Education data safety emergency response and recovery system and method based on artificial intelligence

Abstract

The invention relates to the technical field of data processing, and discloses an education data safety emergency response and recovery system and method based on artificial intelligence. The method comprises the following steps: firstly, acquiring education-related data, generating an initial education data matrix, calculating sensitivity, similarity and association strength, and performing risk assessment on the initial education data matrix; secondly, performing network anomaly detection on the processed education data matrix, and starting an emergency response scheme when the education data is invaded by a network in an abnormal state; a BP neural network is trained to obtain a BP neural network model, and education data risk prediction is realized; and finally, according to an educational data risk prediction result, missing or damaged educational data is recovered, network security situation assessment is carried out, and advanced security emergency response is realized. By analyzing and evaluating the education data, the purpose of safety emergency response and recovery is achieved, and the method is accurate and objective.

Description

Technical Field

[0001] The present invention relates to the technical field of data processing, and specifically to an education data security emergency response and recovery system and method based on artificial intelligence. Background Art

[0002] Chinese patent CN116521303A discloses a method and system for dynamic display of emergency plans based on multi-source data fusion, the method specifically includes: obtaining multiple fine-grained emergency plans containing multi-source emergency data controls, wherein the multi-source emergency data controls include at least one multi-source emergency data; then fusing multiple fine-grained emergency plans containing multi-source emergency data controls through the multi-source emergency data, for receiving response actions that trigger multiple fine-grained emergency plans containing multi-source emergency data controls; when multiple fine-grained emergency plans containing multi-source emergency data controls are triggered, real-time multi-element emergency data in the triggered fine-grained emergency plans are obtained, and the display content of the multi-source emergency data controls in the multiple fine-grained emergency plans containing multi-source emergency data controls is updated according to the real-time multi-element emergency data, so as to realize dynamic display of emergency plans. This invention does not process the data, and the result has a large error.

[0003] Traditional education data security emergency response methods cannot accurately, promptly, and comprehensively obtain real-time education data when an education safety accident occurs, nor can they generate emergency response plans in a timely manner, posing a continuous threat to education data. At the same time, education data recovery methods are slow and difficult to recover, and do not use high-tech technologies such as machine learning, which increases labor costs. Summary of the invention

[0004] In response to the problems in the related technology, the present invention provides an education data security emergency response and recovery system and method based on artificial intelligence to overcome the above-mentioned technical problems existing in the existing related technology.

[0005] In order to solve the above technical problems, the present invention is achieved through the following technical solutions: The present invention is an education data security emergency response and recovery system and method based on artificial intelligence, comprising the following steps: S1. Obtain education-related data, generate an initial education data matrix, calculate the sensitivity, similarity and correlation strength of the initial education data in the initial education data matrix, and perform risk assessment on the initial education data in the initial education data matrix, and obtain a processed education data matrix by comparing with a risk threshold; S2, using an anomaly detection algorithm to perform network anomaly detection on the processed education data in the processed education data matrix, and when in an abnormal state, start an emergency response plan to obtain a final education data matrix; S3, obtain a new set of educational data samples, extract sample features, and train the BP neural network to obtain The BP neural network model outputs the education data risk prediction result of the processed education data matrix to complete the risk prediction; S4. Based on the education data risk prediction results, restore the final education data in the final education data matrix to obtain a restored education data matrix, and perform a network security situation assessment on the restored education data matrix.

[0006] The invention obtains education-related data, generates an initial education data matrix, calculates the sensitivity of the initial education data in the initial education data matrix, and then uses the generalization tree principle to node the initial education data in the initial education data matrix, obtains the similarity by calculating the node distance, obtains the correlation strength according to the data uncertainty, and performs risk assessment on the initial education data matrix based on sensitivity, similarity and correlation strength; the method uses multiple evaluation indicators to facilitate the quantitative processing of risk assessment, and the obtained evaluation results are accurate and objective; secondly, the anomaly detection algorithm is used to perform network anomaly detection on the processed education data matrix, the anomaly coefficient of the network traffic data is calculated, and the judgment is made whether it is In an abnormal state, the education data is invaded by the network, and the education data is missing or damaged; this method predicts network traffic through window data, which can reduce the false alarm rate and quickly judge the abnormal state; then train the BP neural network to obtain the BP neural network model to realize the risk prediction of education data. The neural network has a short training time and high prediction accuracy; finally, according to the education data risk prediction results, the missing or damaged education data is restored to obtain the restored education data matrix, and a network security situation assessment is performed to realize early security emergency response; this method uses overload technology to speed up the recovery speed, and early security emergency response can reduce data intrusion losses and improve the feasibility of the method.

