Method and system for enhancing computer data security

Abstract

The invention relates to the technical field of information security, in particular to a method and system for enhancing computer data security. The method comprises the following steps: performing dynamic security environment assessment processing by using computer terminal equipment to generate dynamic security environment assessment data; performing execution cycle feature analysis on the application program through the dynamic security environment evaluation data to generate multi-mode program execution feature data; performing dynamic privacy data flow tracking according to the multi-modal program execution feature data, and generating dynamic privacy data flow path data; constructing a trusted execution environment according to the dynamic private data flow path data, and generating a private trusted execution environment; performing dynamic security storage and access processing by using the privacy trusted execution ring to obtain a security data storage and access strategy; and performing security situation awareness processing based on the security data storage and access strategy to obtain adaptive security control data. Omnibearing privacy data protection is realized through security situation awareness.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a method and system for enhancing computer data security. Background Art

[0002] With the rapid development of science and technology, computers have become an important tool for people's work and life, and data security issues have become increasingly prominent. With the widespread application of technologies such as the Internet, big data, and cloud computing, a large amount of personal privacy information is digitally stored and transmitted, resulting in an explosive growth in the generation, storage, and transmission of data, which has brought unprecedented challenges to privacy protection. Personal privacy information includes identity information, location information, health information, web browsing history, etc. Once these private data are leaked or abused, it will cause huge economic losses to individuals and society. In practical applications, how to truly achieve "data available but invisible" and prevent privacy leakage is still an urgent problem to be solved. However, traditional security measures are usually built on a single line of defense, such as firewall protection, traditional antivirus software, etc. These methods are all for system-level security protection. Even if the system-level protection is in place, when there are vulnerabilities at the application or file level, it is still easy to cause the leakage of user privacy information if it cannot accurately identify and block the privacy data leakage behavior against the application or file. Summary of the invention

[0003] Based on this, the present invention provides a method and system for enhancing computer data security to solve at least one of the above technical problems.

[0004] To achieve the above object, a method for enhancing computer data security comprises the following steps:

[0005] Step S1: Perform device environment detection using a computer terminal device to generate device environment detection data; perform dynamic security environment assessment processing based on the device environment detection data to generate dynamic security environment assessment data; perform execution cycle feature analysis on the application program using the dynamic security environment assessment data to generate multi-modal program execution feature data;

[0006] Step S2: performing discrete feature encoding processing on the multimodal program execution feature data to generate multimodal feature vector matrix data; performing dynamic data flow processing according to the multimodal feature vector matrix data to generate a program dynamic data flow graph; tracing the dynamic privacy data flow according to the program dynamic data flow graph to generate dynamic privacy data flow path data; using a computer terminal device to construct a trusted execution environment for the dynamic privacy data flow path data to generate a privacy trusted execution environment;

[0007] Step S3: Submit the private data through the application to obtain the user's private data; use the privacy trusted execution environment to dynamically and securely access the user's private data to obtain a secure data access strategy;

[0008] Step S4: Based on the security data access strategy, the computer terminal device is used to perceive the security situation of the user to obtain security situation risk assessment data; adaptive security monitoring processing is performed according to the security situation risk assessment data to obtain adaptive security control data.

[0009] The present invention can obtain real-time device operation status information, including hardware performance, operating system stability, network connection status, etc., by performing in-depth detection on computer terminal devices. This process helps to identify potential hardware failures, software conflicts or network security risks, thereby preventing device failures in advance and improving device operation efficiency. Based on real-time device environment data, a comprehensive assessment of the system's security status is performed to assess whether the current system environment of the computer device is a high-risk or low-risk environment. A high-risk environment can alarm in real time to solve these risks and ensure that the application is tested in a low-risk environment. The key to deeply understanding and improving program performance is to analyze the execution cycle characteristics of the application through dynamic security environment assessment data. They cover multiple dimensions of program execution, such as time, space, resource consumption, etc., and provide detailed basis for program optimization, performance tuning and troubleshooting. Discrete feature encoding of multimodal program execution feature data can convert complex data structures into matrix forms that are easy to process, which is conducive to improving the efficiency and accuracy of data analysis. In this way, the mode and behavior of program operation can be better understood. The dynamic data flow graph of the program is generated by using the eigenvector matrix to intuitively depict the data flow path when the program is running, effectively analyze the internal working mechanism of the program, find and fix errors in data processing, and detect data leakage paths to enhance data security. Through the data flow graph, dynamic privacy data flow tracking can be used to understand the flow of sensitive information in real time. Using terminal devices to build a trusted execution environment for dynamic privacy data flow path data can create an isolated and secure execution environment to ensure the integrity and confidentiality of privacy data during processing. Processing user privacy data in a privacy trusted execution environment can strictly control data access and use to prevent unauthorized access and leakage. This environment provides a high level of protection for data, ensuring the security of privacy data even when other parts of the system are attacked, and improving the overall security level of the system. Dynamic security access processing can adjust data access control policies in real time according to changes in system operation status, improve data security, and ensure that legitimate users can smoothly access the required data. Security situation awareness for users can monitor and evaluate the security status of users in real time during the use of devices. This includes identifying potential threats, vulnerabilities and abnormal behaviors, and evaluating the impact of these risks on user data and system security. These data provide a quantitative analysis of the user's current security status, helping the user understand the severity and urgency of potential risks and ensuring the user's information security in various usage scenarios.Therefore, a method for enhancing computer data security of the present invention performs risk environment assessment on computer equipment in advance to ensure that the computer equipment itself is in a safe state when the application is tested; through application testing, the characteristic conditions of application execution data are obtained, and a program dynamic data flow graph is constructed based on these characteristic data, and dynamic privacy data flow tracking is performed based on the program dynamic data flow graph, thereby constructing a privacy executable environment to ensure the integrity and confidentiality of privacy data during the processing process. The computer equipment is aware of the security situation, the data protection capability is improved in all aspects, and the risk of privacy data loss or theft is effectively reduced.

[0010] Preferably, step S1 comprises the following steps:

[0011] Step S11: Perform device identity authentication using a computer terminal device to generate device identity authentication data;

[0012] Step S12: Perform device environment detection according to the device identity authentication data to generate device environment detection data, wherein the device environment detection data includes operating system status analysis data, network environment detection data and device hardware data;

[0013] Step S13: Perform dynamic security environment assessment processing according to the device environment detection data to generate dynamic security environment assessment data;

[0014] Step S14: using a preset environmental risk threshold to judge the environmental risk of the dynamic security environment assessment data, and when the dynamic security environment assessment data is lower than the environmental risk threshold, marking the computer terminal device as low-risk operating environment data;

[0015] Step S15: When the dynamic security environment assessment data is higher than or equal to the environmental risk threshold, the computer terminal device is marked as high-risk operating environment data; risk environment alarm processing is performed according to the high-risk operating environment data to generate risk environment alarm data; the user performs real-time risk processing through the risk environment alarm data until the dynamic security environment assessment data is lower than the environmental risk threshold, and risk environment feedback data is generated;

[0016] Step S16: Analyze the execution cycle characteristics of the application program using the risk environment feedback data and the low-risk operating environment data to generate multi-modal program execution characteristic data.

[0017] The present invention utilizes computer terminal equipment to perform device identity authentication, ensuring that the identity of the device is authentic and reliable, avoiding the risk of access by unauthorized devices or illegal users, and thus improving the overall security of the system. Device environment detection is performed based on device identity authentication data, and the operating system, network and hardware conditions of the device are comprehensively analyzed to help fully understand the operating environment of the device. Dynamic security environment assessment and processing are performed based on device environment detection data, so that potential security threats in the device environment can be identified and evaluated in a timely manner, making security management more flexible and real-time. Environmental risk judgment is performed on dynamic security environment assessment data using preset environmental risk thresholds, providing a timely risk warning and response mechanism, ensuring that high-risk environments can be quickly identified and processed, reducing the impact of potential security threats, and ensuring that they are in a low-risk environment. By analyzing the execution characteristics of the application, the execution mode of the program can be identified and optimized, further improving the security and performance of the system.

[0018] Preferably, step S16 comprises the following steps:

[0019] Step S161: Perform security environment credential processing according to the risk environment feedback data and the low-risk operating environment data to generate security environment credential data;

[0020] Step S162: Design a program cycle execution test for the application based on the security environment credential data, and generate program execution test event data;

[0021] Step S163: collecting user operation behavior logs according to program execution test event data to generate user operation behavior data;

[0022] Step S164: Monitor user network requests based on the user operation behavior data to obtain user request interaction data; track system resources based on the user operation behavior data to generate system resource tracking data; audit file operations based on the user operation behavior data to generate file operation audit data;

[0023] Step S165: performing context association analysis on the user request interaction data, the system resource tracking data, and the file operation audit data to generate context detection association data;

[0024] Step S166: performing time series feature processing according to the context detection associated data to generate time series detection associated data;

[0025] Step S167: Perform multimodal data fusion processing based on the time series detection associated data to obtain multimodal program execution feature data.

[0026] The present invention processes security environment credentials according to risk environment feedback data and low-risk operating environment data, thereby ensuring that the generated credentials can accurately reflect the security status of the current environment. Comprehensively test the performance of the application in different operating scenarios, and the stability and security of the application in actual operation. Collect user operation behavior logs based on program execution test event data, record the user's operation behavior in detail, comprehensively monitor the user's network requests, system resource usage and file operations, and comprehensively cover all aspects of user behavior, thereby providing a more comprehensive security analysis perspective. By correlating and analyzing different types of data, potential security threats and abnormal behaviors can be identified, thereby improving the accuracy and comprehensiveness of detection. Using time series analysis technology, the characteristics of user behavior and system status changing over time are identified, thereby discovering potential trends and laws. By fusing data of different modes, comprehensive feature data is formed, thereby more accurately evaluating the operating status and security risks of the application, and improving the overall security monitoring and management level.

