Data scanning method and device and terminal equipment

Abstract

The invention discloses a data scanning method and device and terminal equipment, and relates to the technical field of data security, and the method comprises the steps: obtaining a scanning instruction; according to the scanning instruction, utilizing a first machine learning model to determine the scanning demand depth of each data area; determining current state information of the terminal equipment; determining a to-be-scanned area according to the state information and the scanning demand depth of each data area; and scanning the to-be-scanned area at the depth corresponding to the scanning demand. Therefore, the occupation of system resources is reduced to the greatest extent while the data security and integrity are ensured, and the use performance of the terminal equipment is improved.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and in particular to a data scanning method, device and terminal equipment. Background Art

[0002] In the field of data processing and management, data scanning is a vital task, which aims to check, verify and update data stored on various storage media (such as hard disks, solid-state drives, and cloud storage, etc.). In the existing technology, data scanning methods often rely on fixed scanning strategies and cycles, and adopt the same scanning method regardless of the importance of the data, the frequency of access, or the storage location. However, with the explosive growth of data volume and the diversification of data types, this "one-size-fits-all" scanning method can no longer meet the needs of modern data management systems. Based on this, it is necessary to explore a more intelligent and flexible data scanning method to ensure data security and integrity while minimizing the occupation of system resources and improving the performance of terminal devices. Summary of the invention

[0003] In view of this, the main purpose of the present invention is to provide a data scanning method, device and terminal device, aiming to ensure data security and integrity while minimizing the occupation of system resources and improving the performance of the terminal device.

[0004] To achieve the above object, the technical solution of the present invention is achieved as follows: An embodiment of the present invention provides a data scanning method, the method comprising: Get scanning instructions; According to the scanning instruction, using a first machine learning model to determine a required scanning depth of each data area; Determine the current status information of the terminal device; Determine the area to be scanned according to the state information and the required scanning depth of each data area; The area to be scanned is scanned at a depth corresponding to the required scanning depth.

[0005] In the above scheme, the method further comprises: Determine a scanning resource ratio of the terminal device according to the state information and the area to be scanned, wherein the scanning resource ratio is: a ratio of resources used by the terminal device for the area to be scanned to total resources of the terminal device; The scanning of the to-be-scanned area at a depth corresponding to the required scanning depth includes: The resources corresponding to the scanning resource ratio are used to perform a scan of the to-be-scanned area at a depth corresponding to the scanning requirement.

[0006] In the above solution, determining the scanning resource ratio of the terminal device according to the status information and the area to be scanned includes: Determining historical scanning data of the area to be scanned according to the area to be scanned; Determine the resource requirement according to the historical scan data of the area to be scanned and a first weight corresponding to the historical scan data, and the state information and a second weight corresponding to the state information; The scanning resource ratio value is determined according to the resource demand and the resource remaining amount indicated by the status information.

[0007] In the above scheme, the method further includes: Predicting the safety level of the area to be scanned and the peak value of the scanning resource demand of the area to be scanned by using a second machine learning model according to the historical scanning data of the area to be scanned and the status information; Determining the first weight according to the safety level of the area to be scanned, wherein the safety level is negatively correlated with the first weight; A second weight is determined according to a peak value of a scanning resource demand of the area to be scanned, wherein the peak value of the scanning resource demand is positively correlated with the second weight.

[0008] In the above scheme, the method further includes: the required scanning depth represents a scanning data range of the data area and / or a scanning degree of the data area, and the required scanning depth includes: a first scanning depth and a second scanning depth, wherein the scanning data range of the data area and / or the scanning degree of the data area represented by the first scanning depth are greater than the scanning data range of the data area and / or the scanning degree of the data area represented by the second depth; The determining of the area to be scanned according to the state information and the required scanning depth of each data area includes: In response to the state information of the terminal device being the first state information, determining, according to the required scanning depth of each data area, that the area to be scanned is a data area corresponding to the first scanning depth; or, In response to the state information of the terminal device being the second state information, the area to be scanned is determined to be the data area corresponding to the second scanning depth according to the scanning requirement depth of each data area, wherein the remaining resource proportion of the terminal device in the first state information is greater than the remaining resource proportion value in the second state information, wherein the remaining resource proportion value is: the ratio of unused resources of the terminal device to the total resources of the terminal device.

[0009] In the above scheme, the method further includes: Obtain historical access information for each data area, as well as historical risk information for each data area; using the data area marked with the historical access information and the historical risk information as data area sample information; The data region sample information is trained to obtain a first machine learning model.

[0010] In the above solution, the data area marked with the historical access information and the historical risk information is used as data area sample information, including: Determine a data region marked with the historical access information and the historical risk information that meets a first condition as a first data region sample, wherein the first condition includes: the number of historical accesses is greater than an access number threshold within a first preset time period, and the number of historical risk prompts is greater than a prompt number threshold within a second preset time period; The data area marked with the historical access information and the historical risk information that meets the second condition is determined as the second data area sample, wherein the second condition includes: the number of historical access times is less than or equal to the access times threshold within the first preset time length, the number of historical risk warnings is less than or equal to the warning times threshold within the second preset time length, and the scanning requirement depth corresponding to the first data area sample is greater than the scanning requirement depth of the second data area sample.

[0011] In the above scheme, the method further includes: Using a third machine learning model, predicting the duration of the status information; Get the data volume of each data area; In response to the state information of the terminal device being the first state information, determining, according to the required scanning depth of each data area, that the area to be scanned is a data area corresponding to the first scanning depth includes: If the first duration is less than the duration threshold, in response to the state information of the terminal device being the first state information, the area to be scanned is determined to be a data area of ​​the first scanning depth and the first scanning priority of the area to be scanned of the scanning depth is determined according to the scanning requirement depth and the data volume of each data area, wherein the data volume of the area to be scanned is negatively correlated with the first scanning priority; or, if the first duration is greater than or equal to the duration threshold, in response to the state information of the terminal device being the first state information, the area to be scanned is determined to be a data area of ​​the first scanning depth and the second scanning priority of the area to be scanned of the first scanning depth is determined according to the scanning requirement depth and the data volume of each data area, wherein the data volume of the area to be scanned is positively correlated with the second scanning priority; or, In response to the state information of the terminal device being the second state information, determining, according to the required scanning depth of each data area, that the area to be scanned is a data area corresponding to the second scanning depth, includes: If the first duration is less than the duration threshold, in response to the status information of the terminal device being the second status information, the area to be scanned is determined to be the data area of ​​the second scanning depth and the third scanning priority of the area to be scanned of the second scanning depth is determined according to the scanning requirement depth and data volume of each data area, wherein the data volume of the area to be scanned is positively correlated with the third scanning priority; or, if the first duration is greater than or equal to the duration threshold, in response to the status information of the terminal device being the second status information, the area to be scanned is determined to be the data area of ​​the second scanning depth and the fourth scanning priority of the area to be scanned of the second scanning depth is determined according to the scanning requirement depth and data volume of each data area, wherein the data volume of the area to be scanned is negatively correlated with the fourth scanning priority.

