Data security monitoring method and system based on intelligent semantic analysis

Abstract

The invention relates to the technical field of data processing, and discloses a data security monitoring method and system based on intelligent semantic parsing, and the system comprises a data feature security evaluation module, a data use scene security evaluation module, and a data security monitoring result feedback module. Data support is provided for simulation of a real use scene of the original data by precisely screening an optimal operation program object of the original data; according to the optimal operation program object of the original data, executing the use scene state autonomous and accurate simulation operation on the original data; according to the method, original data use scene state image parameters are collected online through screenshots, an intelligent identification algorithm and virus data operation scene state image parameters are combined to carry out real use scene state abnormal state scientific analysis on original data, and dual data state safety monitoring based on data features and a data real use scene is realized. And the accuracy and security of data security monitoring are improved.

Description

Technical Field

[0001] The present invention relates to the technical field of data processing, and in particular to a data security monitoring method and system based on intelligent semantic analysis. Background Art

[0002] Semantic parsing is one of the core tasks of natural language processing technology, involving multiple disciplines such as linguistics, computational linguistics, machine learning, and cognitive speech. Specifically, semantic parsing technology refers to the conversion of natural language text into structured semantic representations, so that computers can understand and execute human instructions. Semantic parsing technology can improve the efficiency and accuracy of human-computer interaction, and has broad application prospects in natural language processing, data analysis, intelligent customer service, smart home and other fields, especially in the era of big data; at the same time, with the development of technologies such as big data and artificial intelligence, data security has become a very important topic. The existing data security management can only search and match based on virus data features, and cannot realize dual data status security monitoring based on data features and real data usage scenarios, which reduces the security of data use.

[0003] The Chinese invention patent application with publication number CN118332574A discloses a network database access security monitoring system, which is provided with a distributed database module, an access information capture module, a security monitoring module, a database information encryption module and an early warning module; it is used to classify and partition network information data; when there is an access to the database, it preliminarily determines whether the access is a malicious access, and captures access information with the possibility of malicious access; and again determines whether the access information with the possibility of malicious access has a security risk; the access information with the security risk is encrypted in layers; when there is an access security risk, an early warning is displayed to realize the security monitoring of network database access; however, the above technical scheme cannot simultaneously perform dual data status security monitoring based on data characteristics and data usage scenarios, which reduces the security of database data access. Summary of the invention

[0004] 1. Technical issues to be resolved In order to solve the problem that the above-mentioned existing data security management can only search and match based on virus data characteristics, and cannot realize dual data status security monitoring based on data characteristics and actual data usage scenarios, thereby reducing the problem of data usage security, the above purpose is achieved by accurately collecting the original data to be tested, the original data storage location information, the original data extended feature information, accurately compiling the original data code information, scientifically analyzing the abnormal results of the original data code information, intelligently screening the optimal original data running program object, autonomously simulating the original data usage scenario status, accurately collecting the original data usage scenario status image, intelligently analyzing the abnormal status of the original data usage, and accurately feedback the original data information security monitoring results.

[0005] (II) Technical solution The present invention is implemented by the following technical solution: a data security monitoring method based on intelligent semantic analysis, the method comprising the following steps: S1. Collecting the original data to be tested, the original data storage location information and the original data extended feature information; S2, compiling the code data of the original data according to the original data to be tested and the characteristic data of different types of programming languages ​​to generate original data code information; S3, performing data feature abnormality analysis processing on the original data code based on the original data code information and the combination data of various programming code information of different types of viruses, generating original data code abnormality analysis data, and directly executing step S7 when there is an abnormality; S4. When there is no abnormality, searching and processing the application objects of the original data operation is performed based on the original data extended characteristic information, generating original data operation program object data and retrieving the usage score of each operation program object, and constructing original data operation program object score data; S5. Perform screening and processing of the optimal operating program object of the original data according to the operating program object and the scoring parameters of the original data, generate the optimal operating program object data of the original data, and perform the original data usage scenario state simulation operation; S6. Collect the original data usage scenario state image data and perform the original data usage scenario state abnormality analysis and processing with the virus data operation scenario state image data to generate the original data usage state abnormality analysis data. When there is no abnormality, directly end this data security monitoring operation; S7. When an abnormality occurs, data security monitoring result data is constructed and data security monitoring feedback operations are performed.

[0006] Preferably, the steps of collecting the original data to be tested, the original data storage location information and the original data extended feature information are as follows: S11. Collect the original data objects for data security monitoring online through the data input dialog box and generate the original data to be tested , the raw data to be tested includes any one of pictures, texts, audios and videos; Collect the specific data storage location of the original data object for data security monitoring online through the data input dialog box and generate the original data storage location information , the original data storage location information represents the location information of the original data in the server or computer; Collect the data extension feature parameters of the original data object for data security monitoring online through the data input dialog box and generate the original data extension feature information , the original data extended feature information represents the file type and format data of the original data.