[0027] Preferably, step S2 comprises the following steps:

[0028] Step S21: performing feature dimensionality reduction processing on the multimodal program execution feature data to generate dimensionality-reduced multimodal execution feature data;

[0029] Step S22: performing discrete feature encoding processing according to the dimension-reduced multimodal execution feature data to generate multimodal feature vector matrix data;

[0030] Step S23: Perform dynamic data flow processing according to the multimodal feature vector matrix data to generate a program dynamic data flow graph;

[0031] Step S24: Calculate the node importance score according to the program dynamic data flow graph to generate node importance score data; identify key data nodes according to the node importance score data to generate key node data;

[0032] Step S25: Track the dynamic privacy data flow of key node data through the program dynamic data flow graph to generate dynamic privacy data flow path data;

[0033] Step S26: Use the computer terminal device to construct a trusted execution environment for the dynamic privacy data flow path data to generate a privacy trusted execution environment.

[0034] The present invention effectively reduces the dimension of feature data and reduces computational complexity by performing feature dimensionality reduction processing on feature data of multimodal program execution. By converting continuous feature data into discrete features and generating a unified feature vector matrix, the data is more suitable for processing by various machine learning and data mining algorithms, thereby improving the operability of data analysis. Through dynamic data flow processing, the data flow and interaction relationship during program execution are fully displayed. By calculating the importance score of the node, the key nodes in the program execution process are identified, which helps to locate potential security risk points and performance bottlenecks, thereby improving the security and efficiency of the program. By tracking the data flow path of key nodes, the transmission and use of privacy data in the program are identified, which helps to identify and protect sensitive data and prevent privacy leaks. By building a trusted execution environment, it is ensured that privacy data is processed in a controlled and secure environment, thereby greatly improving the security and credibility of data processing.

[0035] Preferably, step S23 includes the following steps:

[0036] Step S231: performing data entity analysis on the multimodal feature vector matrix data to generate entity analysis feature data;

[0037] Step S232: Deconstruct the atomic operation flow according to the entity parsing feature data to obtain operation flow deconstruction data;

[0038] Step S233: using the operation flow deconstruction data to perform program dynamic execution logic analysis to generate program dynamic execution behavior data;

[0039] Step S234: performing entity clustering processing according to entity resolution feature data, and performing data dependency mapping processing through program dynamic execution behavior data to generate a dynamic data flow dependency graph;

[0040] Step S235: extracting data flow nodes according to the dynamic data flow dependency graph to generate data flow node data; performing data flow edge processing on the dynamic data flow dependency graph to generate data flow edge data;

[0041] Step S236: constructing a directed data flow graph through the data flow node data and the data flow edge data;

[0042] Step S237: Optimize the redundant nodes of the directed data flow graph to obtain a program dynamic data flow graph.

[0043] The present invention performs data entity parsing on multimodal feature vector matrix data, and parses the original feature data into a data representation with entity meaning, so as to better understand the intrinsic structure and meaning of the data. Atomic operation flow deconstruction is performed according to entity parsing feature data, and entity parsing feature data is deconstructed according to the order and process of atomic operations, and complex operation processes are disassembled into independent atomic operation sequences, which is helpful to understand the execution logic and behavior characteristics of the program in a more fine-grained manner. Using operation flow deconstruction data to perform program dynamic execution logic analysis can help understand the execution logic of the program, identify potential abnormal behaviors and optimize execution efficiency. Data entities are clustered according to entity parsing feature data, and then the dependencies between data are analyzed through dynamic execution behavior data to construct a dynamic data flow dependency graph, which is helpful to clarify the relationship and influence between various data entities in the program. Nodes and edges in the data flow are extracted according to the dynamic data flow dependency graph, which is helpful to further analyze the structure and characteristics of the data flow. A directed data flow graph is constructed through data flow node data and data flow edge data. The extracted data flow nodes and edges are organized into the form of a directed graph, which clearly shows the direction and association relationship of the data flow, and helps to deeply understand the data flow dynamics and interaction mode of the program. Through optimization processing, redundant nodes in the graph are removed, the structure of the data flow graph is simplified, and the readability and comprehension of the graph are improved.

[0044] Preferably, step S25 comprises the following steps:

[0045] Step S251: locate the privacy data source of key node data and generate privacy data source data;

[0046] Step S252: Based on the preset privacy sample label data, the privacy data source data is used to perform privacy data labeling processing to generate labeled privacy data;

[0047] Step S253: Perform dynamic taint propagation simulation according to the marked privacy data to generate dynamic privacy propagation data;

[0048] Step S254: Analyze the propagation path of the dynamic privacy propagation data through the program dynamic data flow graph to obtain dynamic privacy data flow path data.

[0049] The present invention locates the privacy data source of key node data, determines the privacy data source in the data flow, that is, identifies the nodes in the data flow involving privacy information, so as to carry out privacy protection and control on these nodes in a targeted manner, and ensure the security and privacy protection of sensitive information. According to the existing privacy sample label data, the privacy data source is marked and processed, and the privacy data therein is identified, which is helpful for classifying and managing the privacy data. Dynamic taint propagation simulation is performed based on the marked privacy data, and the dynamic taint propagation process of the data during the program execution can be simulated, that is, the flow path and propagation of the privacy data in the program are tracked. The propagation path analysis of the dynamic privacy propagation data is performed through the program dynamic data flow graph, and the propagation path and flow trajectory of the privacy data during the program execution are analyzed.

[0050] Preferably, step S3 comprises the following steps:

[0051] Step S31: Perform identity authentication on the user through the application and generate identity token data;

[0052] Step S32: Submitting private data through the application based on the dynamic identity token data to obtain user private data;

[0053] Step S33: encrypt the user privacy data using the AES-256 encryption algorithm to generate user privacy encrypted data and encryption key data;

[0054] Step S34: Generate a random seed according to the identity token data to obtain random sequence data; generate a key verification code for the encryption key data through the identity token data to obtain a key verification code; perform dynamic encryption key packaging processing on the encryption key data, the random sequence data and the key verification code to generate dynamic encryption key data;

[0055] Step S35: Perform dynamic data segmentation processing on the user privacy encrypted data using the dynamic encryption key data to generate dynamic privacy encrypted fragment data and dynamic fragment verification data respectively;

[0056] Step S36: Based on the privacy trusted execution environment, the computer terminal device is used to perform distributed storage processing on the dynamic privacy encrypted shard data to obtain distributed storage mapping data;

[0057] Step S37: When the user accesses the user's private data, the identity token data is used for identity access control, and the data is decrypted and reorganized through dynamic encryption key data, dynamic sharding verification data and distributed storage mapping data, so as to obtain a secure data access strategy.

[0058] The present invention performs identity authentication processing on users through an application program, thereby ensuring the legitimacy and credibility of the user identity. Only users who pass the identity authentication can obtain subsequent private data, thereby effectively preventing unauthorized access and ensuring the security and privacy protection of data. Based on dynamic identity token data, private data is submitted through an application program, ensuring that users can only submit private data through a valid identity token. The user's private data is strongly encrypted, ensuring the confidentiality and security of the data, and ensuring that the data will not be obtained by unauthorized personnel during transmission and storage. The generated key is dynamically encapsulated, effectively preventing the risk of key leakage and cracking. The user's private encrypted data is dynamically segmented through dynamic encryption key data, ensuring the integrity and reliability of the private data during transmission and storage, while improving the security and efficiency of data transmission. Distributed storage technology is used to disperse the encrypted private data and store it on multiple terminal devices, thereby improving the security and reliability of the data and preventing the risk of single point failure and data loss. Identity access control is performed using identity token data, ensuring that users can only access data for which they have authority, ensuring the security and privacy protection of the data, and providing users with a safe and reliable data access service.

[0059] Preferably, step S35 includes the following steps:

[0060] Step S351: performing binary conversion processing on the random sequence data in the dynamic encryption key data to obtain segmentation reference sequence data; performing optimal segmentation factor calculation on the user privacy encryption data by using the segmentation reference sequence data to generate optimal segmentation factor data;

[0061] Step S352: Calculate the number of segments according to the optimal segmentation factor data, and process the segmentation offset through the key verification code to obtain the data segmentation offset;

[0062] Step S353: dynamically segment and map the user privacy encrypted data by segmenting the reference sequence data, the data segmentation offset, and the optimal segmentation factor data, to obtain dynamic privacy encrypted fragment data and a data segmentation mapping table respectively;

[0063] Step S354: performing fragment verification code processing on the privacy encrypted fragment data to generate fragment verification code data;

[0064] Step S355: Generate a shard integrity certificate for the user's private encrypted data based on the shard verification code data to obtain shard integrity certificate data;

[0065] Step S356: Perform verification hashing and packaging processing on the data segmentation mapping table and the shard integrity proof data to obtain dynamic shard verification data.

