Multi-level audit warning method and system based on offline file security management

Abstract

The present invention discloses a multi-level audit and early warning method and system based on offline file security management, which relates to the field of audit and early warning technology. The method and system comprise the following steps: obtaining U-shield historical storage data and U-shield storage data to be predicted and performing preprocessing; inputting the U-shield storage data to be predicted into a preset U-shield storage prediction model to obtain the U-shield storage usage of each future timestamp and calculate the future growth rate of the U-shield storage of each timestamp; performing a storage space abnormality classification early warning based on the U-shield storage usage of each future timestamp and a preset U-shield storage space threshold; calculating the historical storage growth rate based on the U-shield historical storage data, clustering the historical storage growth rate using a K-means algorithm to obtain G storage growth rate clusters, sorting the G storage growth rate clusters, and performing a storage growth early warning. The method solves the problem that U-shield storage lacks an effective audit and early warning mechanism and cannot monitor the security status of offline files in real time.

Description

Technical Field

[0001] The present invention relates to the field of audit warning technology, and more specifically, to a multi-level audit warning method and system based on offline file security management. Background Art

[0002] As an important part of the national infrastructure, the security of information files in the power industry is of great research significance. With the continuous advancement of informatization, digitalization and intelligentization, the number and complexity of various information files in the power industry, such as production management, dispatching operation, and financial management, have gradually increased. Ensuring the security of these information files has become a core task in the informatization construction of the power industry. The security management of power companies' offline files plays an extremely important role in the power industry. Although the digitalization process is accelerating, offline files are still an important part of the power industry, especially files related to core business, legal compliance and sensitive information. However, traditional offline file management often relies on manual inspection and simple permission control, lacks effective audit and early warning mechanisms, and cannot monitor the security status of files in real time, resulting in security risks such as file loss and unauthorized access.

[0003] USB-shields have limited storage space. Although quantum keys are typically short, if the usage scenario requires frequent generation and storage of large numbers of quantum keys (such as during continuous communication), the USB-shield may not be able to store all the keys and must be regularly cleared or updated. This invention proposes a solution to this problem. Summary of the Invention

[0004] In order to overcome the above-mentioned defects of the prior art, the embodiments of the present invention provide a multi-level audit and early warning method and system based on offline file security management. Through the multi-level audit and early warning method and system based on offline file security management, the problem of U-shield storage lacking an effective audit and early warning mechanism and being unable to monitor the security status of files in real time, resulting in security risks such as file loss and unauthorized access, is solved.

[0005] To achieve the above object, the present invention provides the following technical solutions:

[0006] A multi-level audit and early warning method based on offline file security management is characterized by comprising the following steps: obtaining U-shield historical storage data and U-shield predicted storage data and performing preprocessing, wherein the U-shield historical storage data includes the number of quantum keys currently stored in the U-shield, the quantum key generation time, the quantum key length, and the current storage usage of the U-shield; inputting the U-shield predicted storage data into a preset U-shield storage prediction model to obtain the U-shield storage usage of each future timestamp and calculate the future growth rate of the U-shield storage for each timestamp; performing a hierarchical early warning of storage space anomalies based on the U-shield storage usage of each future timestamp and a preset U-shield storage space threshold; calculating a historical storage growth rate based on the U-shield historical storage data, clustering the historical storage growth rate using a K-means algorithm to obtain G storage growth rate clusters, and sorting the G storage growth rate clusters; calculating G-1 storage growth rate thresholds based on the centroids of the G storage growth rate clusters, and comparing the future U-shield storage growth rate with the G-1 storage growth rate thresholds to perform a hierarchical early warning of U-shield storage abnormal growth.

[0007] In a preferred embodiment, the U-shield storage data to be predicted is input into a preset U-shield storage prediction model to obtain the U-shield storage usage for each future timestamp, specifically: constructing a CNN-LSTM hybrid prediction model; dividing the U-shield historical storage data into a training set, a test set, and a validation set, inputting the training set into the CNN-LSTM hybrid prediction model, initializing the training parameters and training the model; using the test set and the validation set to test and verify the trained model to obtain a trained CNN-LSTM hybrid prediction model; inputting the U-shield storage data to be predicted into the CNN-LSTM hybrid prediction model to predict the U-shield storage usage for each future timestamp.