[0007] Preferably, the steps of compiling the code data of the original data according to the original data to be tested and the characteristic data of different types of programming languages ​​to generate the original data code information are as follows: S21. Establishing feature data sets of different types of programming languages , ;in Indicates The programming languages ​​correspond to different types of programming language feature data. Indicates the maximum number of programming language types; the programming language types include C language, C++ language, Java language and Python language, and the characteristic data of different types of programming languages ​​represent the composition characteristic information of different types of programming languages ​​and syntax; S22, using a data processing large model to process the raw data to be tested According to the different types of programming language feature data to Compile data codes corresponding to different types of programming languages ​​in an orderly manner and generate a collection of original data code information ,in Indicates The programming language corresponds to the original data code information, and the data processing model includes any one of ChatGPT, Zhipu Qingyan, and Baidu Wenxin Yiyan.

[0008] Preferably, the data characteristic abnormality analysis processing of the original data code is performed based on the original data code information and the combination data of various programming code information of different types of viruses to generate the original data code abnormality analysis data. When there is an abnormality, the operation steps of directly executing step S7 are as follows: S31. Establishing a data set of information combinations of various programming codes for different types of viruses , ;in Indicates The data viruses correspond to different types of viruses and various programming code information combination data. Indicates the maximum value of the number of data virus types; data virus types include two-dimensional code viruses, mobile media viruses and web page viruses; the combination data of various programming code information of different types of viruses include the combination data of data codes of different types of data viruses compiled according to various types of programming languages; S32, using a bidirectional search algorithm to collect the original data code information The original data code information described in A data set that is ordered by programming language type number and combined with various programming code information of different types of viruses The combination data of various programming code information of different types of viruses described in Perform code data feature matching and generate raw data code anomaly analysis data based on the code data feature matching results ; when and The code data feature matching is successful, indicating the original data code information If there is data virus information in the data, the original data code abnormal analysis data will be output If there is an exception, directly execute step S7; when and The code data features are not matched successfully, indicating that the original data code information If there is no data virus information, the original data code abnormal analysis data is output There is no abnormality.

[0009] Preferably, when there is no abnormality, the steps of searching and processing the application objects of the original data operation based on the original data extended feature information, generating the original data operation program object data and retrieving the usage score of each operation program object, and constructing the original data operation program object score data are as follows: S41, using the BERT language model to expand feature information based on the original data Search the original data to be tested on the Internet platform The corresponding data runs the application objects required, and generates the original data running program object data set , ;in Indicates The raw data runs the program object data. Indicates the maximum number of running program types; the raw data running program object data indicates application data used to run raw data, and the Internet platform includes any one of Baidu, Sogou, 360 Search, and Yahoo; S42: Using the BERT language model to run the program object data set based on the original data The raw data described in the run program object data to Search the Internet platform for user rating data of running programs and generate a raw data running program object rating data set ,in Represents the raw data running program object data The corresponding raw data runner object scores data.

[0010] Preferably, the steps of performing screening processing on the optimal operating program object of the original data based on the operating program object and the scoring parameter of the original data, generating the optimal operating program object data of the original data and performing the simulation operation of the original data usage scenario state are as follows: S51: Running a program object on the original data to score a data set The raw data runner object scoring data described in Compare the scoring values ​​and analyze the original data with the largest scoring value to run the program object scoring data And generate the original data optimal running program object scoring data through data identification ; S52, using a unified cost search algorithm to optimize the original data to run the program object scoring data Run the program object data set in the original data according to the running program type number Search for the best running program object scoring data with the original data The corresponding raw data running program object data And generate the original data optimal operation program object data through data identification ; S53, the raw data to be tested Import the raw data to optimally run the program object data The original data usage scenario status simulation operation is executed in the corresponding running program object and displayed on the display screen.