[0066] The present invention performs binary conversion processing according to random sequence data in dynamic encryption key data, converts random sequence data into binary form, and ensures the accuracy and controllability of data segmentation. The optimal segmentation factor is calculated for user privacy encrypted data by segmenting reference sequence data, which ensures the efficiency and accuracy of data segmentation. The number of data segmentations is determined according to the optimal segmentation factor, and the segmentation offset is calculated in combination with the key verification code to ensure the accuracy and security of data segmentation. The user privacy encrypted data is segmented according to predetermined segmentation parameters, and a data segmentation mapping table is generated at the same time to facilitate subsequent data reorganization and verification. The verification code is calculated for each data segment to ensure the integrity and accuracy of the data segment, which helps to detect any changes or damage to the data during transmission and storage. The integrity proof of the segment is generated using the verification code data, and the segmentation mapping table and the segment integrity proof data are combined to ensure the security and credibility of the data segment by verifying the hash encapsulation.

[0067] Preferably, step S4 comprises the following steps:

[0068] Step S41: Based on the security data access strategy, the computer terminal device is used to collect the user's operation behavior log to obtain real-time user behavior data;

[0069] Step S42: performing user behavior cluster analysis on the real-time user behavior data through a preset cluster analysis cycle to obtain user behavior cluster events;

[0070] Step S43: extracting abnormal behavior characteristic indicators according to user behavior clustering events to obtain abnormal behavior characteristic indicator data;

[0071] Step S44: Calculate the standard index deviation of the abnormal behavior characteristic index data, and perform comprehensive weighted scoring processing to obtain abnormal behavior score data;

[0072] Step S45: Perform security situation risk assessment based on the abnormal behavior score data to generate security situation risk assessment data;

[0073] Step S46: Perform adaptive security monitoring processing according to the security situation risk assessment data to obtain adaptive security control data.

[0074] The present invention helps to discover potential security threats and abnormal behaviors by recording the user's operating behaviors in the system, including login, browsing, operation, etc. Cluster analysis is performed on user behavior data, and similar behaviors are classified into one category, which helps to discover the patterns and laws of user behavior, thereby identifying potential abnormal behaviors or security events. Cluster analysis is performed on user behavior data, and similar behaviors are classified into one category, which helps to discover the patterns and laws of user behavior, thereby identifying potential abnormal behaviors or security events. By calculating the deviation between abnormal behavior feature indicators and standard indicators, the importance and impact of various indicators are comprehensively considered, and a comprehensive score for abnormal behavior is generated, which provides a quantitative basis for security situation risk assessment. The security status of the system is evaluated and analyzed according to the abnormal behavior score data, and potential security risks and threats are identified, which helps to take timely measures to prevent security incidents. According to the evaluation results of the security situation, the security strategy and control measures of the system are dynamically adjusted to adapt to the changing security environment and threats, improve the security and response capabilities of the system, and ensure the stable operation of the system.

[0075] The present invention also provides a computer data security enhancement system, which executes the above-mentioned computer data security enhancement method, and the computer data security enhancement system comprises:

[0076] The device environment assessment module is used to perform device environment detection using computer terminal equipment to generate device environment detection data; perform dynamic security environment assessment processing based on the device environment detection data to generate dynamic security environment assessment data; perform execution cycle feature analysis on the application program through the dynamic security environment assessment data to generate multi-modal program execution feature data;

[0077] The privacy data flow analysis module is used to perform discrete feature encoding processing on the multimodal program execution feature data to generate multimodal feature vector matrix data; perform dynamic data flow processing based on the multimodal feature vector matrix data to generate a program dynamic data flow graph; track the dynamic privacy data flow based on the program dynamic data flow graph to generate dynamic privacy data flow path data; use computer terminal equipment to construct a trusted execution environment for the dynamic privacy data flow path data to generate a privacy trusted execution environment;

[0078] The dynamic security access module is used to submit private data through the application program to obtain the user's private data; the privacy trusted execution environment is used to perform dynamic security access processing on the user's private data to obtain a security data access strategy;

[0079] The security situation monitoring module is used to use computer terminal equipment to perceive the security situation of users based on the security data access strategy to obtain security situation risk assessment data; and to perform adaptive security monitoring processing based on the security situation risk assessment data to obtain adaptive security control data. BRIEF DESCRIPTION OF THE DRAWINGS

[0080] Figure 1 A schematic diagram of the steps of a method and system for enhancing computer data security according to the present invention;

[0081] Figure 2 for Figure 1 Detailed implementation steps of step S1 in FIG.

[0082] Figure 3 for Figure 1 Detailed implementation steps of step S4 in FIG.

[0083] The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0084] The following is a clear and complete description of the technical method of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by technicians in this field without creative work are within the scope of protection of the present invention.

[0085] In addition, the accompanying drawings are only schematic illustrations of the present invention and are not necessarily drawn to scale. The same reference numerals in the figures represent the same or similar parts, and their repeated description will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities and do not necessarily correspond to physically or logically independent entities. The functional entities can be implemented in software form, or implemented in one or more hardware modules or integrated circuits, or implemented in different networks and / or processor methods and / or microcontroller methods.

[0086] It should be understood that, although the terms "first", "second", etc. may be used herein to describe various units, these units should not be limited by these terms. These terms are used only to distinguish one unit from another unit. For example, without departing from the scope of the exemplary embodiments, the first unit may be referred to as the second unit, and similarly the second unit may be referred to as the first unit. The term "and / or" used herein includes any and all combinations of one or more of the listed associated items.

[0087] To achieve this, please refer to Figures 1 to 3 The present invention provides a method for enhancing computer data security, comprising the following steps:

[0088] Step S1: Perform device environment detection using a computer terminal device to generate device environment detection data; perform dynamic security environment assessment processing based on the device environment detection data to generate dynamic security environment assessment data; perform execution cycle feature analysis on the application program using the dynamic security environment assessment data to generate multi-modal program execution feature data;

[0089] Step S2: performing discrete feature encoding processing on the multimodal program execution feature data to generate multimodal feature vector matrix data; performing dynamic data flow processing according to the multimodal feature vector matrix data to generate a program dynamic data flow graph; tracing the dynamic privacy data flow according to the program dynamic data flow graph to generate dynamic privacy data flow path data; using a computer terminal device to construct a trusted execution environment for the dynamic privacy data flow path data to generate a privacy trusted execution environment;

[0090] Step S3: Submit the private data through the application to obtain the user's private data; use the privacy trusted execution environment to dynamically and securely access the user's private data to obtain a secure data access strategy;

[0091] Step S4: Based on the security data access strategy, the computer terminal device is used to perceive the security situation of the user to obtain security situation risk assessment data; adaptive security monitoring processing is performed according to the security situation risk assessment data to obtain adaptive security control data.

[0092] The present invention can obtain real-time device operation status information, including hardware performance, operating system stability, network connection status, etc., by performing in-depth detection on computer terminal devices. This process helps to identify potential hardware failures, software conflicts or network security risks, thereby preventing device failures in advance and improving device operation efficiency. Based on real-time device environment data, a comprehensive assessment of the system's security status is performed to assess whether the current system environment of the computer device is a high-risk or low-risk environment. A high-risk environment can alarm in real time to solve these risks and ensure that the application is tested in a low-risk environment. The key to deeply understanding and improving program performance is to analyze the execution cycle characteristics of the application through dynamic security environment assessment data. They cover multiple dimensions of program execution, such as time, space, resource consumption, etc., and provide detailed basis for program optimization, performance tuning and troubleshooting. Discrete feature encoding of multimodal program execution feature data can convert complex data structures into matrix forms that are easy to process, which is conducive to improving the efficiency and accuracy of data analysis. In this way, the mode and behavior of program operation can be better understood. The dynamic data flow graph of the program is generated by using the eigenvector matrix to intuitively depict the data flow path when the program is running, effectively analyze the internal working mechanism of the program, find and fix errors in data processing, and detect data leakage paths to enhance data security. Through the data flow graph, dynamic privacy data flow tracking can be used to understand the flow of sensitive information in real time. Using terminal devices to build a trusted execution environment for dynamic privacy data flow path data can create an isolated and secure execution environment to ensure the integrity and confidentiality of privacy data during processing. Processing user privacy data in a privacy trusted execution environment can strictly control data access and use to prevent unauthorized access and leakage. This environment provides a high level of protection for data, ensuring the security of privacy data even when other parts of the system are attacked, and improving the overall security level of the system. Dynamic security access processing can adjust data access control policies in real time according to changes in system operation status, improve data security, and ensure that legitimate users can smoothly access the required data. Security situation awareness for users can monitor and evaluate the security status of users in real time during the use of devices. This includes identifying potential threats, vulnerabilities and abnormal behaviors, and evaluating the impact of these risks on user data and system security. These data provide a quantitative analysis of the user's current security status, helping the user understand the severity and urgency of potential risks and ensuring the user's information security in various usage scenarios.Therefore, a method for enhancing computer data security of the present invention performs risk environment assessment on computer equipment in advance to ensure that the computer equipment itself is in a safe state when the application is tested; through application testing, the characteristic conditions of application execution data are obtained, and a program dynamic data flow graph is constructed based on these characteristic data, and dynamic privacy data flow tracking is performed based on the program dynamic data flow graph, thereby constructing a privacy executable environment to ensure the integrity and confidentiality of privacy data during the processing process. The computer equipment is aware of the security situation, the data protection capability is improved in all aspects, and the risk of privacy data loss or theft is effectively reduced.

