.

[0032] In addition, to achieve the above objectives, this application also provides an electronic device, which includes: a memory, a processor, and a file security management program stored on the memory and executable on the processor. When the file security management program is executed by the processor, it implements the steps of the file security management method described above.

[0033] In addition, to achieve the above objectives, this application also provides a medium, which is a computer-readable storage medium, on which a file security management program is stored, and when the file security management program is executed by a processor, it implements the steps of the file security management method described above.

[0034] In addition, to achieve the above objectives, this application also provides a program product, which includes a computer program product, wherein the computer program product includes a file security management program, and the file security management program, when executed by a processor, implements the steps of the file security management method described above.

[0035] This application embodiment, after obtaining network traffic data and user behavior data sent by the website server through the key management system, inputs the network traffic data and user behavior data into the AI ​​security model to obtain anomaly detection parameters and risk scores. This enables intelligent monitoring of network traffic data and user behavior data through the AI ​​security model in the key management system, accurately assessing potential risks. Furthermore, a dynamic key generation factor is determined based on the anomaly detection parameters and risk scores. A working key is generated based on the dynamic key generation factor and the master key, and then sent to the website server. This allows for real-time updating and generation of new working keys based on network traffic data and user behavior data. This avoids the phenomenon of existing technologies using static keys, which lose their protective capability once cracked, ensuring that the key is a dynamic working key. The website server uses the working key as the latest working key to encrypt the target file corresponding to the file request and sends the encrypted file to the user end. Therefore, it achieves the use of a dynamic working key to encrypt the target file, ensuring file security and improving file security during file transmission. Attached Figure Description

[0036] Figure 1 This is a flowchart illustrating the first embodiment of the security management method for documents in this application.

[0037] Figure 2This is a flowchart illustrating the second embodiment of the document security management method of this application.

[0038] Figure 3 This is a schematic diagram illustrating the training and application process of the AI ​​security model in the security management method of this application.

[0039] Figure 4 This is a flowchart illustrating the fourth embodiment of the document security management method in this application.

[0040] Figure 5 The system workflow diagram of the security management method in this application document;

[0041] Figure 6 This is a schematic diagram of the equipment structure of the hardware operating environment involved in the security management method of this application.

[0042] The objectives, features, and advantages of this invention will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0043] It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

[0044] Since current key management is performed statically, which poses certain security risks, this embodiment employs a dynamic key generation and update mechanism based on an AI security model (such as an AI security vertical large model based on the Llama2 large model (a large language model)). This mechanism can dynamically generate and update keys in real time based on network and user behavior. Network and user behavior can be determined based on network traffic data and user behavior data.

[0045] Optionally, this embodiment can perform intelligent anomaly detection based on an AI security model, which can intelligently detect abnormal network and user behaviors and accurately assess potential risks. Furthermore, compared to using static keys, which lose their protective capability once compromised, this embodiment enhances security through dynamic key management. Based on the dynamic key generation and update mechanism of the AI ​​security model, keys are dynamically updated according to detected threats, improving the security and adaptability of the key management system. Moreover, the dynamic key generation and update mechanism requires generating key generation factors based on the AI ​​security model. These key generation factors integrate multiple complex factors such as risk assessment, anomaly patterns, environmental context, model parameters, and random noise, generated through learnable nonlinear combinations. They possess sufficient complexity and dynamism, making them difficult for attackers to predict and replicate.

[0046] This embodiment enables intelligent security access detection based on an AI security model. By deploying a finely tuned Llama2 large-scale AI security vertical model, it monitors network traffic and user behavior data in real time. Machine learning algorithms identify abnormal behavior and potential attacks, achieving intelligent risk assessment. Furthermore, it implements a dynamic key generation and management mechanism. Based on real-time anomaly detection, the AI ​​security model outputs a key generation factor. This factor is combined with other parameters to generate a new key, i.e., the working key. This key is stored in an encrypted database and distributed to necessary system components. The front-end JS file encryption uses the new key to dynamically update the key. This embodiment ensures the confidentiality and integrity of the front-end JS file, preventing theft, tampering, and reverse engineering, thereby protecting the security of Web (World Wide Web) applications. Simultaneously, the dynamic key management mechanism can respond promptly to security threats, improving the system's flexibility and adaptability.

[0047] Reference Figure 1 This application provides a file security management method applied to a key management system. In the first embodiment of the file security management method, the file security management method includes steps S10-S50.

[0048] Step S10: Obtain network traffic data and user behavior data sent by the website server;

[0049] Optionally, network traffic data and user behavior data can be network traffic data and user behavior data monitored in real time by the website server and sent to the key management system. This data may include IP address (Internet Protocol Address), port number, packet size, request headers, request parameters, event type, event frequency, user ID (IDentity), and device fingerprint, etc. Optionally, network traffic data can include IP address, port number, packet size, etc. User behavior data can include user ID and device fingerprint, etc.

[0050] Optionally, the key management system and the web server can be integrated into the same terminal or deployed separately in different terminals; there is no restriction on this.

[0051] Step S20: Input network traffic data and user behavior data into the pre-trained AI security model to obtain anomaly detection parameters and risk scores;

[0052] Optionally, the anomaly detection parameters may include at least one of anomaly detection probability and anomaly pattern. The anomaly detection probability can correspond to a label result of 0 or 1; 0 indicates no anomaly, and 1 indicates an anomaly. When an anomaly is determined, the anomaly pattern can be determined based on network traffic data and user behavior data. Risk scoring can be performed by assessing the current security risk level based on the anomaly pattern when an anomaly is determined, and generating a corresponding risk score. Alternatively, risk scoring can be performed based on anomaly behavior characteristics to generate a risk score.

[0053] Optionally, a pre-trained AI security model can be deployed in the key management system. This AI security model can be an AI security vertical model based on Llama2, which uses LoRA (Low-Rank Adaptation of Large Language Models) technology to fine-tune Llama2 and is specifically designed to detect abnormal access behavior and assess security risks.

