Multi-level audit early warning method and system based on offline file security management

Abstract

The invention discloses a multi-level auditing early warning method and system based on offline file security management, and relates to the technical field of auditing early warning, and the method comprises the following steps: obtaining the historical storage data of a USB key and the to-be-predicted storage data of the USB key, and carrying out the preprocessing; inputting the to-be-predicted storage data of the USB key into a preset USB key storage prediction model to obtain a USB key storage usage amount of each timestamp in the future, and calculating a USB key storage future growth rate of each timestamp; based on the USB key storage usage amount of each time stamp in the future and a preset USB key storage space threshold value, storage space abnormity grading early warning is carried out; according to the method, the historical storage growth rate is calculated based on the historical storage data of the USB key, the K-means algorithm is used for clustering the historical storage growth rate to obtain G storage growth rate clusters, the G storage growth rate clusters are sorted, and storage growth early warning is carried out, so that the problem that the USB key storage lacks an effective auditing and early warning mechanism is solved; and the security state of the offline file cannot be monitored in real time.

Description

Technical Field

[0001] The present invention relates to the field of audit warning technology, and more specifically, to a multi-level audit warning method and system based on offline file security management. Background Art

[0002] As an important part of the national infrastructure, the security of information files in the power industry is of great research significance. With the continuous advancement of informatization, digitalization and intelligence, the number and complexity of various information files such as production management, dispatching operation, and financial management in the power industry have gradually increased. Ensuring the security of these information files has become a core task in the informatization construction of the power industry. The security management of offline files of power companies plays an extremely important role in the power industry. Although the digitalization process is accelerating, offline files are still an important part of the power industry, especially files involving core business, legal compliance and sensitive information. However, traditional offline file management often relies on manual inspection and simple permission control, lacks effective audit and early warning mechanisms, and cannot monitor the security status of files in real time, resulting in security risks such as file loss and unauthorized access.

[0003] The storage space of the U-shield is limited. Although the length of the quantum key is usually short, if the usage scenario requires frequent generation and storage of a large number of quantum keys (such as in the process of continuous communication), the U-shield may not be able to store all the keys and must be cleaned or updated regularly. In view of the above problems, the present invention proposes a solution. Summary of the invention

[0004] In order to overcome the above-mentioned defects of the prior art, an embodiment of the present invention provides a multi-level audit and early warning method and system based on offline file security management. Through a multi-level audit and early warning method and system based on offline file security management, the problem of U-shield storage lacking an effective audit and early warning mechanism and being unable to monitor the security status of files in real time, resulting in security risks such as file loss and unauthorized access, is solved.

[0005] To achieve the above object, the present invention provides the following technical solutions: The multi-level audit warning method based on offline file security management is characterized in that it includes the following steps: obtaining U-shield historical storage data and U-shield storage data to be predicted and preprocessing, wherein the U-shield historical storage data includes the number of quantum keys currently stored in the U-shield, the quantum key generation time, the quantum key length and the current storage usage of the U-shield; inputting the U-shield storage data to be predicted into a preset U-shield storage prediction model to obtain the U-shield storage usage of each future timestamp and calculate the future growth rate of the U-shield storage of each timestamp; performing storage space abnormality graded warning based on the U-shield storage usage of each future timestamp and the preset U-shield storage space threshold; calculating the historical storage growth rate based on the U-shield historical storage data, clustering the historical storage growth rate using the K-means algorithm to obtain G storage growth rate clusters, and sorting the G storage growth rate clusters; calculating G-1 storage growth rate thresholds based on the centroids of the G storage growth rate clusters and comparing the future growth rate of the U-shield storage with the G-1 storage growth rate thresholds to perform U-shield storage abnormal growth graded warning.

[0006] In a preferred embodiment, the U-shield storage data to be predicted is input into a preset U-shield storage prediction model to obtain the U-shield storage usage for each future timestamp, specifically: construct a CNN-LSTM hybrid prediction model; divide the U-shield historical storage data into a training set, a test set, and a validation set, input the training set into the CNN-LSTM hybrid prediction model, initialize the training parameters and train the model; use the test set and the validation set to test and verify the trained model to obtain a trained CNN-LSTM hybrid prediction model; input the U-shield storage data to be predicted into the CNN-LSTM hybrid prediction model to predict the U-shield storage usage for each future timestamp.