[0007] Preferably, the S1 comprises the following steps: S11, obtaining education-related data, the types of education-related data include classroom teaching activity data, student family information data, faculty information data, etc., obtaining an initial education data set, and generating an initial education data matrix A as follows: ; in, Indicates m Education-related data n Initial education data; Select any education-related data in the initial education data matrix to form a first education data set ,in Indicates Education-related data n initial educational data; normalize the first educational data set, and convert the normalized result into a sensitivity vector, which is recorded as the educational data sensitivity set ,in Indicates Education-related data n The sensitivity of educational data is calculated. The average sensitivity of the education-related data is calculated as follows: ; in, Indicates Education-related data Educational data sensitivity, Indicates The average sensitivity of the education-related data, ; According to Calculation of the average sensitivity of education-related data The subjective sensitivity of the education-related data and The subjective sensitivity of the education-related data is converted into objective sensitivity. The calculation formula is as follows: ; in, Indicates objective sensitivity to education-related data, Indicates The subjective sensitivity of education-related data; The objective sensitivity of all education-related data in the initial education data matrix is ​​obtained in turn, and the sensitivity set of education data is obtained; S12, selecting any education-related data in the initial education data matrix to form a second education data set ,in Indicates Education-related data n initial education data; converting the second education data set into a generalization tree, the generalization tree node is the initial education data, selecting the generalization tree node and generalized tree nodes , calculate the generalization tree node and generalized tree nodes Distance, calculated as follows: ; in, Represents a generalized tree node and generalized tree nodes distance, Represents a generalized tree node and generalized tree nodes Shortest distance, Indicates the longest distance of any node in the generalization tree; Generalization Tree Node and generalized tree nodes Similarity , the generalized tree node and generalized tree nodes The similarity of Initial education data and The similarity of the initial education data is The similarity calculation formula of initial education data is as follows: ; in, Indicates The similarity of the initial education data, ; The similarities of all education-related data in the initial education data matrix are obtained in sequence to obtain a similarity set of education data; S13, selecting any education-related data in the initial education data matrix to form a third education data set ,in Indicates Education-related data n The initial education data is obtained according to the probability of the initial education data in the third education data set, and the gain of the initial education data is calculated according to the uncertainty of the initial education data. The calculation formula of the association strength is as follows: ; in, Represents initial education data Initial education data The strength of association, Represents initial education data and initial education data The gain, Represents initial education data Uncertainty, Represents initial education data Uncertainty; Calculate the correlation strength of all education-related data in the initial education data matrix in turn, and set the correlation strength threshold as , when the association strength of the initial education data is less than the association strength threshold, the association strength of the initial education data is set to 0; otherwise, the association strength of the initial education data is retained to obtain the education data association strength set; S14, assign weights to the education data sensitivity set, the education data similarity set and the education data association strength set, calculate the risk score of the initial education data in the initial education data matrix, and then calculate the average value of the risk score of the initial education data under the education-related data, recorded as the education data risk index; set the risk threshold to , select the education-related data corresponding to the education data risk index greater than the risk threshold, and obtain the processed education data matrix as follows: ; in, Indicates Education-related data n Processed education data.

[0008] The invention calculates the sensitivity, similarity and correlation strength of the initial education data in the initial education data matrix, uses multiple evaluation indicators, facilitates the quantification of risk assessment, and conducts risk assessment on the initial education data matrix based on sensitivity, similarity and correlation strength. The obtained evaluation results are accurate and objective.