[0054] Optionally, after acquiring network traffic data and user behavior data, data preprocessing can be performed on the network traffic data and user behavior data, including data cleaning, normalization, and feature extraction, to obtain an input feature vector. The input feature vector is then input into a pre-trained AI security model for model training.

[0055] Optionally, the AI ​​security model has two sub-tasks: anomaly detection and risk assessment. For the anomaly detection task, the model output is the anomaly detection probability, and the corresponding loss function is the cross-entropy function. For the risk assessment task, the model output is a risk score, and the corresponding loss function is the mean squared error function.

[0056] Optionally, a risk assessment task can be performed using an AI security model to generate a corresponding risk score. Optionally, the risk score can be used to quantify the security risk level of the current environment. LightGBM (Light Gradient Boosting Machine) can be used as the machine learning model in the AI ​​security model to train a risk assessor. LightGBM is a gradient boosting framework based on decision trees, which has advantages such as fast training speed, low memory consumption, and high accuracy, making it very suitable for handling high-dimensional heterogeneous features.

[0057] Optionally, the characteristics of abnormal behavior can be identified first, such as by extracting abnormal behavior characteristics from historical security event logs, and then a corresponding risk score can be assigned based on the severity of the event.

[0058] Optionally, abnormal behavioral characteristics may include, but are not limited to:

[0059] Number of failed login attempts: The number of times you failed to log in within different time windows such as the past hour, day, and week.

[0060] Abnormal login time: The number of times the login time falls outside the regular working hours (such as 3 a.m.).

[0061] Abnormal login location: The degree of deviation between the login location and the usual location can be measured by geographical distance or IP address location.

[0062] Abnormal traffic: The degree of abnormality in access traffic within different time windows such as the past hour, day, and week.

[0063] Number of sensitive operations: The number of times critical resources (such as management backend, database, etc.) are added, deleted, or modified.

[0064] Abnormal access path: The number of times an unconventional functional module or page is accessed, such as accessing the debug page of the management backend.

[0065] Known attack signatures: The number of times the access request contains known attack signatures (such as SQL (Structured Query Language) injection).

[0066] Optionally, the risk score can be a real number between 0 and 1, representing the current level of safety risk in the environment. Different risk scores corresponding to different risk levels are shown in Table 1 below.

[0067] Risk Score Risk level describe [0.0，0.2) Low Acceptable risk, no action required. [0.2，0.4) middle Medium risk, requiring measures to be taken at the appropriate time. [0.4，0.7) high High risk, measures need to be taken as soon as possible. [0.7，1.0] key Key risks require immediate action.

[0068] Table 1

[0069] Optionally, during the model training phase, the LightGBM model in the AI ​​security model can be trained according to Table 1 above. Abnormal behavior features are input, and a risk score is output. Regression loss functions such as mean squared error and cross-entropy, along with sample weights, are used to train the model, thereby improving its sensitivity to high-risk events. During the model application phase, the feature vectors corresponding to network traffic data and user behavior data can be directly input into the LightGBM model in the AI ​​security model to obtain the corresponding risk score.

[0070] Optionally, when the AI ​​security model receives the feature vectors corresponding to network traffic data and user behavior data and performs anomaly detection tasks, it can analyze the feature vectors from three feature attributes: statistical features, frequency features, and time series features, in order to determine the network traffic features and user behavior features.

[0071] Optionally, network traffic characteristics may include the frequency, entropy value, and TF-IDF (Term Frequency Inverse Document Frequency, statistical method) of source / destination IP addresses; the frequency, entropy value, and TF-IDF of source / destination port numbers; the mean, variance, and quantiles of traffic size; and the mean, variance, and quantiles of traffic duration. User behavior characteristics may include the frequency, entropy value, and TF-IDF of operation types (login / logout / query / modify); the trend, periodicity, and autocorrelation of operation timestamps; the frequency, entropy value, and TF-IDF of operation objects (files / databases / systems); the frequency and sequence pattern of user IDs; and the frequency and sequence pattern of device fingerprints (browser / operating system / version).

[0072] Alternatively, different anomaly patterns can be compactly encoded by extracting the center point of each anomaly cluster (i.e. the sample that best represents the characteristics of the cluster) and mapping it to a fixed-length binary string using a hash function, which is anomaly pattern encoding.

[0073] Optionally, the mean of the sample feature vectors of each anomalous cluster can be calculated and used as the centroid vector of that cluster. The centroid vector is then normalized, scaling each element to the interval [0, 1]. A secure hash function is used to map the normalized centroid vector to a fixed-length binary string. Optionally, if there are multiple anomalous clusters, the binary strings of each cluster are concatenated to form the final anomalous pattern portion.

[0074] For example, if there are three anomalous clusters with centroid vectors of cluster 1: [0.2, 0.5, 0.1, 0.8]; cluster 2: [0.9, 0.3, 0.6, 0.4]; and cluster 3: [0.1, 0.7, 0.2, 0.3], then each centroid vector can be normalized, and a secure hash function can be used to obtain the hash values. That is:

[0075] Cluster 1: Hash([0.2, 0.5, 0.1, 0.8]) = "a4b7c8..."; Cluster 2: Hash([0.9, 0.3, 0.6, 0.4]) = "1d2e3f..."; Cluster 3: Hash([0.1, 0.7, 0.2, 0.3]) = "a1b2c3...".

[0076] Therefore, the final exception pattern part is "a4b7c8...1d2e3f...a1b2c3...". This compresses the exception pattern into a compact binary representation, facilitating subsequent storage, comparison, and analysis.

[0077] Optionally, if the AI ​​security model determines that an abnormal pattern exists, the corresponding anomaly detection probability is set to 1, and the specific abnormal pattern can be referred to the above description. If the AI ​​security model determines that no abnormal pattern exists, the corresponding anomaly probability is set to 0.

[0078] Step S30: Determine the dynamic key generation factor based on the anomaly detection parameters and risk score;

[0079] Optionally, after determining the anomaly detection parameters and risk score through the AI ​​security model, the corresponding dynamic key generation factor can be generated in the AI ​​security model using the LoRA fine-tuning technology of the Llama2 model.

