An AI-based digital archive anti-intrusion online identification system and method

Abstract

The present invention belongs to the field of digital archive technology, and is used to solve the problem that the prior art cannot screen and match security optimization decisions of an AI digital archive based on parameters such as the abnormal type of the execution end and the distribution state at the time of the attack event. Specifically, it is an online identification system and method based on AI digital archive anti-intrusion, and the threat data collection module is used to collect and count security threat events of the AI ​​digital archive; the present invention analyzes the concentration of security threats to the AI ​​digital archive, obtains the instability coefficient of all evaluation periods within the evaluation cycle in a time period analysis manner, evaluates the security risk degree of the AI ​​digital archive within the evaluation period through the instability coefficient, conducts centralized analysis when subjected to centralized attacks, and takes targeted optimization measures to control security risks.

Description

Technical Field

[0001] The present invention belongs to the technical field of digital archives, and specifically is an AI-based digital archive anti-intrusion online recognition system and method. Background Art

[0002] AI digital archives are an innovative archive management model that cleverly integrates artificial intelligence technology, bringing revolutionary changes to the storage, retrieval and utilization of archival information. With the help of advanced AI technology, digital archives can achieve automatic classification, intelligent retrieval and precise recommendation, greatly improving the processing efficiency and accuracy of archival information.

[0003] In addition, AI digital archives also have powerful security protection functions, which can monitor and prevent potential security threats in real time, ensuring the integrity and confidentiality of archival information.

[0004] However, in the existing technology, the security threat assessment method in the management process of AI digital archives cannot be analyzed based on parameters such as the type of execution-end anomalies and the distribution status at the time of attack events. It is impossible to effectively screen and match the security optimization decisions of the AI ​​digital archive management system, resulting in low security optimization efficiency of the archive management system when threats exist.

[0005] In view of the above technical problems, this application proposes a solution. Summary of the invention

[0006] The purpose of the present invention is to provide an AI-based digital archive anti-intrusion online identification system and method, which is used to solve the problem that the existing technology cannot screen and match the security optimization decision of the AI ​​digital archive based on parameters such as the type of execution end anomaly and the distribution state of the attack event at the time of occurrence;

[0007] The technical problem to be solved by the present invention is: how to provide an AI digital archive security threat assessment method and system that can screen and match the security optimization decisions of the AI ​​digital archive.

[0008] The purpose of the present invention can be achieved through the following technical solutions:

[0009] An AI-based digital archive anti-intrusion online identification system includes a security assessment platform, wherein the security assessment platform is communicatively connected to a threat data acquisition module, a centralized analysis module, an impact analysis module, and a storage module;

[0010] The threat data collection module is used to collect and count security threat events of the AI ​​digital archive: generate an assessment cycle, count physical events, network events, and related events within the assessment cycle, and send the physical events, network events, and related events to the centralized analysis module through the security assessment platform;

[0011] The centralized analysis module is used to analyze the concentration of security threats to the AI ​​digital archive: the number of physical events, network events, and related events that occur in the AI ​​digital archive during the evaluation period is numerically calculated to obtain a concentration coefficient, a concentration threshold is obtained through the storage module, and the concentration coefficient is compared with the concentration threshold: if the concentration coefficient is less than the concentration threshold, it is determined that the security threats to the AI ​​digital archive during the evaluation period are not centralized; if the concentration coefficient is greater than or equal to the concentration threshold, it is determined that the security threats to the AI ​​digital archive during the evaluation period are centralized, and the evaluation period is centralized for analysis;

[0012] The impact analysis module is used to process the attack interference value of physical events and the operation interference value of network events that occur in the AI ​​digital archive during the evaluation period, obtain the intrusion coefficient of the AI ​​digital archive during the evaluation period, and complete the intrusion impact degree analysis of the AI ​​digital archive during the evaluation period based on the intrusion coefficient.

[0013] Further: physical events include the destruction of the AI ​​digital archive execution terminal, network interruption and power outage, which result in the failure of the AI ​​digital archive function to be executed normally;

[0014] Cyber ​​incidents include cyber threats, hardware system vulnerability exploits, and network attacks;

[0015] The statistical process of associating events includes: marking the occurrence time of the physical event within the evaluation period as the triggering time CF of the physical event, obtaining the pre-association time GLq and the post-association time GLh through the formulas GLq=CF-L1 and GLh=CF+L1, where L1 is a numerical constant in minutes; the pre-association time GLq and the post-association time GLh constitute the association period of the physical event, and determining whether a network event occurs within the association period:

[0016] If a network event occurs during the correlation period, the physical event and all network events occurring during the correlation period constitute a correlation event;

[0017] If no network event occurs during the correlation period, no correlation event is marked.

[0018] Further: the process of obtaining the concentration coefficient of the evaluation period includes: dividing the evaluation period into several evaluation periods, marking the number of occurrences of physical events, network events and associated events in the AI ​​digital archive during the evaluation period as physical threat value WU, network threat value WA and associated threat value GA respectively; through the formula The instability coefficient GZ of the AI ​​digital archive during the evaluation period is obtained, where t1, t2 and t3 are all proportional coefficients, and t1>t2>t3>1, e is a natural constant, and the variance of the instability coefficient GZ of all evaluation periods is calculated to obtain the concentration coefficient.