[0008] In a preferred embodiment, the construction of the CNN-LSTM hybrid prediction model is specifically as follows:

[0009] The U-Shield historical storage data is divided into N time windows of different scales to obtain N time window U-Shield historical storage data of different scales; corresponding N convolution kernels of different scales are constructed, and the N time window U-Shield historical storage data of different scales are used as input to obtain N U-Shield storage feature maps of different scales; a channel attention mechanism is constructed to calculate the attention weights of the N U-Shield storage feature maps of different scales to obtain N weighted U-Shield storage feature maps; the N weighted U-Shield storage feature maps are added element by element to obtain a fused U-Shield storage feature map; an LSTM model is constructed, and the fused U-Shield storage feature map is input into the LSTM model to predict the U-Shield storage usage.

[0010] In a preferred embodiment, the historical storage growth rate is calculated based on the historical storage data of the U-Shield, and the historical storage growth rate is clustered using the K-means algorithm to obtain G storage growth rate clusters, and the G storage growth rate clusters are sorted, specifically: based on the U-Shield storage amount calculation formula, the storage growth rate between all adjacent timestamps is calculated in sequence to obtain the U-Shield historical storage growth rate of each timestamp; the U-Shield historical storage growth rate of G timestamps is randomly selected from the U-Shield historical storage growth rate of each timestamp as the G initial storage cluster centroids; the Euclidean distance formula is used to calculate the Euclidean distance between the U-Shield historical storage growth rate of each timestamp and the G initial storage cluster centroids; based on the Euclidean distance, the U-Shield historical storage growth rate of each timestamp is assigned to the nearest G initial storage cluster centroids; the average value of all U-Shield historical storage growth rates in the G initial storage cluster centroids is calculated, and the average value is set as the new storage cluster centroid to update the storage cluster centroid; the storage cluster centroid update is repeated to obtain G storage growth rate clusters, and the G storage growth rate clusters are sorted in ascending order.

[0011] In a preferred embodiment, the storage growth rate threshold is calculated based on the G storage growth rate clusters, specifically: based on the G storage growth rate clusters, the kernel density of each storage growth rate in each storage growth rate cluster is calculated; based on the kernel density of each storage growth rate in each storage growth rate cluster, the density curve of each storage growth rate cluster is drawn; the local minimum of the density curve of each storage growth rate cluster is calculated; and the local minimum is used as the storage growth rate threshold.

[0012] In a preferred embodiment, a storage space abnormality graded warning is performed based on the U-Shield storage usage of each future timestamp and the preset U-Shield storage threshold, specifically: when the U-Shield storage usage of each future timestamp is lower than the preset first storage space threshold, a green storage space warning is issued, and the user does not need to take any action; when the U-Shield storage usage of each future timestamp is higher than the preset first storage space threshold but lower than the preset second storage space threshold, a yellow storage space warning is issued, and the user promptly cleans up unnecessary quantum keys; when the U-Shield storage usage of each future timestamp is higher than the preset second storage space threshold, a red storage space warning is issued, and the user needs to suspend the storage of quantum keys and perform appropriate capacity expansion.

[0013] A multi-level audit and early warning system based on offline file security management includes a U-shield data acquisition module, a U-shield storage prediction module, a U-shield storage space warning module, a U-shield storage growth rate module, and a U-shield storage growth warning module: The U-shield data acquisition module is used to obtain and pre-process the U-shield historical storage data and the U-shield storage data to be predicted. The U-shield historical storage data includes the number of quantum keys currently stored in the U-shield, the quantum key generation time, the quantum key length, and the current storage usage of the U-shield; The U-Shield storage prediction module is used to input the U-Shield storage data to be predicted into the preset U-Shield storage prediction model, obtain the U-Shield storage usage of each future timestamp and calculate the future growth rate of the U-Shield storage for each timestamp; the U-Shield storage space warning module is used to perform a graded warning of storage space anomalies based on the U-Shield storage usage of each future timestamp and the preset U-Shield storage space threshold; the U-Shield storage growth rate module is used to calculate the historical storage growth rate based on the U-Shield historical storage data, cluster the historical storage growth rate using the K-means algorithm to obtain G storage growth rate clusters, and sort the G storage growth rate clusters; the U-Shield storage growth warning module calculates G-1 storage growth rate thresholds based on the centroid of the G storage growth rate clusters and compares the future U-Shield storage growth rate with the G-1 storage growth rate threshold to perform a graded warning of U-Shield storage abnormal growth.

