Archives information security tracking and real-time monitoring system and method based on the Internet of Things

Abstract

The present invention discloses an archive information security tracking and real-time monitoring system and method based on the Internet of Things, which relates to the technical field of the Internet of Things, including: collecting classification records and transfer records, collectively referred to as operation records, obtaining a number of sub-periods according to the operation time corresponding to each operation record, and obtaining the characteristic coefficient corresponding to each sub-period; obtaining the personnel reliability of each operation record, and obtaining all target records therein according to the characteristic coefficient; obtaining the corresponding keywords in the target record, calculating the similarity between the keywords, and establishing the characteristic archive model corresponding to each archive category; according to the characteristic archive model, classifying the current archive data to be classified, and transmitting it to the corresponding archive category. The present invention analyzes the historical archive data to obtain the archive category to which the current archive data to be classified belongs, thereby improving the classification efficiency, making the classification more accurate and efficient, and realizing real-time monitoring of abnormal archive data.

Description

Technical Field

[0001] The present invention relates to the technical field of Internet of Things, and in particular to an archive information security tracking and real-time monitoring system and method based on the Internet of Things. Background Art

[0002] With the rapid development of computer technology, Internet of Things technology and information security technology, informatization and digitalization have become the mainstream trend in all walks of life. In today's digital age, archival information has become an extremely important asset for organizations. Common archival data include various types of operating parameters of IoT devices, production environment data, project application documents, technical documents and monitoring image data, and these data are stored digitally; however, in the context of globalization, with the increasing complexity of the network environment, more and more IoT devices are connected to the network to generate data, resulting in increasingly complex and numerous archival data. If these archival data are not classified and organized in time, it will not only lead to confusion of archival information, but also face many security threats such as data leakage and tampering.

[0003] The existing classification and organization of archival data usually involves storing the archival data in a specific storage medium or database, and then manually classifying it or using a semi-automatic classification method based on simple rules. Faced with massive amounts of archival data, this is not only inefficient and subjective, but also inevitably leads to errors. In addition, if there is unreasonable classification, data transfer is required, and there is no way to monitor abnormal data in real time. Summary of the invention

[0004] The purpose of the present invention is to provide an archive information security tracking and real-time monitoring system and method based on the Internet of Things to solve the problems raised in the prior art.

[0005] To achieve the above object, the present invention provides the following technical solutions:

[0006] The method for archival information security tracking and real-time monitoring based on the Internet of Things includes the following steps:

[0007] Step S100: Collecting classification records for classifying archive data into different archive categories and transfer records for transferring archive data from one archive category to another archive category. Classification records and transfer records are collectively referred to as operation records. According to the operation time corresponding to each operation record, a number of sub-periods are obtained, and a characteristic coefficient corresponding to each sub-period is obtained.

[0008] Step S200: according to the authority of the operator corresponding to each operation record and the report record filled in after the operation, the operator reliability of each operation record is obtained, and according to the characteristic coefficient, all the target records therein are obtained;

[0009] Step S300: Obtain the corresponding keywords in the target record, and calculate the similarity between the keywords based on the large language model, and then obtain the characteristic words, and establish the feature file model corresponding to each file category based on each characteristic word;

[0010] Step S400: The IoT device currently generating the archive data to be classified is taken as the device to be detected, and the archive data to be classified is taken as the data to be classified. According to the feature archive model and the category of the archive data historically generated by the device to be detected, the category to which the data to be classified belongs is determined, and the data to be classified is transmitted to the corresponding archive category.

[0011] Furthermore, step S100 includes:

[0012] Step S110: Obtain several historical classification records and transfer records, the classification records include: operator, operation time, target category, file number and file content, the file content includes file description and file file, and the transfer record includes: operator, operation time, category before transfer, target category, file number and file content; obtain the operator's working time and leaving time, and take the time between the working time of a certain day and the working time of the next day as the characteristic time period;

[0013] Step S120: Get all the operation moments in the characteristic time period, the number is Q, set the minimum time period to F1, the maximum time period to F2, take the starting point of the characteristic time period as the starting time, the end point as the ending time, the moment with a time length of F1 from the starting time as the first moment M1, and the moment with a time length of F2 from the starting time as the second moment M2. If the number of operation moments between the starting time and the moment M1 is q1>q0, q0 is the number threshold, take the moment M1 as the splitting moment, if q1≤q0, and there is a moment M1 2 between the moment M1 and the moment M2, and the number of operation moments between the starting time and the moment M1 2 is satisfied, q1=q0, then take the moment M1 2 is used as the segmentation moment. If the above conditions are not met, the moment M2 is used as the segmentation moment. Then the segmentation moment is used as the starting moment to obtain another segmentation moment. And so on. If the time period from a certain segmentation moment to the end moment is less than F1+F2, the moment between the two moments is used as the segmentation moment. Then all the segmentation moments are obtained. The time period between the starting point and the adjacent segmentation moment, between two adjacent segmentation moments, and between a certain segmentation moment and the adjacent end point is used as a sub-period. The number of operation moments in each sub-period is divided by the number Q to obtain the characteristic coefficient C corresponding to each sub-period, and the coefficient is normalized.