[0007] In a preferred embodiment, the construction of the CNN-LSTM hybrid prediction model is specifically as follows: Divide the U-shield historical storage data into N time windows of different scales to obtain N time window U-shield historical storage data of different scales; construct corresponding N convolution kernels of different scales, and use the N time window U-shield historical storage data of different scales as input to obtain N U-shield storage feature maps of different scales; construct a channel attention mechanism, calculate the attention weights of the N U-shield storage feature maps of different scales, and obtain N weighted U-shield storage feature maps; add the N weighted U-shield storage feature maps element by element to obtain a fused U-shield storage feature map; construct an LSTM model, and input the fused U-shield storage feature map into the LSTM model to predict the U-shield storage usage.

[0008] In a preferred embodiment, the historical storage growth rate is calculated based on the historical storage data of the U shield, and the historical storage growth rate is clustered using the K-means algorithm to obtain G storage growth rate clusters, and the G storage growth rate clusters are sorted, specifically: based on the U shield storage amount calculation formula, the storage growth rate between all adjacent timestamps is calculated in sequence to obtain the U shield historical storage growth rate of each timestamp; the U shield historical storage growth rate of G timestamps is randomly selected from the U shield historical storage growth rate of each timestamp as the G initial storage cluster centroids; the Euclidean distance formula is used to calculate the Euclidean distance between the U shield historical storage growth rate of each timestamp and the G initial storage cluster centroids; based on the Euclidean distance, the U shield historical storage growth rate of each timestamp is assigned to the nearest G initial storage cluster centroids; the average value of all U shield historical storage growth rates in the G initial storage cluster centroids is calculated, and the average value is set as the new storage cluster centroid to update the storage cluster centroid; the storage cluster centroid update is repeated to obtain G storage growth rate clusters, and the G storage growth rate clusters are sorted in ascending order.

[0009] In a preferred embodiment, a storage growth rate threshold is calculated based on the G storage growth rate clusters, specifically: based on the G storage growth rate clusters, the kernel density of each storage growth rate in each storage growth rate cluster is calculated; based on the kernel density of each storage growth rate in each storage growth rate cluster, a density curve of each storage growth rate cluster is plotted; the local minimum of the density curve of each storage growth rate cluster is calculated; and the local minimum is used as the storage growth rate threshold.

[0010] In a preferred embodiment, a storage space abnormality graded warning is performed based on the U-shield storage usage of each future timestamp and the preset U-shield storage threshold, specifically: when the U-shield storage usage of each future timestamp is lower than the preset first storage space threshold, a green storage space warning is performed, and the user does not need to operate; when the U-shield storage usage of each future timestamp is higher than the preset first storage space threshold but lower than the preset second storage space threshold, a yellow storage space warning is performed, and the user cleans up unnecessary quantum keys in time; when the U-shield storage usage of each future timestamp is higher than the preset second storage space threshold, a red storage space warning is performed, and the user needs to suspend the storage of quantum keys and perform appropriate capacity expansion.

[0011] A multi-level audit and early warning system based on offline file security management includes a U-shield data acquisition module, a U-shield storage prediction module, a U-shield storage space warning module, a U-shield storage growth rate module, and a U-shield storage growth warning module: a U-shield data acquisition module is used to obtain and pre-process the U-shield historical storage data and the U-shield storage data to be predicted, wherein the U-shield historical storage data includes the number of quantum keys currently stored in the U-shield, the quantum key generation time, the quantum key length, and the current storage usage of the U-shield; A U-shield storage prediction module is used to input the U-shield storage data to be predicted into a preset U-shield storage prediction model, obtain the U-shield storage usage of each future timestamp and calculate the future growth rate of the U-shield storage of each timestamp; a U-shield storage space warning module is used to perform a graded warning of storage space abnormalities based on the U-shield storage usage of each future timestamp and a preset U-shield storage space threshold; a U-shield storage growth rate module is used to calculate the historical storage growth rate based on the U-shield historical storage data, cluster the historical storage growth rate using the K-means algorithm, obtain G storage growth rate clusters, and sort the G storage growth rate clusters; a U-shield storage growth warning module calculates G-1 storage growth rate thresholds based on the centroid of the G storage growth rate clusters and compares the future growth rate of the U-shield storage with the G-1 storage growth rate threshold to perform a graded warning of abnormal U-shield storage growth.