[0014] The technical effects and advantages of the multi-level audit warning method and system based on offline file security management of the present invention are as follows:

[0015] 1. This invention captures and preprocesses historical storage data (including quantum key quantity, generation time, key length, and storage usage) from the USB-Shield, accurately capturing its historical storage trends. By inputting the predicted storage data into a storage prediction model, the storage usage and growth rate at future points in time are derived. This enables the system to accurately monitor storage space based on actual storage needs and, through predefined storage space thresholds, provides graded warnings for storage space anomalies, effectively preventing issues such as insufficient storage space or sudden storage overloads.

[0016] 2. By calculating historical storage growth rates and applying the K-means algorithm for clustering, the system can divide historical growth rate data into multiple growth pattern clusters. By sorting the clusters and calculating their centroids, it can determine growth rate thresholds. This method provides refined growth rate analysis and can compare future storage growth rates with historical growth rate trends, thereby enabling graded early warning of abnormal growth. This mechanism enables timely identification and early warning of abnormal storage growth behavior, improving the security and reliability of file storage management and effectively supporting audit work. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 This is a structural diagram of the multi-level audit and early warning method based on offline file security management of the present invention.

[0018] Figure 2 This is a structural diagram of the multi-level audit and early warning system based on offline file security management of the present invention. DETAILED DESCRIPTION

[0019] The following will provide a clear and complete description of the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0020] Example 1, Figure 1 The present invention provides a multi-level audit and early warning method based on offline file security management, which includes the following steps:

[0021] S1, obtain the historical storage data of the U-Shield and the data to be predicted by the U-Shield and pre-process them. The historical storage data of the U-Shield includes the number of quantum keys currently stored in the U-Shield, the time when the quantum key was generated, the length of the quantum key, and the current storage usage of the U-Shield;

[0022] It's important to note that obtaining historical and predicted storage data for USB-Shields is crucial for accurate storage management and risk warning. Historical storage data, such as the number of quantum keys, their generation time, length, and current storage usage, can reflect USB-Shield usage and storage demand trends over time. This data provides the foundation for analyzing storage growth patterns, enabling the system to identify normal growth and abnormal fluctuations. Furthermore, by feeding the predicted storage data into a pre-set storage forecasting model, it generates future storage usage and growth rates, helping the system proactively identify potential storage bottlenecks and security risks. Combining historical and predicted data enables more comprehensive risk assessment and storage strategy optimization, ensuring the optimal use of storage resources, avoiding service interruptions or data loss due to insufficient storage, and thus improving the overall security and reliability of the system. This comprehensive analysis enables administrators to make informed storage management decisions at a higher level.

[0023] In this example, the acquisition of the historical storage data of the U-Shield and the storage data to be predicted by the U-Shield and pre-processing are as follows:

[0024] Clean the historical storage data and the predicted storage data of the U-Shield, and process missing values ​​and outliers;

[0025] Normalize the historical storage data of the U-shield and the storage data to be predicted of the U-shield after data cleaning.

[0026] In this example, the normalization operation of the U-Shield historical storage data and the U-Shield predicted storage data after data cleaning is specifically as follows:

[0027]

[0028] Among them, x is the historical storage data of the U-Shield and the storage data to be predicted by the U-Shield. 、 are the minimum and maximum values ​​of the historical storage data of the U-Shield and the data to be predicted by the U-Shield, respectively. It is standardized data.

[0029] It's important to note that data cleansing of the USB-Shield's historical storage data and the data to be predicted, including addressing missing and outliers, can significantly improve data quality and reliability. Data cleansing ensures the accuracy and completeness of the underlying data for analysis, helping to eliminate bias caused by inaccurate data and thereby improving the accuracy of subsequent analysis and predictions. Furthermore, normalization can unify data of varying magnitudes and ranges to the same standard, eliminating dimensionality effects across the data and ensuring that all features have equal weight during model training and analysis. This process helps improve model performance and stability, ensuring the algorithm can correctly identify patterns and trends in the data, thereby enhancing its ability to predict storage usage. Overall, data cleansing and normalization not only improve the effectiveness of data analysis but also lay a solid foundation for subsequent storage management decisions.