[0012] In addition, an embodiment of the present invention further provides a data scanning device, the device comprising: A first acquisition module, used for acquiring a scanning instruction; A first determination module, configured to determine a required scanning depth of each data region using a first machine learning model according to the scanning instruction; A second determination module is used to determine the current status information of the terminal device; A third determination module is used to determine the area to be scanned according to the state information and the required scanning depth of each data area; The scanning module is used to perform a scan on the area to be scanned at a depth corresponding to the scanning requirement.

[0013] To achieve the above object, an embodiment of the present invention further provides a terminal device, the terminal device comprising: processor; A memory for storing processor executable instructions; wherein the processor is used to execute the data scanning method as described in any of the above schemes.

[0014] A data scanning method, device and terminal device provided by an embodiment of the present invention, by obtaining a scanning instruction; according to the scanning instruction; according to the scanning instruction, using a first machine learning model to determine the scanning requirement depth of each data area; determining the current state information of the terminal device; determining the area to be scanned according to the state information and the scanning requirement depth of each data area; performing a scan of the corresponding scanning requirement depth on the area to be scanned. Therefore, the embodiment of the present invention can dynamically select the area to be scanned based on the demand side of the scanning requirement depth of each data area combined with the current state information of the terminal device, so that the terminal device can no longer mechanically scan in a fixed order during scanning, but scan the area to be scanned with a scanning requirement depth that is adapted to its current state information. In this way, the scanning efficiency of the terminal device can be improved, the impact on the use of the terminal device itself during the scanning process can be reduced, and the occupation of device resources can be minimized while ensuring data security and integrity, thereby improving the performance of the terminal device and achieving the scanning sensitivity of the terminal device. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 A technical framework diagram of a data security protection product provided for some embodiments of the present invention; Figure 2 A schematic diagram of a flow chart of a data scanning method provided in some embodiments of the present invention; Figure 3 Another schematic flow chart of a data scanning method provided by some embodiments of the present invention; Figure 4 Another schematic flow chart of a data scanning method provided by some embodiments of the present invention; Figure 5 A further flow chart of a data scanning method provided by some embodiments of the present invention; Figure 6 is a schematic diagram of a model architecture of a first machine learning model; Figure 7 A schematic diagram of the structure of a data scanning device provided in some embodiments of the present invention; Figure 8 A schematic diagram of the hardware structure of a terminal device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0016] It should be noted that with the development of enterprise cloud, 5G and industrial Internet, the "digital" office of enterprises and institutions has become a major trend. While "digital" office brings efficient data flow to enterprises, the risks and adjustments brought by data leakage are becoming more and more prominent. Therefore, for enterprises and institutions, how to ensure the data security of office computers in enterprises and institutions is one of the directions worth studying at present.

[0017] Based on this, the present invention provides a set of data security protection products for terminal devices. The product can be installed in the terminal device in the form of a plug-in, or it can be installed in a network platform or network server connected to the terminal device. The data security protection product can ensure the security of the terminal device data.

[0018] Figure 1 It is a technical framework diagram of data security protection products, such as Figure 1 As shown in the figure, data security protection products discover and identify data assets, perform data security detection and protection, and respond to data security operations. In the process of data asset discovery and identification, the data assets of terminal devices will be scanned, network data will be identified, and the hidden information of electronic documents will be deeply perceived. At the same time, data assets will be discovered and data will be classified and graded. In the process of terminal device security detection and protection, the data of terminal devices will be adaptively and intelligently protected. The adaptive protection process includes scanning the data to intelligently identify whether the data needs to be protected, such as intelligent auditing and protection of network data. In the process of data security response and operation, high-performance massive data processing, data security shadow automatic process orchestration, and security situation awareness will be performed.

[0019] The embodiments of the present invention are intended to study data scanning technology in the process of data asset discovery and identification as well as data security detection and protection.

[0020] Figure 2 A schematic diagram of a data scanning method provided by some embodiments of the present invention, such as Figure 2 As shown, an embodiment of the present invention provides a data scanning method, which is applied to a terminal device, and the method includes: Step 201: Obtain a scanning instruction; The terminal device here may be a fixed terminal or a mobile terminal, the fixed terminal may be a desktop computer or an all-in-one computer, and the mobile terminal may be a laptop computer, a tablet computer, or a mobile phone, etc. In some embodiments, the terminal device here may be a terminal device within a certain applicable scope, such as a fixed terminal or a mobile terminal used for office work in a company, etc.

[0021] It should be noted that the scanning instruction may be a scanning request from the user to the terminal device, or a system scheduled task trigger, or an instruction triggered by other trigger conditions, such as an instruction triggered by an outgoing email or outgoing message.

[0022] In some embodiments, the executor of the scanning instruction can also be a content deep scanning platform, which is one of the data security protection products and a front-end platform for ensuring data security and preventing data leakage. For example, when the content deep scanning platform scans data with security risks, it can mark it as data with security risks and perform related operations on the data when the data is received or sent, such as deleting or prohibiting sending and receiving, or prompting risks.

[0023] In some embodiments, the scanning instructions here can be generated based on the scanning initiation strategy within the content deep scanning platform. In some embodiments, the scanning initiation strategy includes generating scanning instructions based on a specific time. The specific time here can include, for example, a certain time after get off work, so as to reduce the scanning of terminal devices during working hours; or generating scanning instructions based on a certain period, and different terminal devices can be used at different periods. The scanning initiation strategy can also include scanning instructions generated based on specific operations. The specific operations here can include, for example, operations such as creating, modifying, deleting data, and changing the location of data storage, so as to generate scanning instructions for the data corresponding to these operations based on these specific operations. Of course, specific operations can also be some operations that are identified as potentially threatening the data security of terminal devices, such as outbound operations, which are not limited here.

[0024] Of course, in some embodiments, the scanning instruction may also be a scanning instruction initiated by the terminal device based on the current scanning demand of the user, for example, the terminal device initiates a scanning instruction based on detecting that the user initiates a scan control.

[0025] It is understandable that the scanning instruction may be generated locally by the terminal device, or may be sent from a server corresponding to the content deep scanning platform, and there is no limitation on this.

[0026] Step 202: According to the scanning instruction, use the first machine learning model to determine the required scanning depth of each data area.