[0080] Optionally, a dynamic key generation factor can be generated using a key generation function based on anomaly detection parameters such as anomaly detection probability, risk score, current timestamp, and environmental parameters. Optionally, the key generation function can employ a secure hash algorithm, such as SHA-256 (Secure Hash Algorithm 256-bit), and introduce a random salt value into the hash algorithm to enhance unpredictability.

[0081] In one feasible embodiment, step S30, the step of determining the dynamic key generation factor based on the anomaly detection parameters and risk score, includes step a10.

[0082] Step a10 involves performing nonlinear combination processing on the anomaly detection parameters, risk score, preset environmental parameters, and random noise to generate a dynamic key generation factor.

[0083] Optionally, the dynamic key generation factor Kf can be composed of a risk score, an anomaly pattern component, environmental context embedding parameters, model parameters, and random noise. Optionally, the risk score component includes a risk score, the anomaly pattern component includes anomaly detection parameters, and the environmental parameters include environmental context embedding parameters.

[0084] Optionally, the environmental context embedding parameters can be obtained by embedding the system's current environmental context information (such as time, geographical location, and network topology) into a continuous vector space. Alternatively, environmental context data, such as timestamps, IP prefixes, and AS numbers (Autonomous System Numbers), can be collected. A Word2Vec model (word vector model) is used to train discrete environmental features (obtained by feature extraction from environmental context data) to obtain their embedding vectors in the continuous vector space, which are then concatenated to obtain the environmental context embedding parameters.

[0085] Optionally, random noise can enhance the unpredictability of the dynamic key generation factor. A random vector can be generated using a preset true random number generator and used as random noise. Alternatively, a random vector can be generated using a preset pseudo-random number generator and used as random noise.

[0086] Optionally, in one scenario embodiment, the dynamic key generation factor Kf can be calculated and determined according to the following formula:

[0087] Kf = σ(W1 * Risk Score + W2 * Anomaly Pattern + W3 * Context Embedding Parameters + W4 * Model Parameters + W5 * Random Noise + b). Here, W1, W2, W3, W4, W5, and b are learnable parameters. The risk score, anomaly pattern, context embedding, model parameters, and random noise are combined in a weighted summation, and the final dynamic key generation factor Kf is output through a nonlinear activation function σ.

[0088] Optionally, during the model training phase, initial values ​​can be set for W1, W2, W3, W4, W5, and b. For example, assuming the dimension of Kf is d, the shape of Wi is (d, di), where di is the dimension of the i-th component. The shape of b is (d). Initial values ​​of Wi are randomly sampled from the uniform distribution U(-sqrt(6 / (d+di)), sqrt(6 / (d+di))), and initial values ​​of b are randomly sampled from the uniform distribution U(-sqrt(6 / d), sqrt(6 / d)). During the forward propagation phase, Kf is calculated based on the current Wi and b. Risk_Score, Anomaly_Pattern, Context_Embedding, Model_Params, and Randomness are multiplied by their respective Wi to obtain five d-dimensional vectors. Then, the values ​​are summed and a bias term b is added to obtain the inactive values ​​of Kf. These inactive values ​​are then activated using a non-linear activation function σ to obtain the final Kf. To measure the difference between the generated Kf and the expected Kf, a loss function is designed. The MSE loss function is adopted. Assuming the expected Kf is Kf_true, the loss function is: loss = (Kf - Kf_true)^2.

[0089] Optionally, based on the value of the loss function, the gradient of the loss function with respect to Wi and b is calculated via backpropagation. That is, the gradient with respect to Wi: Gradient of b: in, and It can be obtained using the chain rule: This represents the derivative of the activation function σ.

[0090] Optionally, parameters are updated based on the gradient until a preset number of iterations is reached or an early stopping condition is met (e.g., the validation set error no longer decreases). In each iteration, a batch of training samples is randomly sampled, the loss function and gradient are calculated, and the parameters are updated. This yields a set of optimized Wi and b, ensuring that the generated Kf best meets the requirements of dynamic key generation. In practical applications, Risk_Score, Anomaly_Pattern, Context_Embedding, and Randomness are input into the trained model to generate the required key generation factor Kf in real time.

[0091] In this embodiment, a dynamic key generation factor is generated by nonlinearly combining anomaly detection parameters, risk scores, environmental parameters, and random noise. This provides a basis for generating dynamic working keys and ensures the effectiveness of the dynamic key generation factor.

[0092] Step S40: Generate a working key based on the dynamic key generation factor and the preset master key;

[0093] Optionally, the master key can be pre-set, and each working key has a corresponding master key.

[0094] Optionally, a key derivation function can be used to generate a working key for encryption, combining the master key (updated periodically) and a dynamic key generation factor. For example, the working key can be used to encrypt a front-end JS file. Optionally, the key derivation function can be HKDF (HMAC-based Extract-and-Expand Key Derivation Function), PBKDF2 (Password-Based Key Derivation Function 2), Scrypt (a cryptographic hash function), etc., and salting can be applied to the key derivation function.

[0095] Step S50: Send the working key to the website server.

[0096] It should be noted that the website server uses the working key as the latest working key to encrypt the target file corresponding to the file request, obtains the encrypted file, and sends the encrypted file to the user's terminal.

[0097] Optionally, the key management system can send the working key to a front-end component, such as a web server, via a secure channel. Alternatively, it can also send the private key corresponding to the working key to the user client and the public key corresponding to the working key to the web server. The web server then uses the public key to encrypt the file.

[0098] Optionally, when encrypting files, the website server can use an asymmetric encryption algorithm to encrypt the target file, resulting in an encrypted file. For example, it can use RSA (Rivest-Shamir-Adleman, RSA encryption algorithm) to encrypt front-end JS (JavaScript) files. Furthermore, during encryption, the public key PubKey can be determined based on the working key, and then the target file can be encrypted using the public key PubKey.

[0099] Alternatively, the encryption process can be: $JSFile_{enc} = RSA_{enc}(PubKey, JSFile)$;

[0100] Optionally, the website server sends the encrypted file to the user's client. If the user's client has a private key PrivKey corresponding to the public key PubKey, the encrypted file can be decrypted and displayed based on the private key PrivKey, thereby preventing the JS file from being stolen and tampered with during network transmission.

