Internal Security Detection Method for Federated Learning and Privacy Computing

Abstract

The present invention provides an internal security detection method for federated learning and privacy computing, which relates to the field of data security. The present invention obtains multi-source packets to be detected corresponding to a target scenario, performs data connection on the multi-source packets to be detected to generate data samples to be detected, and obtains data features and user features corresponding to the data samples to be detected. Based on federated learning, a target data training model is set up, and according to the data features and user features, a target data model corresponding to the data samples to be detected is obtained, and then target packets are obtained. Data mining is performed on the target packets to obtain security target data. A data encryption training mechanism is set up to perform encrypted training on the security target data to obtain encrypted target data. An encrypted target data model is established according to the encrypted target data, and then abnormal behaviors are obtained. The present invention improves internal security.

Description

Technical Field

[0001] The present invention relates to the field of data security, and specifically to an internal security detection method for federated learning and privacy computing. Background Art

[0002] Federated learning refers to a machine learning framework that can effectively help multiple institutions to use data and perform machine learning modeling while meeting the requirements of user privacy protection, data security, and government regulations;

[0003] Privacy computing refers to a set of technologies that enable data analysis and computing on the premise of protecting the data itself from external leakage, achieving the goal of "usable but invisible" for data; and realizing the transformation and release of data value on the premise of fully protecting data and privacy security;

[0004] In the prior art, even the realization of centralized integration of data among different departments within the same company faces numerous obstacles. Restricted by data privacy and security constraints such as laws and regulations, policy supervision, trade secrets, and personal privacy, multiple data source parties cannot directly exchange data, resulting in the phenomenon of "data islands", which restricts the further improvement of the capabilities of artificial intelligence models; so in reality, it is almost impossible to integrate data scattered in different places and institutions, and thus the following problems will occur in the internal security detection process: First, if the internal data cannot be fully integrated, it is impossible to conduct a full security detection on the internal data; Second, if there are external intrusion data and malicious behaviors during the security detection of internal data, it will cause the leakage of internal data; Therefore, an internal security detection method for federated learning and privacy computing is provided to solve the above problems. Summary of the Invention

[0005] To solve the above technical problems, the present invention provides an internal security detection method for federated learning and privacy computing;

[0006] The purpose of the present invention can be achieved by the following technical solutions: An internal security detection method for federated learning and privacy computing, the method comprising the following steps:

[0007] Step 1: Obtain multi-source packets to be detected corresponding to a target scenario, perform data connection on the multi-source packets to be detected to generate a data sample to be detected, and obtain the data features and user features corresponding to the data sample to be detected;

[0008] Step 2: Set up a target data training model based on federated learning, obtain the target data model corresponding to the data sample to be detected according to the data features and user features, and then obtain a target packet, and perform data mining on the target packet to obtain security target data;

[0009] Step 3: Set up a data encryption training mechanism to perform encrypted training on the security target data, obtain encrypted target data, establish an encrypted target data model based on the encrypted target data, and further obtain abnormal behaviors.

[0010] Further, the generation process of the data sample to be detected includes:

[0011] Obtain all target departments corresponding to the target venue, and assign non-repeating numbers to the target departments, denoted as i, where i is a natural number greater than 2; sequentially obtain the data packets to be detected corresponding to the target departments according to the number order; and align and arrange the data packets to be detected according to the number order to obtain multi-source data packets to be detected.

[0012] Encode the multi-source data packets to be detected according to the target venue, denoted as venue D, where D is a positive integer.

[0013] Obtain the number of target venues according to the encoding, and further process the multi-source data packets to be detected according to the number of target venues. The target venues include 1 or n; where n is a natural number greater than 1.

[0014] If there is 1 target venue, set up a sub-data chain, and sequentially connect the data packets to be detected of 1 multi-source data packet to be detected through the sub-data chain according to the number order to generate multiple data samples to be detected.

[0015] If there are n target venues, set up a data chain, and connect the multiple data samples to be detected corresponding to the n multi-source data packets to be detected through the data chain to generate a single data sample to be detected.

[0016] The data samples to be detected include multiple data samples to be detected and single data samples to be detected.

[0017] Further, the acquisition process of the data features and user features includes:

[0018] Obtain the data features and user features corresponding to the data packets to be detected in the target departments corresponding to the target venue.

