Safety protection system for highway smart screen information release

Abstract

The invention relates to the technical field of information security, in particular to a security protection system for highway smart screen information release, which comprises an access activity monitoring module, an access control management module, a data source analysis module, a storage demand evaluation module, a backup frequency adjustment module and a flow mode analysis module. According to the method, the risk that the data is tampered is reduced by analyzing the access behavior of the information published by the smart screen, identifying the abnormal behavior, dynamically adjusting the authority and evaluating the consistency of the data and the correctness of the source, and the priority of data storage is adjusted according to the sensitivity and importance of the data; the data backup frequency is adjusted by using the time and frequency of information release, the efficiency and pertinence of data backup are improved, the response capability to abnormal traffic and the security of data are enhanced by monitoring the traffic mode of data transmission in real time, the stability and reliability of highway information release are ensured, and the data backup efficiency and pertinence are improved. And accurate and timely traffic information is provided for drivers and pedestrians.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a security protection system for publishing information on smart screens on highways. Background Art

[0002] The field of information security technology focuses on protecting the confidentiality, integrity and availability of data, reducing unauthorized information access, data tampering and service interruptions, and avoiding various forms of attacks and damage to data. It includes encryption technology, firewalls, intrusion detection systems and security protocols, which are applied to data storage, data transmission and data processing. It continuously monitors and evaluates information systems and implements security policies and procedures to ensure the security of data during storage, processing and transmission. It combines cloud security, endpoint security and artificial intelligence to protect the privacy and sensitive information of users and organizations.

[0003] Among them, the security protection system used for information release on highway smart screens is designed to ensure the safe operation of highway information screens, avoid illegal access, tampering, and destruction of information, and implement physical security measures and network security technologies, including the use of identity authentication, encrypted transmission, real-time monitoring, and anomaly detection. It reduces information leakage and ensures the correct and timely release of information, improves road use efficiency and vehicle driving safety, manages and responds to emergencies, including accidents and sudden weather, and provides drivers and pedestrians with reliable traffic information services by timely releasing related information.

[0004] When dealing with data security, traditional highway smart screen information release protection methods rely on fixed security measures, including firewalls and static intrusion detection systems. They are not flexible and timely when facing complex and changeable attack methods, and cannot effectively identify data leakage risks caused by legitimate users, including internal personnel's misoperation and malicious behavior, which leads to the unexpected disclosure of sensitive information. There are deficiencies in data traceability. When data is tampered with and deleted, it is difficult to trace the original data source and change history, which weakens the ability to respond in data security incidents, resulting in the expansion of problems and increased repair costs. Summary of the invention

[0005] The purpose of the present invention is to solve the shortcomings existing in the prior art and to propose a safety protection system for information release on smart screens on highways.

[0006] In order to achieve the above-mentioned purpose, the present invention adopts the following technical scheme: a safety protection system for information release on a highway smart screen includes:

[0007] The access activity monitoring module analyzes the behavior of accessing the information released by the highway smart screen based on the user access behavior information, identifies the login records and access time, and generates user behavior evaluation records;

[0008] The access control management module sets a behavior detection threshold based on the user behavior evaluation record, adjusts user access rights according to abnormal user behavior, and generates a permission adjustment record;

[0009] The data source analysis module analyzes the published information based on the authority adjustment record, evaluates the consistency of the data and the correctness of the source, and generates data traceability analysis results;

[0010] The storage demand assessment module assesses the storage demand and sensitivity of various data according to the data traceability analysis results, adjusts the priority and hierarchy of data storage, and generates storage demand analysis data;

[0011] The backup frequency adjustment module analyzes the importance of various data to be released based on the storage demand analysis data, and adjusts the frequency of data backup according to the time and frequency of information release to generate data backup parameters;

[0012] The traffic pattern analysis module monitors and analyzes the data transmission traffic based on the data backup parameters, identifies and responds to abnormal traffic patterns, including isolating and correcting abnormal data flows, and generating information risk protection parameters.

[0013] As a further scheme of the present invention, the user behavior evaluation record includes the number of login attempts, activity time point analysis results and abnormal behavior identification records, the permission adjustment record includes behavior detection threshold setting parameters, abnormal user behavior processing records and permission adjustment records, the data traceability analysis results include data relationship map construction results, data point source records and consistency assessment information, the storage demand analysis data includes storage priority adjustment results, hierarchy assessment information and storage sensitivity analysis results, the data backup parameters include backup frequency adjustment results, importance analysis data and information release time and frequency information, and the information risk protection parameters include real-time data flow monitoring records, abnormal traffic pattern recognition results and information risk protection parameters.