[0009] Preferably, S2 comprises the following steps: S21, using an anomaly detection algorithm to perform network anomaly detection on the processed education data in the processed education data matrix to obtain processed education data in an abnormal state, the specific steps are as follows: S211, set the network flow window size to ,exist t Collect network traffic at all times to obtain the initial network traffic sequence ,in express The network traffic data collected at all times; performing averaging processing on the network traffic data in the initial network traffic sequence to obtain a network traffic sequence; S212, setting the noise interference term of the network traffic sequence to , the first The network traffic data is , the first The network traffic data is , and represents the traffic parameter, then the first Network traffic data The calculation formula is as follows: ; S213, according to the network traffic sequence The network traffic data is obtained in the network traffic sequence Network traffic data , set the abnormal parameters to , then the first The anomaly coefficient of network traffic data The calculation formula is as follows: ; The network traffic sequence is divided into a first network traffic sequence and a second network traffic sequence according to positive and negative values, and the mean values ​​of the network traffic in the first network traffic sequence and the second network traffic sequence are calculated and recorded as and , and then calculate the standard deviation of network traffic in the first network traffic sequence and the second network traffic sequence, respectively recorded as and ,set up represents a random number and , then the abnormal threshold range is ,When the abnormal coefficient is within the abnormal threshold range, the network traffic data corresponding to the abnormal coefficient is not abnormal, otherwise the network traffic data corresponding to the abnormal coefficient is abnormal; S214, when the network traffic data is abnormal, the processed education data in the processed education data matrix is ​​in an abnormal state; S22. For the processed education data in an abnormal state, identify the events that caused the abnormal state, evaluate the severity and impact range of the events that caused the abnormal state, set the severity threshold and the impact range threshold. When the severity of the event that caused the abnormal state is greater than the severity threshold and the impact range of the event that caused the abnormal state is greater than the impact range threshold, activate the emergency response plan, isolate the processed education data, obtain the final education data, and generate the final education data matrix.

[0010] The invention uses an anomaly detection algorithm to perform network anomaly detection on the processed education data matrix, and determines whether it is abnormal by comparing with the threshold. It can quickly determine whether the education data has been invaded by the network. This method predicts network traffic through window data, which can reduce the false alarm rate and obtain the situation of missing or damaged education data.

[0011] Preferably, S3 comprises the following steps: S31, initialize the BP (back propagation) neural network, determine the number of input layer nodes, the number of hidden layer nodes and the number of output layer nodes according to the input sample data set, input the sample data set into the input layer, set the learning rate and the activation function, calculate the output result of the hidden layer through the connection weights of the input layer and the hidden layer, and output the prediction result in the output layer according to the connection weights based on the output result of the hidden layer; S32, reacquire new education data, obtain a new education data sample set after the new education data passes the risk assessment, use the new education data sample set to train the BP neural network, and obtain the BP neural network model. The specific steps are as follows: S321, select the characteristics of the new education data sample set to obtain a sample feature set, set the number of BP neural network input nodes to , the number of input nodes is the number of features in the sample feature set, the number of output nodes is 2, the Adam optimizer is used, the activation function is the Softmax function, and the learning rate is , set the maximum number of iterations to ; Divide the sample feature set into a sample feature training set and a sample feature verification set, input the sample feature training set into the BP neural network, and when the current number of iterations reaches the maximum number of iterations, stop the iteration to obtain a trained BP neural network; S322, input the sample feature verification set into the trained BP neural network, and set the accuracy threshold to , when the accuracy of the output result is less than the accuracy threshold, stop the iteration and get the BP neural network model; otherwise, adjust the weight until the accuracy of the output result is less than the accuracy threshold; S33. Binarize the processed education data in the processed education data matrix to obtain a binarized data set, and input the binarized data set into the BP neural network model. When the BP neural network model outputs 1, there is a risk warning for the processed education data in the processed education data matrix. When the BP neural network model outputs 0, there is no risk warning for the processed education data in the processed education data matrix, thereby completing the education data risk prediction.

[0012] The invention extracts sample data features, trains a BP neural network, obtains a BP neural network model, identifies whether there are risk warnings in educational data, and predicts risks in educational data. The neural network has a short training time and high prediction accuracy.