[0014] For files such as development documents and project applications, in order to facilitate operators' quick understanding, it is usually necessary to refine and summarize the file contents, and these refined and summarized parts are called file descriptions in this scheme; generally, under normal circumstances, operators classify the files during working hours, and the farther away from working hours, for example, working hours are during the day, and file operations occur in the early morning, the possibility of abnormal behavior is relatively high. In this scheme, the characteristic coefficient C is used to characterize the abnormal behavior of each sub-time period, and the smaller the characteristic coefficient, the greater the probability of abnormality, and the larger the characteristic coefficient, the greater the probability of normality.

[0015] Further, step S200 includes:

[0016] Step S210: After completing the corresponding operation, the operator needs to fill in a report record, and the content of the report record includes the operator, operation time, file number, and operation description; if the operator, operation time or file number in the report record completely matches the actual one, the matching degree of the operator, operation time or file number is judged to be 1, if not completely matched, the matching degree is 0; if the operator corresponding to a certain operation record has the authority to modify the corresponding target category, the first reliability Y of the certain operation record is set to 1, if not, the first reliability Y is set to 0;

[0017] After completing an operation, the operator needs to fill in a report record to tell the relevant staff what has been changed. If the report record is not filled in or is insufficient or incorrect, the operator will be judged to be highly abnormal. In addition, since the operator needs to log in to operate the file, and the authority is generally set by the administrator according to the responsibilities of each operator, if an operator modifies a category that does not belong to his or her authority, the operator will be highly abnormal. Therefore, the reliability of the operator can be obtained by combining the report record and authority.

[0018] Step S220: Then obtain the personnel reliability D=W1*(∑N n=1X n ) / N+W2*Y, W1 and W2 are the report record weight and permission weight respectively, W1+W2=1, where N is the number of report record contents, n=1,2 or 3, X n is the matching degree of the nth report record content, Y is the first reliability of a certain operation record; then according to a certain operation record, the characteristic coefficient C of the sub-period corresponding to the operation time, the target degree of a certain operation record is obtained as follows: T=W C *C+W D *D, where W C is the characteristic coefficient weight, W Dis the personnel reliability weight, W C +W D =1, if T>T0, T0 is the target degree threshold, then a certain operation record is taken as the target record; obtain the file number FN corresponding to a certain transfer record TR, and the classification record SR corresponding to the file number FN. If a certain transfer record TR and the classification record SR are both target records, cancel the classification record SR as the target record, and then obtain all target records.

[0019] Furthermore, step S300 includes:

[0020] Step S310: Obtain the file description and operation description corresponding to a certain target record, extract all keywords in the two descriptions as the keyword library of the certain target record, and then obtain each keyword library, calculate the similarity between a certain keyword KW in a certain keyword library and each keyword in another keyword library, and normalize them; if the target record corresponding to a certain keyword library is a classification record, and the corresponding maximum similarity value in another keyword library is greater than a first threshold, then the other keyword library is used as the first feature library of the certain keyword KW, and if the number of first feature libraries corresponding to the certain keyword KW is greater than the quantity threshold, the certain keyword KW is marked; if the target record corresponding to a certain keyword library is a transfer record, and the corresponding maximum similarity value in another keyword library is greater than a second threshold, then the other keyword library is used as the second feature library of the certain keyword KW, and if the number of second feature libraries corresponding to the certain keyword KW is greater than the quantity threshold, the certain keyword KW is marked; then all marked keywords are obtained, and unmarked keywords are used as characteristic words, and all characteristic words corresponding to each target record are obtained;

[0021] Step S320: Establish a neural network model for a certain target category, set the initial number of cycles b=1, obtain all target records corresponding to a certain target category, and use all characteristic words corresponding to each target record and some archive contents therein as training sets to train the neural network model. The output result of the neural network model is the relevance between the archive content and the target category; and use random H1 archive contents corresponding to a certain target category as relevant archives, and random H2 archive contents corresponding to the remaining target categories as non-relevant archives. Use the relevant archives and non-relevant archives as verification sets, and input them into the trained neural network model to obtain the output result;