[0019] Further: The specific process of conducting a centralized analysis of the evaluation cycle includes:

[0020] Arrange the evaluation periods in descending order according to the unstable coefficient GZ values ​​to obtain a fault sequence, and intercept the top L2 evaluation periods in the fault sequence and mark them as fault periods;

[0021] The absolute value of the difference between the number of physical events and the number of network events in all failure periods is marked as the tendency value;

[0022] Get the propensity threshold through the storage module and compare the propensity value with the propensity threshold:

[0023] If the tendency value is greater than or equal to the tendency threshold, the security threat to the AI ​​digital archive is determined to be tendency, and the number of physical event occurrences is compared with the number of network event occurrences:

[0024] If the number of physical event occurrences is greater than the number of network event occurrences, an execution-end optimization signal is generated and sent to the administrator's mobile terminal;

[0025] Otherwise, a network optimization signal is generated and sent to the mobile phone terminal of the administrator;

[0026] Compare the propensity score to the propensity threshold:

[0027] If the tendency value is less than the tendency threshold, the previous optimization value and the subsequent optimization value are obtained and compared with each other:

[0028] If the previous optimization value is greater than or equal to the subsequent optimization value, a defense optimization signal is generated and sent to the mobile phone terminal of the administrator;

[0029] If the previous optimization value is less than the subsequent optimization value, a risk scanning optimization signal is generated and sent to the mobile phone terminal of the manager.

[0030] Further: the process of obtaining the preceding optimization value and the subsequent optimization value includes: the preceding period of the physical event is constituted by the pre-association moment GLq and the trigger moment CF of the physical event occurring within the fault period, the subsequent period of the physical event is constituted by the trigger moment CF and the post-association moment GLh of the physical event occurring within the fault period, the number of network events occurring within the preceding period of all physical events within the fault period is marked as the preceding optimization value, and the number of network events occurring within the subsequent period of all physical events within the fault period is marked as the subsequent optimization value.

[0031] Further: The impact analysis module analyzes the degree of intrusion impact of the AI ​​digital archive:

[0032] Obtain the attack interference value of the physical event that occurs in the AI ​​digital archive during the evaluation period and mark it as TWu;

[0033] Obtain the operation interference value of the AI ​​digital archive when a network event occurs during the evaluation period and mark it as TWa;

[0034] By formula The intrusion coefficient YX of the AI ​​digital archive library during the evaluation period is obtained, where GZb is the sum of the unstable coefficients GZ of all evaluation periods during the evaluation period, and di is the AI ​​digital archive attack loss rate during the evaluation period. The intrusion coefficient YX is used to determine whether the overall security threat assessment results of the AI ​​digital archive library during the evaluation period meet the requirements.

[0035] Further: The process of obtaining the AI ​​digital archive attack loss rate during the evaluation period is:

[0036] Obtain the number of data packets stored in the AI ​​digital archive before each associated event occurs and the number of data packets stored in the AI ​​digital archive after each associated event occurs;

[0037] The difference between the number of data packets stored in the AI ​​digital archive before the associated event occurs and the number of data packets stored in the AI ​​digital archive after the associated event occurs is calculated to obtain a data packet storage difference;

[0038] Calculate the ratio of the data packet storage difference to the data packet storage difference threshold to obtain the storage data loss rate of the associated event;

[0039] The storage data packet loss rate of all related events within the evaluation period is obtained, and the sum is averaged to obtain the AI ​​digital archive attack loss rate within the evaluation period;

[0040] Further: The process of obtaining the attack interference value is:

[0041] Obtain the duration of each physical event within the evaluation period, sum and average the durations of multiple physical events, and obtain the average duration of the physical event, recorded as Ts;

[0042] Obtain the interval duration of adjacent physical events within the evaluation period, sum and average the interval durations of multiple adjacent physical events, and obtain the physical event interval duration analysis value, recorded as Tj;

[0043] By formula Calculate the attack interference value TWu of the physical event within the evaluation period;

[0044] The process of obtaining the running interference value is as follows:

[0045] Obtain the duration of each network event during the evaluation period, sum and average the durations of multiple network events, and obtain the average duration of the network event, recorded as Tw;

[0046] Obtain the interval duration of adjacent network events within the evaluation period, sum and average the interval durations of multiple adjacent network events, and obtain the network interval duration analysis value of the network event, recorded as Tc;

[0047] By formula The attack interference value TWa of the network event within the evaluation period is calculated.

[0048] Further: The specific process of determining whether the overall security threat assessment results of the AI ​​digital archive meet the requirements during the assessment cycle includes:

[0049] The intrusion threshold YXmax is obtained through the storage module, and the intrusion coefficient YX of the AI ​​digital archive during the evaluation period is compared with the intrusion threshold YXmax:

[0050] If the intrusion coefficient YX is less than the intrusion threshold YXmax, it is determined that the overall security threat assessment result of the AI ​​digital archive within the assessment period meets the requirements;

[0051] If the intrusion coefficient YX is greater than or equal to the intrusion threshold YXmax, it is determined that the overall security threat assessment result of the AI ​​digital archive within the assessment period does not meet the requirements, and a comprehensive optimization signal is generated and sent to the administrator's mobile terminal.