[0101] Alternatively, the decryption process can be: $JSFile = RSA_{dec}(PrivKey, JSFile_{enc})$.

[0102] In addition, to help understand the overall process in this embodiment, examples are given below.

[0103] For example, if the website server is a web server, the client can send a JS file request through a browser. The reverse proxy server receives the JS file request and retrieves the encrypted JS file from the web server. The web server obtains the latest working key from the key management system to encrypt the original JS file, obtaining the encrypted JS file, and returns it to the reverse proxy server. Simultaneously, the web server sends network traffic data and user behavior data (such as request logs and user actions) to the data processing module in the key management system. The data processing module performs data preprocessing on the network traffic data and user behavior data, including data cleaning and feature extraction, to obtain feature vectors, which are then input into the AI ​​security model. The AI ​​security model performs anomaly detection and risk assessment on the feature vectors, generating anomaly detection probabilities and risk scores. The key generation module in the key management system, based on the anomaly detection probabilities, risk scores, and other inputs such as environmental parameters, calls the key generation function to generate a dynamic key generation factor. The key management module in the key management system can combine the dynamic key generation factor and the master key through the key derivation function to generate a working key, which is then sent to various front-end components, such as the web server, through a secure channel. The web server re-encrypts the JS file using the updated working key and distributes it to the reverse proxy server and CDN (Content Delivery Network). The user's browser obtains the encrypted JS file from the reverse proxy server or CDN, obtains the corresponding private key through authentication and other mechanisms, decrypts it, and executes it.

[0104] In this embodiment, after obtaining network traffic data and user behavior data sent by the website server through the key management system, the network traffic data and user behavior data are input into the AI ​​security model to obtain anomaly detection parameters and risk scores. This allows the AI ​​security model in the key management system to intelligently monitor network traffic data and user behavior data, accurately assessing potential risks. Furthermore, a dynamic key generation factor is determined based on the anomaly detection parameters and risk scores. A working key is generated based on the dynamic key generation factor and the master key, and then sent to the website server. This enables real-time updating and generation of new working keys based on network traffic data and user behavior data. This avoids the problem of existing technologies using static keys, which lose their protective capability once cracked, ensuring that the key is a dynamic working key. The website server uses the working key as the latest working key to encrypt the target file corresponding to the file request and sends the encrypted file to the user end. Therefore, the use of a dynamic working key to encrypt the target file ensures file security and improves file security during transmission.

[0105] Furthermore, based on the first embodiment of this application described above, a second embodiment of the document security management method of this application is proposed. In this embodiment, reference is made to... Figure 2 The above step S30, which is before the step of determining the dynamic key generation factor based on the anomaly detection parameters and risk score, includes steps b10-b30.

[0106] Step b10: Detect whether network traffic data and user behavior data meet preset update conditions, wherein the preset update conditions include at least one of the network traffic data and the user behavior data, which matches preset abnormal traffic data;

[0107] Step b20: If the preset update conditions are met, then execute the step of determining the dynamic key generation factor based on the anomaly detection parameters and risk score;

[0108] If the preset update conditions are not met in step b30, continue with the steps of obtaining network traffic data and user behavior data sent by the website server.

[0109] Optionally, the key management system can use an AI security model to detect real-time input network traffic data and user behavior data, and can perform abnormal access detection and risk assessment, and can also output dynamic key generation factors.

[0110] Optionally, the AI ​​security model monitors and analyzes network traffic and user behavior data in real time, including IP addresses, port numbers, packet sizes, timestamps, login times, operation frequency, devices used, and detected attack behaviors. Using random forest and ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) model data, the model can identify abnormal network and user behavior patterns, such as multiple failed login attempts, large amounts of abnormal traffic, high-frequency operations, and known attack behaviors, thereby assessing the current level of security risk.

[0111] Optionally, the AI ​​security model, based on the analysis of network and user behavior data and the results of security risk assessment, can output a dynamic key generation factor through LoRA fine-tuning technology. Optionally, the dynamic key generation factor can integrate various information such as abnormal behavior patterns and risk assessments analyzed by the model.

[0112] Optionally, the AI ​​security model can simultaneously detect attack behaviors and generate key generation factors through intelligent analysis of two stages: anomaly detection and risk assessment. This enables the entire system to respond to security threats in real time and dynamically update keys, thereby achieving the goal of continuous reinforcement and protection.

[0113] Optionally, the preset update conditions may include at least one of network traffic data and user behavior data, which matches preset abnormal traffic data. Optionally, the abnormal traffic data may include failed login count thresholds, abnormal traffic, and attack behavior data, etc. For example, the preset update conditions are determined to be met when at least one of the following is determined: the number of failed logins exceeds a threshold, abnormal traffic is detected, or attack behavior is discovered.

[0114] Optionally, after the AI ​​security model receives network traffic data and user behavior data, it can check whether the network traffic data and user behavior data meet preset update conditions. If the update conditions are met, a new working key is generated and sent to each server, such as the website server and the user client. When the website server receives a file request instruction from the user client, it encrypts the target file corresponding to the file request instruction according to the new working key and sends it to the user client, who then decrypts it.

[0115] Optionally, if the update conditions are not met, a new working key will not be generated. In this case, the website server will use the previously generated latest working key for file encryption. The key management system will then continue to execute the steps of obtaining network traffic data and user behavior data sent by the website server. Optionally, if both network traffic data and user behavior data meet the preset update conditions within a certain period of time, then after that period has elapsed, the step of determining the dynamic key generation factor based on anomaly detection parameters and risk scores will be executed to update the working key.

[0116] In this embodiment, a new working key is generated when network traffic data and user behavior data meet the preset update conditions, and the original working key is retained when network traffic data and user behavior data do not meet the preset update conditions. This enables dynamic updating of the working key and ensures file security.

[0117] Furthermore, based on the first or second embodiment of this application described above, a third embodiment of the document security management method of this application is proposed. In this embodiment, the document security management method includes steps c10-c30.

