Intelligent prediction method for privacy information storage and transmission security situation

Abstract

The invention discloses a privacy information storage and transmission security situation intelligent prediction method, which comprises the steps of constructing a multi-source data fusion basis, extracting and updating dynamic features, constructing a hybrid model, performing anomaly detection and adaptive learning, and performing real-time monitoring and feedback adjustment, and comprises the following steps of: firstly, constructing the multi-source data fusion basis, collecting and integrating multi-channel data; the method comprises the following steps of: performing dynamic feature extraction and updating, extracting and optimizing features, constructing a hybrid model, combining different types of models, applying a fusion strategy, performing anomaly detection, adaptive learning and multi-dimensional anomaly detection, adjusting the model according to the anomaly detection and the multi-dimensional anomaly detection, and finally performing real-time monitoring, feedback adjustment, continuous data acquisition and result comparison to optimize the model. According to the method, through close cooperation of the steps, prediction can be carried out without being limited to existing data modes and trends, and effective prediction and prevention can be carried out on newly occurring threats or attack modes.

Description

Technical Field

[0001] The present invention belongs to the technical field of privacy information storage, and specifically is a method for intelligently predicting the security situation of privacy information storage and transmission. Background Art

[0002] In today's digital age, the storage and transmission of private information has exploded, covering data in many highly sensitive areas such as personal identity, financial transactions, and medical health. Predicting the security status of private information storage and transmission is crucial to ensuring data security.

[0003] Traditional intelligent prediction methods for the security situation of private information storage and transmission focus on pattern mining and trend analysis of historically accumulated data. They usually collect information such as system access logs, network traffic data, and user operation behavior sequences, and then use statistical analysis and traditional machine learning algorithms to build prediction models. However, the rapid iteration of network technology and the continuous innovation of malicious attack methods have brought huge challenges to traditional prediction methods. New threats and attack methods are constantly emerging. These new threats often lack similar cases in historical data. Traditional intelligent prediction methods for the security situation of private information storage and transmission are limited to being able to make predictions based only on existing data patterns and trends, and are difficult to effectively identify and warn. This results in privacy information being in an unguarded state when facing new security threats. Once attacked, it may lead to a series of catastrophic consequences such as serious personal privacy leaks, damage to corporate trade secrets, and a crisis of social trust. Summary of the invention

[0004] The purpose of the present invention is to provide a method for intelligently predicting the security situation of storage and transmission of private information in order to solve the technical problem that the traditional method for intelligently predicting the security situation of storage and transmission of private information can only predict based on existing data patterns and trends, and it is difficult to effectively predict and prevent new threats or attack methods if there are no similar records in historical data.

[0005] The technical solution adopted by the present invention is as follows: The method for intelligently predicting the security situation of private information storage and transmission includes the following steps: S1. Build a multi-source data fusion foundation, collect various logs from the privacy information system, integrate external security intelligence, use network monitoring tools to capture network-related data, and use user behavior monitoring systems to obtain user operation-related information, clean the collected data, unify the format, and remove duplicates, and associate and integrate them through timestamps and entity identifiers to form a comprehensive and standardized data foundation; S2. Dynamic feature extraction and updating: extract valuable features in real time for different types of data, establish a feature evaluation index system, regularly evaluate existing features, eliminate low-value features, and mine and incorporate new features corresponding to new threats when they emerge, ensuring that the feature set can adapt to changes in security situations; S3. Build a hybrid model, combine various models to form a hybrid model, give full play to their respective advantages to handle different aspects of data and prediction tasks, adopt weighted average fusion and ensemble learning fusion strategies, dynamically adjust weights according to historical performance and real-time conditions of the model, and improve overall prediction accuracy and stability; S4, anomaly detection and adaptive learning, detects anomalies through multi-dimensional methods based on behavioral baseline comparison, external intelligence matching, and unsupervised learning clustering. Once an anomaly is detected, the adaptive learning mechanism begins to operate, adjusting model parameters, updating features, and optimizing model fusion strategies, so that the model can learn new threat patterns and better respond to anomalies; S5. Real-time monitoring and feedback adjustment. Continuously collect various types of data during the transmission process of privacy information storage at an appropriate frequency, and ensure efficient transmission and storage. Compare and analyze the security situation prediction results obtained by the prediction model with the actual security incidents. If a misjudgment occurs, optimize the model parameters. If a new threat is not predicted, use the relevant data as a new sample to retrain the model, continuously improve the model's ability to predict new threats, and achieve dynamic adjustment and optimization.