[0052] An AI digital archive security threat assessment method includes the following steps:

[0053] Step 1: Collect and count security threat events in the AI ​​digital archive: Generate an assessment cycle, count physical events, network events, and related events within the assessment cycle, and send the physical events, network events, and related events to the centralized analysis module through the security assessment platform;

[0054] Step 2: Analyze the failure probability of the AI ​​digital archive: divide the evaluation cycle into several evaluation periods, calculate the number of physical events, network events, and related events in the AI ​​digital archive in all evaluation periods to obtain the concentration coefficient, and use the concentration coefficient to determine whether the security threats to the AI ​​digital archive in the evaluation period are concentrated;

[0055] Step 3: Process the attack interference values ​​of physical events and the operation interference values ​​of network events that occur in the AI ​​digital archive during the assessment period to obtain the intrusion coefficient YX of the AI ​​digital archive during the assessment period. Use the intrusion coefficient YX to determine whether the overall security threat assessment results of the AI ​​digital archive during the assessment period meet the requirements.

[0056] The present invention has the following beneficial effects:

[0057] The threat data collection module can collect and count security threat events in the AI ​​digital archive, and count related events based on the distribution of the time points of physical events and network events. Related events indicate that there is a correlation between physical events and network events, and network attacks cause abnormal operation of the execution end, providing data support for the centralized analysis process of security threats;

[0058] The centralized analysis module can be used to analyze the concentration of security threats to the AI ​​digital archive, obtain the instability coefficients of all evaluation periods within the evaluation cycle by time-based analysis, evaluate the security risk level of the AI ​​digital archive within the evaluation period by the instability coefficients, and then provide feedback on the concentration of attacks on the AI ​​digital archive within the evaluation period in combination with the discrete degree of the instability coefficients of all evaluation periods. When the AI ​​digital archive is attacked in a centralized manner, centralized analysis is performed and targeted optimization measures are taken to control security risks.

[0059] The impact analysis module can be used to analyze the degree of intrusion impact of the AI ​​digital archive, and evaluate the overall security threat level based on the results after the AI ​​digital archive is attacked. When the overall security threat assessment results are abnormal, a comprehensive optimization approach can be taken to optimize the AI ​​digital archive and avoid large-scale security incidents. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0061] Figure 1is a system block diagram of Embodiment 1 of the present invention;

[0062] Figure 2 This is a flow chart of the method of Embodiment 2 of the present invention. DETAILED DESCRIPTION

[0063] The technical solution of the present invention will be clearly and completely described below in conjunction with the embodiments. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0064] Embodiment 1, as Figure 1 As shown, an AI-based digital archive anti-intrusion online identification system includes a security assessment platform, which is communicatively connected to a threat data collection module, a centralized analysis module, an impact analysis module, and a storage module.

[0065] The threat data collection module is used to collect and count security threat events of the AI ​​digital archive: generate an evaluation cycle, and count physical events, network events, and associated events within the evaluation cycle. Physical events include the destruction of the AI ​​digital archive execution end, network interruption, and power interruption, which cause the AI ​​digital archive function to be unable to execute normally, thereby causing failures; network events include network threats, hardware system vulnerability attacks, and network attacks; the statistical process of associated events includes: marking the occurrence time of the physical event within the evaluation cycle as the triggering time CF of the physical event, and obtaining the pre-association time GLq and the post-association time GLh through the formulas GLq=CF-L1 and GLh=CF+L1, where L1 is a numerical constant in minutes; the pre-association time GLq and the post-association time GLh constitute the associated period of the physical event, and determine whether a network event occurs within the associated period: if a network event occurs within the associated period, the physical event and all network events occurring within the corresponding associated period constitute an associated event; if no network event occurs within the associated period, the associated event is not marked, indicating that no network event occurs within the associated period corresponding to the physical event;

[0066] It should be noted that: a correlation event refers to a network event that occurs within the correlation period corresponding to the occurrence of a physical event. The physical event and the network event within the correlation period are combined into a whole and recorded as a correlation event.

[0067] If no network event occurs during the associated period of the physical event, the physical event exists independently and is recorded as a physical event;

[0068] Physical events, network events, and related events are sent to the centralized analysis module through the security assessment platform. Security threat events in the AI ​​digital archive are collected and counted, and related events are counted based on the distribution of the time points of occurrence of physical events and network events. Related events indicate that there is a correlation between physical events and network events, and network attacks cause abnormal operation of the execution end, providing data support for the centralized analysis process of security threats.