[0012] The technical effects and advantages of the multi-level audit warning method and system based on offline file security management of the present invention are as follows: 1. The present invention can accurately capture the historical storage change trend of the U-shield by obtaining and preprocessing the historical storage data of the U-shield (including the number of quantum keys, generation time, key length and storage usage). By inputting the storage data to be predicted into the storage prediction model, the storage usage and growth rate at a future time point are obtained. This allows the system to accurately monitor the storage space according to actual storage needs, and to achieve hierarchical warning of storage space anomalies through the set storage space threshold, effectively avoiding problems such as insufficient storage space or sudden storage overload.

[0013] 2. The present invention calculates the historical storage growth rate and applies the K-means algorithm for clustering. The system can divide the historical growth rate data into multiple growth pattern clusters, and determine the growth rate threshold by sorting the clusters and calculating the centroid. This method provides a refined growth rate analysis and can compare the future storage growth rate with the changing trend of the historical growth rate, thereby achieving a hierarchical early warning of abnormal growth. Through this mechanism, abnormal behavior of storage growth can be identified and warned in a timely manner, improving the security and reliability of file storage management, and effectively supporting audit work. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1It is a structural schematic diagram of the multi-level audit warning method based on offline file security management of the present invention.

[0015] Figure 2 It is a schematic diagram of the structure of the multi-level audit early warning system based on offline file security management of the present invention. DETAILED DESCRIPTION

[0016] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0017] Embodiment 1, Figure 1 The present invention provides a multi-level audit early warning method based on offline file security management, comprising the following steps: S1, obtaining and preprocessing the historical storage data of the U-Shield and the storage data to be predicted by the U-Shield, wherein the historical storage data of the U-Shield includes the number of quantum keys currently stored in the U-Shield, the time when the quantum key was generated, the length of the quantum key, and the current storage usage of the U-Shield; It should be noted that obtaining the historical storage data and the storage data to be predicted of the U-Shield is crucial for achieving accurate storage management and risk warning. Historical storage data, such as the number, generation time, length and current storage usage of quantum keys, can reflect the usage of the U-Shield in different time periods and the trend of storage demand changes. These data provide a basis for analyzing storage growth patterns, enabling the system to identify normal growth and abnormal fluctuations. At the same time, the storage data to be predicted can generate future storage usage and growth rates by inputting the preset storage prediction model, helping the system to identify potential storage bottlenecks and security risks in advance. Combining historical data and predicted data can achieve more comprehensive risk assessment and storage strategy optimization, ensure the rational use of storage resources, avoid service interruptions or data loss caused by insufficient storage, and thus improve the overall security and reliability of the system. Through this comprehensive analysis, managers can make scientific storage management decisions at a higher level.

[0018] In this example, the acquisition of the historical storage data of the U-Shield and the storage data to be predicted by the U-Shield and pre-processing are specifically as follows: Clean the historical storage data of the U-Shield and the storage data to be predicted by the U-Shield, and process missing values ​​and abnormal values; Normalize the U-shield historical storage data and the U-shield predicted storage data after data cleaning.

[0019] In this example, the normalization operation of the U-shield historical storage data and the U-shield predicted storage data after data cleaning is specifically as follows:

[0020] Among them, x is the historical storage data of U-Shield and the storage data to be predicted by U-Shield, , are the minimum and maximum values ​​of the historical storage data of the U-Shield and the predicted storage data of the U-Shield, respectively. It is standardized data.

[0021] It should be noted that data cleaning of the U-Shield's historical storage data and the storage data to be predicted, including processing missing values ​​and outliers, can significantly improve the quality and reliability of the data. Data cleaning ensures that the basic data for analysis is accurate and complete, and helps to eliminate deviations caused by inaccurate data, thereby improving the accuracy of subsequent analysis and prediction. In addition, through normalization operations, data of different magnitudes and ranges can be unified to the same standard, eliminating the dimensional effects between data, so that each feature has the same weight during model training and analysis. This process helps to improve the performance and stability of the model, ensuring that the algorithm can correctly identify patterns and trends in the data, thereby enhancing the ability to predict storage usage. In summary, data cleaning and normalization not only improve the effectiveness of data analysis, but also lay a solid foundation for subsequent storage management decisions.