[0027] Here, the first machine learning model can be a pre-trained neural network algorithm model for evaluating the importance or scanning priority of different data areas. In some embodiments, the first machine learning model can be used to predict the security of each data area. For example, the first machine learning model predicts the security or risk of each data area based on various factors such as historical access information, update frequency, and security requirements of each data area. It can be understood that for areas with higher predicted security, only shallow scanning can be performed without wasting computing resources; and for areas with lower predicted security, deep scanning can be used to ensure the security of the data area. It can be understood that in some embodiments, the scanning instruction is used to determine the scanning requirement depth of each data area, including: according to the scanning instruction, the first machine learning model is used to predict the security of each data area; according to the security of each data area, the scanning requirement depth of each data area is determined, wherein the higher the security, the lower the scanning requirement depth.

[0028] It should be understood that the required scanning depth here refers to the depth to which the data area needs to be scanned. It can be understood that if the risk of the data area is high, then the scanning depth of the data area needs to be higher. Conversely, if the risk of the data area is low, then the scanning depth of the data area needs to be lower.

[0029] It should be understood that the first machine learning model determines the security or risk of each data area based on the historical access information of each data area. The historical access information may include but is not limited to the number of reads and writes to the data area, the access time point, the access object, and the combination of the above factors. It is understandable that the more times the data area is read and written, the higher the corresponding risk, and the deeper the corresponding scanning requirement depth is. On the contrary, if the number of reads and writes to the data area is less, the corresponding risk is shallower, and the corresponding scanning requirement depth is shallower. It is understandable that if the access time point to the data area is not within the preset time range, the higher the risk is. For example, if the company's terminal equipment is accessed during non-working hours, such as late at night, there may be a risk of data leakage, indicating that the risk of this access time point is higher, so the corresponding scanning requirement depth is deeper. On the contrary, if it is within the preset range, such as working hours, the risk is lower, and the corresponding scanning requirement depth is shallower. It is understandable that, for a data area, the higher the security level of the access object, that is, the user accessing the data area, the lower the risk of the corresponding data area, and the shallower the corresponding scanning depth is. Conversely, if the security level of the access object is lower, the risk of the corresponding data area is higher, and the corresponding scanning depth is deeper. In some embodiments, for a terminal device within a company, the security level of the access object can be that the company's internal personnel account is higher than the temporary personnel account and higher than the outsourced personnel account, and the company's internal personnel account is further subdivided according to the position level, and the higher the position level, the higher the security of the internal personnel account.

[0030] It should be added that the different scanning depths refer to the different thoroughness of the hard disk data and hardware during the scanning process. The scanning can be performed at different levels as needed. For example, the scanning of the data area here mainly includes the following types:

[0031] Quick scan: This scan is faster and is usually used for daily monitoring of the health of the hard disk. It mainly checks the basic information of the hard disk, such as temperature, usage time, interface type, etc., but does not deeply check all sectors of the hard disk. For example, CrystalDiskInfo is a tool that provides a quick hard disk status check, which can read SMART information to evaluate the health of the hard disk.

[0032] Regular Scan: More in-depth than a quick scan, it checks more sectors of the hard drive to find and repair possible errors. This scan is usually used for regular hard drive maintenance and can detect more problems, but it takes longer.

[0033] Deep Scan: Also called a full scan or long scan, it is a comprehensive health check of the hard drive, including checking all sectors of the hard drive to find bad sectors, errors, and other problems that may affect the performance of the hard drive and data security. This scan is very thorough, but it takes a long time and may have a certain impact on the life of the hard drive. For example, the error scan function of HD Tune Pro can perform a comprehensive physical examination of the hard drive.

[0034] Bad sector scan: Focuses on detecting bad sectors on the hard disk, i.e. sectors that cannot read or write data. Bad sector scan can be used to determine whether the hard disk needs to be replaced or repaired. DiskGenius software can perform hard disk bad sector detection and provides bad sector detection and repair functions.

[0035] Performance test: This type of scan focuses on the performance indicators of the hard disk, such as read and write speed, seek time, etc. They are usually used to evaluate the performance of the hard disk rather than check the health of the hard disk. CrystalDiskMark is a lightweight hard disk performance test tool, which is mainly used to test the continuous and random read and write speeds of the hard disk.

[0036] SMART self-test: Self-Monitoring, Analysis, and Reporting Technology is a hard drive's built-in monitoring technology that reports the hard drive's health. SMART can perform short and long self-tests, with short self-tests quickly confirming whether the disk is faulty, and long self-tests being more thorough but taking longer.

[0037] It can be understood that different scanning depths are suitable for different scenarios and needs. In this embodiment, the first machine learning model is used to determine the scanning requirement depth of each data area, so as to determine different scanning types for different data areas to perform scans of different depths, thereby reducing the waste of scanning resources or insufficient scanning resources caused by using the same scanning depth for all data areas, so as to fully ensure the data security of the data area while ensuring the scanning performance and accuracy of the scan.

[0038] Step 203: Determine the current status information of the terminal device.

[0039] The status information here includes but is not limited to the memory usage of the terminal device, program processing capability, battery power, etc. It is understandable that in the embodiment of the present invention, the status information can be mainly understood as the resource usage of the terminal device, and the resources can be computing resources and / or system resources.

[0040] Step 204: Determine the area to be scanned according to the state information and the required scanning depth of each data area.

[0041] It should be noted that status information is crucial for optimizing the scanning strategy. In the embodiment of the present invention, the current status information of the terminal device can be determined as a reference factor for the scanning priority of each data area. It is understandable that if the current status information of the terminal device is busy, the data area with a shallow scanning demand depth can be scanned first, reducing the current consumption of terminal device resources and improving the performance of the terminal device; on the contrary, if the current status information of the terminal device is idle, the data area with a deep scanning demand depth can be scanned first, thereby fully mobilizing system resources, increasing the scanning speed, and improving the performance of the terminal.

[0042] Step 205: performing a scan on the to-be-scanned area at a depth corresponding to the required scan.

[0043] It should be understood that if the scanning requirement depth corresponding to the area to be scanned is, for example, a deep scan, then scanning the area to be scanned at the corresponding scanning requirement depth can be understood as performing a deep scan on the area to be scanned; if the scanning requirement depth corresponding to the area to be scanned is, for example, a shallow scan, then scanning the area to be scanned at the corresponding scanning requirement depth can be understood as performing a shallow scan on the area to be scanned.