[0069] The centralized analysis module is used to analyze the security threat concentration of the AI ​​digital archive: the evaluation cycle is divided into several evaluation periods, and the number of physical events, network events, and associated events in the AI ​​digital archive during the evaluation period are marked as physical threat value WU, network threat value WA, and associated threat value GA respectively; the formula The instability coefficient GZ of the AI ​​digital archive during the evaluation period is obtained, where t1, t2 and t3 are all proportional coefficients, and t1>t2>t3>1, e is a natural constant, and the value of e is 2.78; the variance of the instability coefficient GZ of all evaluation periods is calculated to obtain the concentration coefficient, and the concentration threshold is obtained through the storage module, and the concentration coefficient is compared with the concentration threshold: It should be noted that the concentration threshold is an empirical value set by the staff based on experience; Among them, the staff sets the concentration threshold based on many groups of physical threat values ​​WU, network threat values ​​WA and associated threat values ​​GA, as well as many groups of physical threat values ​​WU, network threat values ​​WA and associated threat values ​​GA The instability coefficient GZ of the AI ​​digital archive in the evaluation period is obtained; the concentration of the security threats of the AI ​​digital archive in the evaluation period is evaluated according to the instability coefficient GZ of so many groups of AI digital archives in the evaluation period, so as to obtain a critical value, that is, the concentration threshold; if the concentration coefficient is less than the concentration threshold, it is determined that the security threats of the AI ​​digital archive in the evaluation period are not concentrated; if the concentration coefficient is greater than or equal to the concentration threshold, it is determined that the security threats of the AI ​​digital archive in the evaluation period are concentrated, and the evaluation period is analyzed intensively: the evaluation periods are arranged in descending order according to the value of the instability coefficient GZ to obtain a fault sequence, and the L2 evaluation periods with the highest ranking in the fault sequence are intercepted And mark it as a fault period, mark the absolute value of the difference between the number of physical events and the number of network events in all fault periods as a tendency value, obtain the tendency threshold through the storage module, and compare the tendency value with the tendency threshold: It should be noted that the tendency threshold is an empirical value, which is set by the staff based on experience; Among them, the staff sets the tendency threshold based on the number of physical events and network events in many groups of fault periods, and the tendency value is obtained by the number of physical events and network events in many groups of fault periods; Based on so many groups of tendency values, whether the security threat to the AI ​​digital archive has a tendency is evaluated, so as to obtain a critical value, that is, the tendency Towards the threshold; if the tendency value is greater than or equal to the tendency threshold, the security threat to the AI ​​digital archive is determined to have a tendency, and the number of physical event occurrences is compared with the number of network event occurrences: if the number of physical event occurrences is greater than the number of network event occurrences, an execution end optimization signal is generated and the hardware optimization signal is sent to the administrator's mobile terminal; otherwise, a network optimization signal is generated and the network optimization signal is sent to the administrator's mobile terminal; if the tendency value is less than the tendency threshold, the pre-correlation time GLq and the trigger time CF of the physical event occurring within the fault period constitute the preceding period of the physical event, and the trigger time CF and the post-correlation time GLh of the physical event occurring within the fault period constitute the subsequent period of the physical event;It should be noted that: the preceding period refers to the time period between the triggering moment CF of the physical event and the pre-association moment GLq, the pre-association moment GLq is calculated by the formula GLq=CF-L1, and L1 is a numerical constant; the subsequent period refers to the time period between the triggering moment CF of the physical event and the post-association moment GLh, the post-association moment GLh is calculated by the formula GLh=CF+L1, and L1 is a numerical constant; illustratively, L1 is 30 minutes, the triggering moment CF of the physical event is 10:00 a.m., then the preceding period is the time period of 9:30-10:00, and the subsequent period is the time period of 10:00-10:30; the number of network events occurring in the preceding period of all physical events in the fault period is marked as the preceding optimization value, and the number of network events occurring in the subsequent period of all physical events in the fault period is marked as the preceding optimization value. The number is marked as the subsequent optimization value; the previous optimization value is compared with the subsequent optimization value: if the previous optimization value is greater than or equal to the subsequent optimization value, a defense optimization signal is generated and sent to the administrator's mobile terminal; if the previous optimization value is less than the subsequent optimization value, a risk scanning optimization signal is generated and sent to the administrator's mobile terminal; the concentration of security threats to the AI ​​digital archive is analyzed, and the instability coefficient of all evaluation periods in the evaluation period is obtained by time period analysis. The security risk level of the AI ​​digital archive in the evaluation period is evaluated by the instability coefficient, and then the concentration of attacks on the AI ​​digital archive in the evaluation period is fed back in combination with the discrete degree of the instability coefficient of all evaluation periods. When subjected to concentrated attacks, centralized analysis is performed and targeted optimization measures are taken to control security risks. ;

[0070] The impact analysis module is used to analyze the impact of the intrusion of the AI ​​digital archive:

[0071] Obtain the attack interference value of the physical event that occurs in the AI ​​digital archive during the evaluation period and mark it as TWu;

[0072] The process of obtaining the attack interference value is as follows:

[0073] Obtain the duration of each physical event within the evaluation period, sum and average the durations of multiple physical events, and obtain the average duration of the physical event, recorded as Ts;