[0093] In the embodiment of the present invention, reference Figure 1 The above is a schematic flow chart of the steps of a method for enhancing computer data security of the present invention. In this embodiment, the method for enhancing computer data security includes the following steps:

[0094] Step S1: Perform device environment detection using a computer terminal device to generate device environment detection data; perform dynamic security environment assessment processing based on the device environment detection data to generate dynamic security environment assessment data; perform execution cycle feature analysis on the application program using the dynamic security environment assessment data to generate multi-modal program execution feature data;

[0095] In an embodiment of the present invention, an identity authentication program is started to verify the legitimacy of the device, and a digital signature is generated and sent to the authentication server. The device operating system information, network environment data, hardware parameters, etc. are collected to form detailed device environment detection data. Security status, risk level standards and association models are established, and real-time detection data is input into the evaluation model. According to the preset environmental risk threshold, each security indicator is compared and analyzed one by one to determine the "low risk" or "high risk" operating state, and an alarm is triggered for anomalies to notify relevant personnel to take action. Through processing measures, environmental changes are monitored, risk markers are adjusted in a timely manner, and feedback data is recorded. Integrate periodic logs to analyze resource consumption, error logs, etc., use data mining to distinguish program execution modes, and finally form multimodal program execution feature data.

[0096] Step S2: performing discrete feature encoding processing on the multimodal program execution feature data to generate multimodal feature vector matrix data; performing dynamic data flow processing according to the multimodal feature vector matrix data to generate a program dynamic data flow graph; tracing the dynamic privacy data flow according to the program dynamic data flow graph to generate dynamic privacy data flow path data; using a computer terminal device to construct a trusted execution environment for the dynamic privacy data flow path data to generate a privacy trusted execution environment;

[0097] In an embodiment of the present invention, dimensionality reduction techniques such as PCA, t-SNE or autoencoder are used to remove redundant information in multimodal feature data and retain key features. Non-numeric features are uniquely encoded or ordinal encoded to convert them into numerical vectors. All feature vectors are combined into a multimodal feature vector matrix data. A dynamic data flow graph model that describes the flow of data during program execution is constructed. PageRank or graph neural network models are used to calculate node importance scores and identify key data processing nodes. Dynamic privacy data flow tracking is implemented to record data transmission paths between key nodes to form privacy data flow path data. Finally, based on these path data, TEE such as Intel SGX or ARMTrustZone is deployed in the terminal device to create an isolated security zone for sensitive data processing to ensure the effective implementation of privacy protection.

[0098] Step S3: Submit the private data through the application to obtain the user's private data; use the privacy trusted execution environment to dynamically and securely access the user's private data to obtain a secure data access strategy;

[0099] In an embodiment of the present invention, a user enters a user name and password through an application login interface, and the application uses salt hashing technology to encrypt the password. The application sends the user name and encrypted password to the server for identity authentication, and the server generates identity token data containing user information. The application uses dynamic identity token data as an authorization credential to allow the user to submit private data to the server. The server uses the AES-256 encryption algorithm to encrypt the received user private data and generate encrypted data and encryption keys. A random seed and key verification code are generated based on the identity token data to construct a dynamic encryption key data packet. The encrypted data is divided into multiple shards according to the random indicator, and a unique verification code is calculated for each shard. The shard data is distributedly stored and managed using a privacy trusted execution environment to generate distributed storage mapping data. When a user requests access to data, the system verifies the identity token and calls related data to restore the private data to ensure data security.

[0100] Step S4: Based on the security data access strategy, the computer terminal device is used to perceive the security situation of the user to obtain security situation risk assessment data; adaptive security monitoring processing is performed according to the security situation risk assessment data to obtain adaptive security control data.

[0101] In an embodiment of the present invention, under the protection of a secure data access policy, the system automatically monitors and records user operations, including login, file access, etc., and collects data in real time through an API or system hook. The data is cleaned to retain key information to form real-time behavioral data. Cluster analysis is initiated at a predetermined period, features are extracted from the behavioral data, and feature vectors are classified using unsupervised learning algorithms such as K-means to identify similar behavioral patterns. Statistical analysis is performed on the clustering results to detect abnormal behaviors, such as identifying isolated instances through LOF and marking abnormal features such as operations at abnormal times. The feature deviation is calculated and weighted to obtain an abnormal behavior score, and the user risk level is divided accordingly. The response strategy is triggered based on the score, such as strengthening monitoring for low risks and isolating resources and responding to emergencies for high risks. The system dynamically analyzes risk assessment trends, adaptively adjusts monitoring strategies and alarm thresholds to respond to changes in security situations, and achieves intelligent security monitoring and control.

[0102] Preferably, step S1 comprises the following steps:

[0103] Step S11: Perform device identity authentication using a computer terminal device to generate device identity authentication data;

[0104] Step S12: Perform device environment detection according to the device identity authentication data to generate device environment detection data, wherein the device environment detection data includes operating system status analysis data, network environment detection data and device hardware data;

[0105] Step S13: Perform dynamic security environment assessment processing according to the device environment detection data to generate dynamic security environment assessment data;

[0106] Step S14: using a preset environmental risk threshold to judge the environmental risk of the dynamic security environment assessment data, and when the dynamic security environment assessment data is lower than the environmental risk threshold, marking the computer terminal device as low-risk operating environment data;

[0107] Step S15: When the dynamic security environment assessment data is higher than or equal to the environmental risk threshold, the computer terminal device is marked as high-risk operating environment data; risk environment alarm processing is performed according to the high-risk operating environment data to generate risk environment alarm data; the user performs real-time risk processing through the risk environment alarm data until the dynamic security environment assessment data is lower than the environmental risk threshold, and risk environment feedback data is generated;

[0108] Step S16: Analyze the execution cycle characteristics of the application program using the risk environment feedback data and the low-risk operating environment data to generate multi-modal program execution characteristic data.

[0109] As an example of the present invention, refer to Figure 2 As shown, Figure 1Detailed implementation steps of step S1 in the flowchart, in this example, step S1 includes:

[0110] Step S11: Perform device identity authentication using a computer terminal device to generate device identity authentication data;

[0111] In an embodiment of the present invention, an identity authentication program is started through a computer terminal device. The program can be a pre-installed application or a script manually started by a user. After the program is started, the user will be asked to enter the identity information related to the device, such as the device number, serial number, etc. The program will generate a unique digital signature based on the input identity information. The program will send the generated digital signature to the authentication server. The authentication server will verify whether the received digital signature matches the expected signature of the device. If the match is successful, the authentication server will issue a digital certificate to the device to prove that the identity of the device is legitimate, thereby generating device identity authentication data. These data include but are not limited to the device's unique identifier (MAC address, serial number), timestamp, authentication status, etc.

[0112] Step S12: Perform device environment detection according to the device identity authentication data to generate device environment detection data, wherein the device environment detection data includes operating system status analysis data, network environment detection data and device hardware data;

[0113] In an embodiment of the present invention, a computer terminal sends instructions to a device to request operating system related information by using a secure channel established during device identity authentication. These instructions include querying the operating system version number, patch installation status, system log, running services and process list, etc. For example, for a Linux system, the kernel version can be obtained by executing uname-a, dpkg-l or rpm-qa can be used to check the installed software package and its version, and the system log can be viewed by the journalctl command. Data about the network environment in which the device is located is collected through network diagnostic tools or scripts on the device. This includes but is not limited to IP address, subnet mask, default gateway, DNS server configuration, active network connection status, open port scanning, and network traffic analysis. Instructions are sent to the device to obtain hardware information, including but not limited to CPU model, memory capacity, hard disk space, network card information, and other peripheral status. For example, in a Linux environment, relevant hardware information can be obtained by reading / proc / cpuinfo, / proc / meminfo, and df-h commands. The results are organized into device environment detection data to form a detailed report document or a structured data packet.

[0114] Step S13: Perform dynamic security environment assessment processing according to the device environment detection data to generate dynamic security environment assessment data;

[0115] In an embodiment of the present invention, based on historical environmental data and security event records, an environmental security status, a preset risk level standard, and a correlation model between various environmental factors are constructed, such as a decision tree model, a neural network model, etc. The real-time environmental detection data is input into the evaluation model for security risk assessment. For example, when the network traffic suddenly surges and is accompanied by a large number of unauthorized access attempts, this will be marked as a high-risk factor because it can be represented as a potential DDoS attack. The security assessment score or level of the device environment is calculated in real time, and a comprehensive security assessment score is output, reflecting the immediate security health status including security index, risk level, etc.

[0116] Step S14: using a preset environmental risk threshold to judge the environmental risk of the dynamic security environment assessment data, and when the dynamic security environment assessment data is lower than the environmental risk threshold, marking the computer terminal device as low-risk operating environment data;

[0117] In an embodiment of the present invention, environmental risk thresholds of different dimensions are pre-set according to industry standards, historical data analysis and security policy requirements. These thresholds cover equipment performance indicators (such as CPU usage not exceeding 80% is safe), network behavior (such as no more than 10 abnormal login attempts per second), etc. Each evaluation indicator is compared with the preset risk threshold one by one. For example, the detected average CPU usage of 35% is compared with the set threshold of 80% to confirm whether it is within the safe range, and set clear risk thresholds for different security evaluation indicators. The threshold system is designed to distinguish security levels, such as green (low risk) and red (high risk), to ensure the standardization and objectivity of risk judgment. The system automatically compares dynamic security assessment data with preset environmental risk thresholds. When the evaluation results of all key indicators are lower than the corresponding low-risk threshold, the trigger mechanism marks the computer terminal device as a "low-risk operating environment."