[0044] In this way, the embodiment of the present invention obtains a scanning instruction, and according to the scanning instruction, uses the first machine learning model to determine the scanning requirement depth of each data area; determines the current status information of the terminal device; determines the area to be scanned according to the status information and the scanning requirement depth of each data area, and then performs a scan of the area to be scanned with a corresponding scanning requirement depth, thereby selectively selecting the area to be scanned for priority scanning among multiple data areas according to the current status information, so that the area to be scanned with a scanning requirement depth that is adapted to its current status information can be scanned, which can improve the scanning efficiency of the terminal device while reducing the impact on the use of the terminal device itself during the scanning process, thereby minimizing the occupation of device resources while ensuring data security and integrity, improving the performance of the terminal device, and providing a strong guarantee for achieving the scanning sensitivity of the terminal device.

[0045] In some embodiments, the method further comprises: Determine a scanning resource ratio of the terminal device according to the state information and the area to be scanned, wherein the scanning resource ratio is: a ratio of resources used by the terminal device for the area to be scanned to total resources of the terminal device; The step 205 includes: The resources corresponding to the scanning resource ratio are used to perform a scan of the to-be-scanned area at a depth corresponding to the scanning requirement.

[0046] In this embodiment, while ensuring data security and integrity, the occupation of device resources is minimized to the greatest extent, and the performance of the terminal device is improved. Furthermore, the scanning resource ratio is dynamically determined through status information and the area to be scanned, so that the appropriate scanning resource ratio can be allocated to the scanning task more accurately, thereby reducing the problem of excessive or insufficient resource occupation; and resource allocation is dynamically adjusted according to the scanning resource ratio, ensuring that the scanning task is completed in the most efficient manner with limited resources. By reasonably allocating resources, the impact of the scanning task on other functions of the terminal device is avoided, further ensuring the stability and reliability of the system.

[0047] In some embodiments, see Figure 3 , Figure 3 Another flowchart of a data scanning method provided by some embodiments of the present invention is as follows: Figure 3 As shown, determining the scanning resource ratio value of the terminal device according to the status information and the area to be scanned includes: Step 301: determining historical scanning data of the area to be scanned according to the area to be scanned; Step 302: determining resource requirements according to the historical scan data of the area to be scanned and a first weight corresponding to the historical scan data, and the status information and a second weight corresponding to the status information; Step 303: Determine the scanning resource ratio value according to the resource demand and the remaining resource indicated by the status information.

[0048] It should be noted that during the data scanning process, determining the scanning resource ratio based on the terminal device status information and the area to be scanned is a complex but crucial step. This process is designed to ensure that the scanning task can be completed efficiently without compromising the performance of the terminal device.

[0049] Exemplarily, historical scanning data of the area to be scanned is determined in step 301, where the historical scanning data includes but is not limited to scanning frequency, scanning time, scanning results, etc. In some embodiments, determining the historical scanning data of the area to be scanned according to the area to be scanned includes: retrieving historical scanning records of the area to be scanned from a database; analyzing the historical scanning records to extract key information from the historical scanning records, and obtaining the historical scanning data by analyzing the extracted key information.

[0050] Exemplarily, the resource demand is determined in step 302; the amount of resources that may be required for the current scanning task is evaluated based on the historical scanning data; the first weight of the historical scanning data is used to reflect the stability or predictability of resource demand for past scanning tasks. The status information here includes but is not limited to CPU usage, memory occupancy, battery power, etc.; by analyzing the current status information of the terminal device, the current performance status and available resources of the terminal device are understood, and the second weight of the status information reflects the degree of influence of the current terminal device status on the resource demand evaluation. In this embodiment, the resource demand required for the scanning task is obtained by weighted summing the historical scanning data and the status information according to their respective weights, so that the resource demand required for the scanning task of scanning the area to be scanned can be obtained more accurately, thereby providing a strong basis for the subsequent accurate allocation of resources for the scanning task, and further providing a strong guarantee for ensuring reasonable resource allocation and realizing non-contact scanning.

[0051] Exemplarily, in step 303, the scanning resource ratio is calculated based on the resource demand and the remaining resource indicated by the status information to guide the resource allocation of the scanning task of scanning the area to be scanned. In some embodiments, based on the current status information of the terminal device, the remaining resource amount of the terminal device that can be used for the scanning task is calculated by using real-time monitoring and analysis of the terminal device.

[0052] In this embodiment, by comprehensively considering the historical scanning data of the area to be scanned, the current status information of the terminal device and the corresponding weights, the amount of resources required to scan the area to be scanned can be accurately determined, and the scanning resource ratio value can be calculated accordingly. This provides a scientific basis for resource allocation of scanning tasks, which helps to ensure efficient execution of scanning tasks and stable operation of terminal devices.

[0053] Exemplarily, dynamically adjusting the allocation of scan resources based on historical scan data and status information of the terminal device may include: Collect historical scanning data H, where the historical scanning data H includes but is not limited to scanning time, scanned file type and user access mode, user access times, etc.; Real-time monitoring of the status information S of the terminal device, where the status information S includes but is not limited to the CPU usage, memory usage, storage space usage, and network traffic status of the terminal device; The resource demand is calculated using the weighting coefficients α and β according to the formula R=α*H+β*S, where α is the weighting coefficient of the historical scan data H, i.e., the first weight described in the above embodiment; β is the weighting coefficient of the state information, i.e., the second weight described in the above embodiment; it should be added that, in some embodiments, the values ​​of α and β are dynamically adjusted according to the system importance and real-time demand; According to the resource demand R and the current resource status Ccurrent, determine the scan resource ratio using the formula D=R / (Ccurrent+R); Scanning is performed according to the scanning resource ratio value D to optimize the scanning efficiency.

[0054] In some embodiments, the method may further include: dynamically adjusting the scanning depth of the area to be scanned or the scanning priority of multiple areas to be scanned according to the scanning resource ratio. It is understandable that the scanning resource ratio is positively correlated with the scanning depth; the scanning resource ratio is positively correlated with the priority of the area to be scanned corresponding to the scanning depth, and negatively correlated with the priority of the area to be scanned corresponding to the shallow scanning.

[0055] In some embodiments, the method further comprises: Predicting the safety level of the area to be scanned and the peak value of the scanning resource demand of the area to be scanned by using a second machine learning model according to the historical scanning data of the area to be scanned and the status information; Determining the first weight according to the safety level of the area to be scanned, wherein the safety level is negatively correlated with the first weight; A second weight is determined according to a peak value of a scanning resource demand of the area to be scanned, wherein the peak value of the scanning resource demand is positively correlated with the second weight.

[0056] Exemplarily, a second machine learning model, such as a decision tree or a neural network, is used to predict potential safety hazards and resource demand peaks based on historical scanning data H and status information S; based on the prediction results, the weighting coefficients α and β are dynamically adjusted to adapt to different usage scenarios and safety requirements.