[0074] Obtain the interval duration of adjacent physical events within the evaluation period, sum and average the interval durations of multiple adjacent physical events, and obtain the physical event interval duration analysis value, recorded as Tj;

[0075] By formula Calculate the attack interference value TWu of the physical event within the evaluation period;

[0076] Obtain the operation interference value of the AI ​​digital archive when a network event occurs during the evaluation period and mark it as TWa;

[0077] The process of obtaining the running interference value is as follows:

[0078] Obtain the duration of each network event during the evaluation period, sum and average the durations of multiple network events, and obtain the average duration of the network event, recorded as Tw;

[0079] Obtain the interval duration of adjacent network events within the evaluation period, sum and average the interval durations of multiple adjacent network events, and obtain the network interval duration analysis value of the network event, recorded as Tc;

[0080] By formula Calculate the attack interference value TWa of the network event within the evaluation period;

[0081] By formula The intrusion coefficient YX of the AI ​​digital archive library during the evaluation period is obtained, where GZb is the sum of the unstable coefficients GZ of all evaluation periods during the evaluation period, and di is the AI ​​digital archive attack loss rate during the evaluation period. The intrusion coefficient YX is used to determine whether the overall security threat assessment results of the AI ​​digital archive library during the evaluation period meet the requirements.

[0082] The process of obtaining the AI ​​digital archive attack loss rate during the evaluation period is as follows:

[0083] Obtain the number of data packets stored in the AI ​​digital archive before each associated event occurs and the number of data packets stored in the AI ​​digital archive after each associated event occurs;

[0084] The difference between the number of data packets stored in the AI ​​digital archive before the associated event occurs and the number of data packets stored in the AI ​​digital archive after the associated event occurs is calculated to obtain a data packet storage difference;

[0085] Calculate the ratio of the data packet storage difference to the data packet storage difference threshold to obtain the storage data loss rate of the associated event;

[0086] The packet storage difference threshold is set by the staff based on experience;

[0087] The storage data packet loss rate of all related events within the evaluation period is obtained, and the sum is averaged to obtain the AI ​​digital archive attack loss rate within the evaluation period;

[0088] Through the above process of obtaining the intrusion coefficient YX of the AI ​​digital archive during the evaluation period, by processing the average occurrence duration and interval duration (in terms of frequency) of physical events and network events, and then combining the unstable coefficient of all evaluation periods in the evaluation period (in terms of overall stability) and the packet loss rate of the AI ​​digital archive during the evaluation period (in terms of content), multi-dimensional processing of the intrusion coefficient of the AI ​​digital archive during the evaluation period is achieved, which has higher accuracy and reliability.

[0089] In a specific embodiment, the intrusion threshold value YXmax is obtained through the storage module, and the intrusion coefficient YX of the AI ​​digital archive during the evaluation period is compared with the intrusion threshold value YXmax: It should be noted that the intrusion threshold is an empirical value, which is set by the staff based on experience; wherein, the staff sets the intrusion threshold based on many groups of attack interference values ​​of physical events during the evaluation period, attack interference values ​​of network events during the evaluation period, the sum of the unstable coefficients of all evaluation time periods during the evaluation period, and the attack loss rate of the AI ​​digital archive during the evaluation period, and the intrusion coefficient is obtained by many groups of attack interference values ​​of physical events during the evaluation period, attack interference values ​​of network events during the evaluation period, the sum of the unstable coefficients of all evaluation time periods during the evaluation period, and the attack loss rate of the AI ​​digital archive during the evaluation period; according to so many groups of intrusion coefficients The overall security threat assessment results of the AI ​​digital archive during the assessment period are identified to obtain a critical value, namely the intrusion threshold; if the intrusion coefficient YX is less than the intrusion threshold YXmax, the overall security threat assessment results of the AI ​​digital archive during the assessment period are determined to meet the requirements; if the intrusion coefficient YX is greater than or equal to the intrusion threshold YXmax, the overall security threat assessment results of the AI ​​digital archive during the assessment period are determined to not meet the requirements, and a comprehensive optimization signal is generated and sent to the mobile phone terminal of the manager; the degree of intrusion impact of the AI ​​digital archive is analyzed, and the overall security threat degree is evaluated from the result orientation of the AI ​​digital archive after being attacked, so as to adopt a comprehensive optimization method when the overall security threat assessment result is abnormal, optimize the AI ​​digital archive and avoid large-scale security incidents.

[0090] Embodiment 2, as Figure 2 As shown, an AI digital archive security threat assessment method includes the following steps:

[0091] Step 1: Collect and count security threat events in the AI ​​digital archive: Generate an assessment cycle, count physical events, network events, and related events within the assessment cycle, and send the physical events, network events, and related events to the centralized analysis module through the security assessment platform;

[0092] Step 2: Analyze the failure probability of the AI ​​digital archive: divide the evaluation cycle into several evaluation periods, calculate the number of physical events, network events, and related events in the AI ​​digital archive in all evaluation periods to obtain the concentration coefficient, and use the concentration coefficient to determine whether the security threats to the AI ​​digital archive in the evaluation period are concentrated;

[0093] Step 3: Analyze the degree of intrusion impact of the AI ​​digital archive and obtain the intrusion coefficient YX. Use the intrusion coefficient YX to determine whether the overall security threat assessment results of the AI ​​digital archive during the assessment period meet the requirements.