[0022] It should be noted that when training the model, the training process can be divided into correlation training and non-correlation training. Correlation training is to strengthen the feature association and pattern recognition strengthening aspects of the model to learn and strengthen the relevant features and laws between the input data and the target output, while non-correlation training is mainly to strengthen the similar interference and abnormal recognition aspects of the model, aiming to allow the model to learn and distinguish features and situations that are irrelevant or have large differences with the target output; for example, for two similar but different types of copywriting, if only correlation training is performed on one of the types, and non-correlation training is not performed on the other, the reliability of the output result will be greatly reduced; in this solution, step S320 only performs correlation training on the model, and in step S330, when the number of cycles b is greater than 1, both the correlation and non-correlation of the model must be trained;

[0023] Step S330: If there is a maximum correlation value in non-related files that is greater than the minimum correlation value in related files, both related files and non-related files are used as training sets, and the neural network model is trained again. The value of the number of loops b is increased by 1, and the maximum number of loops is set to B until b=B or the maximum correlation value in non-related files is not greater than the minimum correlation value in related files. The trained neural network model is used as the feature file model, and the feature file model corresponding to each file category is obtained.

[0024] Furthermore, step S400 includes:

[0025] Step S410: extract all keywords in the file description corresponding to the data to be classified, remove the marked keywords according to step S310, input the remaining keywords and the data to be classified into each feature file model, obtain the output result of each model, obtain several correlations, and select the maximum correlation value Z max The corresponding model is taken as A, and the sum of the correlations of the remaining models except model A is taken as Z sum , if Z is satisfied max >k Z *Z sum And Z max >Z0, where k Z is the correlation coefficient, Z0 is the correlation threshold, the data to be classified is classified into the archive category corresponding to model A and transmitted; if Z is satisfied max ≤k Z *Z sum or Z max ≤Z0, obtain several archive data generated by the equipment to be tested in history, and divide them into G parts evenly. The weight of the g-th part is: W g=g / ∑G h=1h; The status of the archive data includes archived and unarchived. According to the ratio of the number of unarchived archive data to the corresponding total number of archive data, the unarchived value of the device to be tested is obtained as val=∑Gg=1W g *R g , R g is the ratio of the gth portion;

[0026] Meet Z max >k Z *Z sum This is to ensure that in the actual classification process, there is only one file category that meets the data to be classified. This is because when the correlations of the remaining file categories are large, such as the second and third largest correlations are also large, it is easy to cause judgment influence and lead to the problem of fuzzy classification. Therefore, through this condition, the main relevant factors can be highlighted, so that the data to be classified can be more accurately classified into the category corresponding to the most relevant model; and Z max >Z0 is to set the minimum relevance threshold, ensure classification quality, exclude irrelevant or weakly relevant data, improve classification accuracy, and ensure that the data has sufficient relevance to the model before it can be classified into the category corresponding to the model;

[0027] Step S420: Take the archive data generated by the history of the device to be detected that exists in a certain archive category as the device data; obtain the keywords in the archive description of the data to be classified, and remove the marked keywords therein to obtain all the detection keywords, calculate the similarity between a certain detection keyword and each keyword in a certain device data, and obtain the maximum similarity corresponding to a certain detection keyword, and then add the maximum similarities corresponding to all detection keywords to obtain the total similarity s, and according to the unarchived value val of the device to be detected, obtain the classification degree CD=1-e of the data to be classified and a certain archive category -k*s / val , e is the natural index, k is the classification coefficient. If the maximum classification degree corresponding to the data to be classified is greater than the classification threshold, the archive category corresponding to the maximum classification degree will be used as the category to which the data to be classified belongs and will be transmitted; if the maximum classification degree is not greater than the classification threshold, a security warning will be issued for the data to be classified and it will not be archived.