[0118] Step c10: Determine the training data, which includes training samples and sample labels. The training samples include historical network traffic data and historical user behavior data, and the sample labels include historical anomaly detection parameters and historical risk scores.

[0119] Step c20: Input the training samples into the preset AI security model for model training, output the prediction results, and determine the loss function value based on the sample labels, the prediction results and the loss function corresponding to the AI ​​security model.

[0120] Step c30: Update the model parameters of the AI ​​security model based on the loss function value until the trained AI security model meets the preset training termination condition, and obtain the pre-trained AI security model. The model parameter update includes the update of the fine-tuning layer parameters in the AI ​​security model.

[0121] Optionally, all models included in the AI ​​security model need to be trained to obtain a pre-trained AI security model, such as training the Llama2 model.

[0122] Optionally, training data can be determined based on historical data, such as network traffic data obtained from historical network traffic logs or historical user behavior data obtained from historical user behavior logs. Furthermore, the training samples in the training data can be labeled with sample tags based on known attack samples.

[0123] Training samples, namely historical user behavior data and historical network traffic data, are input into a pre-defined AI security model for training. The model outputs predicted historical anomaly detection parameters and historical risk scores. These parameters and scores are then input into a loss function corresponding to the AI ​​security model, along with the sample labels from the training data. The loss function value is calculated, and backpropagation is performed based on this value to calculate the gradient. The model parameters, such as those in fine-tuning layers, are updated based on these gradients. Iterative training continues until the trained AI security model meets pre-defined training termination conditions, resulting in a pre-trained AI security model. These conditions include reaching a predetermined number of iterations or meeting an early stopping condition (e.g., the validation set error no longer decreases).

[0124] Optionally, if the AI ​​security model is a vertical AI security model based on Llama2, the Llama2 model can be fine-tuned. Optionally, training data can be determined, which may include logs and events from various cybersecurity scenarios, as well as corresponding risk assessment labels.

[0125] In the Llama2 model, fine-tuning layers, such as LoRA fine-tuning layers, can be set. Within each Transformer block of the Llama2 model, a LoRA fine-tuning layer is added to the weight matrices of the Query matrix, Key matrix, Value matrix, and FeedForward layer. The LoRA fine-tuning layer takes the following form:

[0126] W' = W + AB;

[0127] Here, W is the original weight matrix in the Llama2 model, and A and B are two low-rank matrices, with rank r much smaller than the rank of W. A and B are the parameters actually learned during the LoRA fine-tuning process. This parameterization can significantly reduce the number of trainable parameters during fine-tuning, thereby improving training efficiency.

[0128] Optionally, during the training of the AI ​​security model, it is necessary to update the parameters of the fine-tuning layer. The fine-tuning layer parameters may include:

[0129] The rank r controls the parameter size of the fine-tuning layer, and can be 8, 16, 32, etc. The larger the rank r, the more parameters are fine-tuned, and the stronger the expressive power.

[0130] Learning rate: A smaller learning rate can be used, such as le-4 to le-3.

[0131] Batch: Select an appropriate batch size based on memory limitations and model convergence speed, such as 16, 32, etc.

[0132] Training epochs: The fine-tuning process usually requires several epochs to converge, depending on the amount of data and the model size.

[0133] Weight decay can be achieved by adding a penalty term to the loss function. Appropriate weight decay can prevent overfitting.

[0134] Optionally, the parameters of the LoRA fine-tuning layer can be trained using gradient descent or similar methods based on the training data. This can be achieved by sampling a batch from the training data and inputting it into the Llama2 model. Forward propagation is performed to calculate the Llama2 model's output and loss function. The loss function can take the form of mean squared error, cross-entropy, etc., measuring the difference between the output key generation factor and the expected value. Then, backpropagation is performed to calculate the gradient of the loss function with respect to the fine-tuning layer parameters. The fine-tuning layer parameters are updated based on the gradient, and the model training is repeated until all training data has been traversed, completing one epoch. The performance on the validation set is then used to determine whether to continue training until a preset number of epochs or performance metrics are reached.

[0135] After fine-tuning, the trained fine-tuning layer is used to infer real-time cybersecurity event data, generating corresponding anomaly detection parameters and risk scores. These parameters and scores are then used to generate a dynamic key generation factor. Specifically, event data is input into the Llama2 model, propagated forward to the fine-tuning layer, and its output is extracted. The dynamic key generation factor is then determined based on this output. The dynamic key generation factor is typically a high-dimensional vector, which can be further transformed into the required format using methods such as hashing and discretization. For example, the key generation module can call a key generation function to process the anomaly detection parameters and risk scores to generate the dynamic key generation factor.

[0136] Dynamic key generation factors need to be continuously updated as new security event data is generated. This requires constantly using a fine-tuned model to generate dynamic key generation factors. A sliding window can be set to periodically input the latest event data into the model and update the dynamic key generation factors. Alternatively, a longer time interval can be set to incrementally train the fine-tuning layers using accumulated new data to adapt to changes in the environment.

[0137] Furthermore, in one scenario embodiment, the training and practical application process of the AI ​​security model can be as follows: Figure 3 As shown, it includes:

[0138] Step S01: Determine the training data, which can be obtained from historical data. Historical data can be obtained from network traffic logs, user behavior logs, and known attack samples. Perform data preprocessing on the training data, including data cleaning and feature extraction. Step S02: Input the preprocessed training data into the AI ​​model (i.e., the AI ​​security model) for model training, including anomaly detection: learning to identify abnormal network / user behavior patterns; risk assessment: assessing the potential security risk level based on abnormal behavior patterns; and key factor generation: learning to generate a dynamic key generation factor Kf suitable for different risk scenarios. Step S03: Train the model according to the model parameters / weights. Upon completion of training, the model outputs the following results: anomaly pattern representation, risk score, and key generation factor. The key generation factor is determined based on the anomaly pattern representation and risk score. Step S04: Apply the trained AI model to the actual production environment. Step S05: User access input data into the AI ​​model. Input data includes network traffic data and user behavior data from the actual operating environment, including IP address, port number, packet size, login time, operation frequency, and device fingerprint. Step S06 involves detecting the input data, specifically the AI ​​security model performing anomaly detection and risk assessment. Step S07 involves the model outputting results, including anomaly pattern detection generation, risk score generation, and key factor generation (Kf). During anomaly detection and risk assessment, the trained model extracts anomaly patterns from the input data, assesses the current security risk level based on these patterns, and generates a risk score. Key factor generation uses the anomaly patterns and risk score results to generate a dynamic key generation factor Kf through a trained mechanism. Step S08 involves sending the results to the key management module. The key management module generates a new key associated with the dynamic key generation factor Kf, i.e., the working key. The working key is then stored and deployed, and distributed to necessary system components, such as the reverse proxy server.