[0022] S2, inputting the U-shield storage data to be predicted into a preset U-shield storage prediction model, obtaining the U-shield storage usage at each future timestamp and calculating the future growth rate of the U-shield storage at each timestamp; In this example, the U-shield storage data to be predicted is input into the preset U-shield storage prediction model to obtain the U-shield storage usage at each future timestamp, specifically: Construct a CNN-LSTM hybrid prediction model; Divide the historical storage data of the U-Shield into a training set, a test set and a validation set, input the training set into the CNN-LSTM hybrid prediction model, initialize the training parameters and train the model; Use the test set and validation set to test and validate the trained model to obtain the trained CNN-LSTM hybrid prediction model; The U-shield storage data to be predicted is input into the CNN-LSTM hybrid prediction model to predict the U-shield storage usage at each future timestamp.

[0023] In this example, the construction of the CNN-LSTM hybrid prediction model is specifically as follows: Divide the U-shield historical storage data into N time windows of different scales to obtain N time windows of different scales of U-shield historical storage data; Constructing corresponding N convolution kernels of different scales, and taking the N different scales of time window U-shield historical storage data as input, to obtain N different scales of U-shield storage feature graphs; Construct a channel attention mechanism, calculate the attention weights of the N USB storage feature maps of different scales, and obtain N weighted USB storage feature maps; Add the N weighted U-shield storage feature graphs element by element to obtain a fused U-shield storage feature graph; Construct an LSTM model, and input the fused U-shield storage feature map into the LSTM model to predict the U-shield storage usage.

[0024] In this example, the U-shield historical storage data is divided into N time windows of different scales to obtain N time windows of different scales of U-shield historical storage data, specifically: The advantages of dividing the U-Shield historical storage data into N time windows of different scales, such as short-term windows (1 hour, one day), medium-term windows (one week, one month) and long-term windows (one quarter, one year), are as follows: Analyze U-Shield storage trends from different angles: Through time windows of different scales, you can observe the changing trends of U-Shield storage data from multiple time dimensions, such as short-term, medium-term, and long-term. Short-term windows capture short-term fluctuations, such as abnormal storage growth or emergencies, while long-term windows can reveal the overall trend or periodic changes in storage usage, which is convenient for long-term planning; Enhanced anomaly detection capabilities: Time windows of different scales can help identify different types of storage anomalies. For example, short-term windows can detect rapid storage surges or fluctuations, while medium- and long-term windows help discover slowly accumulating storage problems. Multi-scale analysis enables the system to more accurately identify various storage anomalies.

[0025] In this example, the channel attention mechanism is constructed to calculate the attention weights of the N different scales of the U-Shield storage feature graphs to obtain N weighted U-Shield storage feature graphs, specifically: The advantage of the channel attention mechanism is that it effectively enhances the representation of key features and weakens the influence of unimportant or noise features by assigning different weights to different channels of the feature map. Each channel usually represents a specific feature. For example, in storage data analysis, different channels may correspond to storage usage, growth rate, number of keys, etc. The channel attention mechanism can automatically learn and assign the importance weight of each channel based on the global context information, so that the model can pay more attention to the key features related to the task and pay less attention to irrelevant information. In this way, the model can obtain more discriminative feature expressions when processing multi-dimensional data, thereby improving the accuracy of overall analysis, detection and prediction. Especially when processing complex multi-scale or multi-feature data, the channel attention mechanism can well capture the correlation between different features and enhance the model's perception of key patterns. It is suitable for scenarios that require fine-grained feature learning, such as anomaly detection and prediction tasks.

[0026] In this example, the calculation of the future growth rate of the USB storage for each timestamp is as follows:

[0027] in, For time The storage growth rate, For time Storage usage, For time Storage usage.