[0011] Preferably, the steps of collecting the original data usage scenario status image data and performing the original data usage scenario status abnormality analysis and processing with the virus data operation scenario status image data to generate the original data usage status abnormality analysis data, and directly ending the data security monitoring operation when no abnormality exists are as follows: S61, collecting the original data usage scenario state image online by using screenshots during the original data usage scenario state simulation operation and generating an original data usage scenario state image data set , ;in Indicates the collected The original data uses scene state image data, Indicates the maximum number of scene state images used by the original data; S62: Establishing a virus data running scene state image data set , ;in Indicates The virus data running scene state image data corresponding to the virus data running scene state, Indicates the maximum number of virus data running scenario status types; virus data running scenario status types include abnormal restart of running program, abnormal restart of device running, abnormal deletion of data, abnormal copy of data, abnormal pop-up ad window, and abnormal hardware damage; S63: The original data is used as a scene state image data set The raw data described in the scene state image data is used A collection of image data of the state of the scene running with the virus data Virus data operation scene status image data described in Perform image feature matching and generate raw data based on the image feature matching results. Use state anomaly analysis data , execute to generate raw data and use the status anomaly analysis data The specific steps are as follows: S631, initializing parameters and updating the maximum number of iterations T of the algorithm; S632, initializing the running scene state identification seagull population position, that is, the running scene state identification seagull population is updated in the virus data running scene state image data set Position in the search space; S633: Calculate the virus data running scene state image data set All the virus data in the running scene status image data Use scene state image data with the raw data The fitness value is retained in the state image data set of the virus data running scene The search space uses scene state image data with the original data The virus data with the largest fitness value running scene state image data The global optimal position of S634, Migration, Global Search: There are three main steps to identify the migratory behavior of seagulls in the running scene state. The first step is to meet the image data set of the running scene state of the virus data. The search space has different running scene states to identify the conditions for avoiding collision between individual seagulls; the second is to calculate the image data set of the running scene state of the virus data The search space and the original data use scene state image data The virus data matching the running scene status image data The best position direction; the third is to use the scene state image data according to the original data The best matching virus data running scene state image data Move the direction of the best position to a new position; S6341, calculating the running scene state to identify the seagull in the virus data running scene state image data set Search space for new positions that do not collide with adjacent running scene states to identify seagulls during movement ; , ;in Indicates the running scene state recognition seagull in the virus data running scene state image data set The current position in the search space, Indicates the current iteration number; Indicates the running scene state recognition seagull in the virus data running scene state image data set Movement behavior in the search space; Indicates control A function of the frequency of change, Indicates the maximum number of iterations; S6342, calculating the image data set of the virus data running scene state The search space uses scene state image data with the original data The virus data matching the running scene status image data Best location ; , ,in Represents the image data set of the virus data running scene status Search the search space to find the scene state image data using the original data The virus data matching the running scene status image data The current best position of represents a random number that balances global and local search capabilities, Represents a random number in the interval [0, 1]; S6343, using scene state image data according to the original data The best matching virus data running scene state image data Move to the new position in the direction of the best position , , that is, according to the direction of the best position, the state image data set of the virus data running scene Search the search space to find the scene state image data using the original data The virus data matching the running scene status image data new location; S635, attacking prey, local search, running scene state recognition seagull running scene state image data set in the virus data Search space for attack and the original data using scene state image data The virus data matching the running scene status image data The seagull performs a spiral motion in the air when attacking prey, and the running scene state recognizes the new position of the seagull after attacking the prey. , , that is, the running scene state recognition seagull is the image data set of the running scene state of the virus data Search the search space to find the scene state image data using the original data The virus data matching the running scene status image data of prey; S636: Determine whether the maximum number of iterations is met, and then output the original data using the scene state image data. Image data of the scene status running with the virus data If the image feature matching result is not satisfied, return to step S633; S637: Using scene state image data according to the original data output in step S636 Image data of the scene status running with the virus data Image feature matching results and generate raw data using state anomaly analysis data ; when and The image feature matching is successful, indicating the original data code information If there is data virus information in the data, the original data is output and the status of abnormal analysis data is used For the existence of abnormalities; when and The image feature matching was unsuccessful, indicating that the original data code information If there is no data virus information, the original data is output and the status abnormality analysis data is used Since there is no abnormality, the data security monitoring operation is terminated directly at this time.

[0012] Preferably, when an abnormality occurs, the steps of constructing data security monitoring result data and performing data security monitoring feedback operations are as follows: S71, when the original data code is abnormal, analyze the data Use the status anomaly analysis data for the presence of anomalies or the raw data When there is an abnormality, the original data to be tested and the original data storage location information Combine data to construct data security monitoring result data ; S72, the data security monitoring result data The data is fed back to the data security monitoring terminal through the Internet of Things communication network to perform data security monitoring feedback operations.

[0013] A data security monitoring system based on intelligent semantic analysis, used to implement the data security monitoring method based on intelligent semantic analysis, the system includes a data feature security assessment module, a data usage scenario security assessment module, and a data security monitoring result feedback module; The data feature security assessment module includes a raw data acquisition unit to be tested, a raw data storage location information acquisition unit, a raw data extended feature information acquisition unit, a different type of programming language feature information storage unit, a raw data code information compilation unit, a different type of virus various programming code information combination parameter storage unit, and a raw data code data feature anomaly analysis unit; The original data acquisition unit to be tested acquires the original data to be tested through a data input dialog box; the original data storage location information acquisition unit acquires the original data storage location information through a data input dialog box; the original data extended feature information acquisition unit acquires the original data extended feature information through a data input dialog box; the different types of programming language feature information storage unit is used to store different types of programming language feature data; the original data code information compilation unit performs code data compilation processing of the original data according to the original data to be tested and the different types of programming language feature data based on semantic analysis to generate original data code information; the different types of virus various types of programming code information combination parameter storage unit is used to store various types of programming code information combination data of different types of viruses; the original data code data feature abnormality analysis unit performs data feature abnormality analysis processing of the original data code according to the original data code information and the various types of programming code information combination data of different types of viruses to generate original data code abnormality analysis data; The data usage scenario security assessment module includes an original data running program object search unit, an original data running program object scoring search unit, an original data optimal running program object search unit, an original data usage scenario state simulation unit, an original data usage scenario state image acquisition unit, a virus data running scenario state image storage unit, and an original data usage abnormal state analysis unit; The original data running program object search unit performs a search process for application objects running on the original data based on the original data extended feature information to generate original data running program object data; the original data running program object score search unit retrieves the usage score of each running program object according to the original data running program object data to construct the original data running program object score data; the original data optimal running program object search unit performs a screening process for the original data optimal running program object according to the running program object and the score parameter of the original data to generate the original data optimal running program object data; the original data usage scenario state simulation unit performs an original data usage scenario state simulation operation according to the original data optimal running program object data; the original data usage scenario state image acquisition unit acquires the original data usage scenario state image data through screen capture; the virus data running scenario state image storage unit is used to store the virus data running scenario state image data; the original data usage abnormal state analysis unit performs an original data usage scenario state abnormality analysis process on the original data usage scenario state image data and the virus data running scenario state image data to generate the original data usage state abnormality analysis data; The data security monitoring result feedback module includes a data security monitoring result parameter generation unit and a data security monitoring result information feedback unit; The data security monitoring result parameter generation unit is used to construct data security monitoring result data; the data security monitoring result information feedback unit performs a data security monitoring feedback operation based on the data security monitoring result data.