[0118] Step S15: When the dynamic security environment assessment data is higher than or equal to the environmental risk threshold, the computer terminal device is marked as high-risk operating environment data; risk environment alarm processing is performed according to the high-risk operating environment data to generate risk environment alarm data; the user performs real-time risk processing through the risk environment alarm data until the dynamic security environment assessment data is lower than the environmental risk threshold, and risk environment feedback data is generated;

[0119] In an embodiment of the present invention, if any one or more indicators reach or exceed their corresponding thresholds, the system immediately marks the computer terminal device as a "high-risk operating environment". For example, when it is detected that the hard disk failure rate of a server exceeds the preset 1% threshold for two consecutive days, the system issues a high-risk alarm and marks it. For devices marked as high-risk, the system automatically generates risk environment alarm data. The alarm data includes but is not limited to the device ID, specific abnormal indicators, degree of exceeding the standard, alarm time, recommended emergency treatment measures, etc. This information is quickly pushed to the security operation and maintenance team and designated responsible persons through multiple channels such as email, SMS, and instant messaging tools to ensure immediate response. After receiving the alarm information, the user (security operation and maintenance personnel) takes action based on the risk environment alarm data, which involves remotely logging into the faulty device for diagnosis, executing security protocols, isolating the affected network area, or dispatching on-site engineers for physical inspection and repair. The system continuously monitors changes in dynamic security environment assessment data and updates the assessment results in real time. When the measures taken cause the dynamic safety environment assessment data to return to or fall below the environmental risk threshold, the system automatically cancels the "high risk" mark, changes it to "low risk" or "normal" status, and records this change. At the same time, it generates "risk environment feedback data."

[0120] Step S16: Analyze the execution cycle characteristics of the application program using the risk environment feedback data and the low-risk operating environment data to generate multi-modal program execution characteristic data.

[0121] In an embodiment of the present invention, the generated risk environment feedback data is integrated with the low-risk operating environment data, and the risk environment feedback data includes information such as exception handling process, timestamp and recovery status, while the low-risk operating environment data reflects the performance of the device in a stable state. Data related to the execution cycle is extracted from the log files of the device and the application, including but not limited to program startup time, running time, resource consumption (such as CPU, memory usage), error logs, and interaction records with external systems. The feature data of different dimensions (such as resource usage, error frequency, execution time, etc.) are fused and analyzed to form a multimodal program execution feature data set. In this process, data mining techniques such as cluster analysis are used to identify the differences in execution modes of different applications in different risk environments. The feature data set obtained after processing and analysis is organized into structured multimodal program execution feature data.

[0122] Preferably, step S16 comprises the following steps:

[0123] Step S161: Perform security environment credential processing according to the risk environment feedback data and the low-risk operating environment data to generate security environment credential data;

[0124] Step S162: Design a program cycle execution test for the application based on the security environment credential data, and generate program execution test event data;

[0125] Step S163: collecting user operation behavior logs according to program execution test event data to generate user operation behavior data;

[0126] Step S164: Monitor user network requests based on the user operation behavior data to obtain user request interaction data; track system resources based on the user operation behavior data to generate system resource tracking data; audit file operations based on the user operation behavior data to generate file operation audit data;

[0127] Step S165: performing context association analysis on the user request interaction data, the system resource tracking data, and the file operation audit data to generate context detection association data;

[0128] Step S166: performing time series feature processing according to the context detection associated data to generate time series detection associated data;

[0129] Step S167: Perform multimodal data fusion processing based on the time series detection associated data to obtain multimodal program execution feature data.

[0130] In the embodiment of the present invention, after receiving the risk environment feedback data and confirming that the computer terminal is in a low-risk operating environment, the system enters the security credential processing stage. This includes verifying the digital signatures of all applications, checking whether the permission configuration complies with the principle of least privilege, and confirming that the source of the recently installed or updated software is reliable and non-malicious. Based on these verification results, the system creates or updates a security environment credential data package, which contains information such as the application trust level, permission allocation details, and the timestamp of the most recent security check. The system designs and deploys a periodic execution test plan for each application. For example, set daily scheduled start and basic function tests for office software, such as document opening, editing and saving operations, to ensure software stability and compatibility. The specific parameters and expected results of these test designs are encoded as program execution test event data, stored in a database, and used to guide the execution of automated testing tools. The system starts to execute the test and simultaneously collects user operation behavior data. During the test, not only the log of the test script execution is recorded, such as the test start time, end time, and test step execution results, but also any interaction data generated by real users during the test process, such as click-through rate, page access sequence, and frequency of use of specific functions. Through the network monitoring module, network requests triggered in user operation behavior data are captured and analyzed in real time. For example, the URL, request method (GET, POST, etc.), response status code, and amount of data transmitted of the HTTP / HTTPS request issued by the user's browser are recorded to form user request interaction data. At the same time, the system resource manager continuously tracks the usage of resources such as CPU, memory, and disk I / O, and associates them with specific user operation behaviors, records detailed logs of resource changes before and after the operation, and generates system resource tracking data. In addition, the file system audit tool monitors file creation, modification, deletion, and access events, and records information such as the user involved, timestamp, and file path, thereby constructing file operation audit data. For example, the increase in resource consumption following a specific network request, or the association between file access patterns and specific network behaviors, thereby generating context detection association data. Using time series analysis methods, the data is modeled in chronological order to identify trends, periodicity, and anomalies of data changes over time. For example, by analyzing the peak and valley values ​​of system resource usage within a day, or the periodic changes in file access frequency, the system can more accurately predict future resource bottlenecks or abnormal behavior patterns. These data processed with time series features are time series detection related data. The time series detection related data is fused with other multi-source data (such as historical security event records, user role information, etc.). Multimodal fusion algorithms, such as multi-layer perceptrons in deep learning, are used to perform cross-modal mapping and feature extraction on the data, and more comprehensive and detailed multimodal program execution feature data is output.

[0131] Preferably, step S2 comprises the following steps:

[0132] Step S21: performing feature dimensionality reduction processing on the multimodal program execution feature data to generate dimensionality-reduced multimodal execution feature data;

[0133] Step S22: performing discrete feature encoding processing according to the dimension-reduced multimodal execution feature data to generate multimodal feature vector matrix data;

[0134] Step S23: Perform dynamic data flow processing according to the multimodal feature vector matrix data to generate a program dynamic data flow graph;

[0135] Step S24: Calculate the node importance score according to the program dynamic data flow graph to generate node importance score data; identify key data nodes according to the node importance score data to generate key node data;

[0136] Step S25: Track the dynamic privacy data flow of key node data through the program dynamic data flow graph to generate dynamic privacy data flow path data;

[0137] Step S26: Use the computer terminal device to construct a trusted execution environment for the dynamic privacy data flow path data to generate a privacy trusted execution environment.

[0138] In an embodiment of the present invention, dimensionality reduction techniques such as principal component analysis (PCA), t-distributed neighborhood embedding (t-SNE) or autoencoder are used to remove redundant information in multimodal program execution feature data and retain the most representative features. Finally, a multimodal execution feature data set after dimensionality reduction is obtained, and each feature can clearly reflect the key mode of program execution. For non-numerical features, such as category labels, the system uses one-hot encoding (One-Hot Encoding) or ordinal encoding (Ordinal Encoding) to convert them into numerical vectors. All feature vectors are combined into a large multimodal feature vector matrix data, and each row vector represents the feature representation of a sample in multiple dimensions. Using multimodal feature vector matrix data, the system constructs a dynamic data flow graph of the program. This graph model depicts the path of data flow during program execution, including the source, processing process and end point of the data. Each node represents a data processing operation or a data storage location, and the edge represents the direction of data flow. The PageRank algorithm or a node importance scoring model based on a graph neural network is used to calculate the importance score for each node in the dynamic data flow graph. The score reflects the criticality of the node in the data flow, and nodes with high scores often involve sensitive operations or data. The node importance score data generated in this way is used to identify key nodes that are critical to program security or privacy protection. For the identified key nodes, the system performs dynamic privacy data flow tracking to record the precise path of data flow between these nodes. This includes the complete trajectory of when the data departs from a certain node, which intermediate nodes it passes through, and how it finally reaches the destination. This path information is compiled into dynamic privacy data flow path data to provide precise positioning for privacy protection measures. Based on the dynamic privacy data flow path data, the system deploys a trusted execution environment (TEE), such as Intel SGX or ARM TrustZone, on computer terminal devices. TEE provides an isolated secure execution area for key data nodes to ensure that it is not affected by external untrusted environments when processing privacy data.

[0139] Preferably, step S23 includes the following steps:

[0140] Step S231: performing data entity analysis on the multimodal feature vector matrix data to generate entity analysis feature data;

[0141] Step S232: Deconstruct the atomic operation flow according to the entity parsing feature data to obtain operation flow deconstruction data;

[0142] Step S233: using the operation flow deconstruction data to perform program dynamic execution logic analysis to generate program dynamic execution behavior data;

[0143] Step S234: performing entity clustering processing according to entity resolution feature data, and performing data dependency mapping processing through program dynamic execution behavior data to generate a dynamic data flow dependency graph;

[0144] Step S235: extracting data flow nodes according to the dynamic data flow dependency graph to generate data flow node data; performing data flow edge processing on the dynamic data flow dependency graph to generate data flow edge data;

[0145] Step S236: constructing a directed data flow graph through the data flow node data and the data flow edge data;

[0146] Step S237: Optimize the redundant nodes of the directed data flow graph to obtain a program dynamic data flow graph.