[0014] As a further solution of the present invention, the access activity monitoring module includes:

[0015] The behavior information collection submodule collects and records the user's login time, access frequency, and access duration based on the user's access behavior information, and generates user activity data records;

[0016] The access data analysis submodule analyzes the user's login time and access frequency based on the user activity data record, evaluates the consistency with normal access behavior, identifies abnormal access behavior, and generates abnormal behavior identification records;

[0017] The risk level analysis submodule uses a logistic regression algorithm based on the abnormal behavior identification record to analyze the behavioral characteristics of multiple users, evaluate the security risk level and calculate the behavioral risk score, and generate a user behavior evaluation record.

[0018] As a further solution of the present invention, the logistic regression algorithm is according to the formula:

[0019]

[0020] Calculate the risk level of user behavior, where: is the probability of the predicted risk level, e is the base of the natural logarithm, β 0 is the intercept term, β 1 is the weight coefficient of the number of failed logins, x 1 is the number of failed logins, β 2 is the weight coefficient of the abnormal login time point, x 2 is the abnormal login time point, β 3 is the weight coefficient of access frequency, x 3 is the access frequency, β 4 is the weight coefficient of the data access type, x 4 is the data access type, β 5 is the weight coefficient of the geographic location score, x 5 is the geographic location score, β 6 is the weight coefficient of the device security level, x 6 is the device security level, β 7 is the weight coefficient of time sensitivity, x 7 is the time sensitivity, β 8 is the weight coefficient of behavior continuity, x 8 For behavioral continuity.

[0021] As a further solution of the present invention, the access control management module includes:

[0022] The comparison threshold setting submodule sets the behavior detection threshold based on the user behavior evaluation record, including the number of login failures and abnormal login time interval, and generates the behavior detection threshold parameter;

[0023] The access parameter control submodule adjusts the user's access rights based on the behavior detection threshold parameters and the detected abnormal user behavior, including restricting access and triggering multi-factor authentication, and generates a control parameter adjustment result;

[0024] The response activity recording submodule records the authority adjustment activity based on the control parameter adjustment result, including the adjusted user, the time of adjustment and the type of adjustment, and generates an authority adjustment record.

[0025] As a further solution of the present invention, the data source analysis module includes:

[0026] The data source tracking submodule analyzes the information that needs to be released by the highway smart screen based on the permission adjustment record, identifies the data source of the released information, builds a data source relationship network, and generates a source relationship map;

[0027] The modification history recording submodule records the modification history of multiple data points based on the source relationship graph, records the modifier, modification time, and modification content, and generates a modification record data set;

[0028] The consistency assessment submodule assesses the consistency of the data and the correctness of the source based on the modification record data set, identifies data tampering records and abnormal source data, and generates data traceability analysis results.

[0029] As a further solution of the present invention, the storage demand assessment module includes:

[0030] The access pattern analysis submodule analyzes the access patterns and access frequencies of various data based on the data traceability analysis results, identifies the activity and importance of the data, and generates access pattern analysis information;

[0031] The sensitivity assessment submodule analyzes the information based on the access pattern, assesses the sensitivity level of the data according to the source and type of the data, analyzes the priority of data protection, and generates a data sensitivity rating;

[0032] The storage parameter adjustment submodule adjusts the priority and hierarchy of various data storages based on the data sensitivity rating and according to the sensitivity and protection priority of the data, and generates storage demand analysis data.

[0033] As a further solution of the present invention, the backup frequency adjustment module includes:

[0034] The criticality analysis submodule analyzes the data based on the storage demand, evaluates the importance of multiple data types according to the sensitivity, business value, and urgency of information release, and generates importance evaluation results;

[0035] The frequency parameter setting submodule adjusts the backup frequency of various data based on the importance evaluation result, according to the importance level and the data release frequency, and generates a backup frequency adjustment result;

[0036] The backup mode adjustment submodule adjusts various data backup cycles, backup types and storage locations based on the backup frequency adjustment result to generate data backup parameters.

[0037] As a further solution of the present invention, the traffic pattern analysis module includes:

[0038] The data flow recording submodule continuously monitors the network flow based on the data backup parameters, records the changes of various flow modes and data flow, and generates real-time flow monitoring results;

[0039] The traffic pattern analysis submodule uses a K-nearest neighbor algorithm based on the real-time traffic monitoring results to analyze and identify abnormal data traffic patterns, including traffic surges and data leaks, and generates abnormal traffic identification results;

[0040] The abnormal traffic response submodule responds to the abnormal data traffic pattern based on the abnormal traffic identification result, including performing traffic isolation and data flow correction, and generating information risk protection parameters.