[0139] Optionally, the specific processes of key management, key distribution, and key usage can involve the AI ​​security model's key factor generation module outputting a dynamic key generation factor Kf based on real-time analysis of network traffic and user behavior data. The key management module receives the dynamic key generation factor Kf and, within its internal key generation algorithm module, substitutes Kf with predefined parameters such as seed Tp (time period), current system time Tc, and environment variable Ev into a specific key generation algorithm to calculate and generate a new key NewKey, i.e., the working key.

[0140] Optionally, the key generation algorithm can be NewKey = H(Kf||Tp||Tc||H(Ev));

[0141] Where H is the cryptographic hash function, and || is the concatenation operation.

[0142] The newly generated working key is stored in an encrypted key database. The key distribution module retrieves the latest working key from the key database and distributes it to various system components, such as the web server and reverse proxy server. When the web server receives a user's JS file request, it encrypts it using the working key and sends it to the reverse proxy server. When the reverse proxy server receives the user's JS file request, it decrypts it using the working key and responds to the user's browser. The user's browser receives the decrypted JS file and executes the corresponding function.

[0143] In this embodiment, training data is determined, and training samples from the training data are input into the AI ​​security model to obtain prediction results. Based on the sample labels, prediction results, and loss function, the loss function value is determined. Then, the model parameters of the AI ​​security model are updated according to the loss function value to obtain a pre-trained AI security model. This ensures the effectiveness of the pre-trained AI security model and facilitates the generation of dynamic working keys based on the AI ​​security model, thus protecting the security of the file.

[0144] Furthermore, based on the first, second, or third embodiment of this application described above, a fourth embodiment of the document security management method of this application is proposed. In this embodiment, reference is made to... Figure 4 A file security management method, applied to a website server, including steps S100-S400.

[0145] Step S100: Monitor network traffic data and user behavior data in real time;

[0146] Optionally, when the website server receives a file request from the user, it encrypts the target file corresponding to the file request using the latest working key and sends it back to the user. Furthermore, it can monitor network traffic and user behavior data between the website server and the user in real time while a connection is established.

[0147] Step S200: Send network traffic data and user behavior data to the key management system;

[0148] It should be noted that the key management system processes network traffic data and user behavior data based on the AI ​​security model to obtain anomaly detection parameters and risk scores. Based on the dynamic key generation factor determined by the anomaly detection parameters and risk scores and the preset master key, it generates a working key and sends the working key to the website server.

[0149] Optionally, the website server can send the real-time monitored network traffic data and user behavior data to the key management system. After receiving the network traffic data and user behavior data sent by the website server, the system can perform the steps as described in the first or second embodiment above, which will not be elaborated here.

[0150] Step S300: Obtain the working key sent by the key management system, and use the working key as the latest working key to encrypt the target file corresponding to the file request to obtain the encrypted file;

[0151] It should be noted that the user sends a file request to the website server.

[0152] Optionally, the user terminal can be a device held by the user, such as a mobile phone or tablet computer.

[0153] Optionally, the website server stores the working key after receiving it from the key management system.

[0154] Optionally, the target file corresponding to the file request can be determined. For example, when the file request is a JS file request, the target file is a JS file. Optionally, the latest working key among the stored working keys can be obtained, and the target file can be encrypted based on the latest working key to obtain an encrypted file.

[0155] Optionally, the website server will encrypt the target file using the latest working key, such as encrypting a JS file to obtain the corresponding ciphertext, and use this ciphertext as the encrypted file. The encrypted file is then sent to the CDN or directly to the user's client, where it is decrypted in the browser. Furthermore, when the AI ​​security model detects abnormal access or high risk, it will trigger the generation of a new working key. The next time the user accesses the JS file, the new working key will be used to re-encrypt the JS file, while the old key and ciphertext will gradually become invalid.

[0156] Step S400: Send the encrypted file to the user terminal.

[0157] It should be noted that the user terminal decrypts the encrypted file.

[0158] Alternatively, the website server can directly send the encrypted file to the user's client, such as a browser, where the user can decrypt the file using the latest working key obtained beforehand. Alternatively, the encrypted file can be sent to a reverse proxy server, and then forwarded to the user's client for decryption.

[0159] In this embodiment, after obtaining network traffic data and user behavior data sent by the website server through the key management system, the network traffic data and user behavior data are input into the AI ​​security model to obtain anomaly detection parameters and risk scores. This allows the AI ​​security model in the key management system to intelligently monitor network traffic data and user behavior data, accurately assessing potential risks. Furthermore, a dynamic key generation factor is determined based on the anomaly detection parameters and risk scores. A working key is generated based on the dynamic key generation factor and the master key, and then sent to the website server. This enables real-time updating and generation of new working keys based on network traffic data and user behavior data. This avoids the problem of existing technologies using static keys, which lose their protective capability once cracked, ensuring that the key is a dynamic working key. The website server uses the working key as the latest working key to encrypt the target file corresponding to the file request, sends the encrypted file to the user terminal, and the user terminal decrypts it. Therefore, the use of a dynamic working key to encrypt the target file ensures file security and improves file security during file transmission.

[0160] Furthermore, in one feasible embodiment, after step S200, which involves sending network traffic data and user behavior data to the key management system, steps d10-d20 are included.