[0014] (III) Beneficial effects The present invention provides a data security monitoring method and system based on intelligent semantic analysis, which has the following beneficial effects: 1. Accurately obtain the original data to be tested, the storage location information and extended feature information of the original data through the data input dialog box, and provide reliable data support for subsequent data feature and data usage scenario analysis; scientifically preset different types of programming language feature parameters combined with the data processing large model to perform intelligent processing of raw data code compilation based on semantic analysis and the original parameters to be tested, and realize intelligent raw data code compilation processing based on semantic analysis; standard storage of various types of virus programming code information combination parameters combined with intelligent search algorithm raw data code to perform scientific analysis of raw data code characteristics, realize data security monitoring based on raw data characteristics, and improve the accuracy of data security monitoring results.

[0015] 2. Through precise screening and processing of the optimal running program objects of raw data, data support is provided for the simulation of the real usage scenarios of raw data; based on the optimal running program objects of raw data, the usage scenario status of raw data is autonomously and accurately simulated; through online collection of raw data usage scenario status image parameters through screenshots, combined with intelligent recognition algorithms and virus data running scenario status image parameters, scientific analysis of the abnormal status of the real usage scenario status of raw data is carried out, realizing dual data status security monitoring based on data characteristics and real data usage scenarios, thereby improving the accuracy and security of data security monitoring.

[0016] 3. Through the scientific construction of data security monitoring result parameters for data with abnormal data characteristics and usage scenario status, efficient and accurate collection of data security monitoring result information is achieved; the data security monitoring results are autonomously and efficiently fed back to the data security monitoring end through IoT communication, realizing dynamic feedback of data security monitoring results, improving the response efficiency of data monitoring, and ensuring the security of data use. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 A schematic diagram of a module of a data security monitoring system based on intelligent semantic analysis provided by the present invention; Figure 2 A flow chart of a data security monitoring method based on intelligent semantic analysis provided by the present invention. DETAILED DESCRIPTION

[0018] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0019] The embodiments of the data security monitoring method and system based on intelligent semantic analysis are as follows: Embodiment 1: See also Figure 1 - Figure 2 , a data security monitoring method based on intelligent semantic analysis, the method comprises the following steps: S1. Collecting the original data to be tested, the original data storage location information and the original data extended feature information; S2. Compile and process the code data of the original data according to the original data to be tested and the characteristic data of different types of programming languages ​​to generate the original data code information; S3, performing data feature anomaly analysis and processing of the original data code based on the original data code information and the combination data of various programming code information of different types of viruses, generating original data code anomaly analysis data, and directly executing step S7 when an anomaly exists; S4. When there is no abnormality, search and process the application object running on the original data based on the extended characteristic information of the original data, generate the original data running program object data and retrieve the usage score of each running program object, and construct the original data running program object score data; S5. Perform screening and processing of the optimal operating program object of the original data according to the operating program object and the scoring parameters of the original data, generate the optimal operating program object data of the original data, and perform the original data usage scenario state simulation operation; S6. Collect the original data usage scenario state image data and perform the original data usage scenario state abnormality analysis and processing with the virus data operation scenario state image data to generate the original data usage state abnormality analysis data. When there is no abnormality, directly end this data security monitoring operation; S7. When an abnormality occurs, data security monitoring result data is constructed and data security monitoring feedback operations are performed.

[0020] For further information, see Figure 1 - Figure 2 The steps for collecting the original data to be tested, the original data storage location information and the original data extended feature information are as follows: S11. Collect the original data objects for data security monitoring online through the data input dialog box and generate the original data to be tested ,The original data to be tested includes any one of pictures, texts, audios and videos; Collect the specific data storage location of the original data object for data security monitoring online through the data input dialog box and generate the original data storage location information , the original data storage location information represents the location information of the original data in the server or computer; Collect the data extension feature parameters of the original data object for data security monitoring online through the data input dialog box and generate the original data extension feature information ,The raw data extended feature information represents the file type and format data of the raw data.

[0021] The steps for compiling the code data of the original data and generating the code information of the original data are as follows: S21. Establishing feature data sets of different types of programming languages , ;in Indicates The programming languages ​​correspond to different types of programming language feature data. Indicates the maximum number of programming language types; programming language types include C language, C++ language, Java language and Python language. Different types of programming language feature data represent the component feature information of different types of programming languages ​​and syntax; S22, using the data processing model to convert the original data to be tested Feature data by different types of programming languages to Compile data codes corresponding to different types of programming languages ​​in an orderly manner and generate a collection of original data code information ,in Indicates The programming languages ​​correspond to the original data code information, and the data processing models include any one of ChatGPT, Zhipu Qingyan, and Baidu Wenxin Yiyan.