[0006] Among them, to build a multi-source data fusion foundation, it is necessary to first determine the data source and collection channel, including in-depth mining of privacy information system logs, cooperation with external security intelligence platforms, and the use of network monitoring and management tools and user behavior monitoring systems. Then, data cleaning and organization, unify data formats, remove noise and duplicate data, and finally associate and integrate data based on timestamps and entity identifiers to build data fusion tables or data warehouses to provide a comprehensive, accurate and closely related multi-source data foundation for subsequent analysis.

[0007] Among them, the privacy information system logs include database operation logs and transmission protocol logs; the cooperation with the external security intelligence platform includes well-known manufacturer services and industry exchange information; the network monitoring and management tools include traffic monitoring software and equipment management system data; the user behavior monitoring system includes terminal equipment monitoring software, combined with the identity authentication system, and the integration and storage of behavior data.

[0008] Among them, dynamic feature extraction and updating will first extract features based on the data type, and then set feature evaluation indicators, such as information gain and correlation coefficient, regularly evaluate and screen features, remove poor features to reduce dimensionality, and finally, when there are new threats, mine the corresponding new features and include them in the feature set. At the same time, initialize and evaluate the new features, continuously monitor their performance in prediction and adjust them as needed.

[0009] Among them, the hybrid models constructed in the hybrid model include traditional statistical analysis models, machine learning models and deep learning models. The advantages of each model are used to process different data and tasks, and then a weighted average fusion strategy is adopted to determine the initial weights according to the performance of historical data, and adjust the weights in real time. At the same time, integrated learning fusion is used to integrate models of different training data subsets of the same type through bagging, and boosting is used to iteratively train and integrate different types of weak models, so as to improve the accuracy and stability of the overall prediction.

[0010] Among them, in anomaly detection and adaptive learning, we first collect normal user behavior data based on the behavioral baseline to build a distribution model, compare user operations with the baseline in real time, and use sliding window technology to avoid misjudgment. Then we build an intelligence library and scan privacy information related data in real time to match it with external intelligence. Next, we use unsupervised learning to cluster the data and identify anomalies by calculating the distance from the data point to the cluster center.

[0011] Among them, anomaly detection and adaptive learning start the adaptive learning mode after detecting an anomaly, including model parameter adjustment, recalculating the loss function and adjusting parameters based on abnormal data feedback to the artificial intelligence model, adopting an adaptive learning rate strategy, feature update, analyzing abnormal data features and incorporating them into the model, optimizing model fusion strategy, adjusting fusion weights according to the model anomaly detection performance, introducing new models or adjusting structures to enhance the ability to respond to new threats.

[0012] Among them, in the process of real-time monitoring and feedback adjustment, in terms of real-time monitoring, the data collection frequency will first be set according to the system security sensitivity and the speed of data change, and distributed technology will be used to synchronously collect multi-source data. Then, the data will be compressed and encrypted through an efficient transmission protocol and transmitted to the processing center, and stored in a high-speed cache database and a persistent storage database respectively. In the feedback adjustment link, the security situation prediction results of the prediction model will be compared with the actual security incidents. If the prediction is misjudged, the cause will be analyzed and the model parameters will be optimized, such as adjusting the feature selection or the neural network learning rate. If there is an unpredicted new threat, the relevant data will be pre-processed and added to the training set, and the components of the hybrid model will be retrained. At the same time, the external security intelligence library will be updated to improve the model's prediction ability for new threats.