[0028] The archival information security tracking and real-time monitoring system based on the Internet of Things includes a characteristic coefficient calculation module, a target record acquisition module, a characteristic archive model establishment module and a data classification module to be classified;

[0029] Characteristic coefficient calculation module: used to collect classification records for classifying archive data into different archive categories, and transfer records for transferring archive data from one archive category to another archive category. Classification records and transfer records are collectively referred to as operation records. According to the operation time corresponding to each operation record, several sub-periods are obtained, and the characteristic coefficient corresponding to each sub-period is obtained;

[0030] Target record acquisition module: used to obtain the operator reliability of each operation record according to the authority of the operator corresponding to each operation record and the report record filled in after the operation, and obtain all the target records therein according to the characteristic coefficient;

[0031] Feature file model building module: used to obtain the corresponding keywords in the target record, and calculate the similarity between the keywords based on the large language model, and then obtain the characteristic words, and build the feature file model corresponding to each file category based on each characteristic word;

[0032] Data classification module for to be classified: It is used to treat the IoT device that currently generates the archival data to be classified as the device to be detected, and the archival data to be classified as the data to be classified. According to the feature archival model and the category of the archival data historically generated by the device to be detected, the category to which the data to be classified belongs is determined, and the data to be classified is transferred to the corresponding archival category.

[0033] Further, the characteristic coefficient calculation module includes an operation record classification unit and a characteristic coefficient calculation unit;

[0034] Operation record classification unit: used to obtain several historical classification records and transfer records, and obtain characteristic time periods according to the operator's working hours and leaving hours;

[0035] Characteristic coefficient calculation unit: used to obtain each sub-period in the characteristic period, and obtain the characteristic coefficient corresponding to each sub-period according to the number of operation records in the sub-period.

[0036] Further, the data classification module to be classified includes an unfiled value calculation unit and a data classification unit to be classified;

[0037] Unarchived value calculation unit: used to obtain the number of historical unarchived data of the device to be detected, and obtain the unarchived value of the device to be detected based on the total generated archived data;

[0038] Classification unit for data to be classified: used to calculate the classification degree of the data to be classified and each file category, and determine the category to which the data to be classified belongs based on each classification degree.

[0039] Compared with the prior art, the beneficial effects of the present invention are as follows: the present invention provides an archive information security tracking and real-time monitoring system and method based on the Internet of Things, including: collecting classification records and transfer records, collectively referred to as operation records, obtaining several sub-periods according to the operation time corresponding to each operation record, and obtaining the characteristic coefficient corresponding to each sub-period; obtaining the personnel reliability of each operation record, and obtaining all target records therein according to the characteristic coefficient; obtaining the corresponding keywords in the target record, calculating the similarity between the keywords, and establishing the characteristic archive model corresponding to each archive category; according to the characteristic archive model, classifying the current archive data to be classified and transmitting it to the corresponding archive category. The present invention analyzes the historical archive data to obtain the archive category to which the current archive data to be classified belongs, thereby improving the classification efficiency, making the classification more accurate and efficient, and realizing real-time monitoring of abnormal archive data. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 It is a flow chart of the method for secure tracking and real-time monitoring of archive information based on the Internet of Things of the present invention;

[0041] Figure 2 It is a structural diagram of the archive information security tracking and real-time monitoring system based on the Internet of Things of the present invention. DETAILED DESCRIPTION

[0042] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0043] Example: Figure 1 As shown, the present invention provides a system and method for archival information security tracking and real-time monitoring based on the Internet of Things, comprising the following steps:

[0044] Step S100: Collect classification records for classifying archive data into different archive categories, and transfer records for transferring archive data from one archive category to another archive category. The classification records and transfer records are collectively referred to as operation records. According to the operation time corresponding to each operation record, several sub-periods are obtained, and the characteristic coefficient corresponding to each sub-period is obtained.

[0045] Step S110: Obtain several historical classification records and transfer records, the classification records include: operator, operation time, target category, file number and file content, the file content includes file description and file file, and the transfer record includes: operator, operation time, category before transfer, target category, file number and file content; obtain the operator's working time and leaving time, and take the time between the working time of a certain day and the working time of the next day as the characteristic time period.

[0046] Step S120: Get all the operation moments in the characteristic time period, the number is Q, set the minimum time period to F1, the maximum time period to F2, take the starting point of the characteristic time period as the starting time, the end point as the ending time, the moment with a time length of F1 from the starting time as the first moment M1, and the moment with a time length of F2 from the starting time as the second moment M2. If the number of operation moments between the starting time and the moment M1 is q1>q0, q0 is the number threshold, take the moment M1 as the splitting moment, if q1≤q0, and there is a moment M1 2 between the moment M1 and the moment M2, and the number of operation moments between the starting time and the moment M1 2 is satisfied, q1=q0, then take the moment M1 2 is used as the segmentation moment. If the above conditions are not met, the moment M2 is used as the segmentation moment. Then the segmentation moment is used as the starting moment to obtain another segmentation moment. And so on. If the time period from a certain segmentation moment to the end moment is less than F1+F2, the moment between the two moments is used as the segmentation moment. Then all the segmentation moments are obtained. The time period between the starting point and the adjacent segmentation moment, between two adjacent segmentation moments, and between a certain segmentation moment and the adjacent end point is used as a sub-period. The number of operation moments in each sub-period is divided by the number Q to obtain the characteristic coefficient C corresponding to each sub-period, and the coefficient is normalized.