[0013] Preferably, S4 comprises the following steps: S41, storing the initial education data in the initial education data matrix in the education database, and restoring the final education data in the final education data matrix using a reload strategy based on the education data risk prediction result, the specific steps are as follows: S411. Back up the initial education data in the initial education data matrix in advance according to the education data risk prediction result; if it is detected that the network is abnormal and the final education data in the final education data matrix is ​​missing or damaged, a data transmission signal application is sent to the education database; after receiving the data transmission signal, the education database selects the data page in the final education data matrix where the final education data is missing or damaged and adds it to the transmission queue; S412, preferentially scheduling the data pages of the final education data in the final education data matrix in the transmission queue until the transmission is completed, obtaining the restored education data, generating the restored education data matrix, and realizing education data recovery; S42, performing a network security situation assessment on the restored education data matrix to obtain a network security situation value, and performing a security emergency response in advance according to the network security situation value, the specific steps are as follows: S421. Obtain network traffic data during the network abnormality process to obtain a network traffic data set ,in Indicates i The network traffic data set is processed by binary classification, abnormal network traffic data is set to 1, and normal network traffic data is set to 0. The attack probability calculation formula is as follows: ; in, E represents the attack probability, Indicates The binary classification results of network traffic data are: ; S422. During the network attack, set j The impact of network attacks on network confidentiality is , No. j The impact of network attacks on network integrity is , No. j The impact of network attacks on network availability is , , and Represent the weights of network confidentiality, network integrity and network availability respectively, and the network attack impact coefficient calculation formula is as follows: ; in, Indicates j Cyber ​​attack impact coefficient of cyber attack-like; S423, set the number of network attack types to q , No. j The number of attacks of the network type is , the total amount of network attacks is G , then the network security situation value H The calculation formula is as follows; ; Set the situation threshold to When the network security situation value is greater than the situation threshold, there is a risk in the restored education data matrix, and a security emergency response is carried out in advance; otherwise, there is no risk in the restored education data matrix, and the network security situation assessment is completed.

[0014] This invention recovers missing or damaged education data based on the results of education data risk prediction, and uses overloading technology to speed up the recovery process; it also conducts network security situation assessment to achieve early security emergency response and improve the feasibility of the method.

[0015] The present invention also discloses a system of an education data security emergency response and recovery method based on artificial intelligence, which specifically includes: an initial education data risk assessment module, an education data security emergency response module, an education data risk prediction module, and an education data recovery and network security situation assessment module; The initial education data risk assessment module is used to perform risk assessment based on the sensitivity, similarity and association strength of the initial education data; The education data security emergency response module is used to perform network anomaly detection on education data and initiate an emergency response plan; The education data risk prediction module is used to predict the education data risk using a BP neural network model; The education data recovery and network security situation assessment module is used to recover missing or damaged education data and perform network security situation assessment.

[0016] The present invention has the following beneficial effects: 1. The invention calculates the sensitivity, similarity and correlation strength of the initial education data in the initial education data matrix, uses multiple evaluation indicators, facilitates the quantification of risk assessment, and conducts risk assessment, and the obtained evaluation results are accurate and objective.

[0017] 2. The invention uses an anomaly detection algorithm to perform network anomaly detection on the processed education data matrix, which can quickly determine whether the education data has been invaded by the network. By predicting network traffic through window data, the false alarm rate can be reduced to obtain the situation of missing or damaged education data.

[0018] 3. The invention extracts sample data features, trains a BP neural network, obtains a BP neural network model, identifies whether there are risk warnings in educational data, and realizes risk prediction of educational data. The neural network has a short training time and high prediction accuracy.

[0019] 4. The invention recovers missing or damaged education data according to the results of education data risk prediction, and uses overloading technology to speed up the recovery process; it also conducts network security situation assessment to implement security emergency response in advance, thereby improving the feasibility of the method.

[0020] Of course, any product implementing the present invention does not necessarily need to achieve all of the advantages described above at the same time. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions of the embodiments of the invention, the drawings required for describing the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the invention. For ordinary technicians in this field, they can also obtain drawings based on these drawings without paying creative work.

[0022] Figure 1 A schematic diagram of the process of emergency response and recovery of education data security by the artificial intelligence-based education data security emergency response and recovery system provided by the present invention. DETAILED DESCRIPTION

[0023] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0024] In the description of the present invention, it is necessary to understand that the terms "opening", "upper", "lower", "top", "middle", "inside" and the like indicating orientation or positional relationship are only for the convenience of describing the invention and simplifying the description, and do not indicate or imply that the components or elements referred to must have a specific orientation, be constructed and operate in a specific orientation, and therefore cannot be understood as limiting the invention.