[0094] An AI-based digital archive anti-intrusion online identification system and method, when working, generates an evaluation cycle, counts physical events, network events and related events within the evaluation cycle, and sends the physical events, network events and related events to a centralized analysis module through a security evaluation platform; divides the evaluation cycle into several evaluation periods, numerically calculates the number of occurrences of physical events, network events and related events in the AI ​​digital archive in all evaluation periods to obtain a concentration coefficient, and determines whether the security threats to the AI ​​digital archive in the evaluation cycle are centralized through the concentration coefficient; analyzes the intrusion impact of the AI ​​digital archive and obtains the intrusion coefficient YX, and determines whether the overall security threat evaluation result of the AI ​​digital archive in the evaluation cycle meets the requirements through the intrusion coefficient YX.

[0095] The above contents are merely examples and explanations of the structure of the present invention. The technicians in this technical field may make various modifications or additions to the specific embodiments described or replace them in a similar manner. As long as they do not deviate from the structure of the invention or exceed the scope defined by the claims, they should all fall within the protection scope of the present invention.

[0096] The above formulas are obtained by collecting a large amount of data and performing software simulation to select a formula close to the actual value. The coefficients in the formula are set by technicians in this field according to actual conditions; for example: Formula ; A technician in this field collects multiple groups of sample data and sets a corresponding unstable coefficient for each group of sample data; Substitute the set unstable coefficient and the collected sample data into the formula, any three formulas constitute a three-variable linear equation system, screen the calculated coefficients and take the average, and obtain the values ​​of t1, t2 and t3, which are 4.52, 2.64 and 2.17 respectively;

[0097] The size of the coefficient is to quantify each parameter to obtain a specific value for subsequent comparison. The size of the coefficient depends on the amount of sample data and the initial setting of the corresponding unstable coefficient for each set of sample data by technical personnel in this field; as long as it does not affect the proportional relationship between the parameter and the quantized value, such as the unstable coefficient is proportional to the value of the associated threat value.

[0098] In the description of this specification, the description with reference to the terms "one embodiment", "example", "specific example", etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner.

[0099] The preferred embodiments of the present invention disclosed above are only used to help explain the present invention. The preferred embodiments do not describe all the details in detail, nor do they limit the invention to only specific implementation methods. Obviously, many modifications and changes can be made according to the content of this specification. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the present invention, so that those skilled in the art can understand and use the present invention well. The present invention is limited only by the claims and their full scope and equivalents.