[0041] As a further solution of the present invention, the K nearest neighbor algorithm is according to the formula:

[0042]

[0043] Calculate the abnormal degree of data traffic, where d(x,x i ) is point x and point x i The distance between them, x is the currently observed data point, x i is a point in the training data set, x j is the jth eigenvalue of point x, x ij For point x i The jth eigenvalue of j is the weight coefficient of the jth feature, s j is the normalization factor of the jth feature, n is the total number of features, t is the time decay factor, Δt is the time difference, e is the base of the natural logarithm, d is the distance, i is the index, and j is the feature index.

[0044] Compared with the prior art, the advantages and positive effects of the present invention are:

[0045] In the present invention, by analyzing the information access behavior released by the smart screen, identifying abnormal behavior and dynamically adjusting permissions, combined with the evaluation of the consistency of data and the correctness of the source, the risk of data tampering is reduced, the priority of data storage is adjusted according to the sensitivity and importance of the data, and the data backup frequency is adjusted according to the time and frequency of information release. The efficiency and pertinence of data backup are improved, and the responsiveness to abnormal traffic and data security are enhanced by real-time monitoring of data transmission traffic patterns, ensuring the stability and reliability of highway information release, and providing accurate and timely traffic information for drivers and pedestrians. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 is a system flow chart of the present invention;

[0047] Figure 2 It is a schematic diagram of the system framework of the present invention;

[0048] Figure 3 This is a flow chart of the access activity monitoring module of the present invention;

[0049] Figure 4 This is a flow chart of the access control management module of the present invention;

[0050] Figure 5 It is a flow chart of the data source analysis module of the present invention;

[0051] Figure 6 It is a flow chart of the storage demand assessment module of the present invention;

[0052] Figure 7 This is a flow chart of the backup frequency adjustment module of the present invention;

[0053] Figure 8 It is a flow chart of the traffic pattern analysis module of the present invention. DETAILED DESCRIPTION

[0054] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0055] In the description of the present invention, it should be understood that the terms "length", "width", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside" and the like indicate positions or positional relationships based on the positions or positional relationships shown in the drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as limiting the present invention. In addition, in the description of the present invention, "multiple" means two or more, unless otherwise clearly and specifically defined.

[0056] Example

[0057] See also Figure 1 to Figure 2 , a safety protection system for highway smart screen information release includes:

[0058] The access activity monitoring module analyzes the behavior of accessing the information released by the highway smart screen based on the user access behavior information, identifies the login records and access time, and generates user behavior evaluation records;

[0059] The access control management module sets behavior detection thresholds based on user behavior assessment records, adjusts user access rights according to abnormal user behavior, and generates permission adjustment records;

[0060] The data source analysis module analyzes the published information based on the authority adjustment records, evaluates the consistency of the data and the correctness of the source, and generates data traceability analysis results;

[0061] The storage demand assessment module assesses the storage demand and sensitivity of various data based on the data traceability analysis results, adjusts the priority and hierarchy of data storage, and generates storage demand analysis data;

[0062] The backup frequency adjustment module analyzes the data based on storage demand, analyzes the importance of various data that need to be released, and adjusts the frequency of data backup according to the time and frequency of information release, and generates data backup parameters;

[0063] The traffic pattern analysis module monitors and analyzes data transmission traffic based on data backup parameters, identifies and responds to abnormal traffic patterns, including isolating and correcting abnormal data flows, and generating information risk protection parameters.

[0064] User behavior assessment records include the number of login attempts, activity time point analysis results and abnormal behavior identification records. Permission adjustment records include behavior detection threshold setting parameters, abnormal user behavior processing records and permission adjustment records. Data traceability analysis results include data relationship map construction results, data point source records and consistency assessment information. Storage demand analysis data includes storage priority adjustment results, hierarchy assessment information and storage sensitivity analysis results. Data backup parameters include backup frequency adjustment results, importance analysis data and information release time and frequency information. Information risk protection parameters include real-time data flow monitoring records, abnormal traffic pattern recognition results and information risk protection parameters.

[0065] See also Figure 2 and Figure 3 , access activity monitoring modules include:

[0066] The behavior information collection submodule collects and records the user's login time, access frequency, and access duration based on the user's access behavior information, and generates the user activity data record in the following process:

[0067] In the behavior information collection submodule, based on the user access behavior information, the login time, access frequency, and access duration of each user are recorded, and the recording parameters are set including login time, access frequency, and access duration. The daily user activity index is calculated using the formula: Activity Index = Number of Visits / Login Time + Duration. The data records are updated in real time, and the user activity data within one month is accumulated and stored in the central database, and indexed according to the user ID. For the data collection process, data archiving is set at early morning every day to ensure the timeliness and integrity of the information and generate user activity data records.