[0022] According to the original data code information and the combination data of various programming code information of different types of viruses, the data feature abnormality analysis and processing of the original data code are performed to generate the original data code abnormality analysis data. When there is an abnormality, the operation steps of directly executing step S7 are as follows: S31. Establishing a data set of information combinations of various programming codes for different types of viruses , ;in Indicates The data viruses correspond to different types of viruses and various programming code information combination data. Indicates the maximum value of the number of data virus types; data virus types include QR code viruses, mobile media viruses and web page viruses; the combined data of various programming code information of different types of viruses include the combined data of data codes of different types of data viruses compiled in various types of programming languages; S32, using a bidirectional search algorithm to collect the original data code information Original data code information A data set that is ordered by programming language type and combined with various programming code information of different types of viruses Different types of viruses, various programming code information combination data Perform code data feature matching and generate raw data code anomaly analysis data based on the code data feature matching results ; when and The code data feature matching is successful, indicating the original data code information If there is data virus information in the data, the original data code abnormal analysis data will be output If there is an exception, directly execute step S7; when and The code data features were not matched successfully, indicating that the original data code information If there is no data virus information, the original data code abnormal analysis data is output There is no abnormality.

[0023] Through the cooperation between the original data acquisition unit to be tested, the original data storage location information acquisition unit, and the original data extended feature information acquisition unit, the data input dialog box is used to accurately obtain the original data to be tested, the storage location information of the original data and the extended feature information, so as to provide reliable data support for the subsequent data feature and data usage scenario analysis; the different types of programming language feature information storage units and the original data code information compilation units cooperate with each other, and scientifically preset different types of programming language feature parameters are combined with the data processing large model to perform intelligent processing of raw data code compilation based on semantic analysis and the original parameters to be tested, so as to realize intelligent raw data code compilation processing based on semantic analysis; the storage units for various types of programming code information combination parameters of different types of viruses and the original data code data feature anomaly analysis units cooperate with each other, and standard storage of various types of programming code information combination parameters of different types of viruses is combined with the original data code of the intelligent search algorithm to perform scientific analysis of the original data code features, so as to realize data security monitoring based on the original data features and improve the accuracy of the data security monitoring results.

[0024] For further information, see Figure 1 - Figure 2 , when there is no exception, the original data running application object search processing is performed based on the original data extended feature information, the original data running program object data is generated and the usage score of each running program object is retrieved, and the operation steps for constructing the original data running program object score data are as follows: S41. Use the BERT language model to expand feature information based on original data Search the Internet platform for the original data to be tested The corresponding data runs the application objects required, and generates the original data running program object data set , ;in Indicates The raw data runs the program object data. Indicates the maximum number of running program types; the raw data running program object data indicates the application data used to run the raw data, and the Internet platform includes any one of Baidu, Sogou, 360 Search, and Yahoo; S42. Use the BERT language model to run the program object data set based on the original data Raw data in Runtime object data to Search the Internet platform for user rating data of running programs and generate a raw data running program object rating data set ,in Represents raw data running program object data The corresponding raw data runner object scores data.

[0025] The steps for screening the optimal running program object of the original data according to the running program object and scoring parameters of the original data, generating the optimal running program object data of the original data and performing the simulation operation of the original data usage scenario state are as follows: S51. Run program object scoring data set on original data Raw data in the runner object scoring data Compare the scoring values ​​and analyze the original data with the largest scoring value. Run the program object scoring data And generate the original data optimal running program object scoring data through data identification ; S52, using a unified cost search algorithm to optimize the original data to run the program object scoring data Run the program object data collection in the original data according to the running program type number Search for the best running program object scoring data with the original data Corresponding raw data running program object data And generate the original data optimal operation program object data through data identification ; S53, the original data to be tested Import raw data to optimize program object data The original data usage scenario status simulation operation is executed in the corresponding running program object and displayed on the display screen.