[0030] S2, inputting the USB-Shield storage data to be predicted into a preset USB-Shield storage prediction model, obtaining the USB-Shield storage usage at each future timestamp and calculating the future growth rate of the USB-Shield storage at each timestamp;

[0031] In this example, the USB-Shield storage data to be predicted is input into the preset USB-Shield storage prediction model to obtain the USB-Shield storage usage for each future timestamp, specifically:

[0032] Build a CNN-LSTM hybrid prediction model;

[0033] Divide the historical storage data of the U-Shield into a training set, a test set, and a validation set, input the training set into the CNN-LSTM hybrid prediction model, initialize the training parameters, and train the model;

[0034] Use the test set and validation set to test and validate the trained model to obtain the trained CNN-LSTM hybrid prediction model;

[0035] The U-shield storage data to be predicted is input into the CNN-LSTM hybrid prediction model to predict the U-shield storage usage at each future timestamp.

[0036] In this example, the construction of the CNN-LSTM hybrid prediction model is specifically as follows:

[0037] Divide the U-Shield historical storage data into N time windows of different scales to obtain N U-Shield historical storage data of time windows of different scales;

[0038] Constructing N corresponding convolution kernels of different scales, and taking the N different scales of time window USB-shield historical storage data as input, to obtain N different scales of USB-shield storage feature maps;

[0039] Construct a channel attention mechanism, calculate the attention weights of the N USB-shield storage feature maps of different scales, and obtain N weighted USB-shield storage feature maps;

[0040] Add the N weighted U-Shield storage feature maps element by element to obtain a fused U-Shield storage feature map;

[0041] Construct an LSTM model, and input the fused U-shield storage feature map into the LSTM model to predict the U-shield storage usage.

[0042] In this example, the U-Shield historical storage data is divided into N time windows of different scales to obtain N time windows of different scales of U-Shield historical storage data, specifically:

[0043] The advantages of dividing the historical storage data of the USB-Shield into N time windows of different scales, such as short-term windows (1 hour, 1 day), medium-term windows (1 week, 1 month) and long-term windows (1 quarter, 1 year), are as follows:

[0044] Analyze USB-Shield storage trends from different perspectives: Using time windows of varying sizes, you can observe the changing trends of USB-Shield storage data from multiple time dimensions: short-term, medium-term, and long-term. Short-term windows capture short-term fluctuations, such as abnormal storage growth or emergencies, while long-term windows reveal overall trends or cyclical changes in storage usage, facilitating long-term planning.

[0045] Enhanced anomaly detection capabilities: Time windows of varying scales can help identify different types of storage anomalies. For example, short-term windows can detect rapid storage surges or fluctuations, while medium- to long-term windows can help identify slowly accumulating storage issues. Multi-scale analysis enables the system to more accurately identify various storage anomalies.

[0046] In this example, the channel attention mechanism is constructed to calculate the attention weights of the N USB-Shield storage feature maps of different scales to obtain N weighted USB-Shield storage feature maps, specifically:

[0047] The advantage of the channel attention mechanism is that it effectively enhances the representation of key features and mitigates the influence of unimportant or noisy features by assigning different weights to different channels in the feature map. Each channel typically represents a specific feature. For example, in storage data analysis, different channels may correspond to storage usage, growth rate, number of keys, and so on. The channel attention mechanism automatically learns and assigns importance weights to each channel based on global contextual information, allowing the model to focus more on key task-related features and less on irrelevant information. In this way, the model can obtain more discriminative feature representations when processing multi-dimensional data, thereby improving the accuracy of overall analysis, detection, and prediction. Especially when processing complex multi-scale or multi-feature data, the channel attention mechanism can effectively capture the correlations between different features, enhancing the model's ability to perceive key patterns. It is suitable for scenarios requiring fine-grained feature learning, such as anomaly detection and prediction tasks.

[0048] In this example, the calculation of the future growth rate of the USB-Shield storage for each timestamp is as follows:

[0049]

[0050] in, For time Storage growth rate, For time Storage usage, For time Storage usage.