[0028] S3, performing storage space abnormality classification warning based on the U-shield storage usage at each future timestamp and the preset U-shield storage space threshold; In this example, a storage space abnormality classification warning is performed based on the U-shield storage usage at each future timestamp and the preset U-shield storage threshold, specifically: When the U-shield storage usage at each future timestamp is lower than the preset first storage space threshold, a green storage space warning is issued, and the user does not need to operate; When the U-shield storage usage of each future timestamp is higher than the preset first storage space threshold but lower than the preset second storage space threshold, a yellow storage space warning is issued, and the user cleans up unnecessary quantum keys in time; When the U-shield storage usage of each timestamp in the future exceeds the preset second storage space threshold, a red storage space warning will be issued, and the user needs to suspend the storage of quantum keys and expand the capacity appropriately.

[0029] It should be noted that the step of hierarchical warning based on the U-shield storage usage and preset storage threshold of each future timestamp has significant advantages and can effectively improve the flexibility and security of storage management. First, by setting different storage space thresholds (green, yellow, and red), the system can accurately reflect the current storage status, thereby providing users with clear operation instructions. When the storage usage is lower than the first threshold, users can continue to use it without taking any measures, thus avoiding unnecessary interference and operation; when the usage exceeds the first threshold but is lower than the second threshold, the system issues a yellow warning to remind users to clean up unnecessary quantum keys in time, which helps to actively manage storage resources and prevent future storage pressure. This warning mechanism encourages users to develop the habit of regular maintenance and cleaning in daily operations to improve resource utilization; at the same time, when the storage usage exceeds the second threshold, the system promptly issues a red warning, requiring users to suspend quantum key storage and expand capacity to avoid data loss or service interruption caused by insufficient storage. This hierarchical warning strategy not only improves the efficiency of storage management, but also enhances the security of the overall system, helping users to identify and respond to potential risks as early as possible, thereby ensuring the safe storage of important data such as quantum keys.

[0030] S4, calculating the historical storage growth rate based on the historical storage data of the U shield, clustering the historical storage growth rate using the K-means algorithm to obtain G storage growth rate clusters, and sorting the G storage growth rate clusters; In this example, the historical storage growth rate is calculated based on the historical storage data of the U shield, and the historical storage growth rate is clustered using the K-means algorithm to obtain G storage growth rate clusters, and the G storage growth rate clusters are sorted, specifically: Based on the U-Shield storage capacity calculation formula, the storage growth rate between all adjacent timestamps is calculated in sequence to obtain the U-Shield historical storage growth rate for each timestamp; Randomly select G timestamps of U-shield historical storage growth rates from the U-shield historical storage growth rates of each timestamp as G initial storage clustering centroids; Use the Euclidean distance formula to calculate the Euclidean distance between the historical storage growth rate of the U-Shield at each timestamp and the G initial storage cluster centroids; Based on the Euclidean distance, the historical storage growth rate of the USB shield of each timestamp is distributed to the nearest G initial storage cluster centroids; Calculate the average value of the historical storage growth rates of all U-shields in the G initial storage cluster centroids, and set the average value as the new storage cluster centroid to update the storage cluster centroid; The storage clustering centroid update is repeated to obtain G storage growth rate clusters, and the G storage growth rate clusters are sorted in ascending order.

[0031] In this example, the storage growth rate between all adjacent timestamps is calculated in sequence based on the U-shield storage calculation formula to obtain the U-shield historical storage growth rate of each timestamp, specifically:

[0032] in, For time The storage growth rate, For time Storage usage, For time Storage usage.

[0033] In this example, the historical storage growth rates of U-shields of G timestamps are randomly selected from the historical storage growth rates of U-shields of each timestamp as the G initial storage clustering centroids, specifically: The advantage of randomly selecting G initial clustering centroids from the historical storage growth rate of the U-Shield at each timestamp is that it can improve the diversity and stability of the clustering. First, the randomly selected centroids can cover different storage growth patterns, thereby more accurately reflecting the overall trend of the data and avoiding the deviation that may be caused by a single centroid; secondly, this randomization process reduces the risk of the K-means algorithm falling into a local optimal solution and improves the robustness of the clustering results. Randomly selecting the initial centroid can also accelerate the convergence of the algorithm and reduce the calculation time because it avoids the additional overhead caused by complex initialization methods; finally, through the diverse selection of initial centroids, it is possible to better capture the important features of the U-Shield storage data, improve the accuracy of anomaly detection and prediction, and promote a deeper understanding of storage growth behavior. In this example, the Euclidean distance formula is used to calculate the Euclidean distance between the historical storage growth rate of the U-Shield at each timestamp and the G initial storage cluster centroids, specifically:

[0034] in, For each timestamp, the Euclidean distance between the historical storage growth rate of the USB shield and the centroids of the G initial storage clusters, is the historical storage growth rate of the U-Shield at the jth timestamp, Store the cluster centroids for the ith initial cluster.