[0025] Example 1 Please refer to Figure 1 The present invention is an artificial intelligence-based education data security emergency response and recovery method, comprising the following steps: S1. Obtain education-related data, generate an initial education data matrix, calculate the sensitivity, similarity and correlation strength of the initial education data in the initial education data matrix, and perform risk assessment on the initial education data in the initial education data matrix, and obtain a processed education data matrix by comparing with a risk threshold; The S1 comprises the following steps: S11, obtaining education-related data, the types of education-related data include classroom teaching activity data, student family information data, faculty information data, etc., obtaining an initial education data set, and generating an initial education data matrix A as follows: ; in, Indicates m Education-related data n Initial education data; Select any education-related data in the initial education data matrix to form a first education data set ,in Indicates Education-related data n initial educational data; normalize the first educational data set, and convert the normalized result into a sensitivity vector, which is recorded as the educational data sensitivity set ,in Indicates Education-related data n The sensitivity of educational data is calculated. The average sensitivity of the education-related data is calculated as follows: ; in, Indicates Education-related data Educational data sensitivity, Indicates The average sensitivity of the education-related data, ; According to Calculation of the average sensitivity of education-related data The subjective sensitivity of the education-related data and The subjective sensitivity of the education-related data is converted into objective sensitivity. The calculation formula is as follows: ; in, Indicates objective sensitivity to education-related data, Indicates The subjective sensitivity of education-related data; The objective sensitivity of all education-related data in the initial education data matrix is ​​obtained in turn, and the sensitivity set of education data is obtained; S12, selecting any education-related data in the initial education data matrix to form a second education data set ,in Indicates Education-related data n initial education data; converting the second education data set into a generalization tree, the generalization tree node is the initial education data, selecting the generalization tree node and generalized tree nodes , calculate the generalization tree node and generalized tree nodes Distance, calculated as follows: ; in, Represents a generalized tree node and generalized tree nodes distance, Represents a generalized tree node and generalized tree nodes Shortest distance, Indicates the longest distance of any node in the generalization tree; Generalization Tree Node and generalized tree nodes Similarity , the generalized tree node and generalized tree nodes The similarity of Initial education data and The similarity of the initial education data is The similarity calculation formula of initial education data is as follows: ; in, Indicates The similarity of the initial education data, ; The similarities of all education-related data in the initial education data matrix are obtained in sequence to obtain a similarity set of education data; S13, selecting any education-related data in the initial education data matrix to form a third education data set ,in Indicates Education-related data n The initial education data is obtained according to the probability of the initial education data in the third education data set, and the gain of the initial education data is calculated according to the uncertainty of the initial education data. The calculation formula of the association strength is as follows: ; in, Represents initial education data Initial education data The strength of association, Represents initial education data and initial education data The gain, Represents initial education data Uncertainty, Represents initial education data Uncertainty; Calculate the correlation strength of all education-related data in the initial education data matrix in turn, and set the correlation strength threshold as , when the association strength of the initial education data is less than the association strength threshold, the association strength of the initial education data is set to 0; otherwise, the association strength of the initial education data is retained to obtain the education data association strength set; S14, assign weights to the education data sensitivity set, the education data similarity set and the education data association strength set, calculate the risk score of the initial education data in the initial education data matrix, and then calculate the average value of the risk score of the initial education data under the education-related data, recorded as the education data risk index; set the risk threshold to , select the education-related data corresponding to the education data risk index greater than the risk threshold, and obtain the processed education data matrix as follows: ; in, Indicates Education-related data n processed education data; S2, using an anomaly detection algorithm to perform network anomaly detection on the processed education data in the processed education data matrix, and when in an abnormal state, start an emergency response plan to obtain a final education data matrix; The S2 comprises the following steps: S21, using an anomaly detection algorithm to perform network anomaly detection on the processed education data in the processed education data matrix to obtain processed education data in an abnormal state, the specific steps are as follows: S211, set the network flow window size to ,exist t Collect network traffic at all times to obtain the initial network traffic sequence ,in express The network traffic data collected at all times; performing averaging processing on the network traffic data in the initial network traffic sequence to obtain a network traffic sequence; S212, setting the noise interference term of the network traffic sequence to , the first The network traffic data is , the first The network traffic data is , and represents the traffic parameter, then the first Network traffic data The calculation formula is as follows: ; S213, according to the network traffic sequence The network traffic data is obtained in the network traffic sequence Network traffic data , set the abnormal parameters to , then the first The anomaly coefficient of network traffic data The calculation formula is as follows: ; The network traffic sequence is divided into a first network traffic sequence and a second network traffic sequence according to positive and negative values, and the mean values ​​of the network traffic in the first network traffic sequence and the second network traffic sequence are calculated and recorded as and , and then calculate the standard deviation of network traffic in the first network traffic sequence and the second network traffic