[0013] In summary, due to the adoption of the above technical solution, the beneficial effects of the present invention are: In the present invention, a multi-source data fusion foundation is constructed, dynamic feature extraction and updating is performed, a hybrid model is constructed, anomaly detection and adaptive learning is performed, and real-time monitoring and feedback adjustment are performed. In multi-source data fusion, a variety of internal and external data are integrated to mine associations and risks that cannot be discovered by a single data source. Dynamic feature extraction and updating can extract features according to different data types and timely incorporate new threat features. The hybrid model construction combines the advantages of multiple models and dynamically adjusts weights to overcome the limitations of a single model and improve accuracy and stability. Anomaly detection and adaptive learning can discover new anomalies through multi-dimensional detection, and can automatically adjust model parameters, update features and optimization strategies after detecting anomalies. Real-time monitoring and feedback adjustment can continuously collect data and optimize the model based on the comparison between prediction and actual, ensuring the response to new threats and continuous improvement of the model. The close coordination of each step can make predictions not limited to existing data patterns and trends. For newly emerging threats or attack methods, even if there are no similar records in historical data, predictions and preventions can be performed. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1 A flowchart of the operating steps of the present invention; Figure 2 This is an operational flow chart for constructing the multi-source data fusion basis in the present invention. DETAILED DESCRIPTION

[0015] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0016] Reference Figure 1-Figure 2 , the intelligent prediction method of privacy information storage and transmission security situation includes the following steps: S1. Build a multi-source data fusion foundation, collect various logs from the privacy information system, integrate external security intelligence, use network monitoring tools to capture network-related data, and use user behavior monitoring systems to obtain user operation-related information, clean the collected data, unify the format, and remove duplicates, and associate and integrate them through timestamps and entity identifiers to form a comprehensive and standardized data foundation; S2. Dynamic feature extraction and updating: extract valuable features in real time for different types of data, establish a feature evaluation index system, regularly evaluate existing features, eliminate low-value features, and mine and incorporate new features corresponding to new threats when they emerge, ensuring that the feature set can adapt to changes in security situations; S3. Build a hybrid model, combine various models to form a hybrid model, give full play to their respective advantages to handle different aspects of data and prediction tasks, adopt weighted average fusion and ensemble learning fusion strategies, dynamically adjust weights according to historical performance and real-time conditions of the model, and improve overall prediction accuracy and stability; S4, anomaly detection and adaptive learning, detects anomalies through multi-dimensional methods based on behavioral baseline comparison, external intelligence matching, and unsupervised learning clustering. Once an anomaly is detected, the adaptive learning mechanism begins to operate, adjusting model parameters, updating features, and optimizing model fusion strategies, so that the model can learn new threat patterns and better respond to anomalies; S5. Real-time monitoring and feedback adjustment. Continuously collect various types of data during the transmission process of privacy information storage at an appropriate frequency, and ensure efficient transmission and storage. Compare and analyze the security situation prediction results obtained by the prediction model with the actual security incidents. If a misjudgment occurs, optimize the model parameters. If a new threat is not predicted, use the relevant data as a new sample to retrain the model, continuously improve the model's ability to predict new threats, and achieve dynamic adjustment and optimization.

[0017] Specifically, through the close collaboration of various steps, the intelligent prediction method for the security situation of privacy information storage and transmission is not limited to existing data patterns and trend predictions. It can also predict and prevent emerging threats or attack methods when there are no similar records in historical data. This prediction method can comprehensively use innovative analysis techniques, forward-looking theoretical models, and real-time intelligence collection and integration mechanisms to achieve accurate prediction of new threats and attacks through flexible feature recognition, dynamic model updates, and keen insight into potential risk factors.

[0018] Reference Figure 2 As shown in the figure, to build a multi-source data fusion foundation, it is necessary to first determine the data source and collection channel, including in-depth mining of privacy information system logs, cooperation with external security intelligence platforms, and the use of network monitoring and management tools and user behavior monitoring systems. Then, data cleaning and organization, unified data format, removal of noise and duplicate data, and finally, data association and integration based on timestamps and entity identifiers, to build data fusion tables or data warehouses, to provide a comprehensive, accurate and closely related multi-source data foundation for subsequent analysis. By widely collecting various logs within the privacy information storage and transmission system, external security intelligence, network monitoring, user behavior monitoring and other multi-channel data, and cleaning, associating and integrating them, it provides comprehensive, rich and interrelated basic data support for subsequent dynamic feature extraction, hybrid model construction, anomaly detection and adaptive learning, real-time monitoring and feedback adjustment, etc., to help more accurately grasp the security situation of privacy information storage and transmission.