[0047] Generally, under normal circumstances, operators classify files during working hours, and the further away from working hours, for example, if file operations occur during the daytime and in the early morning, the possibility of abnormal behavior is higher. In this scheme, the characteristic coefficient C is used to characterize the abnormal behavior of each sub-period, and the smaller the characteristic coefficient, the greater the probability of abnormality, and the larger the characteristic coefficient, the greater the probability of normality.

[0048] Step S200: According to the authority of the operator corresponding to each operation record and the report record filled in after the operation, the operator reliability of each operation record is obtained, and according to the characteristic coefficient, all target records therein are obtained.

[0049] Step S210: After completing the corresponding operation, the operator needs to fill in a report record. The content of the report record includes the operator, operation time, file number, and operation description; if the operator, operation time or file number in the report record completely matches the actual one, the matching degree of the operator, operation time or file number is judged to be 1, if it is not a complete match, the matching degree is 0; if the operator corresponding to a certain operation record has the authority to modify the corresponding target category, the first reliability Y=1 of the operation record, if he does not have the authority to modify, the first reliability Y=0.

[0050] After completing an operation, the operator needs to fill out a report record to tell the relevant staff what changes have been made. If the report record is not filled out or is written incomplete or incorrectly, the operator will be judged to have a high degree of abnormality. In addition, since the operator needs to log in to operate the file, and the authority is generally established by the administrator according to the responsibilities of each operator, if an operator modifies a category that does not belong to his or her authority, the operator will also be judged to have a high degree of abnormality. Therefore, the reliability of the operator can be obtained by combining the report record and authority.

[0051] Step S220: Then obtain the personnel reliability D=W1*(∑N n=1X n ) / N+W2*Y, W1 and W2 are the report record weight and permission weight respectively, W1+W2=1, where N is the number of report record contents, n=1,2 or 3, X n is the matching degree of the nth report record content, Y is the first reliability of a certain operation record; then according to a certain operation record, the characteristic coefficient C of the sub-period corresponding to the operation time, the target degree of a certain operation record is obtained as follows: T=W C *C+W D *D, where W C is the characteristic coefficient weight, W D is the personnel reliability weight, W C +W D =1, if T>T0, T0 is the target degree threshold, then a certain operation record is taken as the target record; obtain the file number FN corresponding to a certain transfer record TR, and the classification record SR corresponding to the file number FN. If a certain transfer record TR and the classification record SR are both target records, cancel the classification record SR as the target record, and then obtain all target records.

[0052] Step S300: Obtain the corresponding keywords in the target record, and calculate the similarity between the keywords based on the large language model, and then obtain the characteristic words, and establish the feature file model corresponding to each file category based on the characteristic words.

[0053] Step S310: Obtain the file description and operation description corresponding to a certain target record, extract all keywords in the two descriptions as the keyword library of the certain target record, and then obtain each keyword library, calculate the similarity between a certain keyword KW in a certain keyword library and each keyword in another keyword library, and normalize them; if the target record corresponding to a certain keyword library is a classification record, and the corresponding maximum similarity value in another keyword library is greater than a first threshold, then the other keyword library is used as the first feature library of the certain keyword KW, and if the number of first feature libraries corresponding to the certain keyword KW is greater than the quantity threshold, the certain keyword KW is marked; if the target record corresponding to a certain keyword library is a transfer record, and the corresponding maximum similarity value in another keyword library is greater than a second threshold, then the other keyword library is used as the second feature library of the certain keyword KW, and if the number of second feature libraries corresponding to the certain keyword KW is greater than the quantity threshold, the certain keyword KW is marked; then all marked keywords are obtained, and unmarked keywords are used as characteristic words, and all characteristic words corresponding to each target record are obtained;

[0054] Step S320: Establish a neural network model for a target category, set the initial number of loops b=1, obtain all target records corresponding to a target category, and use all characteristic words corresponding to each target record and some archive contents therein as training sets to train the neural network model. The output result of the neural network model is the correlation between the archive content and the target category; and use random H1 archive contents corresponding to a target category as relevant archives, and random H2 archive contents corresponding to the remaining target categories as non-relevant archives. Use relevant archives and non-relevant archives as verification sets, and input them into the trained neural network model to obtain the output result.