[0051] S3, performing a storage space abnormality classification warning based on the USB-Shield storage usage at each future timestamp and the preset USB-Shield storage space threshold;

[0052] In this example, a storage space abnormality classification warning is performed based on the USB-Shield storage usage at each future timestamp and the preset USB-Shield storage threshold, specifically:

[0053] When the U-Shield storage usage at each future timestamp is lower than the preset first storage space threshold, a green storage space warning will be issued and the user does not need to take any action;

[0054] When the U-Shield storage usage at each future timestamp exceeds the preset first storage space threshold but is lower than the preset second storage space threshold, a yellow storage space warning is issued, and the user cleans up unnecessary quantum keys in a timely manner;

[0055] When the U-Shield storage usage for each future timestamp exceeds the preset second storage space threshold, a red storage space warning will be issued, and the user needs to suspend the storage of quantum keys and expand the capacity appropriately.

[0056] It's important to note that the tiered warning process, based on USB-Shield storage usage at each future timestamp and preset storage thresholds, offers significant advantages, effectively enhancing the flexibility and security of storage management. First, by setting different storage space thresholds (green, yellow, and red), the system accurately reflects current storage conditions, providing users with clear operational guidance. When storage usage is below the first threshold, users can continue using the device without taking any action, thus avoiding unnecessary interruptions and operations. When usage exceeds the first threshold but falls below the second, the system issues a yellow warning, reminding users to promptly clear unnecessary quantum keys. This helps proactively manage storage resources and prevent future storage pressures. This warning mechanism encourages users to develop the habit of regular maintenance and clearing, improving resource utilization. Furthermore, when storage usage exceeds the second threshold, the system issues a red warning, requiring users to suspend quantum key storage and expand capacity, avoiding data loss or service interruptions caused by insufficient storage. This tiered warning strategy not only improves storage management efficiency but also enhances overall system security, helping users identify and address potential risks early, thereby ensuring the secure storage of important data such as quantum keys.

[0057] S4, calculating the historical storage growth rate based on the historical storage data of the USB shield, clustering the historical storage growth rate using the K-means algorithm to obtain G storage growth rate clusters, and sorting the G storage growth rate clusters;

[0058] In this example, the historical storage growth rate is calculated based on the historical storage data of the U shield, and the historical storage growth rate is clustered using the K-means algorithm to obtain G storage growth rate clusters, and the G storage growth rate clusters are sorted as follows:

[0059] Based on the U-Shield storage capacity calculation formula, calculate the storage growth rate between all adjacent timestamps in sequence to obtain the U-Shield historical storage growth rate for each timestamp;

[0060] Randomly select G timestamps of the U-Shield historical storage growth rate from the U-Shield historical storage growth rate of each timestamp as G initial storage cluster centroids;

[0061] Use the Euclidean distance formula to calculate the Euclidean distance between the historical storage growth rate of the USB-Shield at each timestamp and the G initial storage cluster centroids;

[0062] Based on the Euclidean distance, the historical storage growth rate of the USB-Shield at each timestamp is assigned to the nearest G initial storage cluster centroids;

[0063] Calculate the average of the historical storage growth rates of all U-Shields in the G initial storage cluster centroids, and set the average as the new storage cluster centroid to update the storage cluster centroid;

[0064] The storage cluster centroid update is repeated to obtain G storage growth rate clusters, and the G storage growth rate clusters are sorted in ascending order.

[0065] In this example, the storage growth rate between all adjacent timestamps is calculated in sequence based on the USB-Shield storage capacity calculation formula to obtain the USB-Shield historical storage growth rate for each timestamp, specifically:

[0066]

[0067] in, For time Storage growth rate, For time Storage usage, For time Storage usage.

[0068] In this example, G timestamps of the historical storage growth rate of the U-Shield are randomly selected from the historical storage growth rate of the U-Shield at each timestamp as the G initial storage cluster centroids, specifically:

[0069] The advantage of randomly selecting G initial cluster centroids from the historical storage growth rate of the U-Shield at each timestamp is that it can improve the diversity and stability of the clustering. First, the randomly selected centroids can cover different storage growth patterns, thereby more accurately reflecting the overall trend of the data and avoiding the deviation that may be caused by a single centroid; secondly, this randomization process reduces the risk of the K-means algorithm falling into a local optimal solution and improves the robustness of the clustering results. Randomly selecting the initial centroid can also accelerate the convergence of the algorithm and reduce computing time because it avoids the additional overhead brought by complex initialization methods; ultimately, through the selection of diverse initial centroids, it is possible to better capture the important features of the U-Shield storage data, improve the accuracy of anomaly detection and prediction, and promote a deeper understanding of storage growth behavior.