[0035] It should be noted that using the Euclidean distance formula to calculate the Euclidean distance between the historical storage growth rate of the U-Shield at each timestamp and the G initial storage cluster centroids has many advantages. First, this method can quantify the similarity between each growth rate and the defined growth pattern, helping to identify whether the current storage growth trend belongs to the historically known normal pattern. Through this distance calculation, the abnormality of storage growth can be effectively judged, thereby providing a basis for early warning of abnormal behavior. Secondly, the calculation method of the Euclidean distance is simple and intuitive, easy to understand and implement, making cluster analysis in a multidimensional data environment more efficient. In addition, by comparing the distance between the growth rate and the centroid, the system can flexibly adjust the early warning mechanism, identify the potential risks of storage growth in real time, enhance the responsiveness of storage management and the accuracy of early warning, thereby improving the security and reliability of the U-Shield. In short, the use of Euclidean distance can provide strong support for the analysis and management of storage growth rates and help make more scientific storage decisions.

[0036] In this example, the average value of the historical storage growth rates of all U-shields in the G initial storage cluster centroids is calculated, and the average value is set as the new storage cluster centroid to update the storage cluster centroid, specifically:

[0037] in is the new centroid of the kth storage growth rate cluster, is the number of timestamps in the k-th storage growth rate cluster, is the historical storage growth rate of the U-Shield at the i-th timestamp, is the kth storage growth rate cluster, It is the sum of the historical storage growth rates of all timestamp USB shields in the kth storage growth rate cluster.

[0038] S5, based on the centroids of the G storage growth rate clusters, calculate G-1 storage growth rate thresholds and compare the future growth rate of the U-shield storage with the G-1 storage growth rate thresholds to perform a graded warning of abnormal U-shield storage growth.

[0039] In this example, based on the G storage growth rate clusters, the storage growth rate threshold is calculated, specifically: Based on the G storage growth rate clusters, calculating the kernel density of each storage growth rate in each storage growth rate cluster; Based on the kernel density of each storage growth rate in each storage growth rate cluster, drawing a density curve of each storage growth rate cluster; Calculating the local minimum value of the density curve of each storage growth rate cluster; The local minimum value is used as a storage growth rate threshold.

[0040] Embodiment 2, Figure 2 A multi-level audit warning system based on offline file security management is given, including U-shield data acquisition module, U-shield storage prediction module, U-shield storage space warning module, U-shield storage growth rate module and U-shield storage growth warning module: A U-shield data acquisition module is used to acquire and pre-process the U-shield historical storage data and the U-shield predicted storage data, wherein the U-shield historical storage data includes the number of quantum keys currently stored in the U-shield, the time when the quantum key was generated, the length of the quantum key, and the current storage usage of the U-shield; A U-shield storage prediction module is used to input the U-shield storage data to be predicted into a preset U-shield storage prediction model to obtain the U-shield storage usage at each future timestamp and calculate the future growth rate of the U-shield storage at each timestamp; A U-shield storage space warning module, used to provide storage space abnormality classification warning based on the U-shield storage usage at each future timestamp and a preset U-shield storage space threshold; A U-shield storage growth rate module is used to calculate the historical storage growth rate based on the U-shield historical storage data, cluster the historical storage growth rate using the K-means algorithm to obtain G storage growth rate clusters, and sort the G storage growth rate clusters; The U-shield storage growth warning module calculates G-1 storage growth rate thresholds based on the centroid of the G storage growth rate clusters and compares the future growth rate of the U-shield storage with the G-1 storage growth rate thresholds to perform a graded warning of abnormal U-shield storage growth.