Claims

1. An AI-based digital archive anti-intrusion online identification system, characterized in that: It includes a security assessment platform, which is communicatively connected to a threat data acquisition module, a centralized analysis module, an impact analysis module, and a storage module; The threat data collection module is used to collect and count security threat events of the AI ​​digital archive: generate an assessment cycle, count physical events, network events, and related events within the assessment cycle, and send the physical events, network events, and related events to the centralized analysis module through the security assessment platform; The centralized analysis module is used to analyze the concentration of security threats to the AI ​​digital archive: the number of physical events, network events, and related events that occur in the AI ​​digital archive during the evaluation period is numerically calculated to obtain a concentration coefficient, a concentration threshold is obtained through the storage module, and the concentration coefficient is compared with the concentration threshold: if the concentration coefficient is less than the concentration threshold, it is determined that the security threats to the AI ​​digital archive during the evaluation period are not centralized; if the concentration coefficient is greater than or equal to the concentration threshold, it is determined that the security threats to the AI ​​digital archive during the evaluation period are centralized, and the evaluation period is centralized for analysis; The impact analysis module is used to process the attack interference value of the physical event and the operation interference value of the network event that occurs in the AI ​​digital archive during the evaluation period, obtain the intrusion coefficient of the AI ​​digital archive during the evaluation period, and complete the intrusion impact degree analysis of the AI ​​digital archive during the evaluation period based on the intrusion coefficient; Physical events include the destruction of the AI ​​digital archive execution terminal, network interruption, and power outage, which result in the inability of the AI ​​digital archive function to execute normally, thus causing failures; Cyber ​​incidents include cyber threats, hardware system vulnerability exploits, and network attacks; The statistical process of associating events includes: marking the occurrence time of the physical event within the evaluation period as the triggering time CF of the physical event, obtaining the pre-association time GLq and the post-association time GLh through the formulas GLq=CF-L1 and GLh=CF+L1, where L1 is a numerical constant in minutes; the pre-association time GLq and the post-association time GLh constitute the association period of the physical event, and determining whether a network event occurs within the association period: If a network event occurs during the correlation period, the physical event and all network events occurring during the correlation period constitute a correlation event; If no network event occurs during the correlation period, no correlation event is marked; The process of obtaining the concentration coefficient of the assessment cycle includes: dividing the assessment cycle into several assessment periods, marking the number of physical events, network events, and associated events in the AI ​​digital archive within the assessment period as physical threat value WU, network threat value WA, and associated threat value GA respectively; The instability coefficient GZ of the AI ​​digital archive in the evaluation period is obtained, where t1, t2 and t3 are all proportional coefficients, and t1>t2>t3>1, e is a natural constant, and the variance of the instability coefficient GZ of all evaluation periods is calculated to obtain the concentration coefficient; The impact analysis module analyzes the degree of intrusion impact of the AI ​​digital archive: Obtain the attack interference value of the physical event that occurs in the AI ​​digital archive during the evaluation period and mark it as TWu; Obtain the operation interference value of the AI ​​digital archive when a network event occurs during the evaluation period and mark it as TWa; By formula The intrusion coefficient YX of the AI ​​digital archive library during the evaluation period is obtained, where GZb is the sum of the instability coefficients GZ of all evaluation periods during the evaluation period, and di is the attack loss rate of the AI ​​digital archive during the evaluation period; the intrusion coefficient YX is used to determine whether the overall security threat assessment result of the AI ​​digital archive library during the evaluation period meets the requirements; The process of obtaining the AI ​​digital archive attack loss rate during the evaluation period is as follows: Obtain the number of data packets stored in the AI ​​digital archive before each associated event occurs and the number of data packets stored in the AI ​​digital archive after each associated event occurs; The difference between the number of data packets stored in the AI ​​digital archive before the associated event occurs and the number of data packets stored in the AI ​​digital archive after the associated event occurs is calculated to obtain a data packet storage difference; Calculate the ratio of the data packet storage difference to the data packet storage difference threshold to obtain the storage data loss rate of the associated event; The storage data packet loss rate of all related events within the evaluation period is obtained, and the sum is averaged to obtain the AI ​​digital archive attack loss rate within the evaluation period; The process of obtaining the attack interference value is as follows: Obtain the duration of each physical event within the evaluation period, sum and average the durations of multiple physical events, and obtain the average duration of the physical event, recorded as Ts; Obtain the interval duration of adjacent physical events within the evaluation period, sum and average the interval durations of multiple adjacent physical events, and obtain the physical event interval duration analysis value, recorded as Tj; By formula Calculate the attack interference value TWu of the physical event within the evaluation period; The process of obtaining the running interference value is as follows: Obtain the duration of each network event during the evaluation period, sum and average the durations of multiple network events, and obtain the average duration of the network event, recorded as Tw; Obtain the interval duration of adjacent network events within the evaluation period, sum and average the interval durations of multiple adjacent network events, and obtain the network interval duration analysis value of the network event, recorded as Tc; By formula The attack interference value TWa of the network event within the evaluation period is calculated.

2. According to claim 1, the AI-based digital archive anti-intrusion online identification system is characterized in that: The specific process of conducting a centralized analysis of the evaluation cycle includes: Arrange the evaluation periods in descending order according to the unstable coefficient GZ values ​​to obtain a fault sequence, and intercept the top L2 evaluation periods in the fault sequence and mark them as fault periods; The absolute value of the difference between the number of physical events and the number of network events in all failure periods is marked as the tendency value; Get the propensity threshold through the storage module and compare the propensity value with the propensity threshold: If the tendency value is greater than or equal to the tendency threshold, the security threat to the AI ​​digital archive is determined to be tendency, and the number of physical event occurrences is compared with the number of network event occurrences: If the number of physical event occurrences is greater than the number of network event occurrences, an execution-end optimization signal is generated and sent to the administrator's mobile terminal; Otherwise, a network optimization signal is generated and sent to the mobile phone terminal of the administrator; Compare the propensity score to the propensity threshold: If the tendency value is less than the tendency threshold, the previous optimization value and the subsequent optimization value are obtained and compared with each other: If the previous optimization value is greater than or equal to the subsequent optimization value, a defense optimization signal is generated and sent to the mobile phone terminal of the administrator; If the previous optimization value is less than the subsequent optimization value, a risk scanning optimization signal is generated and sent to the mobile phone terminal of the manager.

3. According to claim 2, the AI-based digital archive anti-intrusion online identification system is characterized in that: The process of obtaining the preceding optimization value and the subsequent optimization value includes: the preceding period of the physical event is constituted by the associated pre-time GLq and the trigger time CF of the physical event occurring within the fault period, the subsequent period of the physical event is constituted by the trigger time CF and the associated post-time GLh of the physical event occurring within the fault period, the number of network events occurring within the preceding period of all physical events within the fault period is marked as the preceding optimization value, and the number of network events occurring within the subsequent period of all physical events within the fault period is marked as the subsequent optimization value.