[0026] Collect the original data usage scenario status image data and perform the original data usage scenario status abnormality analysis and processing with the virus data operation scenario status image data to generate the original data usage status abnormality analysis data. When there is no abnormality, the operation steps to directly end this data security monitoring operation are as follows: S61, collecting the original data usage scenario state image online by using screenshots during the original data usage scenario state simulation operation and generating an original data usage scenario state image data set , ;in Indicates the collected The original data uses scene state image data, Indicates the maximum number of scene state images used by the original data; S62: Establishing a virus data running scene state image data set , ;in Indicates The virus data running scene state image data corresponding to the virus data running scene state, Indicates the maximum number of virus data running scenario status types; virus data running scenario status types include abnormal restart of running program, abnormal restart of device running, abnormal deletion of data, abnormal copy of data, abnormal pop-up ad window, and abnormal hardware damage; S63: Set the original data using scene state image data The original data in the scene state image data is used Image data collection of running scene status with virus data Virus data running scene status image data Perform image feature matching and generate raw data based on the image feature matching results. Use state anomaly analysis data , execute to generate raw data and use the status anomaly analysis data The specific steps are as follows: S631, initializing parameters and updating the maximum number of iterations T of the algorithm; S632, initializing the running scene state to identify the position of the seagull population, that is, the running scene state to identify the seagull population is updated in the virus data running scene state image data set Position in the search space; S633: Calculate virus data running scene state image data set All virus data in the running scene status image data Use scene state image data with raw data The fitness value is retained in the virus data running scene state image data set Using scene state image data in the search space together with the original data Image data of the virus data with the largest fitness value running scene status The global optimal position of S634, Migration, Global Search: There are three main steps to identify the migratory behavior of seagulls in the running scene state. The first step is to meet the image data set of the running scene state in the virus data. The search space is used to identify the conditions for avoiding collisions between individual seagulls in different operating scene states; the second is to calculate the image data set of the operating scene state in the virus data Search space and original data using scene state image data Matching virus data running scene status image data The best position direction; third, based on the original data using scene state image data Best matching virus data running scene status image data Move the direction of the best position to a new position; S6341, calculate the running scene state to identify the seagull in the virus data running scene state image data set Search space for new positions that do not collide with adjacent running scene states to identify seagulls during movement ; , ;in Represents the running scene state recognition seagull in the virus data running scene state image data collection The current position in the search space, Indicates the current iteration number; Represents the running scene state recognition seagull in the virus data running scene state image data collection Movement behavior in the search space; Indicates control A function of the frequency of change, Indicates the maximum number of iterations; S6342, calculate the image data set of the virus data running scene state Using scene state image data in the search space together with the original data Matching virus data running scene status image data Best location ; , ,in Represents a collection of image data representing the status of virus data running scenarios Search the search space to find the scene state image data that is consistent with the original data Matching virus data running scene status image data The current best position of represents a random number that balances global and local search capabilities, Represents a random number in the interval [0, 1]; S6343, based on the use of scene state image data with the original data Best matching virus data running scene status image data Move to the new position in the direction of the best position , , that is, according to the direction of the best position in the virus data running scene state image data set Search the search space to find the scene state image data that is consistent with the original data Matching virus data running scene status image data new location; S635, attack prey, local search, run scene state recognition seagull in virus data run scene state image data collection Attack and original data in the search space using scene state image data Matching virus data running scene status image data The seagull performs a spiral motion in the air when attacking prey, and the running scene state recognizes the new position of the seagull after attacking the prey. , , that is, the running scene state recognition seagull in the virus data running scene state image data set Search the search space to find the scene state image data that is consistent with the original data Matching virus data running scene status image data of prey; S636: Determine whether the maximum number of iterations is met, then output the original data using the scene state image data Running scene status image data with virus data If the image feature matching result is not satisfied, return to step S633; S637: Using scene state image data according to the original data output in step S636 Running scene status image data with virus data Image feature matching results and generate raw data using state anomaly analysis data ; when and Image feature matching is successful, indicating the original data code information If there is data virus information in the data, the original data is output and the status of abnormal analysis data is used For the existence of abnormalities; when and Image feature matching failed, indicating that the original data code information If there is no data virus information, the original data is output and the status abnormality analysis data is used Since there is no abnormality, the data security monitoring operation is terminated directly at this time.

[0027] Through the cooperation among the original data running program object search unit, the original data running program object scoring search unit and the original data optimal running program object search unit, the optimal running program object of the original data is accurately screened and processed, providing data support for the simulation of the real usage scenario of the original data; the original data usage scenario state simulation unit performs autonomous and accurate simulation operations on the usage scenario state of the original data according to the optimal running program object of the original data; the original data usage scenario state image acquisition unit and the original data usage abnormal state analysis unit cooperate with each other, collect the original data usage scenario state image parameters online through screenshots, and combine the intelligent recognition algorithm with the virus data running scenario state image parameters to perform scientific analysis of the abnormal state of the real usage scenario state of the original data, thereby realizing dual data state security monitoring based on data characteristics and real data usage scenarios, and improving the accuracy and security of data security monitoring.

[0028] For further information, see Figure 1 - Figure 2 , when there is an anomaly, the steps to construct the data security monitoring result data and perform the data security monitoring feedback operation are as follows: S71. Analyze data when the original data code is abnormal Use state anomaly analysis data for anomalies or raw data When there is an abnormality, the original data to be tested and original data storage location information Combine data to construct data security monitoring result data ; S72. Data security monitoring result data The data is fed back to the data security monitoring terminal through the Internet of Things communication network to perform data security monitoring feedback operations.

[0029] Through the data security monitoring result parameter generation unit, data security monitoring result parameters are scientifically constructed for data with abnormal data characteristics and usage scenario status, so as to realize efficient and accurate collection of data security monitoring result information; the data security monitoring result information feedback unit autonomously and efficiently feeds back the data security monitoring results to the data security monitoring terminal through the Internet of Things communication, so as to realize dynamic feedback of data security monitoring results, improve the response efficiency of data monitoring, and ensure the security of data use.