[0068] The access data analysis submodule analyzes the user's login time and access frequency based on the user activity data records, evaluates the consistency with normal access behavior, identifies abnormal access behavior, and generates abnormal behavior identification records. The specific process is as follows:

[0069] In the access data analysis submodule, the user's average login time, access frequency, and average daily access duration are calculated based on the user activity data records. For the login time, the average value of all records is calculated. For the access frequency, the total number of visits is calculated divided by the number of record days. For the access duration, the total duration is calculated divided by the number of visits. The consistency index is calculated using the following formula: consistency index = (average login time * number of visits + average daily access duration) / access frequency. It is used to compare the differences between the model calculation results and the historical data model. By evaluating the consistency with normal access behavior, abnormal access behavior that deviates from the norm is identified, and abnormal behavior identification records are generated.

[0070] The risk level analysis submodule uses a logistic regression algorithm based on abnormal behavior identification records to analyze the behavioral characteristics of multiple users, evaluate the security risk level and calculate the behavioral risk score. The specific process of generating user behavior evaluation records is as follows:

[0071] In the risk level analysis submodule, based on abnormal behavior identification records, the behavioral characteristics of multiple users are analyzed, including login time, access frequency, and operation type. The target characteristics are grouped and organized, quantified, and a user behavior feature matrix is ​​constructed. The feature matrix is ​​normalized and the data is stratified using a hierarchical screening method. The proportion and characteristics of abnormal behaviors in each layer are calculated. By comparing multi-level data, risky user groups are identified and risk scores are calculated for each user. A logistic regression model is used in combination with user historical behavior data to evaluate the user's security risk level and generate a user behavior evaluation record.

[0072] Logistic regression algorithm, according to the formula:

[0073]

[0074] Calculate the risk level of user behavior, where: is the probability of the predicted risk level, which is used to represent the potential security risk of user behavior, e is the base of the natural logarithm, β 0 is the intercept term, which is used to adjust the bias of the entire model, β 1 is the weight coefficient of the number of failed logins, which is used to measure the contribution of failed logins to the risk score. 1 is the number of login failures, which is used to measure abnormal behavior of users when logging in. 2 is the weight coefficient of the abnormal login time point, which is used to measure the contribution of the abnormal login time to the risk score. 2 is the abnormal login time point, which is used to identify the time abnormality of user login behavior, β 3 is the weight coefficient of access frequency, which is used to measure the impact of access frequency on risk score. 3 is the access frequency, which is used to measure how frequently users access the system, and β 4 is the weight coefficient of the data access type, which is used to measure the impact of different data access behaviors on the risk score. 4 is the data access type, which is used to identify the user's behavior pattern when accessing different data. 5 is the weight coefficient of the geographic location score, which is used to measure the impact of the user's geographic location on security risks. 5 is the geographic location score, which is used to represent the geographic location information of the user's access request, β 6 is the weight coefficient of the device security level, which is used to measure the impact of device security on the risk score. 6 is the device security level, which is used to indicate the security status of the device used by the user to access the system. 7 is the weight coefficient of time sensitivity, which is used to measure the impact of access timing on security risks. 7 is time sensitivity, which is used to identify whether the user accesses the data during a sensitive period of time. 8 is the weight coefficient of behavior continuity, which is used to measure the impact of the continuity of user behavior patterns on risk scores. 8 Behavior continuity is used to describe the consistency and periodicity of user behavior.

[0075] The specific execution process of the formula is as follows:

[0076] By collecting the user's login data, we obtain multiple parameters such as the number of failed logins, abnormal login time points, access frequency, data access type, geographic location score, device security level, time sensitivity, and behavior continuity. We use the maximum likelihood estimation method to determine the weight coefficient of the model, substitute the parameters into the formula, calculate the probability of the risk level, predict the threat posed by the user's behavior to the system security, and implement corresponding security measures, including strengthening monitoring, restricting access, and triggering security alarms.

[0077] See also Figure 2 and Figure 4 , the access control management module includes:

[0078] The comparison threshold setting submodule sets the behavior detection threshold based on the user behavior evaluation record, including the number of login failures and abnormal login time interval. The specific process of generating the behavior detection threshold parameters is as follows;

[0079] In the comparison threshold setting submodule, based on the user behavior assessment records, the upper and lower limits of the behavior risk score are identified to define the behavior detection threshold. The threshold for the number of failed logins is set to 5 times, and the abnormal login time interval is from 12 o'clock in the evening to 4 o'clock in the morning. For threshold setting, the calculation formula is: Behavior risk threshold = average behavior risk score ± standard deviation. The boundary between normal behavior and abnormal behavior is determined, the number of failed logins and the abnormal login time interval are recorded, and the behavior detection threshold parameters are generated to provide a basis for access control.