[0070] In this example, the Euclidean distance formula is used to calculate the Euclidean distance between the historical storage growth rate of the USB-Shield at each timestamp and the G initial storage cluster centroids, specifically:

[0071]

[0072] in, For each timestamp, the Euclidean distance between the historical storage growth rate of the USB shield and the G initial storage cluster centroids, is the historical storage growth rate of the U-Shield at the jth timestamp, Initially store cluster centroids for the ith cluster.

[0073] It's important to note that using the Euclidean distance formula to calculate the Euclidean distance between the historical storage growth rate of the USB-Shield at each timestamp and the centroids of the G initial storage clusters offers several advantages. First, this method quantifies the similarity between individual growth rates and defined growth patterns, helping to identify whether current storage growth trends fall within known historical norms. This distance calculation effectively identifies abnormalities in storage growth, providing a basis for early warning of abnormal behavior. Second, the Euclidean distance calculation method is simple and intuitive, easy to understand and implement, making cluster analysis more efficient in multidimensional data environments. Furthermore, by comparing the distance between growth rates and centroids, the system can flexibly adjust early warning mechanisms and identify potential storage growth risks in real time, enhancing storage management responsiveness and early warning accuracy, thereby improving the security and reliability of the USB-Shield. In summary, using Euclidean distance provides powerful support for analyzing and managing storage growth rates, helping to make more informed storage decisions.

[0074] In this example, the average value of the historical storage growth rates of all U-Shields in the G initial storage cluster centroids is calculated, and the average value is set as the new storage cluster centroid to update the storage cluster centroid. Specifically,

[0075]

[0076] in is the new centroid of the k-th storage growth rate cluster, is the number of timestamps in the k-th storage growth rate cluster, is the historical storage growth rate of the U-Shield at the i-th timestamp, is the kth storage growth rate cluster, It is the sum of the historical storage growth rates of all timestamp USB-Shields in the k-th storage growth rate cluster.

[0077] S5, based on the centroids of the G storage growth rate clusters, calculate G-1 storage growth rate thresholds and compare the future growth rate of the U-Shield storage with the G-1 storage growth rate thresholds to perform a graded warning of abnormal U-Shield storage growth.

[0078] In this example, based on the G storage growth rate clusters, the storage growth rate threshold is calculated as follows:

[0079] Based on the G storage growth rate clusters, calculating the kernel density of each storage growth rate in each storage growth rate cluster;

[0080] Drawing a density curve of each storage growth rate cluster based on the kernel density of each storage growth rate in each storage growth rate cluster;

[0081] Calculating a local minimum value of a density curve of each storage growth rate cluster;

[0082] The local minimum value is used as a storage growth rate threshold.

[0083] Example 2, Figure 2 A multi-level audit and early warning system based on offline file security management is proposed, including a USB-shield data acquisition module, a USB-shield storage prediction module, a USB-shield storage space early warning module, a USB-shield storage growth rate module, and a USB-shield storage growth early warning module:

[0084] A U-shield data acquisition module is used to obtain and pre-process the U-shield historical storage data and the U-shield predicted storage data. The U-shield historical storage data includes the number of quantum keys currently stored in the U-shield, the time when the quantum key was generated, the length of the quantum key, and the current storage usage of the U-shield;

[0085] A U-Shield storage prediction module is used to input the U-Shield storage data to be predicted into a preset U-Shield storage prediction model to obtain the U-Shield storage usage at each future timestamp and calculate the future growth rate of the U-Shield storage at each timestamp;

[0086] A U-Shield storage space warning module is used to provide a storage space abnormality classification warning based on the U-Shield storage usage at each future timestamp and a preset U-Shield storage space threshold;

[0087] A U-Shield storage growth rate module is used to calculate the historical storage growth rate based on the U-Shield historical storage data, cluster the historical storage growth rate using the K-means algorithm to obtain G storage growth rate clusters, and sort the G storage growth rate clusters;

[0088] The U-Shield storage growth warning module calculates G-1 storage growth rate thresholds based on the centroid of the G storage growth rate clusters and compares the future growth rate of the U-Shield storage with the G-1 storage growth rate thresholds to provide a graded warning of abnormal U-Shield storage growth.