[0147] In an embodiment of the present invention, based on the multimodal feature vector matrix data, the system identifies and marks the key entities in the data, such as specific function calls, variable names, API interfaces, etc., through an entity resolution algorithm to form entity resolution feature data. The underlying atomic operations associated with each data entity, such as reading, writing, and calculating, are further refined to generate operation flow deconstruction data. The system uses static analysis and dynamic tracking technology to comprehensively analyze the behavior patterns of the program at different execution stages, identify changes in control flow and data flow, and form program dynamic execution behavior data. With the support of entity resolution feature data, the system classifies similar data entities through a clustering algorithm to form entity clusters. At the same time, combined with the program dynamic execution behavior data, data dependency relationships are mapped to construct a dynamic data flow dependency graph. This figure shows the call, transfer, and dependency relationships between data entities, and intuitively reflects the flow path of data in the program. From the dynamic data flow dependency graph, the system extracts each node that independently processes data, such as function call points, conditional branches, etc., to form data flow node data. At the same time, the data flow direction between each pair of nodes is identified and recorded, data flow edge data is generated, and the data transfer path between nodes is clarified. By integrating data flow node data and data flow edge data, the system builds a directed data flow graph. This graph uses nodes to represent data processing units and edges to represent data flow directions, clearly showing the flow logic and control structure of data during program execution. The directed data flow graph is optimized to remove redundant nodes that do not contribute additional information, simplify complex connections, and ensure the simplicity and efficiency of the graph.

[0148] Preferably, step S25 comprises the following steps:

[0149] Step S251: locate the privacy data source of key node data and generate privacy data source data;

[0150] Step S252: Based on the preset privacy sample label data, the privacy data source data is used to perform privacy data labeling processing to generate labeled privacy data;

[0151] Step S253: Perform dynamic taint propagation simulation according to the marked privacy data to generate dynamic privacy propagation data;

[0152] Step S254: Analyze the propagation path of the dynamic privacy propagation data through the program dynamic data flow graph to obtain dynamic privacy data flow path data.

[0153] In the embodiment of the present invention, the system conducts in-depth analysis on the identified key node data, and identifies variables, function parameters or return values ​​containing private data through regular expression matching, keyword search or pattern recognition algorithm. The data sources processed by these nodes are traced back to identify the original data storage location containing sensitive information such as personal identity information, financial records, health status, etc., and generate private data source data. Based on a pre-defined set of privacy sample labels (such as "personal information", "financial data", "medical records", etc.), a simulated execution environment is established to track the flow of marked private data during program operation. The system injects a virtual "taint" tag into the marked private data. When these data are read, assigned to new variables or passed as function parameters, the tag will also be propagated. Through control flow and data flow analysis, the system records the flow path and state changes of these tags in real time, and generates detailed dynamic privacy propagation data. Using the program dynamic data flow graph as the analysis framework, the propagation path of private data is deeply analyzed through the graph traversal algorithm. For each propagation path, the system evaluates the nodes and edges on the path and identifies potential security weaknesses, such as unencrypted data transmission, external interface exposure of sensitive information, etc. The system maps out these paths, marks key nodes and risk points, and ultimately generates dynamic privacy data flow path data.

[0154] Preferably, step S3 comprises the following steps:

[0155] Step S31: Perform identity authentication on the user through the application and generate identity token data;

[0156] Step S32: Submitting private data through the application based on the dynamic identity token data to obtain user private data;

[0157] Step S33: encrypt the user privacy data using the AES-256 encryption algorithm to generate user privacy encrypted data and encryption key data;

[0158] Step S34: Generate a random seed according to the identity token data to obtain random sequence data; generate a key verification code for the encryption key data through the identity token data to obtain a key verification code; perform dynamic encryption key packaging processing on the encryption key data, the random sequence data and the key verification code to generate dynamic encryption key data;

[0159] Step S35: Perform dynamic data segmentation processing on the user privacy encrypted data using the dynamic encryption key data to generate dynamic privacy encrypted fragment data and dynamic fragment verification data respectively;

[0160] Step S36: Based on the privacy trusted execution environment, the computer terminal device is used to perform distributed storage processing on the dynamic privacy encrypted shard data to obtain distributed storage mapping data;

[0161] Step S37: When the user accesses the user's private data, the identity token data is used for identity access control, and the data is decrypted and reorganized through dynamic encryption key data, dynamic sharding verification data and distributed storage mapping data, so as to obtain a secure data access strategy.

[0162] In an embodiment of the present invention, a user enters a pre-registered user name and password through the login interface of the application. The application uses salt hashing technology to encrypt the password and sends the user name and encrypted password to the server for verification. The server side confirms the authenticity of the user's identity by comparing the user information stored in the database, and then generates an identity token data containing the user's identity information and validity period. The application uses the dynamic identity token data as an authorization credential to allow the user to submit private data, such as personal bank account information or medical records. These data are uploaded to the server through the application program interface (API). After receiving the data, the server side confirms the validity of the identity token, thereby ensuring the legitimacy of the data submission process. After receiving the user's private data, the server immediately encrypts it using the AES-256 encryption algorithm. The algorithm uses a 256-bit key to provide extremely high security. The encryption process generates two parts of data: encrypted user private data and encryption key data for decryption. At the same time, in order to ensure the safe storage and transmission of the key, the system will also generate a separate key verification code to verify the integrity and authenticity of the key. Based on the specific information of the identity token data, the system generates a random seed for further data protection. The random seed, together with the encryption key data, generates a key verification code through a specific algorithm. Subsequently, the encryption key data, random sequence data, and key verification code are encapsulated in a specific format to form a dynamic encryption key data packet. A series of random numbers are generated as shard indicators based on the dynamic encryption key data through a secure random algorithm. Then, the user's private encrypted data will be divided into multiple shards of different sizes according to these indicators. The size and location of each shard are determined randomly and unpredictably to increase the security of the data. At the same time, the system calculates a unique verification code for each shard, namely the dynamic shard verification data. Based on the constructed privacy trusted execution environment, the computer terminal device plays the role of a distributed storage manager. In this environment, each dynamic privacy encrypted shard data will be allocated to different physical storage nodes or cloud storage services according to a pre-set strategy. The system uses encrypted communication channels to ensure the security of the shards during transmission, and records the storage location information of each shard to generate distributed storage mapping data. When a user requests to access his private data, he must first pass the identity authentication. The system verifies the identity token data provided by the user to confirm the legitimacy of the request and the correctness of the user's identity. After verification, the system calls the dynamic encryption key data, dynamic shard verification data, and distributed storage mapping data based on the user information associated with the identity token. The dynamic encryption key data is used to decrypt the shards, and the shard verification data is used to verify the integrity of each shard after it is recalled to ensure that it has not been tampered with. Finally, the original user privacy data is restored, ensuring the privacy and data security of the user during the access process, forming a complete secure data access strategy.

[0163] Preferably, step S35 includes the following steps:

[0164] Step S351: performing binary conversion processing on the random sequence data in the dynamic encryption key data to obtain segmentation reference sequence data; performing optimal segmentation factor calculation on the user privacy encryption data by using the segmentation reference sequence data to generate optimal segmentation factor data;

[0165] Step S352: Calculate the number of segments according to the optimal segmentation factor data, and process the segmentation offset through the key verification code to obtain the data segmentation offset;

[0166] Step S353: dynamically segment and map the user privacy encrypted data by segmenting the reference sequence data, the data segmentation offset, and the optimal segmentation factor data, to obtain dynamic privacy encrypted fragment data and a data segmentation mapping table respectively;

[0167] Step S354: performing fragment verification code processing on the privacy encrypted fragment data to generate fragment verification code data;

[0168] Step S355: Generate a shard integrity certificate for the user's private encrypted data based on the shard verification code data to obtain shard integrity certificate data;

[0169] Step S356: Perform verification hashing and packaging processing on the data segmentation mapping table and the shard integrity proof data to obtain dynamic shard verification data.

[0170] In an embodiment of the present invention, random sequence data is extracted from dynamic encryption key data, and this sequence includes a series of randomly generated numbers or characters. These data are converted into a series of binary bit strings through a binary conversion algorithm to form segmentation reference sequence data. According to the segmentation reference sequence data, the structure of the user's privacy encrypted data is analyzed, and an optimal segmentation strategy, that is, optimal segmentation factor data, is calculated. The optimal segmentation factor data aims to find an optimal data segmentation method to ensure that the segmented data blocks can maintain information security and are easy to manage and store efficiently. Based on the calculated optimal segmentation factor data, the system determines the exact number of segments, which is determined according to the ideal size and storage efficiency of the data block. The key verification code is used for further security enhancement. By calculating the key verification code, the system calculates the offset when the data is segmented. These offsets introduce randomness to the data segmentation process, ensuring that even the same original data will produce different shard layouts in different segmentation operations. The system dynamically segments and maps the user's privacy encrypted data. This means that according to the calculated segmentation points and offsets, the privacy encrypted data is accurately cut into multiple shards, and each shard is accompanied by specific identification information for subsequent management and recombination. At the same time, the system maintains a detailed data segmentation mapping table to record the storage location and related metadata of each shard, as well as the generated dynamic privacy encrypted shard data. A hash algorithm is executed on each dynamic privacy encrypted shard data to generate a unique shard verification code. These verification codes are fixed-length digital fingerprints calculated based on the shard content. Any slight change to the shard content will cause a significant change in the verification code, so they can be used to verify the integrity and consistency of the data and form shard verification code data. Based on the shard verification code data, the system further generates a shard integrity proof. This step uses mathematical proof to prove that the integrity of the shard is not compromised during the segmentation and storage process, even if the original data is not directly displayed. The previously generated data segmentation mapping table and shard integrity proof data are integrated and encapsulated through a verification hash algorithm. For example, these two pieces of key information are transformed into a fixed-length summary, namely the dynamic shard verification data, through an irreversible hash operation.