[0080] The access parameter control submodule adjusts the user's access rights based on the behavior detection threshold parameters and the detected abnormal user behavior, including restricting access and triggering multi-factor authentication. The specific process of generating the control parameter adjustment results is as follows;

[0081] In the access parameter control submodule, based on the behavior detection threshold parameter, the comparison result between the current login attempt and the set threshold is analyzed. When it is detected that the number of failed logins exceeds the set threshold and the login time falls within the abnormal interval, the access permission adjustment is performed. The formula is: access permission adjustment = (number of failed logins > number of failed logins threshold) or (current time∈abnormal login time interval). Based on whether access restriction or multi-factor authentication is triggered, the user's access permission is adjusted, including restricting access and triggering multi-factor authentication, and the control parameter adjustment result is generated.

[0082] The response activity record submodule records the permission adjustment activity based on the control parameter adjustment result, including the adjusted user, the time of adjustment and the type of adjustment. The specific process of generating the permission adjustment record is as follows:

[0083] In the response activity recording submodule, based on the control parameter adjustment results, the information of each permission adjustment is recorded, including the adjusted user, the time when the adjustment occurred, and the type of adjustment. By extracting the user ID, adjustment time and adjustment type, formatting the information, and writing it to the database, the record format is: Permission adjustment record entry = user ID + adjustment time + adjustment type, ensuring data consistency and readability, and generating a permission adjustment record.

[0084] See also Figure 2 and Figure 5 , the data source analysis module includes:

[0085] The data source tracking submodule analyzes the information that needs to be released by the highway smart screen based on the permission adjustment record, identifies the data source of the released information, builds a data source relationship network, and generates a source relationship map. The specific process is as follows;

[0086] In the data source tracking submodule, based on the permission adjustment records, the record data is analyzed, the permission change events and timestamps are extracted, and the publishing information of each data point is analyzed, including the publisher, publishing time and content. The validity of the data source is identified and verified. By constructing data nodes and associated nodes, multiple data points are connected using graph theory algorithms to form a data source relationship diagram. By using data points as nodes and data interactions as edges, the data flow and dependencies are visualized. The node weight is determined by the data update frequency and data access volume. The formula is: node weight = update frequency / data access volume + number of permission adjustments. The sources and relationships of various data are analyzed to generate a source relationship map.

[0087] The modification history submodule records the modification history of multiple data points based on the source relationship graph, records the modifier, modification time and modification content, and generates the modification record data set in the following process:

[0088] In the modification history submodule, the modification history of each data point is recorded based on the source relationship graph, including extracting nodes and connected edges from the graph. For each data modification, the modifier, modification time and modification content are recorded, and the weight of the node is adjusted according to the nature and frequency of the modification. By tracking the modification events in the node, the flow and changes of the data are tracked. The formula is: modification impact = number of modifications / number of node connections + importance of modification content, and a modification record data set is generated.

[0089] The consistency assessment submodule evaluates the consistency of data and the correctness of the source based on the modification record data set, identifies data tampering records and abnormal source data, and generates data traceability analysis results. The specific process is as follows:

[0090] In the consistency assessment submodule, based on the modification record data set, the difference analysis method is used to evaluate the consistency of the data and the correctness of the source. For each record in the data set, the status before and after the modification is compared. According to the degree of change in the data content and the frequency of source change, the data consistency is calculated. When signs of data tampering are detected and the source information is inconsistent with the authority record, it is marked as an anomaly. By comparing the consistency of the data modification record with the source relationship map, the formula is: consistency score = node weight / modification impact + data integrity. According to the score, the tampered record and abnormal source data are identified, and the data traceability analysis results are generated.

[0091] See also Figure 2 and Figure 6, the storage requirements assessment module includes:

[0092] The access pattern analysis submodule analyzes the access patterns and access frequencies of various data based on the data traceability analysis results, identifies the activity and importance of the data, and generates the access pattern analysis information in the following process:

[0093] In the access pattern analysis submodule, based on the data traceability analysis results, each data point in the analysis results is classified, the access pattern and frequency are analyzed according to the activity records of the data points, the access records of each data point are arranged in time series, and the activity is determined by calculating the access interval and frequency of each data point. Combined with the data update frequency and user access volume, the weighted average method is used to evaluate the importance of the data. The formula is: activity = access frequency / average interval + number of updates. The activity and importance of each type of data are quantified to generate access pattern analysis information.

[0094] The sensitivity assessment submodule analyzes information based on access patterns, assesses the sensitivity level of data according to the source and type of data, analyzes the priority of data protection, and generates the data sensitivity rating process as follows;

[0095] In the sensitivity assessment submodule, based on the access pattern analysis information, the source and type of each data are analyzed. According to the original source of the data, the change history, and the complexity of the access pattern, a hierarchical assessment method is used to determine the sensitivity level of the data, including scoring the privacy, volatility, and relevance of the data. The formula is: Sensitivity level = source sensitivity weight / data type impact + access complexity. Based on the assessment results, the priority of data protection is analyzed and a data sensitivity rating is generated.