[0057] In some embodiments, the method further includes: the required scanning depth represents a scanning data range of the data area and / or a scanning degree of the data area, the scanning depth includes: a first depth and a second depth, wherein the first scanning depth represents a scanning data range of the data area and / or a scanning degree of the data area that is greater than the scanning data range of the data area and / or a scanning degree of the data area represented by the second scanning depth; The determining of the area to be scanned according to the state information and the required scanning depth of each data area includes: In response to the state information of the terminal device being the first state information, determining, according to the required scanning depth of each data area, that the area to be scanned is a data area corresponding to the first scanning depth; or, In response to the state information of the terminal device being the second state information, the area to be scanned is determined to be the data area corresponding to the second scanning depth according to the scanning requirement depth of each data area, wherein the remaining resource proportion value of the terminal device in the first state information is greater than the remaining resource proportion value in the second state information, wherein the remaining resource proportion value is: the ratio of unused resources of the terminal device to the total resources of the terminal device.

[0058] In fact, it can be understood that the first scanning depth is a deep scan, and the second scanning depth is a shallow scan. The scanning depth here includes but is not limited to the scanning degree and the scanning range. It should be supplemented that the scanning degree refers to the degree of detail of scanning the content of a single file. The greater the scanning degree, the more careful the inspection of the file content, but it does not necessarily involve changes in the number of scanned files; the scanning range refers to the file data or file types covered during the scanning process. The wider the range, the more files or types involved. The first status information here can refer to when the terminal device is idle, or it can be understood as a case where the remaining resource ratio of the terminal device is greater than a certain value, that is, there are enough resources to complete the scanning task. The second status information here can refer to when the terminal device is busy, or it can be understood as a case where the remaining resource ratio of the terminal device is less than or equal to a certain value, that is, there are not enough resources to complete the scanning task.

[0059] In this embodiment, by dividing the data area into a data area of ​​a first scanning depth and a data area of ​​a second scanning depth, for example, the data area can be divided into a data area for deep scanning and a data area for shallow scanning. When the status information of the terminal device indicates that the terminal device is idle, the data area of ​​the first scanning depth, i.e., the data area that needs deep scanning, is scanned, and when the status information of the terminal device indicates that the terminal device is busy, the data area of ​​the second scanning depth, i.e., the data area that needs shallow scanning, is scanned. Exemplarily, the first scanning depth may include full-text scanning, small scanning of documents or emails and / or instant communications, full scanning or partial scanning; and the second scanning depth may include scanning of the title and / or summary of the data. In this embodiment, the scanning requirement depth of each data area is first predicted by the first machine learning model, and then combined with the current status information of the terminal device, so that the scanning strategy currently adapted to the current status information can be dynamically adjusted, including the area to be scanned, so as to be beneficial to the scanning efficiency while also improving the performance of the terminal device and increasing the insensitivity of the scanning.

[0060] It should be added that, in some embodiments, the required scanning depth may include not only the first scanning depth and the second scanning depth, but also a scanning method with multiple different scanning degrees between the first scanning depth and the second scanning depth; the determination of the area to be scanned according to the state information and the required scanning depth of each data area includes: determining the scanning priority of each data area according to the state information and the required scanning depth of each data area; scanning each data area according to the scanning priority. In this way, system resources can be fully utilized to ensure the performance of the terminal device while ensuring data security and integrity.

[0061] In some other embodiments, see Figure 4 ,like Figure 4 As shown, the method also includes: Step 401: Obtain historical access information of each data area and historical risk information of each data area; Step 402: using the data region marked with the historical access information and the historical risk information as data region sample information; Step 403: Train the data region sample information to obtain a first machine learning model.

[0062] In some embodiments, please refer to Figure 5 ,like Figure 5 As shown, the step 402, i.e., taking the data area marked with the historical access information and the historical risk information as data area sample information, includes: Step 4021: Determine a data region marked with the historical access information and the historical risk information that meets a first condition as a first data region sample, wherein the first condition includes: the number of historical accesses is greater than an access number threshold within a first preset time period, and the number of historical risk warnings is greater than a warning number threshold within a second preset time period; Step 4022: Determine the data area marked with the historical access information and the historical risk information that meets the second condition as the second data area sample, wherein the second condition includes: the number of historical access times is less than or equal to the access times threshold within the first preset time length, the number of historical risk warnings is less than or equal to the warning times threshold within the second preset time length, and the scanning requirement depth corresponding to the first data area sample is greater than the scanning requirement depth of the second data area sample.

[0063] In fact, if the data area has a large number of historical accesses, it means that its importance is higher, and the corresponding security detection importance is also higher, so a deeper scan is required; on the contrary, if the data area has a small number of historical accesses, it means that its importance is lower, and the corresponding security detection importance can be lower, so a shallow scan can meet the needs. Similarly, if the data area has a large number of security risk warnings, it means that the security detection importance is higher, so a deeper scan is required; on the contrary, if the data area has a small number of security risk warnings, it means that the security detection importance is lower, so a shallow scan can meet the needs.

[0064] This embodiment trains the data region by constructing a first machine learning model to predict the scanning depth of the data region. Exemplarily, the process of constructing the first machine learning model is: obtain historical access information, specifically, collect historical access records of each data region, which may include access time, access rate, visitor identity, etc.; obtain historical risk information: collect historical risk assessment data of each data region, which may include known vulnerabilities, previous security incidents, data leakage history, etc. Data region sample information: combine historical access information and historical risk information to form sample information of the data region. Training data preparation: pre-process the sample information, including data cleaning, feature selection, feature engineering, etc. First machine learning model training: use the prepared training data to train the model. Model evaluation: evaluate the performance of the model to determine whether it meets the predetermined performance standards. Deploy the model: if the model performance is satisfactory, deploy it to the production environment. Adjust model parameters: if the model performance is not satisfactory, adjust the model parameters or redesign the features, and then return to the training step.

[0065] Exemplarily, in the first machine learning model, the input layer will include feature vectors of historical access information and historical risk information, the hidden layer may include multiple fully connected layers and ReLU activation functions, the output layer will be a binary classifier, for example, using a Sigmoid activation function, and the loss function may be a binary cross entropy loss. Specifically, exemplarily, please refer to Figure 6 , Figure 6 This is a schematic diagram of the model architecture of the first machine learning model, such as Figure 6As shown, input layer: historical access information feature vector and historical risk information feature vector are input into this layer, wherein the historical access information feature vector may include but is not limited to access rating, access timestamp, access source IP, etc., and the historical risk feature information may include but is not limited to risk level, historical vulnerability record, data sensitivity, etc.; hidden layer 1: neurons (fully connected layer), which use activation function: ReLU; hidden layer 2: neurons (fully connected layer), which use activation function: ReLU; hidden layer 3: neurons (fully connected layer), which use activation function: ReLU; output layer: this layer has at least 1 neuron, which is used for binary classification, such as classification for deep scanning or not, and its activation function can be Sigmoid, and the loss function can be binary cross-entropy loss Binary Cross-Enrtopy.