[0019] Reference Figure 2As shown in Figure 1, the privacy information system log includes database operation log and transmission protocol log. For relational databases, the built-in log query function or special database management tools are used to extract operation records such as data insertion, update, and deletion, and to record in detail the timestamp of the operation, the user account that performs the operation, the data table and fields involved in the operation, and other information. If the system uses a specific transmission protocol, the start and end IP addresses of the transmission can be obtained by analyzing the transport layer log. The information includes the address, the amount of data transmitted, the transmission time, and the error code during the transmission process. Cooperation with external security intelligence platforms includes information exchange between well-known manufacturers and the industry. Companies in the same industry often face similar security challenges. Through such communication activities, they can share their own security incident cases, suspected signs of attacks, and prevention experiences. These manufacturers usually have a global security monitoring network, which can promptly discover emerging security threats and attack methods and provide detailed intelligence reports. Network monitoring and management tools include traffic monitoring software and device management system data. The monitoring software can deeply capture and analyze data packets in the network. By setting filters, it focuses on traffic related to the transmission of privacy information, extracts the source and destination MAC addresses, IP addresses, port numbers, protocol types, data packet content characteristics and other information of the data packet, and the user behavior monitoring system includes terminal device monitoring software, combined with the identity authentication system, and integrates and stores behavior data. The behavior monitoring software is installed on the user's terminal device to record the user's operation behavior sequence. Combined with the identity authentication system, it collects relevant information about user login and access to the privacy information system.

[0020] Reference Figure 1 As shown in the figure, dynamic feature extraction and updating will first extract features based on the data type, then set feature evaluation indicators, such as information gain and correlation coefficient, regularly evaluate and filter features, remove poor features to reduce dimensionality, and finally, when there are new threats, mine the corresponding new features and include them in the feature set. At the same time, initialize and evaluate the new features, continuously monitor their performance in prediction and adjust them as needed.

[0021] The extracted features based on data types include privacy information access log features, network traffic data features, external security intelligence features and user behavior data features. Privacy information access log features refer to extracting access frequency features, calculating the number of visits per unit time, and analyzing their distribution, such as whether there are periodic access peaks or troughs, and then determining access duration features, counting the time spent on each access to privacy information, including the average access duration, the longest access duration and the variance of the access duration, in order to identify abnormal long-term access behaviors, and then analyzing the access source diversity features, recording the number of different source IP addresses that access privacy information and the access ratio of each IP address. Network traffic data features refer to traffic size features, traffic direction features and protocol analysis. Distribution characteristics, traffic size characteristics include total traffic, average traffic, peak traffic and traffic fluctuations. Abnormal traffic peaks may indicate data leakage or attacks. Traffic direction characteristics refer to tracking the starting and ending IP addresses and ports of data transmission, and counting the proportion of traffic in different directions. If a large amount of data flows to unknown or suspicious external addresses, attention should be paid. Protocol distribution characteristics, that is, identifying the usage ratio of different protocols in network traffic. Abnormal use of certain protocols may be related to specific attacks. External security intelligence characteristics include threat type frequency characteristics, threat severity characteristics and vulnerability related characteristics. Threat type frequency characteristics are to count the frequency of occurrence of different types of threats in intelligence. An increase in frequency may mean an increase in related risks. Threat severity characteristics are Based on the threat assessment of intelligence, it is quantified into a numerical value so that its impact weight can be considered in the comprehensive assessment. Vulnerability-related features are used to extract vulnerability information that may be related to the privacy information system. User behavior data features include operation sequence features, operation time features, and permission usage features. The operation sequence feature converts a series of user operations into sequence patterns, and uses sequence pattern mining algorithms to extract frequently occurring normal operation sequences and abnormal operation sequences. The operation time feature analyzes the time pattern of user operations, such as the operation activity during normal working hours, the operation frequency during non-working hours, etc. A large number of operations during non-working hours may be abnormal situations. The permission usage feature counts the frequency and proportion of users using different permissions. Abnormal permission usage upgrades or permission abuse may lead to To solve the security problem, the feature update mechanism includes feature evaluation index setting, regular evaluation and screening, and new feature discovery and inclusion. That is, the information gain index is used to evaluate the ability of features to distinguish normal and abnormal data, and the information entropy in normal and abnormal data is calculated. The larger the information gain, the more effective the feature is in distinguishing the two types of data. Then, the correlation coefficient is used to measure the correlation between the feature and the security situation prediction result. The Pearson correlation coefficient or Spearman correlation coefficient between the feature and the occurrence of known security events or the quantitative indicators of security situation is calculated. Features with high correlation are more valuable in prediction. Then, a regular evaluation cycle is set. During the evaluation, the existing features are sorted according to the above indicators. For features with information gain below the threshold and correlation coefficient close to zero,Consider deleting it from the feature set. When new security threats or attack methods emerge, deeply analyze the relevant data, mine the corresponding new features, perform initial evaluation on the newly included features, and determine their initial information gain and correlation coefficients so that they can be used reasonably in subsequent feature selection and model training. At the same time, continuously monitor the performance of new features in actual predictions, and further adjust the feature set and model parameters according to their effects.