[0055] Step S330: If there is a maximum correlation value in non-related files that is greater than the minimum correlation value in related files, both related files and non-related files are used as training sets, and the neural network model is trained again. The value of the number of loops b is increased by 1, and the maximum number of loops is set to B until b=B or the maximum correlation value in non-related files is not greater than the minimum correlation value in related files. The trained neural network model is used as the feature file model, and the feature file model corresponding to each file category is obtained.

[0056] Step S400: The IoT device currently generating the archive data to be classified is taken as the device to be detected, and the archive data to be classified is taken as the data to be classified. According to the feature archive model and the category of the archive data historically generated by the device to be detected, the category to which the data to be classified belongs is determined, and the data to be classified is transmitted to the corresponding archive category.

[0057] Step S410: extract all keywords in the file description corresponding to the data to be classified, remove the marked keywords according to step S310, input the remaining keywords and the data to be classified into each feature file model, obtain the output result of each model, obtain several correlations, and select the maximum correlation value Z max The corresponding model is taken as A, and the sum of the correlations of the remaining models except model A is taken as Z sum , if Z is satisfied max >k Z *Z sum And Z max >Z0, where k Z is the correlation coefficient, Z0 is the correlation threshold, the data to be classified is classified into the archive category corresponding to model A and transmitted; if Z is satisfied max ≤k Z *Z sum or Z max ≤Z0, obtain several archive data generated by the equipment to be tested in history, and divide them into G parts evenly. The weight of the g-th part is: W g =g / ∑G h=1h; The status of the archive data includes archived and unarchived. According to the ratio of the number of unarchived archive data to the corresponding total number of archive data, the unarchived value of the device to be tested is obtained as val=∑Gg=1W g *R g , R g is the ratio of the gth portion;

[0058] Step S420: Take the archive data generated by the history of the device to be detected that exists in a certain archive category as the device data; obtain the keywords in the archive description of the data to be classified, and remove the marked keywords therein to obtain all the detection keywords, calculate the similarity between a certain detection keyword and each keyword in a certain device data, and obtain the maximum similarity corresponding to a certain detection keyword, and then add the maximum similarities corresponding to all detection keywords to obtain the total similarity s, and according to the unarchived value val of the device to be detected, obtain the classification degree CD=1-e of the data to be classified and a certain archive category -k*s / val , e is the natural index, k is the classification coefficient. If the maximum classification degree corresponding to the data to be classified is greater than the classification threshold, the archive category corresponding to the maximum classification degree will be used as the category to which the data to be classified belongs and will be transmitted; if the maximum classification degree is not greater than the classification threshold, a security warning will be issued for the data to be classified and it will not be archived.

[0059] It will be apparent to those skilled in the art that the invention is not limited to the details of the exemplary embodiments described above and that the invention can be implemented in other specific forms without departing from the spirit or essential features of the invention. Therefore, the embodiments should be considered exemplary and non-limiting in all respects, and the scope of the invention is defined by the appended claims rather than the foregoing description, and it is intended that all variations falling within the meaning and scope of the equivalent elements of the claims be included in the invention. Any reference numeral in a claim should not be considered as limiting the claim to which it relates.

Claims

1. A method for tracking and real-time monitoring of archive information security based on the Internet of Things, characterized in that: The following steps are involved: Step S100: Collecting classification records for classifying archive data into different archive categories and transfer records for transferring archive data from one archive category to another archive category. Classification records and transfer records are collectively referred to as operation records. According to the operation time corresponding to each operation record, a number of sub-periods are obtained, and a characteristic coefficient corresponding to each sub-period is obtained. Step S200: according to the authority of the operator corresponding to each operation record and the report record filled in after the operation, the operator reliability of each operation record is obtained, and according to the characteristic coefficient, all the target records therein are obtained; Step S300: Obtain the corresponding keywords in the target record, and calculate the similarity between the keywords based on the large language model, and then obtain the characteristic words, and establish the feature file model corresponding to each file category based on each characteristic word; Step S400: The IoT device currently generating the archive data to be classified is used as the device to be detected, and the archive data to be classified is used as the data to be classified. According to the feature archive model and the category of the archive data historically generated by the device to be detected, the category to which the data to be classified belongs is determined, and the data to be classified is transmitted to the corresponding archive category; Step S200 includes: Step S210: Obtain the report record filled in by the operator after completing the corresponding operation, the content of the report record includes the operator, operation time, file number, and operation description; if the operator, operation time or file number in the report record completely matches the operator, operation time or file number of the actual operation monitored by the computer program, the matching degree of the operator, operation time or file number is judged to be 1, if not completely matched, the matching degree is 0; if the operator corresponding to a certain operation record has the authority to modify the corresponding target category, the first reliability Y of the certain operation record is set to 1, if not, the first reliability Y is set to 0; Step S220: Obtaining the personnel reliability corresponding to a certain operation record , W1 and W2 are the report record weight and permission weight respectively, W1+W2=1, where N is the number of report record contents, X n is the matching degree of the nth report record content, n=1, 2 or 3, Y is the first reliability of a certain operation record; then according to the characteristic coefficient C of the sub-period where the corresponding operation time is located, the target degree of a certain operation record is obtained as follows: T=W C *C+W D *D, where W C is the characteristic coefficient weight, W D is the personnel reliability weight, W C +W D =1, if T>T0, T0 is the target degree threshold, then a certain operation record is taken as the target record; obtain the file number FN corresponding to a certain transfer record TR, and the classification record SR corresponding to the file number FN. If a certain transfer record TR and the classification record SR are both target records, cancel the classification record SR as the target record, and then obtain all target records.