sequence, respectively recorded as and ,set up represents a random number and , then the abnormal threshold range is ,When the abnormal coefficient is within the abnormal threshold range, the network traffic data corresponding to the abnormal coefficient is not abnormal, otherwise the network traffic data corresponding to the abnormal coefficient is abnormal; S214, when the network traffic data is abnormal, the processed education data in the processed education data matrix is ​​in an abnormal state; S22, for the processed education data in an abnormal state, identify the event causing the abnormal state, evaluate the severity and impact range of the event causing the abnormal state, set a severity threshold and an impact range threshold, and when the severity of the event causing the abnormal state is greater than the severity threshold and the impact range of the event causing the abnormal state is greater than the impact range threshold, start the emergency response plan, isolate the processed education data, obtain the final education data, and generate the final education data matrix; S3, obtain a new set of educational data samples, extract sample features, and train the BP neural network to obtain The BP neural network model outputs the education data risk prediction result of the processed education data matrix to complete the risk prediction; The S3 comprises the following steps: S31, initialize the BP neural network, determine the number of input layer nodes, the number of hidden layer nodes and the number of output layer nodes according to the input sample data set, input the sample data set into the input layer, set the learning rate and the activation function, calculate the output result of the hidden layer through the connection weights of the input layer and the hidden layer, and output the prediction result in the output layer according to the connection weights based on the output result of the hidden layer; S32, reacquire new education data, obtain a new education data sample set after the new education data passes the risk assessment, use the new education data sample set to train the BP neural network, and obtain the BP neural network model. The specific steps are as follows: S321, select the characteristics of the new education data sample set to obtain a sample feature set, set the number of BP neural network input nodes to , the number of input nodes is the number of features in the sample feature set, the number of output nodes is 2, the Adam optimizer is used, the activation function is the Softmax function, and the learning rate is , set the maximum number of iterations to ; Divide the sample feature set into a sample feature training set and a sample feature verification set, input the sample feature training set into the BP neural network, and when the current number of iterations reaches the maximum number of iterations, stop the iteration to obtain a trained BP neural network; S322, input the sample feature verification set into the trained BP neural network, and set the accuracy threshold to , when the accuracy of the output result is less than the accuracy threshold, stop the iteration and get the BP neural network model; otherwise, adjust the weight until the accuracy of the output result is less than the accuracy threshold; S33, binarizing the processed education data in the processed education data matrix to obtain a binarized data set, and inputting the binarized data set into the BP neural network model. When the BP neural network model outputs 1, there is a risk warning for the processed education data in the processed education data matrix. When the BP neural network model outputs 0, there is no risk warning for the processed education data in the processed education data matrix, thereby completing the education data risk prediction. S4. Based on the education data risk prediction result, restore the final education data in the final education data matrix to obtain a restored education data matrix, and perform a network security situation assessment on the restored education data matrix; The S4 comprises the following steps: S41, storing the initial education data in the initial education data matrix in the education database, and restoring the final education data in the final education data matrix using a reload strategy based on the education data risk prediction result, the specific steps are as follows: S411. Back up the initial education data in the initial education data matrix in advance according to the education data risk prediction result; if it is detected that the network is abnormal and the final education data in the final education data matrix is ​​missing or damaged, a data transmission signal application is sent to the education database; after receiving the data transmission signal, the education database selects the data page in the final education data matrix where the final education data is missing or damaged and adds it to the transmission queue; S412, preferentially scheduling the data pages of the final education data in the final education data matrix in the transmission queue until the transmission is completed, obtaining the restored education data, generating the restored education data matrix, and realizing education data recovery; S42, performing a network security situation assessment on the restored education data matrix to obtain a network security situation value, and performing a security emergency response in advance according to the network security situation value, the specific steps are as follows: S421. Obtain network traffic data during the network abnormality process to obtain a network traffic data set ,in Indicates i The network traffic data set is processed by binary classification, abnormal network traffic data is set to 1, and normal network traffic data is set to 0. The attack probability calculation formula is as follows: ; in, E represents the attack probability, Indicates The binary classification results of network traffic data are: ; S422. During the network attack, set j The impact of network attacks on network confidentiality is , No. j The impact of network attacks on network integrity is , No. j The impact of network attacks on network availability is , , and Represent the weights of network confidentiality, network integrity and network availability respectively, and the network attack impact coefficient calculation formula is as follows: ; in, Indicates j Cyber ​​attack impact coefficient of cyber attack-like; S423, set the number of network attack types to q , No. j The number of attacks of the network type is , the total amount of network attacks is G , then the network security situation value H The calculation formula is as follows; ; Set the situation threshold to When the network security situation value is greater than the situation threshold, there is a risk in the restored education data matrix, and a security emergency response is carried out in advance; otherwise, there is no risk in the restored education data matrix, and the network security situation assessment is completed.