[0022] Reference Figure 1 As shown in the figure, the hybrid model in the construction includes traditional statistical analysis models, machine learning models and deep learning models. The advantages of each model are used to process different data and tasks, and then a weighted average fusion strategy is adopted to determine the initial weights according to the performance of historical data, and adjust the weights in real time. At the same time, integrated learning fusion is used to integrate models of different training data subsets of the same type through bagging, and iterative training and integration of different types of weak models through boosting, so as to improve the accuracy and stability of the overall prediction.

[0023] In detail, bagging and boosting are both ensemble learning methods. Bagging is to obtain multiple different training subsets by sampling the training data set with replacement, and then use these different training subsets to train the same type of basic models respectively. In the prediction stage, the prediction results of these basic models are combined, usually by voting or averaging to get the final prediction result. Because each basic model is trained based on a different training subset, their prediction results will have certain differences. By combining the results of these models with large differences, the overfitting problem of a single model caused by randomness or noise of the data can be reduced, thereby making the integrated model more stable and accurate. The goal of boosting is to combine multiple weak learners into A strong learner will first assign an initial weight to each sample in the training data set, and then use a weak learner to train the data set. After the training is completed, the weight of the sample is adjusted according to the prediction results of the weak learner. For those samples that are incorrectly predicted, their weights will be increased, so that the next weak learner will pay more attention to these difficult-to-learn samples during training. Then, the next weak learner is trained again using the adjusted weights. This is repeated many times to train multiple weak learners. In the prediction stage, the prediction results of these weak learners are combined according to certain weights to obtain the final prediction results. It can focus on samples that are difficult to classify or predict. By continuously adjusting sample weights and iterative training, the model can gradually improve its prediction ability for these complex samples.

[0024] Reference Figure 1As shown in the figure, in anomaly detection and adaptive learning, firstly, based on the behavior baseline, normal user behavior data is collected to build a distribution model, and user operations are compared with the baseline in real time. The sliding window technology is used to avoid misjudgment. Then, an intelligence library is built and the privacy information-related data is scanned in real time to match with external intelligence. Then, unsupervised learning is performed to cluster the data and identify abnormal points by calculating the distance from the data point to the cluster center. In anomaly detection based on the behavior baseline, a user behavior baseline model is established to collect the behavior data of users accessing privacy information under normal circumstances. A behavior distribution model is built through statistical analysis methods. Then, these data are used to calculate statistics such as the mean and variance to determine the range of normal behavior. User behavior is monitored in real time and compared with the baseline. When the user performs an operation, his current behavior characteristics are compared with the behavior baseline in real time. If an employee suddenly logs into the system during non-working hours and downloads a large amount of customer data, which exceeds the standard deviation range of normal behavior, the system will determine it as abnormal behavior. At the same time, the sliding window technology is used to conduct a comprehensive analysis of the behavior within a certain time window to avoid misjudgment due to fluctuations in individual data points. In the external intelligence matching, an external security intelligence library is built to collect security intelligence from network security agencies, industry associations and other channels, including known malware features, network attack patterns, vulnerability information, etc., and organize them into a structured data format for fast query and matching, and real-time scanning and matching. The data in the process of private information storage and transmission is scanned in real time, including network traffic, system logs, etc., and the data features are matched with the information in the external security intelligence library. If a specific port communication mode related to the spread of a known malware is detected in the network traffic, or an abnormal operation record related to a certain vulnerability exploit is found in the system log, the system will determine it as an abnormal situation. Unsupervised learning uses a clustering algorithm to cluster and analyze the private information storage and transmission data, cluster similar data points into one category, and then determine whether the data point belongs to a normal cluster by calculating indicators such as the distance from the data point to the center of each cluster. If a data point is far away from all normal clusters, it is determined to be an abnormal point.