[0096] The storage parameter adjustment submodule adjusts the priority and hierarchy of various data storage based on data sensitivity rating and data protection priority, and generates storage demand analysis data in the following process:

[0097] In the storage parameter adjustment submodule, based on the data sensitivity rating, the storage priority and storage hierarchy are adjusted for data with differentiated sensitivity levels. The data is classified according to the sensitivity level, and differentiated levels of storage resources are allocated to each type of data, including differentiated encryption levels and physical storage locations. A dynamic resource allocation algorithm is used to ensure that highly sensitive data obtains a higher level of protection. The formula is: storage priority = sensitivity level * protection priority / data access frequency. The parameters of data storage are adjusted to generate storage demand analysis data.

[0098] See also Figure 2 and Figure 7 , the backup frequency adjustment module includes:

[0099] The criticality analysis submodule analyzes data based on storage requirements, and evaluates the importance of various data types according to the sensitivity, business value, and urgency of information release. The specific process of generating importance assessment results is as follows:

[0100] In the criticality analysis submodule, multiple types of data are evaluated based on storage demand analysis data. Scoring criteria are set for each type of data according to the data's sensitivity level, business value, and urgency of information release. The data's usage and feedback from business departments are monitored in real time to analyze the impact of the data on business processes. The criticality is calculated using a scoring algorithm that combines the business value and sensitivity of each type of data. The formula is: Criticality = Sensitivity rating * Business value + Urgency. The importance assessment result is generated based on the resulting score.

[0101] The frequency parameter setting submodule adjusts the backup frequency of various data based on the importance assessment results, according to the importance level and data release frequency, and the specific process of generating the backup frequency adjustment result is as follows;

[0102] In the frequency parameter setting submodule, the backup frequency of the data is adjusted based on the importance assessment results. Corresponding backup frequency parameters are set for data of various importance levels. The backup frequency is adjusted based on the data importance assessment results, data release and change frequency, using the threshold judgment method. By comparing the activity and criticality of the data, the formula is: backup frequency = criticality / data release frequency. The backup frequencies of various data types are adjusted to generate backup frequency adjustment results.

[0103] The backup mode adjustment submodule adjusts the various data backup cycles, backup types and storage locations based on the backup frequency adjustment result, and generates the data backup parameters in the following specific process:

[0104] In the backup mode adjustment submodule, the backup parameters of various data types are adjusted based on the backup frequency adjustment results, including the backup cycle, backup type, and storage location. The current backup parameters of each data type are determined, the backup cycle is set, and the backup type is selected. For the storage location, the security and access speed of the data are considered, and the optimal storage location is selected. The formula is: backup cycle = basic cycle / backup frequency. The backup parameters are reconfigured to generate data backup parameters.

[0105] See also Figure 2 and Figure 8 , the traffic pattern analysis module includes:

[0106] The data traffic recording submodule continuously monitors network traffic based on data backup parameters, records changes in various traffic patterns and data traffic, and generates real-time traffic monitoring results. The specific process is as follows:

[0107] In the data traffic recording submodule, based on the data backup parameters, the basic parameters of network monitoring are set, including monitoring frequency and monitoring range, to ensure coverage of all key data nodes. By deploying traffic monitoring tools on network nodes, the traffic patterns and changes of each node through which the data flow passes are continuously tracked and recorded. The data transmission volume per second, per minute and per hour, and abnormal fluctuations during the transmission process are recorded. The average rate, peak value and trough value of the data flow are recorded. The formula is: real-time traffic = current traffic / average traffic + traffic fluctuation rate, and real-time traffic monitoring results are generated.

[0108] The traffic pattern analysis submodule uses the K nearest neighbor algorithm based on the real-time traffic monitoring results to analyze and identify abnormal data traffic patterns, including traffic surges and data leaks. The specific process of generating abnormal traffic identification results is as follows:

[0109] In the traffic pattern analysis submodule, based on the real-time traffic monitoring results, the monitoring data is preprocessed, including removing noise and abnormal data, smoothing data fluctuations, calculating key feature indicators for each time window, including average flow, maximum flow, minimum flow and flow standard deviation, constructing feature vectors using target feature indicators, and using K nearest neighbor algorithm for cluster analysis. The feature vectors are compared with historical normal traffic data, and the degree of abnormality of the current traffic pattern is determined by calculating the distance between feature vectors. Abnormal traffic is identified, and the identification results are recorded to generate abnormal traffic identification results.