[0041] The above formulas are all dimensionless and numerical calculations. The formula is a formula for the most recent real situation obtained by collecting a large amount of data and performing software simulation. The preset parameters in the formula are set by technicians in this field according to actual conditions.

[0042] The above embodiments may be implemented in whole or in part by software, hardware, firmware or any other combination. When implemented by software, the above embodiments may be implemented in whole or in part in the form of a computer program product.

[0043] Those of ordinary skill in the art will appreciate that the modules and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0044] In addition, each functional module in each embodiment of the present application may be integrated into one processing module, or each module may exist physically separately, or two or more modules may be integrated into one module.

[0045] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0046] Finally: The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A multi-level audit and early warning method based on offline file security management, characterized in that: The following steps are involved: Obtaining and preprocessing the historical storage data of the U-Shield and the storage data to be predicted by the U-Shield, wherein the historical storage data of the U-Shield includes the number of quantum keys currently stored in the U-Shield, the time when the quantum key was generated, the length of the quantum key, and the current storage usage of the U-Shield; Input the U-shield storage data to be predicted into a preset U-shield storage prediction model to obtain the U-shield storage usage at each future timestamp and calculate the future growth rate of the U-shield storage at each timestamp; Perform storage space abnormality classification warning based on the U-shield storage usage at each future timestamp and the preset U-shield storage space threshold; Calculate the historical storage growth rate based on the historical storage data of the U shield, cluster the historical storage growth rate using the K-means algorithm to obtain G storage growth rate clusters, and sort the G storage growth rate clusters; Based on the G storage growth rate clusters, the storage growth rate threshold is calculated and the future growth rate of the U-shield storage is compared with the storage growth rate threshold to perform a graded warning of abnormal growth of the U-shield storage.

2. The multi-level audit warning method based on offline file security management according to claim 1 is characterized in that: The U-shield storage data to be predicted is input into the preset U-shield storage prediction model to obtain the U-shield storage usage at each future timestamp, specifically: Construct a CNN-LSTM hybrid prediction model; Divide the historical storage data of the U-Shield into a training set, a test set and a validation set, input the training set into the CNN-LSTM hybrid prediction model, initialize the training parameters and train the model; Use the test set and validation set to test and validate the trained model to obtain the trained CNN-LSTM hybrid prediction model; The U-shield storage data to be predicted is input into the CNN-LSTM hybrid prediction model to predict the U-shield storage usage at each future timestamp.

3. The multi-level audit warning method based on offline file security management according to claim 2 is characterized in that: The construction of the CNN-LSTM hybrid prediction model is specifically as follows: Divide the U-shield historical storage data into N time windows of different scales to obtain N time windows of different scales of U-shield historical storage data; Constructing corresponding N convolution kernels of different scales, and taking the N different scales of time window U-shield historical storage data as input, to obtain N different scales of U-shield storage feature graphs; Construct a channel attention mechanism, calculate the attention weights of the N USB storage feature maps of different scales, and obtain N weighted USB storage feature maps; Add the N weighted U-shield storage feature graphs element by element to obtain a fused U-shield storage feature graph; Construct an LSTM model, and input the fused U-shield storage feature map into the LSTM model to predict the U-shield storage usage.

4. The multi-level audit warning method based on offline file security management according to claim 1 is characterized in that: The historical storage growth rate is calculated based on the historical storage data of the U shield, the historical storage growth rate is clustered using the K-means algorithm to obtain G storage growth rate clusters, and the G storage growth rate clusters are sorted, specifically as follows: Based on the U-Shield storage capacity calculation formula, the storage growth rate between all adjacent timestamps is calculated in sequence to obtain the U-Shield historical storage growth rate for each timestamp; Randomly select G timestamps of U-shield historical storage growth rates from the U-shield historical storage growth rates of each timestamp as G initial storage clustering centroids; Use the Euclidean distance formula to calculate the Euclidean distance between the historical storage growth rate of the U-Shield at each timestamp and the G initial storage cluster centroids; Based on the Euclidean distance, the historical storage growth rate of the USB shield of each timestamp is distributed to the nearest G initial storage cluster centroids; Calculate the average value of the historical storage growth rates of all U-shields in the G initial storage cluster centroids, and set the average value as the new storage cluster centroid to update the storage cluster centroid; The storage clustering centroid update is repeated to obtain G storage growth rate clusters, and the G storage growth rate clusters are sorted in ascending order.