[0030] Embodiment 2: See also Figure 1 - Figure 2 , a data security monitoring system based on intelligent semantic analysis, a data security monitoring method based on intelligent semantic analysis is implemented, the system includes a data feature security assessment module, a data usage scenario security assessment module, and a data security monitoring result feedback module; The data feature security assessment module includes a raw data acquisition unit to be tested, a raw data storage location information acquisition unit, a raw data extended feature information acquisition unit, a different type of programming language feature information storage unit, a raw data code information compilation unit, a different type of virus various programming code information combination parameter storage unit, and a raw data code data feature anomaly analysis unit; The original data acquisition unit to be tested is used to collect the original data to be tested through the data input dialog box; the original data storage location information acquisition unit is used to collect the original data storage location information through the data input dialog box; the original data extended feature information acquisition unit is used to collect the original data extended feature information through the data input dialog box; the different types of programming language feature information storage unit is used to store the different types of programming language feature data; the original data code information compilation unit is used to compile the code data of the original data according to the original data to be tested and the different types of programming language feature data based on semantic analysis to generate the original data code information; the different types of virus various programming code information combination parameter storage unit is used to store the different types of virus various programming code information combination data; the original data code data feature anomaly analysis unit is used to analyze the original data code data feature anomaly according to the original data code information and the different types of virus various programming code information combination data to generate the original data code anomaly analysis data; The data usage scenario security assessment module includes an original data running program object search unit, an original data running program object scoring search unit, an original data optimal running program object search unit, an original data usage scenario state simulation unit, an original data usage scenario state image acquisition unit, a virus data running scenario state image storage unit, and an original data usage abnormal state analysis unit; A raw data running program object search unit, which searches for application objects running on raw data based on raw data extended feature information to generate raw data running program object data; a raw data running program object scoring search unit, which retrieves the usage score of each running program object based on raw data running program object data to construct raw data running program object scoring data; a raw data optimal running program object search unit, which performs raw data optimal running program object screening processing based on raw data running program objects and scoring parameters to generate raw data optimal running program object data; a raw data usage scenario state simulation unit, which performs raw data usage scenario state simulation operations based on raw data optimal running program object data; a raw data usage scenario state image acquisition unit, which acquires raw data usage scenario state image data through screenshots; a virus data running scenario state image storage unit, which is used to store virus data running scenario state image data; a raw data usage abnormal state analysis unit, which performs raw data usage scenario state abnormality analysis processing on raw data usage scenario state image data and virus data running scenario state image data to generate raw data usage state abnormality analysis data; The data security monitoring result feedback module includes a data security monitoring result parameter generation unit and a data security monitoring result information feedback unit; The data security monitoring result parameter generation unit is used to construct the data security monitoring result data; the data security monitoring result information feedback unit performs the data security monitoring feedback operation according to the data security monitoring result data.

[0031] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A data security monitoring method based on intelligent semantic analysis, characterized in that: The method comprises the following steps: S1. Collecting the original data to be tested, the original data storage location information and the original data extended feature information; S2, compiling the code data of the original data according to the original data to be tested and the characteristic data of different types of programming languages ​​to generate original data code information; S3, performing data feature anomaly analysis and processing of the original data code based on the original data code information and the combination data of various programming code information of different types of viruses, generating original data code anomaly analysis data, and directly executing step S7 when an anomaly exists; S4. When there is no abnormality, searching and processing the application objects of the original data operation is performed based on the original data extended characteristic information, generating original data operation program object data and retrieving the usage score of each operation program object, and constructing original data operation program object score data; S5. Perform screening and processing of the optimal operating program object of the original data according to the operating program object and the scoring parameters of the original data, generate the optimal operating program object data of the original data, and perform the original data usage scenario state simulation operation; S6. Collect the original data usage scenario status image data and perform the original data usage scenario status abnormality analysis and processing with the virus data operation scenario status image data to generate the original data usage status abnormality analysis data. When there is no abnormality, directly end this data security monitoring operation; S7. When an abnormality occurs, data security monitoring result data is constructed and data security monitoring feedback operations are performed.

2. According to claim 1, a data security monitoring method based on intelligent semantic analysis is characterized in that: The S1 comprises the following steps: S11. Collect the original data objects for data security monitoring online through the data input dialog box and generate the original data to be tested ; Collect the specific data storage location of the original data object for data security monitoring online through the data input dialog box and generate the original data storage location information ; Collect the data extension feature parameters of the original data object for data security monitoring online through the data input dialog box and generate the original data extension feature information .

3. According to claim 2, a data security monitoring method based on intelligent semantic analysis is characterized in that: The S2 comprises the following steps: S21. Establishing feature data sets of different types of programming languages , ;in Indicates The programming languages ​​correspond to different types of programming language feature data. Indicates the maximum number of programming language types; S22, using a data processing large model to process the raw data to be tested According to the different types of programming language feature data to Compile data codes corresponding to different types of programming languages ​​in an orderly manner and generate a collection of original data code information ,in Indicates The programming language corresponds to the original data code information.

4. The data security monitoring method based on intelligent semantic analysis according to claim 3 is characterized in that: The S3 comprises the following steps: S31. Establishing a data set of information combinations of various programming codes for different types of viruses , ;in Indicates The data viruses correspond to different types of viruses and various programming code information combination data. Indicates the maximum number of data virus types; S32, using a bidirectional search algorithm to collect the original data code information The original data code information described in A data set that is ordered by programming language type number and combined with various programming code information of different types of viruses The combination data of various programming code information of different types of viruses described in Perform code data feature matching and generate raw data code anomaly analysis data based on the code data feature matching results ; when and If the code data feature matching is successful, the original data code abnormality analysis data will be output If there is an exception, directly execute step S7; when and If the code data features are not matched successfully, the original data code abnormality analysis data will be output There is no abnormality.