[0110] K nearest neighbor algorithm, according to the formula:

[0111]

[0112] Calculate the abnormal degree of data traffic, where d(x,x i ) is point x and point x i The distance between them is used to measure the similarity and difference between two data points in the feature space. x is the currently observed data point, x i is a point in the training data set, which is used to compare with the current point to determine whether it is abnormal. j is the jth eigenvalue of point x, which is used to describe the specific attributes of the target data point. ij For point x i The j-th eigenvalue of is used to describe the specific attributes of the training data point, w j is the weight coefficient of the jth feature, which is used to adjust the influence of the target feature in the distance calculation to reflect the importance of different features. jis the normalization factor of the j-th feature, which is used to convert feature values ​​of different dimensions to the same scale. n is the total number of features, indicating how many features are used to calculate the distance. t is the time decay factor, which is used to adjust the influence of the distance according to the time difference to reduce the influence of old data on the current decision. Δt is the time difference, which represents the time interval between the current data point and the training data point. e is the base of the natural logarithm, which is used to calculate the exponential effect of time decay. d is the distance, which is used to measure the similarity and difference between two data points in the feature space and identify abnormal and normal patterns. i is the index, which represents the i-th data point in the data set. j is the feature index, which is used to identify the j-th feature of the data point.

[0113] The specific execution process of the formula is as follows:

[0114] Collect data through the real-time monitoring system and obtain the characteristic values ​​x of multiple data points j and timestamp, and use gradient descent to train the model based on historical data to determine the weight w j , normalization factor s j , and time decay factor t, substitute the parameters into the formula, calculate the distance between each data point and the data points in the training set, and identify abnormal patterns in the data flow, including traffic surges and data leakage.

[0115] The abnormal traffic response submodule responds to abnormal data traffic patterns based on the abnormal traffic identification results, including performing traffic isolation and data flow correction, and generating information risk protection parameters. The specific process is as follows;

[0116] In the abnormal traffic response submodule, targeted traffic response measures are taken based on the abnormal traffic identification results. According to the nature and severity of the abnormality, the data flow is isolated or corrected. The data flow identified as abnormal is isolated, the abnormal data flow is analyzed and corrected, and the normal state of the data flow is restored. The formula is: risk protection = anomaly score * sensitivity level, and information risk protection parameters are generated.

[0117] The above are only preferred embodiments of the present invention and are not intended to limit the present invention in other forms. Any technician familiar with the profession may use the technical contents disclosed above to change or modify them into equivalent embodiments with equivalent changes and apply them to other fields. However, any simple modification, equivalent change and modification made to the above embodiments based on the technical essence of the present invention without departing from the technical solution of the present invention still falls within the protection scope of the technical solution of the present invention.

Claims

1. A safety protection system for information release on highway smart screens, characterized by: The system comprises: The access activity monitoring module analyzes the behavior of accessing the information released by the highway smart screen based on the user access behavior information, identifies the login records and access time, and generates user behavior evaluation records; The access control management module sets a behavior detection threshold based on the user behavior evaluation record, adjusts user access rights according to abnormal user behavior, and generates a permission adjustment record; The data source analysis module analyzes the published information based on the authority adjustment record, evaluates the consistency of the data and the correctness of the source, and generates data traceability analysis results; The storage demand assessment module assesses the storage demand and sensitivity of various data according to the data traceability analysis results, adjusts the priority and hierarchy of data storage, and generates storage demand analysis data; The backup frequency adjustment module analyzes the importance of various data to be released based on the storage demand analysis data, and adjusts the frequency of data backup according to the time and frequency of information release to generate data backup parameters; The traffic pattern analysis module monitors and analyzes the data transmission traffic based on the data backup parameters, identifies and responds to abnormal traffic patterns, including isolating and correcting abnormal data flows, and generating information risk protection parameters.

2. The safety protection system for highway smart screen information release according to claim 1 is characterized in that: The user behavior assessment record includes the number of login attempts, activity time point analysis results and abnormal behavior identification records; the permission adjustment record includes behavior detection threshold setting parameters, abnormal user behavior processing records and permission adjustment records; the data traceability analysis results include data relationship map construction results, data point source records and consistency assessment information; the storage demand analysis data includes storage priority adjustment results, hierarchy assessment information and storage sensitivity analysis results; the data backup parameters include backup frequency adjustment results, importance analysis data and information release time and frequency information; the information risk protection parameters include real-time data flow monitoring records, abnormal traffic pattern recognition results and information risk protection parameters.

3. The safety protection system for highway smart screen information release according to claim 1 is characterized in that: The access activity monitoring module includes: The behavior information collection submodule collects and records the user's login time, access frequency, and access duration based on the user's access behavior information, and generates user activity data records; The access data analysis submodule analyzes the user's login time and access frequency based on the user activity data record, evaluates the consistency with normal access behavior, identifies abnormal access behavior, and generates abnormal behavior identification records; The risk level analysis submodule uses a logistic regression algorithm based on the abnormal behavior identification record to analyze the behavioral characteristics of multiple users, evaluate the security risk level and calculate the behavioral risk score, and generate a user behavior evaluation record.