4. According to claim 1, the AI-based digital archive anti-intrusion online identification system is characterized in that: The specific process of determining whether the overall security threat assessment results of the AI ​​digital archive meet the requirements during the assessment cycle includes: The intrusion threshold YXmax is obtained through the storage module, and the intrusion coefficient YX of the AI ​​digital archive during the evaluation period is compared with the intrusion threshold YXmax: If the intrusion coefficient YX is less than the intrusion threshold YXmax, it is determined that the overall security threat assessment result of the AI ​​digital archive within the assessment period meets the requirements; If the intrusion coefficient YX is greater than or equal to the intrusion threshold YXmax, it is determined that the overall security threat assessment result of the AI ​​digital archive within the assessment period does not meet the requirements, and a comprehensive optimization signal is generated and sent to the administrator's mobile terminal.

5. An AI digital archive security threat assessment method, characterized in that: The following steps are involved: Step 1: Collect and count security threat events in the AI ​​digital archive: Generate an assessment cycle, count physical events, network events, and related events within the assessment cycle, and send the physical events, network events, and related events to the centralized analysis module through the security assessment platform; Step 2: Analyze the failure probability of the AI ​​digital archive: divide the evaluation cycle into several evaluation periods, calculate the number of physical events, network events, and related events in the AI ​​digital archive in all evaluation periods to obtain the concentration coefficient, and use the concentration coefficient to determine whether the security threats to the AI ​​digital archive in the evaluation period are concentrated; Step 3: Process the attack interference value of the physical event and the operation interference value of the network event that occurs in the AI ​​digital archive during the evaluation period to obtain the intrusion coefficient YX of the AI ​​digital archive during the evaluation period. Use the intrusion coefficient YX to determine whether the overall security threat assessment result of the AI ​​digital archive during the evaluation period meets the requirements; Physical events include the destruction of the AI ​​digital archive execution terminal, network interruption, and power outage, which result in the inability of the AI ​​digital archive function to execute normally, thus causing failures; Cyber ​​incidents include cyber threats, hardware system vulnerability exploits, and network attacks; The statistical process of associating events includes: marking the occurrence time of the physical event within the evaluation period as the triggering time CF of the physical event, obtaining the pre-association time GLq and the post-association time GLh through the formulas GLq=CF-L1 and GLh=CF+L1, where L1 is a numerical constant in minutes; the pre-association time GLq and the post-association time GLh constitute the association period of the physical event, and determining whether a network event occurs within the association period: If a network event occurs during the correlation period, the physical event and all network events occurring during the correlation period constitute a correlation event; If no network event occurs during the correlation period, no correlation event is marked; The process of obtaining the concentration coefficient of the assessment cycle includes: dividing the assessment cycle into several assessment periods, marking the number of physical events, network events, and associated events in the AI ​​digital archive within the assessment period as physical threat value WU, network threat value WA, and associated threat value GA respectively; The instability coefficient GZ of the AI ​​digital archive in the evaluation period is obtained, where t1, t2 and t3 are all proportional coefficients, and t1>t2>t3>1, e is a natural constant, and the variance of the instability coefficient GZ of all evaluation periods is calculated to obtain the concentration coefficient; The impact analysis module analyzes the degree of intrusion impact of the AI ​​digital archive: Obtain the attack interference value of the physical event that occurs in the AI ​​digital archive during the evaluation period and mark it as TWu; Obtain the operation interference value of the AI ​​digital archive when a network event occurs during the evaluation period and mark it as TWa; By formula The intrusion coefficient YX of the AI ​​digital archive library during the evaluation period is obtained, where GZb is the sum of the instability coefficients GZ of all evaluation periods during the evaluation period, and di is the attack loss rate of the AI ​​digital archive during the evaluation period; the intrusion coefficient YX is used to determine whether the overall security threat assessment result of the AI ​​digital archive library during the evaluation period meets the requirements; The process of obtaining the AI ​​digital archive attack loss rate during the evaluation period is as follows: Obtain the number of data packets stored in the AI ​​digital archive before each associated event occurs and the number of data packets stored in the AI ​​digital archive after each associated event occurs; The difference between the number of data packets stored in the AI ​​digital archive before the associated event occurs and the number of data packets stored in the AI ​​digital archive after the associated event occurs is calculated to obtain a data packet storage difference; Calculate the ratio of the data packet storage difference to the data packet storage difference threshold to obtain the storage data loss rate of the associated event; The storage data packet loss rate of all related events within the evaluation period is obtained, and the sum is averaged to obtain the AI ​​digital archive attack loss rate within the evaluation period; The process of obtaining the attack interference value is as follows: Obtain the duration of each physical event within the evaluation period, sum and average the durations of multiple physical events, and obtain the average duration of the physical event, recorded as Ts; Obtain the interval duration of adjacent physical events within the evaluation period, sum and average the interval durations of multiple adjacent physical events, and obtain the physical event interval duration analysis value, recorded as Tj; By formula Calculate the attack interference value TWu of the physical event within the evaluation period; The process of obtaining the running interference value is as follows: Obtain the duration of each network event during the evaluation period, sum and average the durations of multiple network events, and obtain the average duration of the network event, recorded as Tw; Obtain the interval duration of adjacent network events within the evaluation period, sum and average the interval durations of multiple adjacent network events, and obtain the network interval duration analysis value of the network event, recorded as Tc; By formula The attack interference value TWa of the network event within the evaluation period is calculated.

Images