[0019] Mark the obtained data features and user features. Mark the data features as venue ; Mark the user features as venue ; where represents the data features corresponding to the data packets to be detected in the target department i in the target venue D; represents the user features corresponding to the data packets to be detected in the target department i in the target venue D;

[0020] Further, the generation process of the target data model includes:

[0021] Set a sample training unit and a data mining unit in the target data training model. The sample training unit is used to perform data training on the data samples to be detected; the data mining unit is used to perform data mining on the target data.

[0022] The sample training unit trains two adjacent data packets to be detected connected by a sub-data chain in multiple data samples to be detected, obtains the corresponding data feature set and user feature set of the two adjacent data packets to be detected; and marks them respectively as and ; where Q and P represent the numbers corresponding to Q data features and P user features included in the data packet to be detected.

[0023] The target data training model set based on federated learning will aggregate the data packets to be detected from different sources according to the data features and user features, and then perform federated learning according to the size of the overlapping part of the data features and user features; if the data features have a large overlapping part and the user features have a small overlapping part, then perform horizontal federated learning to increase the total amount of data samples to be detected. If the data features have a small overlapping part and the user features have a large overlapping part, then perform vertical federated learning to increase the dimension of the data samples to be detected; if the data features and the user features both have a small overlapping part, then perform transfer federated learning.

[0024] Train two adjacent data packets to be detected according to the data feature set and user feature set, and then generate target training data packets; similarly, continue to perform data training on target training data, generate target training data packets, and so on, until 1 target training data packet is generated, then stop training and generate the corresponding target data model.

[0025] Furthermore, the process of obtaining the target data packet includes:

[0026] Send the single data sample to be detected to the target data model to generate n target training data packets. Similarly, continue to perform data training on the n target training data packets until 1 target training data packet is generated, then stop training and mark it as the target data packet.

[0027] Furthermore, the process of obtaining the secure target data includes:

[0028] Obtain all target data in the target data packet; based on federated learning, set the standard parameter conversion criterion in the data mining unit, send the target data packet to the data mining unit, and perform parameter conversion on the target data in the target data packet according to the standard parameter conversion criterion to generate target parameters, and then determine whether the target parameters meet the standard parameter conversion criterion;

[0029] If the target parameters meet the standard parameter conversion criterion, mark the corresponding target data as secure target data;

[0030] Otherwise, mark the corresponding target data as abnormal target data; and set an abnormal behavior recycle bin in the data mining unit, and send the abnormal target data to the abnormal behavior recycle bin for storage.

[0031] Further, the process of obtaining the encrypted target data includes:

[0032] The data encryption training mechanism is used to set a number of noise nodes in the secure target data, and the noise nodes are used to add noise to the secure target data;

[0033] Obtain the privacy target data corresponding to the secure target data, add noise nodes to the privacy target data, and then generate encrypted target data;

[0034] Generate a corresponding noise digital signature for the noise node corresponding to the encrypted target data, obtain the private key corresponding to the noise digital signature, and then connect the noise digital signature and the corresponding private key for data connection to generate a noise node database;

[0035] Set up a data encryption chain for connecting the encrypted target data in pairs to generate an encrypted target data model;

[0036] Set up an interaction node in the data encryption chain for data interaction of the encrypted target data, and obtain the interaction account corresponding to the interactors who perform data interaction.

[0037] Further, the process of obtaining the abnormal behavior includes:

[0038] Establish a data trust model, wirelessly communicate with the encrypted target data model, and pre-store the interactor's authorized account in the data trust model for detecting the trust level of the interactor;

[0039] The interactor enters the encrypted target data model through the interaction node for data interaction. The interaction node obtains the interaction account corresponding to the interactor and sends the interaction account to the data trust model for interaction account detection to determine whether it is an authorized account;

[0040] If the interactive account matches the pre-stored authorized account of the interactant successfully, it is marked as the authorized account, and the corresponding interactant data interaction behavior is marked as the authorized behavior;

[0041] Otherwise, an abnormal behavior is generated;

[0042] The interactant enters the encrypted target model for data interaction, obtains the encrypted target data, and matches the private key with a number of noise digital signatures corresponding to the encrypted target data according to the noise node database;

[0043] If the match is successful, it is marked as the authorized behavior, and then the noise digital signature is decrypted to obtain the privacy target data corresponding to the noise digital signature;

[0044] Otherwise, an abnormal behavior is generated;

[0045] The trustworthiness of the interactant's authorized account in the data trust model is detected according to the authorized behavior and the abnormal behavior to obtain the trust score;

[0046] One point is added for the authorized behavior and one point is deducted for the abnormal behavior. If the trust score of the interactant's account is less than three points, the interactant's account is removed from the data trust model, and then the encrypted target data in the encrypted target model cannot be interacted with continuously. Therefore, it is necessary to pre-store the interactive authorized account in the data trust model again.