[0089] The above formulas are all dimensionless and numerical calculations. The formulas are obtained by collecting a large amount of data and performing software simulation to obtain the most recent real situation. The preset parameters in the formulas are set by technicians in this field according to actual conditions.

[0090] The above embodiments may be implemented in whole or in part through software, hardware, firmware, or any other combination thereof. When implemented using software, the above embodiments may be implemented in whole or in part in the form of a computer program product.

[0091] Those skilled in the art will appreciate that the modules and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0092] In addition, each functional module in each embodiment of the present application may be integrated into one processing module, or each module may exist physically separately, or two or more modules may be integrated into one module.

[0093] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

[0094] Finally: The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A multi-level audit and early warning method based on offline file security management, characterized by: The following steps are involved: Obtain and pre-process the historical storage data of the U-Shield and the data to be predicted for the U-Shield storage. The historical storage data of the U-Shield includes the number of quantum keys currently stored in the U-Shield, the time when the quantum key was generated, the length of the quantum key, and the current storage usage of the U-Shield. Input the U-Shield storage data to be predicted into a preset U-Shield storage prediction model to obtain the U-Shield storage usage at each future timestamp and calculate the future growth rate of the U-Shield storage at each timestamp; Providing a storage space abnormality classification warning based on the U-Shield storage usage at each future timestamp and the preset U-Shield storage space threshold; Calculate the historical storage growth rate based on the historical storage data of the U-Shield, cluster the historical storage growth rate using the K-means algorithm to obtain G storage growth rate clusters, and sort the G storage growth rate clusters; Based on the G storage growth rate clusters, a storage growth rate threshold is calculated and the future growth rate of the U-shield storage is compared with the storage growth rate threshold to perform a graded warning of abnormal U-shield storage growth.

2. The multi-level audit and early warning method based on offline file security management according to claim 1 is characterized in that: The U-Shield storage data to be predicted is input into the preset U-Shield storage prediction model to obtain the U-Shield storage usage at each future timestamp, specifically: Build a CNN-LSTM hybrid prediction model; Divide the historical storage data of the U-Shield into a training set, a test set, and a validation set, input the training set into the CNN-LSTM hybrid prediction model, initialize the training parameters, and train the model; Use the test set and validation set to test and validate the trained model to obtain the trained CNN-LSTM hybrid prediction model; The U-shield storage data to be predicted is input into the CNN-LSTM hybrid prediction model to predict the U-shield storage usage at each future timestamp.

3. The multi-level audit and early warning method based on offline file security management according to claim 2 is characterized in that: The construction of the CNN-LSTM hybrid prediction model is specifically as follows: Divide the U-Shield historical storage data into N time windows of different scales to obtain N U-Shield historical storage data of time windows of different scales; Constructing N corresponding convolution kernels of different scales, and taking the N different scales of time window USB-shield historical storage data as input, to obtain N different scales of USB-shield storage feature maps; Construct a channel attention mechanism, calculate the attention weights of the N USB-shield storage feature maps of different scales, and obtain N weighted USB-shield storage feature maps; Add the N weighted U-Shield storage feature maps element by element to obtain a fused U-Shield storage feature map; Construct an LSTM model, and input the fused U-shield storage feature map into the LSTM model to predict the U-shield storage usage.

4. The multi-level audit and early warning method based on offline file security management according to claim 1 is characterized in that: The historical storage growth rate is calculated based on the historical storage data of the U shield, and the historical storage growth rate is clustered using the K-means algorithm to obtain G storage growth rate clusters, and the G storage growth rate clusters are sorted as follows: Based on the U-Shield storage capacity calculation formula, calculate the storage growth rate between all adjacent timestamps in sequence to obtain the U-Shield historical storage growth rate for each timestamp; Randomly select G timestamps of the U-Shield historical storage growth rate from the U-Shield historical storage growth rate of each timestamp as G initial storage cluster centroids; Use the Euclidean distance formula to calculate the Euclidean distance between the historical storage growth rate of the USB-Shield at each timestamp and the G initial storage cluster centroids; Based on the Euclidean distance, the historical storage growth rate of the USB-Shield at each timestamp is assigned to the nearest G initial storage cluster centroids; Calculate the average of the historical storage growth rates of all U-Shields in the G initial storage cluster centroids, and set the average as the new storage cluster centroid to update the storage cluster centroid; The storage cluster centroid update is repeated to obtain G storage growth rate clusters, and the G storage growth rate clusters are sorted in ascending order.