[0161] Step d10: If no working key is received from the key management system within the preset time period, then retrieve all stored historical working keys.

[0162] Step d20: Determine the storage time corresponding to each historical working key, and determine the historical working key corresponding to the storage time closest to the current time as the latest working key. Encrypt the file corresponding to the file request according to the latest working key, and send the encrypted file to the user terminal.

[0163] Optionally, the preset time period can be a user-defined time period, such as 1 second. If the website server receives a file request from the user, it checks whether it has received a working key from the key management system within the preset time period. If no working key is obtained, it determines all historical working keys stored in the website server. Optionally, the historical working keys are those generated before the current time.

[0164] The website server determines the time when it receives and stores each historical working key, and uses this as the storage time. It compares the storage time corresponding to each historical working key with the current time, and determines the historical working key with the storage time closest to the current time as the latest working key. Then, it uses the latest working key to encrypt the file corresponding to the file request, sends the encrypted file to the user's client, and the user then decrypts it.

[0165] In this embodiment, if no working key is received from the key management system within a preset time period, the latest working key is determined based on the storage time of all historical working keys. Then, the file corresponding to the file request is encrypted based on the latest working key, and the encrypted file is sent to the user terminal. This can protect the security of the file and improve the security of file transmission.

[0166] In addition, examples are given illustrating the workflow of a file security management system that includes a key management system and a web server.

[0167] For example, such as Figure 5 As shown, the system workflow diagram includes S1 (initialization phase), S2 (user access request phase), S3 (key generation phase), and S4 (key update phase).

[0168] Optionally, the S1 initialization phase may include the following processes: 1. Loading the Llama2 model and LoRA (Low-rank Adaptation) fine-tuning parameters; 2. Initializing the key store to store the generated keys; 3. Initializing the user behavior library to store historical user behavior data.

[0169] The S2 user access request phase may include the following processes: 1. Collecting network traffic data, including IP address, port number, packet size, timestamp, etc. 2. Collecting user behavior data, including login time, operation frequency, device used, detected attack behavior, etc. 3. Inputting the collected network traffic data and user behavior data into the AI ​​model (i.e., the AI ​​security model) for LoRA fine-tuning, and outputting the key generation factor Kf, i.e., the dynamic key generation factor.

[0170] The S3 key generation phase can include the following processes: 1. Based on the key generation factor Kf, combined with the predefined key generation seed Tp (generated based on the current timestamp and pseudo-random number generator), the current system data Tc, and the environment variable set Ev, a new key NewKey, which is the working key, is generated using a hash function. That is: NewKey = H(Kf||Tp||Tc||H(Ev)). H is the hash function. 2. The newly generated key NewKey is stored in the encryption database. 3. The key NewKey is distributed to system proxies, such as reverse proxy servers that need to use the key. 4. The requested JS file is encrypted using the key NewKey, for example, encrypting key parameters of the JS file. 5. The encrypted JS file is transmitted in response to the user request.

[0171] The S4 key update phase can include the following processes: 1. The AI ​​security model continuously monitors user / network behavior data. 2. Detection is performed based on preset update conditions, such as the number of failed login attempts exceeding a threshold, abnormal traffic detected, or attack behavior discovered (if no abnormalities are found, the seed TP is updated periodically). If the update conditions are met, the "key generation" phase is resent to generate and deploy a new key, replacing the old key. By continuously updating the key, it is possible to effectively cope with constantly changing security threats and improve the system's adaptability and defense capabilities.

[0172] In addition, this application also provides a file security management system, including a key management system and a web server.

[0173] The website server is used to monitor network traffic data and user behavior data in real time, and send the network traffic data and user behavior data to the key management system.

[0174] The key management system is used to acquire network traffic data and user behavior data sent by the website server; input the network traffic data and user behavior data into a pre-trained AI security model to obtain anomaly detection parameters and risk scores; determine the dynamic key generation factor based on the anomaly detection parameters and risk scores; generate working keys based on the dynamic key generation factor and the preset master key; and send the working keys to the website server.

[0175] The website server is used to obtain the working key sent by the key management system, use the working key as the latest working key to encrypt the target file corresponding to the file request, and then send the encrypted file to the user terminal, where the user terminal that sent the file request decrypts the encrypted file.

[0176] The specific implementation method of the document security management system in this application is basically the same as the embodiments of the document security management method described above, and will not be repeated here.

[0177] In addition, this application also provides an electronic device, which includes a memory, a processor, and a file security management program stored in the memory and executable on the processor. When the file security management program is executed by the processor, it implements the steps of the file security management method described above.

[0178] Furthermore, in one embodiment, Figure 6 This is a schematic diagram of the structure of an electronic device according to an embodiment of the present invention, as shown below. Figure 6As shown, at the hardware level, this electronic device includes a processor, and optionally also includes an internal bus, a network interface, and memory. The memory may include main memory, such as high-speed random-access memory (RAM), or non-volatile memory, such as at least one disk storage device. Of course, this electronic device may also include other hardware required for its functions. The processor, network interface, and memory can be interconnected via an internal bus, which can be an ISA (Industry Standard Architecture) bus, a PCI (Peripheral Component Interconnect) bus, or an EISA (Extended Industry Standard Architecture) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of illustration, only a single bidirectional arrow is used in the diagram, but this does not imply that there is only one bus or one type of bus. The memory is used to store programs. Specifically, the program can include program code, which includes computer operation instructions. The processor reads the corresponding computer program from non-volatile memory into memory and then executes it, forming a shared resource access control mechanism at the logical level. The processor executes the program stored in memory and specifically performs the steps of the aforementioned file security management method.

[0179] The specific implementation of the electronic device in this application is basically the same as the embodiments of the document security management method described above, and will not be repeated here.

[0180] In addition, to achieve the above objectives, this application also provides a medium, including a computer-readable storage medium on which a file security management program is stored, wherein the file security management program, when executed by a processor, implements the steps of the file security management method described above.

[0181] The specific implementation of the computer-readable storage medium in this application is basically the same as the embodiments of the above-described file security management method, and will not be repeated here.