[0171] Preferably, step S4 comprises the following steps:

[0172] Step S41: Based on the security data access strategy, the computer terminal device is used to collect the user's operation behavior log to obtain real-time user behavior data;

[0173] Step S42: performing user behavior cluster analysis on the real-time user behavior data through a preset cluster analysis cycle to obtain user behavior cluster events;

[0174] Step S43: extracting abnormal behavior characteristic indicators according to user behavior clustering events to obtain abnormal behavior characteristic indicator data;

[0175] Step S44: Calculate the standard index deviation of the abnormal behavior characteristic index data, and perform comprehensive weighted scoring processing to obtain abnormal behavior score data;

[0176] Step S45: Perform security situation risk assessment based on the abnormal behavior score data to generate security situation risk assessment data;

[0177] Step S46: Perform adaptive security monitoring processing according to the security situation risk assessment data to obtain adaptive security control data.

[0178] As an example of the present invention, refer to Figure 3 As shown, Figure 1 Detailed implementation steps of step S4 in the embodiment are shown in the flowchart. In this embodiment, step S4 includes:

[0179] Step S41: Based on the security data access strategy, the computer terminal device is used to collect the user's operation behavior log to obtain real-time user behavior data;

[0180] In the embodiment of the present invention, under the execution of the security data access strategy, the system continuously monitors and records all operation activities of the user on the terminal. This includes but is not limited to user login and logout, file access, application use, network request, system setting change and other behaviors. Under the premise of ensuring compliance with the user's privacy policy, the system captures these behavior data in real time through the API interface or system hook technology without manual intervention. The collected raw data is preliminarily cleaned and formatted to remove irrelevant information, and only the core elements such as the timestamp of key actions, user ID, operation type and related parameters are retained, and finally real-time user behavior data is formed.

[0181] Step S42: performing user behavior cluster analysis on the real-time user behavior data through a preset cluster analysis cycle to obtain user behavior cluster events;

[0182] In an embodiment of the present invention, the system automatically triggers the cluster analysis process according to a preset periodic plan (such as hourly, daily or weekly). This process first extracts features from real-time user behavior data, including but not limited to operation frequency, operation type, operation time distribution, operation object (such as file, application), etc. Then, the system uses unsupervised learning algorithms such as K-means, DBSCAN or hierarchical clustering to analyze the extracted feature vectors. Taking K-means as an example, the system first randomly selects several initial cluster centers (centroids), and then assigns each user behavior instance to the nearest cluster based on a distance metric (such as Euclidean distance). Next, the average value of each cluster is recalculated to update the centroid, and this assignment-update process is repeated until the centroid no longer changes significantly or the preset maximum number of iterations is reached. Through such iterative optimization, user behaviors are grouped into different clusters, each cluster representing a class with similar behavior patterns.

[0183] Step S43: extracting abnormal behavior characteristic indicators according to user behavior clustering events to obtain abnormal behavior characteristic indicator data;

[0184] In an embodiment of the present invention, the behavior data in each cluster is statistically analyzed, such as calculating the operation frequency, mean, median, standard deviation and other statistics of the time distribution. Statistical methods (such as Z-score or IQR method) are used to detect the degree of deviation of each behavior instance relative to the statistical characteristics of the cluster to which it belongs. For example, if a user's access frequency during non-working hours far exceeds the average level of users in the same cluster plus several standard deviations, this needs to be regarded as an anomaly. The local anomaly factor (LOF) is used to mark isolated or low-density instances in the behavior space, and characteristic indicators of abnormal behavior are extracted, such as "high-frequency file downloads late at night", "system setting changes at unconventional times", "database query volume beyond the normal range", etc. These features are not only quantitative (such as frequency, timestamp) but also qualitative (such as operation type, object sensitivity).

[0185] Step S44: Calculate the standard index deviation of the abnormal behavior characteristic index data, and perform comprehensive weighted scoring processing to obtain abnormal behavior score data;

[0186] In the embodiment of the present invention, for each abnormal behavior characteristic indicator, the application will calculate the degree of deviation from the normal user group. For example, if the proportion of a user's nighttime login time is much higher than that of normal users, the deviation of the indicator will be higher. The deviation can be calculated by Z-score, percentile and other methods. The system will assign different weight coefficients according to the importance of each abnormal behavior characteristic indicator. For example, for the behavior of "reading a large amount of private data", a higher weight can be assigned because it represents a more serious abnormal situation. The weight coefficient can be set by security experts according to the actual situation. Multiply the deviation of each indicator by the weight, and then sum them to obtain the final comprehensive score of abnormal behavior.

[0187] Step S45: Perform security situation risk assessment based on the abnormal behavior score data to generate security situation risk assessment data;

[0188] In an embodiment of the present invention, the abnormal behavior of the user is divided into different risk levels, such as low risk, medium risk and high risk, based on the abnormal behavior score data. The basis for the division is usually a pre-set score threshold, for example, a score between 0-30 points is low risk, between 31-70 points is medium risk, and more than 70 points is high risk. Such a division helps to quickly identify the most pressing issues. For each user, the system will compare its abnormal behavior score with the risk threshold. If the score exceeds the threshold, it is determined that the user has a high security risk. If the score does not exceed the threshold, it is determined that the security risk is low. The risk assessment results of all users will be counted to calculate the overall security situation risk level. For example, the proportion of users exceeding the risk threshold can be counted as an indicator of the overall risk.

[0189] Step S46: Perform adaptive security monitoring processing according to the security situation risk assessment data to obtain adaptive security control data.

[0190] In an embodiment of the present invention, the system matches a preset response policy library according to the risk level in the security situation risk assessment data. The policy library stores a series of predefined control measures for different risk levels. For example, only logging and auditing need to be strengthened under low risk, access control and warning notifications need to be added when the risk is medium, and the affected resources are immediately isolated and the emergency response process is initiated when the risk is high. The monitoring strategy is adjusted in real time according to the assessment results. The system analyzes the changing trends in the risk assessment data and automatically adjusts the frequency, depth and focus of monitoring. The alarm threshold is dynamically adjusted according to the assessment data to ensure that the alarm is triggered in time before the security situation deteriorates. For example, if a certain type of abnormal behavior is found to be gradually increasing, the system will lower the threshold for triggering the alarm for this type of behavior to achieve early warning.

[0191] The present invention also provides a computer data security enhancement system, which executes the above-mentioned computer data security enhancement method, and the computer data security enhancement system comprises:

[0192] The device environment assessment module is used to perform device environment detection using computer terminal equipment to generate device environment detection data; perform dynamic security environment assessment processing based on the device environment detection data to generate dynamic security environment assessment data; perform execution cycle feature analysis on the application program through the dynamic security environment assessment data to generate multi-modal program execution feature data;

[0193] The privacy data flow analysis module is used to perform discrete feature encoding processing on the multimodal program execution feature data to generate multimodal feature vector matrix data; perform dynamic data flow processing based on the multimodal feature vector matrix data to generate a program dynamic data flow graph; track the dynamic privacy data flow based on the program dynamic data flow graph to generate dynamic privacy data flow path data; use computer terminal equipment to construct a trusted execution environment for the dynamic privacy data flow path data to generate a privacy trusted execution environment;

[0194] The dynamic security access module is used to submit private data through the application program to obtain the user's private data; the privacy trusted execution environment is used to perform dynamic security access processing on the user's private data to obtain a security data access strategy;

[0195] The security situation monitoring module is used to use computer terminal equipment to perceive the security situation of users based on the security data access strategy to obtain security situation risk assessment data; and to perform adaptive security monitoring processing based on the security situation risk assessment data to obtain adaptive security control data.

[0196] The beneficial effect of this application is that it monitors the operation status of the device in real time, and promptly discovers and prevents hardware failures, software conflicts or network security risks. Based on real-time device environment data, comprehensively evaluate the system security status, ensure that the application is tested in a low-risk environment, and improve the security of the application. In-depth analysis of application execution characteristics, including time, space, resource consumption, etc., provides a basis for program optimization, performance tuning and troubleshooting, and helps to better understand the program operation mode and behavior. Generate a dynamic data flow diagram of the program using the eigenvector matrix to enhance data security. Build an isolated and secure privacy data processing execution environment, strictly control data access and use, ensure the integrity and confidentiality of privacy data during the processing process, and improve the overall security level of the system. Dynamically adjust the data access control strategy according to the system operation status, improve data security, and ensure that legitimate users can smoothly access the required data, achieving a harmonious unity of security and convenience. In addition, the security situation awareness function allows users to grasp their own security status in real time, and the system takes more accurate protection measures accordingly, which not only improves the intelligence level of security management, but also comprehensively protects the privacy information security of users in different scenarios.

[0197] Therefore, the embodiments should be regarded as illustrative and non-restrictive from all points, and the scope of the present invention is limited by the appended claims rather than the above description, and it is therefore intended that all changes falling within the meaning and range of equivalent elements of the application documents are included in the present invention.

[0198] The above description is only a specific embodiment of the present invention, so that those skilled in the art can understand or implement the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but should conform to the widest scope consistent with the principles and novel features invented herein.