5. The multi-level audit and early warning method based on offline file security management according to claim 3 is characterized in that: Based on the G storage growth rate clusters, a storage growth rate threshold is calculated, specifically: Based on the G storage growth rate clusters, calculating the kernel density of each storage growth rate in each storage growth rate cluster; Drawing a density curve of each storage growth rate cluster based on the kernel density of each storage growth rate in each storage growth rate cluster; Calculating a local minimum value of a density curve of each storage growth rate cluster; The local minimum value is used as a storage growth rate threshold.

6. The multi-level audit and early warning method based on offline file security management according to claim 1 is characterized in that: Based on the U-Shield storage usage at each future timestamp and the preset U-Shield storage threshold, a storage space abnormality classification warning is performed, specifically: When the U-Shield storage usage at each future timestamp is lower than the preset first storage space threshold, a green storage space warning will be issued and the user does not need to take any action; When the U-Shield storage usage at each future timestamp exceeds the preset first storage space threshold but is lower than the preset second storage space threshold, a yellow storage space warning is issued, and the user cleans up unnecessary quantum keys in a timely manner; When the U-Shield storage usage for each future timestamp exceeds the preset second storage space threshold, a red storage space warning will be issued, and the user needs to suspend the storage of the quantum key and expand the capacity.

7. The multi-level audit and early warning method based on offline file security management according to claim 1 is characterized in that: The calculation of the future growth rate of the USB-Shield storage for each timestamp is specifically as follows: in, For time Storage growth rate, For time Storage usage, For time Storage usage.

8. The multi-level audit and early warning method based on offline file security management according to claim 4 is characterized in that: The Euclidean distance formula is used to calculate the Euclidean distance between the historical storage growth rate of the USB shield at each timestamp and the G initial storage cluster centroids, specifically: in, For each timestamp, the Euclidean distance between the historical storage growth rate of the USB shield and the G initial storage cluster centroids, is the historical storage growth rate of the U-Shield at the jth timestamp, Initially store cluster centroids for the ith cluster.

9. The multi-level audit and early warning method based on offline file security management according to claim 4 is characterized in that: Calculate the average value of the historical storage growth rates of all U-Shields in the G initial storage cluster centroids, and set the average value as the new storage cluster centroid to update the storage cluster centroid, specifically: in is the new centroid of the k-th storage growth rate cluster, is the number of timestamps in the k-th storage growth rate cluster, is the historical storage growth rate of the U-Shield at the i-th timestamp, is the kth storage growth rate cluster, It is the sum of the historical storage growth rates of all timestamp USB-Shields in the k-th storage growth rate cluster.

10. A multi-level audit warning system based on offline file security management according to any one of claims 1 to 9, characterized in that: It includes U-Shield data acquisition module, U-Shield storage prediction module, U-Shield storage space warning module, U-Shield storage growth rate module and U-Shield storage growth warning module: A U-shield data acquisition module is used to obtain and pre-process the U-shield historical storage data and the U-shield predicted storage data. The U-shield historical storage data includes the number of quantum keys currently stored in the U-shield, the time when the quantum key was generated, the length of the quantum key, and the current storage usage of the U-shield; A U-Shield storage prediction module is used to input the U-Shield storage data to be predicted into a preset U-Shield storage prediction model to obtain the U-Shield storage usage at each future timestamp and calculate the future growth rate of the U-Shield storage at each timestamp; A U-Shield storage space warning module is used to provide a storage space abnormality classification warning based on the U-Shield storage usage at each future timestamp and a preset U-Shield storage space threshold; A U-Shield storage growth rate module is used to calculate the historical storage growth rate based on the U-Shield historical storage data, cluster the historical storage growth rate using the K-means algorithm to obtain G storage growth rate clusters, and sort the G storage growth rate clusters; The U-Shield storage growth warning module calculates G-1 storage growth rate thresholds based on the centroid of the G storage growth rate clusters and compares the future growth rate of the U-Shield storage with the G-1 storage growth rate thresholds to provide a graded warning of abnormal U-Shield storage growth.

Images