[0026] Example 2 The present invention also discloses a system of an education data security emergency response and recovery method based on artificial intelligence, which specifically includes: an initial education data risk assessment module, an education data security emergency response module, an education data risk prediction module, and an education data recovery and network security situation assessment module; The initial education data risk assessment module is used to perform risk assessment based on the sensitivity, similarity and association strength of the initial education data; The education data security emergency response module is used to perform network anomaly detection on education data and initiate an emergency response plan; The education data risk prediction module is used to predict the education data risk using a BP neural network model; The education data recovery and network security situation assessment module is used to recover missing or damaged education data and perform network security situation assessment.

[0027] In the description of this specification, the description with reference to the terms "one embodiment", "example", "specific example", etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner.

[0028] The preferred embodiments of the invention disclosed above are only used to help explain the invention. The preferred embodiments do not describe all the details in detail, nor do they limit the invention to the specific implementation methods described. Obviously, many modifications and changes can be made according to the content of this specification. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the invention, so that those skilled in the art can understand and use the invention well.

Claims

1. An artificial intelligence-based education data security emergency response and recovery method, characterized in that: The steps include: S1. Obtain education-related data, generate an initial education data matrix, calculate the sensitivity, similarity and correlation strength of the initial education data in the initial education data matrix, and perform risk assessment on the initial education data in the initial education data matrix, and obtain a processed education data matrix by comparing with a risk threshold; S2, using an anomaly detection algorithm to perform network anomaly detection on the processed education data in the processed education data matrix, and when in an abnormal state, start an emergency response plan to obtain a final education data matrix; S3, obtain a new set of educational data samples, extract sample features, and train the BP neural network to obtain The BP neural network model outputs the education data risk prediction result of the processed education data matrix to complete the risk prediction; S4. Based on the education data risk prediction results, restore the final education data in the final education data matrix to obtain a restored education data matrix, and perform a network security situation assessment on the restored education data matrix.

2. The artificial intelligence-based education data security emergency response and recovery method according to claim 1 is characterized in that: The S1 comprises the following steps: S11, obtaining education-related data, generating an initial education data matrix, calculating the objective sensitivity of the initial education data in the initial education data matrix, and obtaining an education data sensitivity set; S12, converting the initial education data matrix into a generalized tree, where the generalized tree nodes are the initial education data, calculating the similarity of the generalized tree nodes, and obtaining an education data similarity set; S13, calculating the uncertainty of the initial education data in the initial education data matrix, calculating the association strength of the initial education data according to the uncertainty of the initial education data, and obtaining a set of association strengths of the education data; S14, assigning weights to the education data sensitivity set, the education data similarity set and the education data association strength set, calculating the risk score of the initial education data in the initial education data matrix, and setting the risk threshold to , perform risk assessment on the initial education data in the initial education data matrix to obtain the processed education data matrix.

3. The artificial intelligence-based education data security emergency response and recovery method according to claim 2 is characterized in that: The S2 comprises the following steps: S21, using an anomaly detection algorithm to perform network anomaly detection on the processed education data in the processed education data matrix to obtain processed education data in an abnormal state; S22. Based on the processed education data of the abnormal state, identify the event that caused the abnormal state, evaluate the severity and impact scope of the event that caused the abnormal state, initiate an emergency response plan, isolate the processed education data, obtain the final education data, and generate a final education data matrix.