2. The method for secure tracking and real-time monitoring of archive information based on the Internet of Things according to claim 1 is characterized in that: Step S100 includes: Step S110: Obtain several historical classification records and transfer records, wherein the classification records include: operator, operation time, target category, file number and file content, the file content includes file description and file file, and the transfer record includes: operator, operation time, category before transfer, target category, file number and file content; obtain the operator's working time and leaving time, and take the time between the working time of a certain day and the working time of the next day as the characteristic time period; Step S120: Get all the operation moments in the characteristic time period, the number is Q, set the minimum time period to F1, the maximum time period to F2, take the starting point of the characteristic time period as the starting time, the end point as the ending time, the moment with a time length of F1 from the starting time as the first moment M1, and the moment with a time length of F2 from the starting time as the second moment M2. If the number of operation moments between the starting time and the moment M1 is q1>q0, q0 is the quantity threshold, take the moment M1 as the splitting moment, if q1≤q0, and there is a moment between the moment M1 and the moment M2 , satisfying the start time and time The number of operation moments q1=q0, then the moment As the split moment, if the above conditions are not met, take moment M2 as the split moment; then take the split moment as the starting moment to get another split moment, and so on. If the time period from a split moment to the end moment is less than F1+F2, take the moment between the two moments as the split moment, and then get all the split moments, take the time period between the starting point and the adjacent split moment, between two adjacent split moments, and between a split moment and the adjacent end point as a sub-period, divide the number of operation moments in each sub-period by the number Q, and take the characteristic coefficient C corresponding to each sub-period, and normalize it.

3. The method for secure tracking and real-time monitoring of archive information based on the Internet of Things according to claim 2 is characterized in that: Step S300 includes: Step S310: Obtain the file description and operation description corresponding to a certain target record, extract all keywords in the two descriptions as the keyword library of the certain target record, and then obtain each keyword library, calculate the similarity between a certain keyword KW in a certain keyword library and each keyword in another keyword library, and normalize them; if the target record corresponding to a certain keyword library is a classification record, and the corresponding maximum similarity value in the other keyword library is greater than a first threshold, then the other keyword library is used as the first feature library of the certain keyword KW, and if the number of first feature libraries corresponding to the certain keyword KW is greater than the quantity threshold, the certain keyword KW is marked; if the target record corresponding to a certain keyword library is a transfer record, and the corresponding maximum similarity value in the other keyword library is greater than a second threshold, then the other keyword library is used as the second feature library of the certain keyword KW, and if the number of second feature libraries corresponding to the certain keyword KW is greater than the quantity threshold, the certain keyword KW is marked; then all marked keywords are obtained, and unmarked keywords are used as characteristic words, and all characteristic words corresponding to each target record are obtained; Step S320: Establish a neural network model for a certain target category, set the initial number of cycles b=1, obtain all target records corresponding to the target category, and use all characteristic words corresponding to each target record and some archive contents therein as training sets to train the neural network model. The output result of the neural network model is the correlation between the archive content and the target category; and use random H1 archive contents corresponding to a certain target category as relevant archives, and random H2 archive contents corresponding to the remaining target categories as non-relevant archives, and use the relevant archives and non-relevant archives as verification sets, and input them into the trained neural network model to obtain the output result; Step S330: If there is a maximum correlation value in non-related files that is greater than the minimum correlation value in related files, both related files and non-related files are used as training sets, and the neural network model is trained again. The value of the number of loops b is increased by 1, and the maximum number of loops is set to B until b=B or the maximum correlation value in non-related files is not greater than the minimum correlation value in related files. The trained neural network model is used as the feature file model, and the feature file model corresponding to each file category is obtained.