[0182] In addition, to achieve the above objectives, this application also provides a program product, which includes a computer program product, wherein the computer program product includes a financial middleware server control program, and the financial middleware server control program, when executed by a processor, implements the steps of the financial middleware server control method as described above.

[0183] The specific implementation method of the computer program product in this application is basically the same as the various embodiments of the above-mentioned financial middleware server control method, and will not be described again here.

[0184] It will be understood by those skilled in the art that all or some of the steps, systems, or apparatuses disclosed above, and their functional modules / units, can be implemented as software, firmware, hardware, or suitable combinations thereof. In hardware implementations, the division between functional modules / units mentioned above does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may be performed collaboratively by several physical components. Some or all physical components may be implemented as software executed by a processor, such as a central processing unit, digital signal processor, or microprocessor, or as hardware, or as an integrated circuit, such as an application-specific integrated circuit (ASIC). Such software may be distributed on a computer-readable medium, which may include computer storage media (or non-transitory media) and communication media (or transient media). As is known to those skilled in the art, the term computer-readable storage medium includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer-readable storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technologies, CD-ROM, digital versatile disc (DVD) or other optical disc storage, magnetic cartridges, magnetic tape, disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and is accessible by a computer. Furthermore, it is well known to those skilled in the art that communication media typically contain computer-readable instructions, data structures, program modules, or other data in modulated data signals such as carrier waves or other transmission mechanisms, and may include any information delivery medium.

[0185] The above are merely preferred embodiments of the present invention and do not limit the scope of the patent. Any equivalent structural or procedural transformations made based on the description and drawings of the present invention, or direct or indirect applications in other related technical fields, are similarly included within the scope of patent protection of the present invention.

Claims

1. A document security management method, characterized in that, Applied to a key management system, the method includes: Obtain network traffic data and user behavior data sent by the website server; The network traffic data and user behavior data are input into a pre-trained AI security model to obtain anomaly detection parameters and risk scores. The dynamic key generation factor is determined based on the anomaly detection parameters and risk score. A working key is generated based on the dynamic key generation factor and the preset master key; The working key is sent to the website server, which uses the working key as the latest working key to encrypt the target file corresponding to the file request, obtains an encrypted file, and sends the encrypted file to the user terminal.

2. The method as described in claim 1, characterized in that, The step of determining the dynamic key generation factor based on the anomaly detection parameters and risk score includes: The anomaly detection parameters, the risk score, the preset environmental parameters, and random noise are subjected to nonlinear combination processing to generate a dynamic key generation factor.

3. The method as described in claim 1, characterized in that, Before the step of determining the dynamic key generation factor based on the anomaly detection parameters and risk score, the following steps are included: The network traffic data and the user behavior data are checked to see if they meet preset update conditions, wherein the preset update conditions include at least one of the network traffic data and the user behavior data, which matches preset abnormal traffic data; If the preset update conditions are met, then the step of determining the dynamic key generation factor based on the anomaly detection parameters and risk score is executed; If the preset update conditions are not met, continue with the steps of obtaining network traffic data and user behavior data sent by the website server.

4. The method according to any one of claims 1-3, characterized in that, The method further includes: Determine the training data, wherein the training data includes training samples and sample labels, the training samples include historical network traffic data and historical user behavior data, and the sample labels include historical anomaly detection parameters and historical risk scores; The training samples are input into a preset AI security model for model training, and the prediction results are output. The loss function value is determined based on the sample labels, the prediction results, and the loss function corresponding to the AI ​​security model. The AI ​​security model is updated with model parameters based on the loss function value until the trained AI security model meets the preset training termination condition, thus obtaining a pre-trained AI security model. The model parameter update includes the update of the fine-tuning layer parameters in the AI ​​security model.

5. A document security management method, characterized in that, Applied to a web server, the method includes: Real-time monitoring of network traffic and user behavior data; The network traffic data and user behavior data are sent to the key management system, which processes the network traffic data and user behavior data according to the AI ​​security model to obtain anomaly detection parameters and risk scores, and generates a working key based on the dynamic key generation factor determined by the anomaly detection parameters and risk scores and the preset master key, and sends the working key to the website server. Obtain the working key sent by the key management system, and use the working key as the latest working key to encrypt the target file corresponding to the file request to obtain the encrypted file. The user sends the file request to the website server. The encrypted file is sent to the user terminal, whereby the user terminal decrypts the encrypted file.

6. The method as described in claim 5, characterized in that, After the step of sending the network traffic data and user behavior data to the key management system, the following steps are included: If no working key is received from the key management system within a preset time period, then all stored historical working keys are retrieved. The storage time corresponding to each historical working key is determined, and the historical working key corresponding to the storage time closest to the current time is determined as the latest working key. The file corresponding to the file request is encrypted according to the latest working key, and the encrypted file is sent to the user terminal.

7. A document security management system, characterized in that, The file security management system includes a key management system and a website server. The website server is used to monitor network traffic data and user behavior data in real time, and send the network traffic data and user behavior data to the key management system. The key management system is used to acquire network traffic data and user behavior data sent by the website server; and input the network traffic data and user behavior data into a pre-trained AI security model to obtain anomaly detection parameters and risk scores. The dynamic key generation factor is determined based on the anomaly detection parameters and risk score. A working key is generated based on the dynamic key generation factor and the preset master key; the working key is then sent to the website server. The website server is used to obtain the working key sent by the key management system, use the working key as the latest working key to encrypt the target file corresponding to the file request, and obtain an encrypted file; the encrypted file is sent to the user terminal, wherein the user terminal that sent the file request decrypts the encrypted file.

8. An electronic device, characterized in that, The electronic device includes: a memory, a processor, and a computer program stored on the memory and executable on the processor, the computer program being configured to implement the steps of the file security management method as described in any one of claims 1 to 6.

9. A medium, characterized in that, The medium is a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, it implements the steps of the file security management method as described in any one of claims 1 to 6.

10. A program product, characterized in that, The program product is a computer program product, which includes a computer program. When the computer program is executed by a processor, it implements the steps of the file security management method as described in any one of claims 1 to 6.

Images