4. The artificial intelligence-based education data security emergency response and recovery method according to claim 3 is characterized in that: The S21 comprises the following steps: S211, setting a network traffic window, collecting network traffic to obtain an initial network traffic sequence, and performing average processing on network traffic data in the initial network traffic sequence to obtain a network traffic sequence; S212: predicting the network traffic according to the network traffic sequence to obtain the first Network traffic data; S213, according to the network traffic sequence The network flow data is used to obtain the abnormal coefficient of network flow, set the network flow threshold, and compare whether the network flow is in an abnormal state; S214. When the network traffic data is abnormal, the processed education data in the processed education data matrix is ​​in an abnormal state, and the processed education data in the abnormal state is obtained.

5. The artificial intelligence-based education data security emergency response and recovery method according to claim 4 is characterized in that: The S3 comprises the following steps: S31, initialize the BP neural network, determine the number of input layer nodes, the number of hidden layer nodes and the number of output layer nodes according to the input sample data set, input the sample data set into the input layer, set the learning rate and the activation function, calculate the output result of the hidden layer through the connection weights of the input layer and the hidden layer, and output the prediction result in the output layer according to the connection weights based on the output result of the hidden layer; S32, reacquiring new education data, obtaining a new education data sample set after the new education data passes the risk assessment, and using the new education data sample set to train the BP neural network to obtain a BP neural network model; S33. Binarize the processed education data in the processed education data matrix to obtain a binarized data set, and input the binarized data set into the BP neural network model. When the BP neural network model outputs 1, there is a risk warning for the processed education data in the processed education data matrix. When the BP neural network model outputs 0, there is no risk warning for the processed education data in the processed education data matrix, thereby completing the education data risk prediction.

6. The artificial intelligence-based education data security emergency response and recovery method according to claim 5 is characterized in that: The S32 comprises the following steps: S321, select the characteristics of the new education data sample set to obtain a sample feature set, set the number of BP neural network input nodes to , the number of input nodes is the number of features in the sample feature set, the number of output nodes is 2, the Adam optimizer is used, the activation function is the Softmax function, and the learning rate is , set the maximum number of iterations to ; Divide the sample feature set into a sample feature training set and a sample feature verification set, input the sample feature training set into the BP neural network, and when the current number of iterations reaches the maximum number of iterations, stop the iteration to obtain a trained BP neural network; S322, input the sample feature verification set into the trained BP neural network, and set the accuracy threshold to When the accuracy of the output result is less than the accuracy threshold, the iteration is stopped to obtain the BP neural network model; otherwise, the weights are adjusted until the accuracy of the output result is less than the accuracy threshold.

7. The artificial intelligence-based education data security emergency response and recovery method according to claim 6 is characterized in that: The S4 comprises the following steps: S41, storing the initial education data in the initial education data matrix in the education database, and restoring the final education data in the final education data matrix using a reload strategy based on the education data risk prediction result; S42. Conduct a network security situation assessment on the restored education data matrix to obtain a network security situation value, and perform a security emergency response in advance according to the network security situation value.

8. The artificial intelligence-based education data security emergency response and recovery method according to claim 7 is characterized in that: The use of the reload strategy to restore the final education data in the final education data matrix comprises the following steps: The initial education data in the initial education data matrix is ​​backed up in advance according to the education data risk prediction results; when a network abnormality is detected and the final education data in the final education data matrix is ​​missing or damaged, the education database uses a reload strategy to prioritize the missing or damaged data pages to obtain the restored education data, generate the restored education data matrix, and realize education data recovery.

9. A system for implementing the artificial intelligence-based education data security emergency response and recovery method as described in any one of claims 1 to 8, characterized in that: Specifically include: Initial education data risk assessment module, education data security emergency response module, education data risk prediction module, and education data recovery and network security situation assessment module; The initial education data risk assessment module is used to perform risk assessment based on the sensitivity, similarity and association strength of the initial education data; The education data security emergency response module is used to perform network anomaly detection on education data and initiate an emergency response plan; The education data risk prediction module is used to predict the education data risk using a BP neural network model; The education data recovery and network security situation assessment module is used to recover missing or damaged education data and perform network security situation assessment.

Images