5. The multi-level audit warning method based on offline file security management according to claim 3 is characterized in that: Based on the G storage growth rate clusters, a storage growth rate threshold is calculated, specifically: Based on the G storage growth rate clusters, calculating the kernel density of each storage growth rate in each storage growth rate cluster; Based on the kernel density of each storage growth rate in each storage growth rate cluster, drawing a density curve of each storage growth rate cluster; Calculating the local minimum value of the density curve of each storage growth rate cluster; The local minimum value is used as a storage growth rate threshold.

6. The multi-level audit warning method based on offline file security management according to claim 1 is characterized in that: Based on the U-shield storage usage of each future timestamp and the preset U-shield storage threshold, a storage space abnormality classification warning is performed, specifically: When the U-shield storage usage at each future timestamp is lower than the preset first storage space threshold, a green storage space warning is issued, and the user does not need to operate; When the U-shield storage usage of each future timestamp is higher than the preset first storage space threshold but lower than the preset second storage space threshold, a yellow storage space warning is issued, and the user cleans up unnecessary quantum keys in time; When the U-shield storage usage of each timestamp in the future exceeds the preset second storage space threshold, a red storage space warning will be issued, and the user needs to suspend the storage of quantum keys and expand the capacity.

7. The multi-level audit warning method based on offline file security management according to claim 1 is characterized in that: The calculation of the future growth rate of the USB storage for each timestamp is specifically: in, For time The storage growth rate, For time Storage usage, For time Storage usage.

8. The multi-level audit warning method based on offline file security management according to claim 4 is characterized in that: The Euclidean distance formula is used to calculate the Euclidean distance between the historical storage growth rate of the U-shield at each timestamp and the G initial storage cluster centroids, specifically: in, For each timestamp, the Euclidean distance between the historical storage growth rate of the USB shield and the centroids of the G initial storage clusters, is the historical storage growth rate of the U-Shield at the jth timestamp, Store the cluster centroids for the ith initial cluster.

9. The multi-level audit warning method based on offline file security management according to claim 3 is characterized in that: Calculate the average value of all historical storage growth rates of all U-shields in the G initial storage cluster centroids, and set the average value as the new storage cluster centroid to update the storage cluster centroid, specifically: in is the new centroid of the kth storage growth rate cluster, is the number of timestamps in the k-th storage growth rate cluster, is the historical storage growth rate of the U-Shield at the i-th timestamp, is the kth storage growth rate cluster, It is the sum of the historical storage growth rates of all timestamp USB shields in the kth storage growth rate cluster.

10. A multi-level audit warning system based on offline file security management as claimed in any one of claims 1 to 9, characterized in that: It includes U-shield data acquisition module, U-shield storage prediction module, U-shield storage space warning module, U-shield storage growth rate module and U-shield storage growth warning module: A U-shield data acquisition module is used to acquire and pre-process the U-shield historical storage data and the U-shield predicted storage data, wherein the U-shield historical storage data includes the number of quantum keys currently stored in the U-shield, the time when the quantum key was generated, the length of the quantum key, and the current storage usage of the U-shield; A U-shield storage prediction module is used to input the U-shield storage data to be predicted into a preset U-shield storage prediction model to obtain the U-shield storage usage at each future timestamp and calculate the future growth rate of the U-shield storage at each timestamp; A U-shield storage space warning module, used to provide storage space abnormality classification warning based on the U-shield storage usage at each future timestamp and a preset U-shield storage space threshold; A U-shield storage growth rate module is used to calculate the historical storage growth rate based on the U-shield historical storage data, cluster the historical storage growth rate using the K-means algorithm to obtain G storage growth rate clusters, and sort the G storage growth rate clusters; The U-shield storage growth warning module calculates G-1 storage growth rate thresholds based on the centroid of the G storage growth rate clusters and compares the future growth rate of the U-shield storage with the G-1 storage growth rate thresholds to perform a graded warning of abnormal U-shield storage growth.

Images