[0025] Reference Figure 1 As shown, anomaly detection and adaptive learning start the adaptive learning mode after detecting an anomaly, including model parameter adjustment, recalculating the loss function and adjusting parameters based on the abnormal data feedback to the artificial intelligence model, adopting an adaptive learning rate strategy, feature update, analyzing the abnormal data features and incorporating them into the model, optimizing the model fusion strategy, adjusting the fusion weight according to the model anomaly detection performance, introducing new models or adjusting the structure to improve the ability to respond to new threats, thereby effectively improving the ability of the entire prediction method to respond to unknown risks and ensuring the security of privacy information storage and transmission.

[0026] Reference Figure 1As shown in the figure, in the process of real-time monitoring and feedback adjustment, in terms of real-time monitoring, the data collection frequency is first set according to the system security sensitivity and the speed of data change, and distributed technology is used to synchronously collect multi-source data. Then, the data is compressed and encrypted through an efficient transmission protocol and transmitted to the processing center, and stored in a cache database and a persistent storage database respectively. In the feedback adjustment link, the security situation prediction results of the prediction model are compared with the actual security events. If the prediction is misjudged, the reasons are analyzed and the model parameters are optimized, such as adjusting the feature selection or the neural network learning rate. If there is a new threat that is not predicted, the relevant data is pre-processed and added to the training set, and the components of the hybrid model are retrained. At the same time, the external security intelligence library is updated to improve the model's prediction ability for new threats. By continuously collecting data, efficiently transmitting and properly storing each link of privacy information storage and transmission, real-time grasp of the security situation is achieved, and the prediction results are compared and analyzed with the actual security events. According to the comparison situation, the model parameters are optimized and the model structure is updated in time, so that the model can better adapt to new threats and dynamically improve the prediction accuracy, thereby effectively ensuring that the storage and transmission of privacy information is always in a reliable and secure state.

[0027] The above are only preferred embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. An intelligent prediction method for the security situation of private information storage and transmission, characterized in that: The following steps are involved: S1. Build a multi-source data fusion foundation, collect various logs from the privacy information system, integrate external security intelligence, use network monitoring tools to capture network-related data, and use user behavior monitoring systems to obtain user operation-related information, clean the collected data, unify the format, and remove duplicates, and associate and integrate them through timestamps and entity identifiers to form a comprehensive and standardized data foundation; S2. Dynamic feature extraction and updating: extract valuable features in real time for different types of data, establish a feature evaluation index system, regularly evaluate existing features, eliminate low-value features, and mine and incorporate new features corresponding to new threats when they emerge, ensuring that the feature set can adapt to changes in security situations; S3. Build a hybrid model, combine various models to form a hybrid model, give full play to their respective advantages to handle different aspects of data and prediction tasks, adopt weighted average fusion and ensemble learning fusion strategies, dynamically adjust weights according to historical performance and real-time conditions of the model, and improve overall prediction accuracy and stability; S4, anomaly detection and adaptive learning, detects anomalies through multi-dimensional methods based on behavioral baseline comparison, external intelligence matching, and unsupervised learning clustering. Once an anomaly is detected, the adaptive learning mechanism begins to operate, adjusting model parameters, updating features, and optimizing model fusion strategies, so that the model can learn new threat patterns and better respond to anomalies; S5. Real-time monitoring and feedback adjustment. Continuously collect various types of data during the transmission process of privacy information storage at an appropriate frequency, and ensure efficient transmission and storage. Compare and analyze the security situation prediction results obtained by the prediction model with the actual security incidents. If a misjudgment occurs, optimize the model parameters. If a new threat is not predicted, use the relevant data as a new sample to retrain the model, continuously improve the model's ability to predict new threats, and achieve dynamic adjustment and optimization.