[0066] In this embodiment, by learning and training the historical access information and historical risk information of a large number of data areas, the access information and risk information of the data area can be predicted, so that the security detection level can be determined according to the prediction results, and the scanning requirement depth can be determined according to the security detection level. It can be understood that the security detection level is positively correlated with the scanning requirement depth. In this way, the waste of system resources can be reduced, and the shortage of system resources can be reduced, which can optimize data scanning and improve the performance of terminal devices.

[0067] In some other embodiments, the method further comprises: The method further comprises: Using a third machine learning model, predicting the duration of the status information; Get the data volume of each data area; In response to the state information of the terminal device being the first state information, determining, according to the required scanning depth of each data area, that the area to be scanned is a data area corresponding to the first scanning depth, includes: If the first duration is less than the duration threshold, in response to the state information of the terminal device being the first state information, the area to be scanned is determined to be the data area of ​​the first scanning depth and the first scanning priority of the area to be scanned of the first scanning depth is determined according to the scanning requirement depth and the data volume of each data area, wherein the data volume of the area to be scanned is negatively correlated with the first scanning priority; or, if the first duration is greater than or equal to the duration threshold, in response to the state information of the terminal device being the first state information, the area to be scanned is determined to be the data area of ​​the first scanning depth and the second scanning priority of the area to be scanned of the first scanning depth is determined according to the scanning requirement depth and the data volume of each data area, wherein the data volume of the area to be scanned is positively correlated with the second scanning priority; or, In response to the state information of the terminal device being the second state information, determining, according to the required scanning depth of each data area, that the area to be scanned is a data area corresponding to the second scanning depth, includes: If the first duration is less than the duration threshold, in response to the status information of the terminal device being the second status information, the area to be scanned is determined to be the data area of ​​the second scanning depth and the third scanning priority of the area to be scanned of the second scanning depth is determined according to the scanning requirement depth and data volume of each data area, wherein the data volume of the area to be scanned is positively correlated with the third scanning priority; or, if the first duration is greater than or equal to the duration threshold, in response to the status information of the terminal device being the second status information, the area to be scanned is determined to be the data area of ​​the second scanning depth and the fourth scanning priority of the area to be scanned of the second scanning depth is determined according to the scanning requirement depth and data volume of each data area, wherein the data volume of the area to be scanned is negatively correlated with the fourth scanning priority.

[0068] The third machine learning model here is similar to the first machine learning model, with only the learning samples being different.

[0069] It can be understood that in this embodiment, by predicting the duration of the current status information of the terminal device and the amount of data in each data area, a suitable data area is selected to execute the scanning instruction. Exemplarily, if the idle time of the terminal device is not long enough, a data area with a smaller amount of data can be selected to complete the first scanning depth scanning first, such as completing the deep scanning first; if the idle time of the terminal device is long enough, a data area with a larger amount of data can be selected to complete the first scanning depth scanning first, such as completing the deep scanning first; similarly, if the busy time of the terminal device is not long, a data area with a larger amount of data can be selected to complete the second scanning depth scanning first, such as completing the shallow scanning first, because it can be switched to the idle state of the device immediately, and resources can be freed up to process the scanning of the data area with a larger amount of data; if the busy time of the terminal device will be very long, a data area with a smaller amount of data can be selected to complete the shallow scanning first. In this way, by planning the scanning strategy of the sub-priority for the scanning area of ​​the same priority again, the insensitivity in the scanning process can be further guaranteed, the resources of the terminal device can be fully utilized, and the performance of the terminal device can be improved.

[0070] In other words, in some embodiments, the method further comprises: Using the third machine learning model, predict the duration of the status information; Get the data volume of each data area; The determining of the area to be scanned according to the state information and the required scanning depth of each data area includes: The area to be scanned is determined according to the duration of the state information, the scanning requirement depth of each data area, and the data volume, wherein, when the scanning requirement depth is the same, in the case of the first state information, the duration is positively correlated with the data volume selection, and in the case of the second state information, the duration is negatively correlated with the data volume selection; when the data volume is the same, in the case of the first state information, the duration is positively correlated with the selection of the scanning requirement depth; in the case of the second state information, the duration is negatively correlated with the selection of the scanning requirement depth; the remaining resource ratio of the terminal device in the first state information is greater than the remaining resource ratio in the second state information, wherein the remaining resource ratio is: the ratio of the unused resources of the terminal device to the total resources of the terminal device. In this way, system resources can be fully mobilized while ensuring data security, improving the insensitivity of data scanning, and enhancing the performance of terminal devices.

[0071] To achieve the above purpose, the present invention also provides a data scanning device. Figure 7 , the device comprises: A first acquisition module 71, used to acquire a scanning instruction; A first determination module 72, configured to determine a required scanning depth of each data region using a first machine learning model according to the scanning instruction; A second determination module 73, used to determine the current status information of the terminal device; A third determination module 74 is used to determine the area to be scanned according to the state information and the required scanning depth of each data area; The scanning module 75 is used to perform a scan on the to-be-scanned area at a depth corresponding to a required scan.

[0072] In some embodiments, the apparatus further comprises: A fourth determination module is used to determine a scanning resource ratio of the terminal device according to the state information and the area to be scanned, wherein the scanning resource ratio is: a ratio of resources used by the terminal device for the area to be scanned to total resources of the terminal device; The scanning module 75 is also used for: The resources corresponding to the scanning resource ratio are used to perform a scan of the to-be-scanned area at a depth corresponding to the scanning requirement.

[0073] In some embodiments, the fourth determining module is further configured to: Determining historical scanning data of the area to be scanned according to the area to be scanned; Determine the resource requirement according to the historical scan data of the area to be scanned and a first weight corresponding to the historical scan data, and the state information and a second weight corresponding to the state information; The scanning resource ratio value is determined according to the resource demand and the resource remaining amount indicated by the status information.

[0074] In some embodiments, the apparatus further comprises: A first prediction module, configured to predict the safety level of the area to be scanned and the peak value of the scanning resource demand of the area to be scanned by using a second machine learning model according to the historical scanning data of the area to be scanned and the status information; a fifth determining module, configured to determine the first weight according to a safety level of the area to be scanned, wherein the safety level is negatively correlated with the first weight; The sixth determination module is used to determine a second weight according to a peak value of a scanning resource demand of the area to be scanned, wherein the peak value of the scanning resource demand is positively correlated with the second weight.