4. The method for secure tracking and real-time monitoring of archive information based on the Internet of Things according to claim 3 is characterized in that: Step S400 includes: Step S410: extract all keywords in the file description corresponding to the data to be classified, remove the marked keywords according to step S310, input the remaining keywords and the data to be classified into each feature file model, obtain the output result of each model, obtain several correlations, and select the maximum correlation value Z max The corresponding model is taken as A, and the sum of the correlations of the remaining models except model A is taken as Z sum , if Z is satisfied max >k Z *Z sum And Z max >Z0, where k Z is the correlation coefficient, Z0 is the correlation threshold, the data to be classified is classified into the file category corresponding to model A and transmitted; if Z is satisfied max ≤k Z *Z sum or Z max ≤Z0, obtain several archive data generated by the equipment to be tested in history, and divide them into G parts evenly, and the weight of the g-th part is: The status of the archive data includes archived and unarchived. The unarchived value of the device to be tested is obtained based on the ratio of the number of unarchived archive data to the corresponding total number of archive data. , R g is the ratio of the gth portion; Step S420: The archive data generated by the history of the device to be detected that exists in a certain archive category is used as the device data; the keywords in the archive description of the data to be classified are obtained, and the marked keywords are removed to obtain all the detection keywords, and the similarity between a certain detection keyword and each keyword in a certain device data is calculated, and the maximum similarity corresponding to a certain detection keyword is obtained, and then the maximum similarities corresponding to all detection keywords are added to obtain the total similarity s, and according to the unarchived value val of the device to be detected, the classification degree CD=1-e of the data to be classified and the certain archive category is obtained. -k*s / val , when val=0, let the classification degree CD=1, e is the natural index, k is the classification coefficient, if the maximum classification degree corresponding to the data to be classified is greater than the classification threshold, the archive category corresponding to the maximum classification degree is used as the category to which the data to be classified belongs and is transmitted; if the maximum classification degree is not greater than the classification threshold, a security warning will be issued for the data to be classified and it will not be archived.

5. A file information security tracking and real-time monitoring system, used to execute the file information security tracking and real-time monitoring method based on the Internet of Things as described in any one of claims 1 to 4, characterized in that: The system includes a characteristic coefficient calculation module, a target record acquisition module, a characteristic file model establishment module and a to-be-classified data classification module; Characteristic coefficient calculation module: used to collect classification records for classifying archive data into different archive categories, and transfer records for transferring archive data from one archive category to another archive category. Classification records and transfer records are collectively referred to as operation records. According to the operation time corresponding to each operation record, several sub-periods are obtained, and the characteristic coefficient corresponding to each sub-period is obtained; Target record acquisition module: used to obtain the operator reliability of each operation record according to the authority of the operator corresponding to each operation record and the report record filled in after the operation, and obtain all the target records therein according to the characteristic coefficient; Feature file model building module: used to obtain the corresponding keywords in the target record, and calculate the similarity between the keywords based on the large language model, and then obtain the characteristic words, and build the feature file model corresponding to each file category based on each characteristic word; Data classification module for to be classified: It is used to treat the IoT device that currently generates the archival data to be classified as the device to be detected, and the archival data to be classified as the data to be classified. According to the feature archival model and the category of the archival data historically generated by the device to be detected, the category to which the data to be classified belongs is determined, and the data to be classified is transferred to the corresponding archival category.

6. The archive information security tracking and real-time monitoring system according to claim 5 is characterized in that: The characteristic coefficient calculation module includes an operation record classification unit and a characteristic coefficient calculation unit; Operation record classification unit: used to obtain several historical classification records and transfer records, and obtain characteristic time periods according to the operator's working hours and leaving hours; Characteristic coefficient calculation unit: used to obtain each sub-period in the characteristic period, and obtain the characteristic coefficient corresponding to each sub-period according to the number of operation records in the sub-period.

7. The archive information security tracking and real-time monitoring system according to claim 6 is characterized in that: The data classification module to be classified includes an unfiled value calculation unit and a data classification unit to be classified; Unarchived value calculation unit: used to obtain the number of historical unarchived data of the device to be detected, and obtain the unarchived value of the device to be detected based on the total generated archived data; Classification unit for data to be classified: used to calculate the classification degree of the data to be classified and each file category, and determine the category to which the data to be classified belongs based on each classification degree.

Images