2. The method for intelligently predicting the security situation of private information storage and transmission according to claim 1, characterized in that: To build a multi-source data fusion foundation, it is necessary to first determine the data source and collection channel, including in-depth mining of privacy information system logs, cooperation with external security intelligence platforms, and the use of network monitoring and management tools and user behavior monitoring systems. Then, data cleaning and organization, unifying data formats, removing noise and duplicate data, and finally associating and integrating data based on timestamps and entity identifiers to build data fusion tables or data warehouses to provide a comprehensive, accurate and closely related multi-source data foundation for subsequent analysis.

3. The method for intelligently predicting the security situation of private information storage and transmission as claimed in claim 2, characterized in that: The privacy information system logs include database operation logs and transmission protocol logs. The cooperation with the external security intelligence platform includes well-known manufacturer services and industry exchange information. The network monitoring and management tools include traffic monitoring software and equipment management system data. The user behavior monitoring system includes terminal equipment monitoring software, combined with the identity authentication system, and integrates and stores behavior data.

4. The method for intelligently predicting the security situation of private information storage and transmission according to claim 1, characterized in that: Dynamic feature extraction and updating will first extract features based on the data type, then set feature evaluation indicators, such as information gain and correlation coefficient, regularly evaluate and filter features, remove poor features to reduce dimensionality, and finally, when there are new threats, mine the corresponding new features and incorporate them into the feature set. At the same time, initialize and evaluate the new features, continuously monitor their performance in prediction and adjust them as needed.

5. The method for intelligently predicting the security situation of private information storage and transmission according to claim 1, characterized in that: The hybrid models in the construction of hybrid models include traditional statistical analysis models, machine learning models and deep learning models. The advantages of each model are used to process different data and tasks, and then a weighted average fusion strategy is adopted to determine the initial weights according to the performance of historical data and adjust the weights in real time. At the same time, integrated learning fusion is used to integrate models of different training data subsets of the same type through bagging, and boosting is used to iteratively train and integrate different types of weak models, so as to improve the accuracy and stability of the overall prediction.

6. The method for intelligently predicting the security situation of private information storage and transmission according to claim 1, characterized in that: In anomaly detection and adaptive learning, we first collect normal user behavior data based on the behavioral baseline to build a distribution model, compare user operations with the baseline in real time, and use sliding window technology to avoid misjudgment. Then we build an intelligence library and scan privacy information-related data in real time to match it with external intelligence. This is followed by unsupervised learning, data clustering, and identifying anomalies by calculating the distance from the data point to the cluster center.

7. The method for intelligently predicting the security situation of private information storage and transmission according to claim 6, characterized in that: Anomaly detection and adaptive learning start the adaptive learning mode after detecting an anomaly, including model parameter adjustment, recalculating the loss function and adjusting parameters based on the abnormal data feedback to the artificial intelligence model, adopting an adaptive learning rate strategy, feature update, analyzing the abnormal data characteristics and incorporating them into the model, optimizing the model fusion strategy, adjusting the fusion weight according to the model anomaly detection performance, introducing new models or adjusting the structure to improve the ability to respond to new threats.

8. The method for intelligently predicting the security situation of private information storage and transmission according to claim 1, characterized in that: In the process of real-time monitoring and feedback adjustment, in terms of real-time monitoring, the data collection frequency is first set according to the system security sensitivity and the speed of data change, and distributed technology is used to synchronously collect multi-source data. The data is then compressed and encrypted through an efficient transmission protocol and transmitted to the processing center, and stored in a high-speed cache database and a persistent storage database respectively. In the feedback adjustment link, the security situation prediction results of the prediction model are compared with the actual security incidents. If the prediction is misjudged, the cause is analyzed and the model parameters are optimized, such as adjusting the feature selection or the neural network learning rate. If there is a new threat that has not been predicted, the relevant data is pre-processed and added to the training set, and the components of the hybrid model are retrained. At the same time, the external security intelligence library is updated to improve the model's prediction ability for new threats.

Images