[0075] In some embodiments, the required scanning depth represents a scanning data range of the data area and / or a scanning degree of the data area, and the required scanning depth includes: a first scanning depth and a second scanning depth, wherein the scanning data range of the data area and / or the scanning degree of the data area represented by the first scanning depth are both greater than the scanning data range of the data area and / or the scanning degree of the data area represented by the second scanning depth; The third determining module 74 is further configured to: In response to the state information of the terminal device being the first state information, determining, according to the required scanning depth of each data area, that the area to be scanned is a data area corresponding to the first scanning depth; or, In response to the state information of the terminal device being the second state information, the area to be scanned is determined to be the data area corresponding to the second scanning depth according to the scanning requirement depth of each data area, wherein the remaining resource proportion value of the terminal device in the first state information is greater than the remaining resource proportion value in the second state information, wherein the remaining resource proportion value is: the ratio of unused resources of the terminal device to the total resources of the terminal device.

[0076] In some embodiments, the apparatus further comprises: A first acquisition module is used to acquire historical access information of each data area and historical risk information of each data area; as a module, used to use a data area marked with the historical access information and the historical risk information as data area sample information; A module is obtained, which is used to train the data area sample information to obtain the first machine learning model.

[0077] In some embodiments, the module is further used to: Determine a data area marked with the historical access information and the historical risk information that meets a first condition as a first data area sample, wherein the first condition includes: the number of historical accesses is greater than an access number threshold within a first preset time period, and the number of historical risk warnings is greater than a warning number threshold within a second preset time period; The data area marked with the historical access information and the historical risk information that meets the second condition is determined as the second data area sample, wherein the second condition includes: the number of historical access times is less than or equal to the access times threshold within the first preset time length, the number of historical risk warnings is less than or equal to the warning times threshold within the second preset time length, and the scanning requirement depth corresponding to the first data area sample is greater than the scanning requirement depth of the second data area sample.

[0078] In some embodiments, the apparatus further comprises: A second prediction module is used to predict the duration of the state information by using a third machine learning model; The second acquisition module is used to acquire the data volume of each data area; The third determining module 74 is further used for: If the first duration is less than the duration threshold, in response to the state information of the terminal device being the first state information, the area to be scanned is determined to be the data area of ​​the first scanning depth and the first scanning priority of the area to be scanned of the first scanning depth is determined according to the scanning requirement depth and the data volume of each data area, wherein the data volume of the area to be scanned is negatively correlated with the first scanning priority; or, if the first duration is greater than or equal to the duration threshold, in response to the state information of the terminal device being the first state information, the area to be scanned is determined to be the data area of ​​the first scanning depth and the second scanning priority of the area to be scanned of the first scanning depth is determined according to the scanning requirement depth and the data volume of each data area, wherein the data volume of the area to be scanned is positively correlated with the second scanning priority; or, If the first duration is less than the duration threshold, in response to the status information of the terminal device being the second status information, the area to be scanned is determined to be the data area of ​​the second scanning depth and the third scanning priority of the area to be scanned of the second scanning depth is determined according to the scanning requirement depth and data volume of each data area, wherein the data volume of the area to be scanned is positively correlated with the third scanning priority; or, if the first duration is greater than or equal to the duration threshold, in response to the status information of the terminal device being the second status information, the area to be scanned is determined to be the data area of ​​the second scanning depth and the fourth scanning priority of the area to be scanned of the second scanning depth is determined according to the scanning requirement depth and data volume of each data area, wherein the data volume of the area to be scanned is negatively correlated with the fourth scanning priority.

[0079] It should be noted that the description of the above data scanning device is similar to the description of the above data scanning method, and the beneficial effects of the same method are not described in detail. For technical details not disclosed in the data scanning device embodiment of the present invention, please refer to the description of the data scanning method embodiment of the present invention.

[0080] To achieve the above object, an embodiment of the present invention further provides a terminal device, such as Figure 7 As shown, the terminal device includes a processor 801 and a memory 802 connected to the processor 801 via a communication bus 803; wherein the memory 802 is used for a data scanning program; and the processor 801 is used to execute the data scanning program to implement the data scanning method described in any of the above schemes.

[0081] Optionally, the processor 801 may be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. Here, the program executed by the processor 801 may be stored in a memory 802 connected to the processor 801 via a communication bus 803, and the memory 802 may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a magnetic random access memory (FRAM), a flash memory, a magnetic surface memory, an optical disc, or a compact disc read-only memory (CD-ROM); the magnetic surface memory can be a disk memory or a tape memory. The volatile memory can be a random access memory (RAM), which is used as an external cache.By way of example but not limitation, many forms of RAM are available, such as static random access memory (SRAM), synchronous static random access memory (SSRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), direct memory bus random access memory (DRRAM). The memory 802 described in the embodiment of the present invention is intended to include but is not limited to these and any other suitable types of memory 802. The memory 802 in the embodiment of the present invention is used to store various types of data to support the operation of the processor 801. Examples of such data include: any computer program operated by the processor 801, such as an operating system and application programs; contact data; phone book data; messages; pictures; videos, etc. Among them, the operating system includes various system programs, such as a framework layer, a core library layer, a driver layer, etc., which are used to implement various basic services and process hardware-based tasks.

[0082] In some embodiments, the memory 802 in the embodiments of the present invention may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct memory bus random access memory (DRRAM). The memory 802 of the systems and methods described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0083] The processor 801 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit or software instructions in the processor 801. The above processor 801 may be a general processor, a digital signal processor (Digital Signal Processor, DSP), an application specific integrated circuit (Application Specific Integrated Circuit, ASIC), a field programmable gate array (Field Programmable Gate Array, FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present invention can be implemented or executed. The general processor may be a microprocessor or the processor may also be any conventional processor, etc. The steps of the method disclosed in the embodiment of the present invention can be directly embodied as a hardware decoding processor to be executed, or the hardware and software modules in the decoding processor are combined to be executed. The software module can be located in a mature storage medium in the field such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory 802, and the processor 801 reads the information in the memory 802 and completes the steps of the above method in combination with its hardware. In some embodiments, the embodiments described herein may be implemented in hardware, software, firmware, middleware, microcode, or a combination thereof. For hardware implementation, the processing unit may be implemented in one or more application specific integrated circuits (ASIC), digital signal processors (DSP), digital signal processing devices (DSPD), programmable logic devices (PLD), field programmable gate arrays (FPGA), general purpose processors, controllers, microcontrollers, microprocessors, other electronic units for performing the functions described in the present application, or a combination thereof.

[0084] For software implementation, the techniques described herein can be implemented by modules (e.g., procedures, functions, etc.) that perform the functions described herein. The software code can be stored in a memory and executed by a processor. The memory can be implemented in the processor or outside the processor.