4. The safety protection system for highway smart screen information release according to claim 3 is characterized in that: The logistic regression algorithm is based on the formula: Calculate the risk level of user behavior, where: is the probability of the predicted risk level, e is the base of the natural logarithm, β0 is the intercept term, β1 is the weight coefficient of the number of failed logins, x1 is the number of failed logins, β2 is the weight coefficient of the abnormal login time point, x2 is the abnormal login time point, β3 is the weight coefficient of the access frequency, x3 is the access frequency, β4 is the weight coefficient of the data access type, x4 is the data access type, β5 is the weight coefficient of the geographic location score, x5 is the geographic location score, β6 is the weight coefficient of the device security level, x6 is the device security level, β7 is the weight coefficient of time sensitivity, x7 is time sensitivity, β8 is the weight coefficient of behavior continuity, x8 is behavior continuity.

5. The safety protection system for highway smart screen information release according to claim 1 is characterized in that: The access control management module includes: The comparison threshold setting submodule sets the behavior detection threshold based on the user behavior evaluation record, including the number of login failures and abnormal login time interval, and generates the behavior detection threshold parameter; The access parameter control submodule adjusts the user's access rights based on the behavior detection threshold parameters and the detected abnormal user behavior, including restricting access and triggering multi-factor authentication, and generates a control parameter adjustment result; The response activity recording submodule records the authority adjustment activity based on the control parameter adjustment result, including the adjusted user, the time of adjustment and the type of adjustment, and generates an authority adjustment record.

6. The safety protection system for highway smart screen information release according to claim 1 is characterized in that: The data source analysis module includes: The data source tracking submodule analyzes the information that needs to be released by the highway smart screen based on the permission adjustment record, identifies the data source of the released information, builds a data source relationship network, and generates a source relationship map; The modification history recording submodule records the modification history of multiple data points based on the source relationship graph, records the modifier, modification time, and modification content, and generates a modification record data set; The consistency assessment submodule assesses the consistency of the data and the correctness of the source based on the modification record data set, identifies data tampering records and abnormal source data, and generates data traceability analysis results.

7. The safety protection system for highway smart screen information release according to claim 1 is characterized in that: The storage demand assessment module includes: The access pattern analysis submodule analyzes the access patterns and access frequencies of various data based on the data traceability analysis results, identifies the activity and importance of the data, and generates access pattern analysis information; The sensitivity assessment submodule analyzes the information based on the access pattern, assesses the sensitivity level of the data according to the source and type of the data, analyzes the priority of data protection, and generates a data sensitivity rating; The storage parameter adjustment submodule adjusts the priority and hierarchy of various data storages based on the data sensitivity rating and according to the sensitivity and protection priority of the data, and generates storage demand analysis data.

8. The safety protection system for highway smart screen information release according to claim 1 is characterized in that: The backup frequency adjustment module includes: The criticality analysis submodule analyzes the data based on the storage demand, evaluates the importance of multiple data types according to the sensitivity, business value, and urgency of information release, and generates importance evaluation results; The frequency parameter setting submodule adjusts the backup frequency of various data based on the importance evaluation result, according to the importance level and the data release frequency, and generates a backup frequency adjustment result; The backup mode adjustment submodule adjusts various data backup cycles, backup types and storage locations based on the backup frequency adjustment result to generate data backup parameters.

9. The safety protection system for highway smart screen information release according to claim 1 is characterized in that: The traffic pattern analysis module includes: The data flow recording submodule continuously monitors the network flow based on the data backup parameters, records the changes of various flow modes and data flow, and generates real-time flow monitoring results; The traffic pattern analysis submodule uses a K-nearest neighbor algorithm based on the real-time traffic monitoring results to analyze and identify abnormal data traffic patterns, including traffic surges and data leaks, and generates abnormal traffic identification results; The abnormal traffic response submodule responds to the abnormal data traffic pattern based on the abnormal traffic identification result, including performing traffic isolation and data flow correction, and generating information risk protection parameters.

10. The safety protection system for highway smart screen information release according to claim 9 is characterized in that: The K nearest neighbor algorithm is based on the formula: Calculate the abnormal degree of data traffic, where d(x,x i ) is point x and point x i The distance between them, x is the currently observed data point, x i is a point in the training data set, x j is the jth eigenvalue of point x, x ij For point x i The jth eigenvalue of j is the weight coefficient of the jth feature, s j is the normalization factor of the jth feature, n is the total number of features, t is the time decay factor, Δt is the time difference, e is the base of the natural logarithm, d is the distance, i is the index, and j is the feature index.

Images