Claims

1. A method for enhancing computer data security, characterized in that: The following steps are involved: Step S1: Use computer terminal equipment to perform equipment environment detection and generate equipment environment detection data; Perform dynamic security environment assessment processing based on device environment detection data to generate dynamic security environment assessment data; perform execution cycle feature analysis on the application program through the dynamic security environment assessment data to generate multi-modal program execution feature data; Step S2: performing discrete feature encoding processing on the multimodal program execution feature data to generate multimodal feature vector matrix data; performing dynamic data flow processing according to the multimodal feature vector matrix data to generate a program dynamic data flow graph; performing dynamic privacy data flow tracking according to the program dynamic data flow graph to generate dynamic privacy data flow path data; Using computer terminal equipment to construct a trusted execution environment for dynamic privacy data flow path data to generate a privacy trusted execution environment; Step S3: Submit the private data through the application to obtain the user's private data; use the privacy trusted execution environment to dynamically and securely access the user's private data to obtain a secure data access strategy; Step S4: Based on the security data access strategy, the computer terminal device is used to perceive the security situation of the user to obtain security situation risk assessment data; Adaptive security monitoring and processing is performed based on the security situation risk assessment data to obtain adaptive security control data.

2. The method for enhancing computer data security according to claim 1, characterized in that: Step S1 includes the following steps: Step S11: Perform device identity authentication using a computer terminal device to generate device identity authentication data; Step S12: Perform device environment detection according to the device identity authentication data to generate device environment detection data, wherein the device environment detection data includes operating system status analysis data, network environment detection data and device hardware data; Step S13: Perform dynamic security environment assessment processing according to the device environment detection data to generate dynamic security environment assessment data; Step S14: using a preset environmental risk threshold to judge the environmental risk of the dynamic security environment assessment data, and when the dynamic security environment assessment data is lower than the environmental risk threshold, marking the computer terminal device as low-risk operating environment data; Step S15: When the dynamic security environment assessment data is higher than or equal to the environmental risk threshold, the computer terminal device is marked as high-risk operating environment data; risk environment alarm processing is performed according to the high-risk operating environment data to generate risk environment alarm data; the user performs real-time risk processing through the risk environment alarm data until the dynamic security environment assessment data is lower than the environmental risk threshold, and risk environment feedback data is generated; Step S16: Analyze the execution cycle characteristics of the application program using the risk environment feedback data and the low-risk operating environment data to generate multi-modal program execution characteristic data.

3. The method for enhancing computer data security according to claim 2, characterized in that: Step S16 includes the following steps: Step S161: Perform security environment credential processing according to the risk environment feedback data and the low-risk operating environment data to generate security environment credential data; Step S162: Design a program cycle execution test for the application based on the security environment credential data, and generate program execution test event data; Step S163: collecting user operation behavior logs according to the program execution test event data to generate user operation behavior data; Step S164: Monitor user network requests based on the user operation behavior data to obtain user request interaction data; track system resources based on the user operation behavior data to generate system resource tracking data; audit file operations based on the user operation behavior data to generate file operation audit data; Step S165: performing context association analysis on the user request interaction data, the system resource tracking data, and the file operation audit data to generate context detection association data; Step S166: performing time series feature processing according to the context detection associated data to generate time series detection associated data; Step S167: Perform multimodal data fusion processing based on the time series detection associated data to obtain multimodal program execution feature data.

4. The method for enhancing computer data security according to claim 1, characterized in that: Step S2 includes the following steps: Step S21: performing feature dimensionality reduction processing on the multimodal program execution feature data to generate dimensionality-reduced multimodal execution feature data; Step S22: performing discrete feature encoding processing according to the dimension-reduced multimodal execution feature data to generate multimodal feature vector matrix data; Step S23: Perform dynamic data flow processing according to the multimodal feature vector matrix data to generate a program dynamic data flow graph; Step S24: Calculate the node importance score according to the program dynamic data flow graph to generate node importance score data; identify key data nodes according to the node importance score data to generate key node data; Step S25: Track the dynamic privacy data flow of key node data through the program dynamic data flow graph to generate dynamic privacy data flow path data; Step S26: Use the computer terminal device to construct a trusted execution environment for the dynamic privacy data flow path data to generate a privacy trusted execution environment.

5. The method for enhancing computer data security according to claim 4, characterized in that: Step S23 includes the following steps: Step S231: performing data entity analysis on the multimodal feature vector matrix data to generate entity analysis feature data; Step S232: Deconstruct the atomic operation flow according to the entity parsing feature data to obtain operation flow deconstruction data; Step S233: using the operation flow deconstruction data to perform program dynamic execution logic analysis to generate program dynamic execution behavior data; Step S234: performing entity clustering processing according to entity resolution feature data, and performing data dependency mapping processing through program dynamic execution behavior data to generate a dynamic data flow dependency graph; Step S235: extracting data flow nodes according to the dynamic data flow dependency graph to generate data flow node data; performing data flow edge processing on the dynamic data flow dependency graph to generate data flow edge data; Step S236: construct a directed data flow graph through the data flow node data and the data flow edge data; Step S237: Optimize the redundant nodes of the directed data flow graph to obtain a program dynamic data flow graph.

6. The method for enhancing computer data security according to claim 4, characterized in that: Step S25 includes the following steps: Step S251: locate the privacy data source of key node data and generate privacy data source data; Step S252: Based on the preset privacy sample label data, the privacy data source data is used to perform privacy data labeling processing to generate labeled privacy data; Step S253: Perform dynamic taint propagation simulation according to the marked privacy data to generate dynamic privacy propagation data; Step S254: Analyze the propagation path of the dynamic privacy propagation data through the program dynamic data flow graph to obtain dynamic privacy data flow path data.

7. The method for enhancing computer data security according to claim 1, characterized in that: Step S3 includes the following steps: Step S31: Perform identity authentication on the user through the application and generate identity token data; Step S32: Submitting private data through the application based on the dynamic identity token data to obtain user private data; Step S33: encrypt the user privacy data using the AES-256 encryption algorithm to generate user privacy encrypted data and encryption key data; Step S34: Generate a random seed according to the identity token data to obtain random sequence data; generate a key verification code for the encryption key data through the identity token data to obtain a key verification code; perform dynamic encryption key packaging processing on the encryption key data, the random sequence data and the key verification code to generate dynamic encryption key data; Step S35: Perform dynamic data segmentation processing on the user privacy encrypted data using the dynamic encryption key data to generate dynamic privacy encrypted fragment data and dynamic fragment verification data respectively; Step S36: Based on the privacy trusted execution environment, the computer terminal device is used to perform distributed storage processing on the dynamic privacy encrypted shard data to obtain distributed storage mapping data; Step S37: When the user accesses the user's private data, the identity token data is used for identity access control, and the data is decrypted and reorganized through dynamic encryption key data, dynamic sharding verification data and distributed storage mapping data, so as to obtain a secure data access strategy.

8. The method for enhancing computer data security according to claim 7, characterized in that: Step S35 includes the following steps: Step S351: performing binary conversion processing on the random sequence data in the dynamic encryption key data to obtain segmentation reference sequence data; performing optimal segmentation factor calculation on the user privacy encryption data by using the segmentation reference sequence data to generate optimal segmentation factor data; Step S352: Calculate the number of segments according to the optimal segmentation factor data, and process the segmentation offset through the key verification code to obtain the data segmentation offset; Step S353: dynamically segment and map the user privacy encrypted data by segmenting the reference sequence data, the data segmentation offset, and the optimal segmentation factor data, to obtain dynamic privacy encrypted fragment data and a data segmentation mapping table respectively; Step S354: performing fragment verification code processing on the privacy encrypted fragment data to generate fragment verification code data; Step S355: Generate a shard integrity certificate for the user's private encrypted data based on the shard verification code data to obtain shard integrity certificate data; Step S356: Perform verification hashing and packaging processing on the data segmentation mapping table and the shard integrity proof data to obtain dynamic shard verification data.

9. The method for enhancing computer data security according to claim 1, characterized in that: Step S4 includes the following steps: Step S41: Based on the security data access strategy, the computer terminal device is used to collect the user's operation behavior log to obtain real-time user behavior data; Step S42: performing user behavior cluster analysis on the real-time user behavior data through a preset cluster analysis cycle to obtain user behavior cluster events; Step S43: extracting abnormal behavior characteristic indicators according to user behavior clustering events to obtain abnormal behavior characteristic indicator data; Step S44: Calculate the standard index deviation of the abnormal behavior characteristic index data, and perform comprehensive weighted scoring processing to obtain abnormal behavior score data; Step S45: Perform security situation risk assessment based on the abnormal behavior score data to generate security situation risk assessment data; Step S46: Perform adaptive security monitoring processing according to the security situation risk assessment data to obtain adaptive security control data.

10. A system for enhancing computer data security, characterized in that: For executing the method for enhancing computer data security as claimed in claim 1, the system for enhancing computer data security comprises: The device environment assessment module is used to perform device environment detection using computer terminal equipment to generate device environment detection data; perform dynamic security environment assessment processing based on the device environment detection data to generate dynamic security environment assessment data; perform execution cycle feature analysis on the application program through the dynamic security environment assessment data to generate multi-modal program execution feature data; The privacy data flow analysis module is used to perform discrete feature encoding processing on the multimodal program execution feature data to generate multimodal feature vector matrix data; perform dynamic data flow processing based on the multimodal feature vector matrix data to generate a program dynamic data flow graph; track the dynamic privacy data flow based on the program dynamic data flow graph to generate dynamic privacy data flow path data; use computer terminal equipment to construct a trusted execution environment for the dynamic privacy data flow path data to generate a privacy trusted execution environment; The dynamic security access module is used to submit private data through the application program to obtain the user's private data; the privacy trusted execution environment is used to perform dynamic security access processing on the user's private data to obtain a security data access strategy; The security situation monitoring module is used to use computer terminal equipment to perceive the security situation of users based on the security data access strategy to obtain security situation risk assessment data; and to perform adaptive security monitoring processing based on the security situation risk assessment data to obtain adaptive security control data.

Images