[0085] Another embodiment of the present invention provides a computer storage medium, the computer readable storage medium stores an executable program, and when the executable program is executed by the processor 801, the steps of the data scanning method applied to the terminal device can be implemented. Figure 2-Figure 5 One or more of the methods shown.

[0086] In some embodiments, the computer storage medium may include: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and other media that can store program codes.

[0087] It should be noted that the technical solutions described in the embodiments of the present invention can be combined arbitrarily without conflict.

[0088] The above description is only a preferred embodiment of the present invention and is not intended to limit the protection scope of the present invention.

Claims

1. A data scanning method, characterized in that: The method comprises: Get scanning instructions; According to the scanning instruction, using a first machine learning model to determine a required scanning depth of each data area; Determine the current status information of the terminal device; Determine the area to be scanned according to the state information and the required scanning depth of each data area; The area to be scanned is scanned at a depth corresponding to the required scanning depth.

2. The method according to claim 1, characterized in that The method further comprises: Determine a scanning resource ratio of the terminal device according to the state information and the area to be scanned, wherein the scanning resource ratio is: a ratio of resources used by the terminal device for the area to be scanned to total resources of the terminal device; The scanning of the to-be-scanned area at a depth corresponding to the required scanning depth includes: The resources corresponding to the scanning resource ratio are used to perform a scan of the to-be-scanned area at a depth corresponding to the scanning requirement.

3. The method according to claim 2, characterized in that The determining, according to the state information and the area to be scanned, a scanning resource proportion value of the terminal device includes: Determining historical scanning data of the area to be scanned according to the area to be scanned; Determine the resource requirement according to the historical scan data of the area to be scanned and a first weight corresponding to the historical scan data, and the state information and a second weight corresponding to the state information; The scanning resource ratio value is determined according to the resource demand and the resource remaining amount indicated by the status information.

4. The method according to claim 3, characterized in that The method further comprises: Predicting the safety level of the area to be scanned and the peak value of the scanning resource demand of the area to be scanned by using a second machine learning model according to the historical scanning data of the area to be scanned and the status information; Determining the first weight according to the safety level of the area to be scanned, wherein the safety level is negatively correlated with the first weight; A second weight is determined according to a peak value of a scanning resource demand of the area to be scanned, wherein the peak value of the scanning resource demand is positively correlated with the second weight.

5. The method according to claim 1, characterized in that The required scanning depth represents a scanning data range of the data area and / or a scanning degree of the data area, and the required scanning depth includes: a first scanning depth and a second scanning depth, wherein the scanning data range of the data area and / or the scanning degree of the data area represented by the first scanning depth are both greater than the scanning data range of the data area and / or the scanning degree of the data area represented by the second scanning depth; The determining of the area to be scanned according to the state information and the required scanning depth of each data area includes: In response to the state information of the terminal device being the first state information, determining, according to the required scanning depth of each data area, that the area to be scanned is a data area corresponding to the first scanning depth; or, In response to the state information of the terminal device being the second state information, the area to be scanned is determined to be the data area corresponding to the second scanning depth according to the scanning requirement depth of each data area, wherein the remaining resource proportion value of the terminal device in the first state information is greater than the remaining resource proportion value in the second state information, wherein the remaining resource proportion value is: the ratio of unused resources of the terminal device to the total resources of the terminal device.

6. The method according to claim 2, characterized in that The method further comprises: Obtain historical access information for each data area, as well as historical risk information for each data area; using the data area marked with the historical access information and the historical risk information as data area sample information; The data region sample information is trained to obtain the first machine learning model.

7. The method according to claim 6, characterized in that The step of identifying the data area with the historical access information and the historical risk information as data area sample information includes: Determine a data region marked with the historical access information and the historical risk information that meets a first condition as a first data region sample, wherein the first condition includes: the number of historical accesses is greater than an access number threshold within a first preset time period, and the number of historical risk prompts is greater than a prompt number threshold within a second preset time period; The data area marked with the historical access information and the historical risk information that meets the second condition is determined as the second data area sample, wherein the second condition includes: the number of historical access times is less than or equal to the access times threshold within the first preset time length, the number of historical risk warnings is less than or equal to the warning times threshold within the second preset time length, and the scanning requirement depth corresponding to the first data area sample is greater than the scanning requirement depth of the second data area sample.

8. The method according to claim 5, characterized in that The method further comprises: Predicting a first duration of the status information using a third machine learning model; Get the data volume of each data area; In response to the state information of the terminal device being the first state information, determining, according to the required scanning depth of each data area, that the area to be scanned is a data area corresponding to the first scanning depth, includes: If the first duration is less than the duration threshold, in response to the state information of the terminal device being the first state information, the area to be scanned is determined to be the data area of ​​the first scanning depth and the first scanning priority of the area to be scanned of the first scanning depth is determined according to the scanning requirement depth and the data volume of each data area, wherein the data volume of the area to be scanned is negatively correlated with the first scanning priority; or, if the first duration is greater than or equal to the duration threshold, in response to the state information of the terminal device being the first state information, the area to be scanned is determined to be the data area of ​​the first scanning depth and the second scanning priority of the area to be scanned of the first scanning depth is determined according to the scanning requirement depth and the data volume of each data area, wherein the data volume of the area to be scanned is positively correlated with the second scanning priority; or, In response to the state information of the terminal device being the second state information, determining, according to the required scanning depth of each data area, that the area to be scanned is a data area corresponding to the second scanning depth, includes: If the first duration is less than the duration threshold, in response to the status information of the terminal device being the second status information, the area to be scanned is determined to be the data area of ​​the second scanning depth and the third scanning priority of the area to be scanned of the second scanning depth is determined according to the scanning requirement depth and data volume of each data area, wherein the data volume of the area to be scanned is positively correlated with the third scanning priority; or, if the first duration is greater than or equal to the duration threshold, in response to the status information of the terminal device being the second status information, the area to be scanned is determined to be the data area of ​​the second scanning depth and the fourth scanning priority of the area to be scanned of the second scanning depth is determined according to the scanning requirement depth and data volume of each data area, wherein the data volume of the area to be scanned is negatively correlated with the fourth scanning priority.

9. A data scanning device, characterized in that: The device comprises: A first acquisition module, used for acquiring a scanning instruction; A first determination module, configured to determine a required scanning depth of each data region using a first machine learning model according to the scanning instruction; A second determination module is used to determine the current status information of the terminal device; A third determination module is used to determine the area to be scanned according to the state information and the required scanning depth of each data area; The scanning module is used to perform a scan on the area to be scanned at a depth corresponding to the scanning requirement.

10. A terminal device, characterized in that: include: processor; a memory for storing processor-executable instructions; Wherein, the processor is used to execute the data scanning method as described in any one of claims 1 to 8.

Images