5. The data security monitoring method based on intelligent semantic analysis according to claim 4 is characterized in that: When there is no abnormality, S4 includes the following steps: S41, using the BERT language model to expand feature information based on the original data Search the original data to be tested on the Internet platform The corresponding data runs the application objects required, and generates the original data running program object data set , ;in Indicates The raw data runs the program object data. Indicates the maximum number of running program types; S42: Using the BERT language model to run the program object data set based on the original data The raw data described in the run program object data to Search the Internet platform for user rating data of running programs and generate a raw data running program object rating data set ,in Represents the raw data running program object data The corresponding raw data runner object scores data.

6. The data security monitoring method based on intelligent semantic analysis according to claim 5 is characterized by: The S5 comprises the following steps: S51: Running a program object on the original data to score a data set The raw data runner object scoring data described in Compare the scoring values ​​and analyze the original data with the largest scoring value to run the program object scoring data And generate the original data optimal running program object scoring data through data identification ; S52, using a unified cost search algorithm to optimize the original data to run the program object scoring data Run the program object data set in the original data according to the running program type number Search for the best running program object scoring data with the original data The corresponding raw data running program object data And generate the original data optimal operation program object data through data identification ; S53, the raw data to be tested Import the raw data to optimally run the program object data The original data usage scenario status simulation operation is executed in the corresponding running program object and displayed on the display screen.

7. The data security monitoring method based on intelligent semantic analysis according to claim 6 is characterized by: The S6 comprises the following steps: S61, collecting the original data usage scenario state image online by using screenshots during the original data usage scenario state simulation operation and generating an original data usage scenario state image data set , ;in Indicates the collected The original data uses scene state image data, Indicates the maximum number of scene state images used by the original data; S62: Establishing a virus data running scene state image data set , ;in Indicates The virus data running scene state image data corresponding to the virus data running scene state, Indicates the maximum number of virus data running scenario status types; S63: The original data is used as a scene state image data set The raw data described in the scene state image data is used A collection of image data of the state of the scene running with the virus data Virus data described in the running scene status image data Perform image feature matching and generate raw data based on the image feature matching results. Use state anomaly analysis data , execute to generate raw data and use the status anomaly analysis data The specific steps are as follows: S631, initializing parameters and updating the maximum number of iterations T of the algorithm; S632, initializing the running scene state identification seagull population position, that is, the running scene state identification seagull population is updated in the virus data running scene state image data set Position in the search space; S633: Calculate the virus data running scene state image data set All the virus data in the running scene status image data Use scene state image data with the raw data The fitness value is retained in the state image data set of the virus data running scene The search space uses scene state image data with the original data The virus data with the largest fitness value running scene state image data The global optimal position of S634, Migration, Global Search: There are three main steps to identify the migratory behavior of seagulls in the running scene state. The first step is to meet the image data set of the running scene state of the virus data. The search space has different running scene states to identify the conditions for avoiding collision between individual seagulls; the second is to calculate the image data set of the running scene state of the virus data The search space and the original data use scene state image data The virus data matching the running scene status image data The best position direction; the third is to use the scene state image data according to the original data The best matching virus data running scene state image data Move the direction of the best position to a new position; S6341, calculating the running scene state to identify the seagull in the virus data running scene state image data set Search space for new positions that do not collide with adjacent running scene states to identify seagulls during movement ; S6342, calculating the image data set of the virus data running scene state The search space uses scene state image data with the original data The virus data matching the running scene status image data Best location ; S6343, using scene state image data according to the original data The best matching virus data running scene state image data Move to the new position in the direction of the best position ; S635, attacking prey, local search, running scene state recognition seagull running scene state image data set in the virus data Search space for attack and the original data using scene state image data The virus data matching the running scene status image data The seagull performs a spiral motion in the air when attacking prey, and the running scene state recognizes the new position of the seagull after attacking the prey. ; S636: Determine whether the maximum number of iterations is met, and then output the original data using the scene state image data. Image data of the scene status running with the virus data If the image feature matching result is not satisfied, return to step S633; S637: Using scene state image data according to the original data output in step S636 Image data of the scene status running with the virus data Image feature matching results and generate raw data using state anomaly analysis data ; when and If the image feature matching is successful, the original data is output and the abnormal state analysis data is used For the existence of abnormalities; when and If image feature matching is unsuccessful, the original data is output and the abnormal state analysis data is used. Since there is no abnormality, the data security monitoring operation is terminated directly at this time.

8. The data security monitoring method based on intelligent semantic analysis according to claim 7 is characterized by: The S7 comprises the following steps: S71, when the original data code is abnormal, analyze the data Use the status anomaly analysis data for the presence of anomalies or the raw data When there is an abnormality, the original data to be tested and the original data storage location information Combine data to construct data security monitoring result data ; S72, the data security monitoring result data The data is fed back to the data security monitoring terminal through the Internet of Things communication network to perform data security monitoring feedback operations.

9. A data security monitoring system based on intelligent semantic analysis, used to implement a data security monitoring method based on intelligent semantic analysis as claimed in any one of claims 1 to 8, characterized in that: The system includes a data feature security assessment module, a data usage scenario security assessment module, and a data security monitoring result feedback module.

Images