[0047] Compared with the prior art, the beneficial effects of the present invention are:

[0048] 1. The present invention classifies and detects the data samples to be detected by obtaining the data samples to be detected; the data packet to be detected obtained from a single target location is split to generate multiple data samples to be detected, and the data to be detected in the data packet to be detected in a single target location is more accurately detected for security; the multi-source data packets to be detected obtained from multiple target locations are connected and merged to generate a single data sample to be detected, and the multi-source data packets to be detected obtained from multiple target locations are more conveniently detected for security, reducing the detection time and improving the detection efficiency;

[0049] 2. Based on federated learning, a target data training model is set up, and the target data model corresponding to the data sample to be detected is obtained according to the data characteristics and user characteristics, and then the target data packet is obtained, and data mining is performed on the target data packet to obtain the secure target data. It is not possible to determine that all the target data packets obtained from the target location are secure target data. Therefore, based on federated learning, it is converted into standard data parameters, and then it is judged whether the obtained target data packet is an abnormal target data, and the abnormal target data is removed, which further ensures the security of the data; Description of the Drawings

[0050] To more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the accompanying drawings required in the embodiments. Obviously, the accompanying drawings described below are only some embodiments recorded in the present invention. For those of ordinary skill in the art, other accompanying drawings can also be obtained based on these drawings.

[0051] Figure 1 It is a flowchart of the present invention. Detailed implementation manners

[0052] To more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the accompanying drawings required in the embodiments. Obviously, the accompanying drawings described below are only some embodiments recorded in the present invention. For those of ordinary skill in the art, other accompanying drawings can also be obtained based on these drawings.

[0053] As Figure 1 shown, an internal security detection method for federated learning and privacy computing, the method includes the following steps:

[0054] Step 1: Obtain multi-source data packets to be detected corresponding to the target scenario, perform data connection on the multi-source data packets to be detected to generate data samples to be detected, and obtain the data features and user features corresponding to the data samples to be detected;

[0055] Step 2: Set up a target data training model based on federated learning, obtain the target data model corresponding to the data samples to be detected according to the data features and user features, and then obtain the target data, and perform data mining on the target data to obtain security target data;

[0056] Step 3: Set up a data encryption training mechanism, perform encryption training on the security target data to obtain encrypted target data, establish an encrypted target data model according to the encrypted target data, and then obtain abnormal behaviors;

[0057] In step 1, the generation process of the data samples to be detected includes:

[0058] The target venue is used to represent the venue that requires internal security detection, including but not limited to hospitals, schools, enterprises, etc.;

[0059] Obtain all target departments corresponding to the target venue, and assign non-repeating numbers to the target departments, denoted as i, where i is a natural number greater than 2; sequentially obtain the data packets to be detected corresponding to the target departments according to the number order; and align and arrange the data packets to be detected according to the number order to obtain multi-source data packets to be detected;

[0060] It should be further noted that in a specific embodiment, the target department is included in the target location. For example, if the target location is a school, the target department includes, but is not limited to, colleges, classes, offices, etc.

[0061] Encode the multi-source data packets to be detected according to the target location, denoted as location D, where D is a positive integer.

[0062] Obtain the number of target locations based on the encoding, and then process the multi-source data packets to be detected according to the number of target locations. The target location includes 1 or n; where n is a natural number greater than 1.

[0063] If the target location is 1, set up a sub-data chain, and connect the data packets to be detected in sequence through the sub-data chain according to the serial number order of 1 multi-source data packet to be detected, generating multiple data samples to be detected.

[0064] If the target location is n, set up a data chain, and connect the multiple data samples to be detected corresponding to the n multi-source data packets to be detected through the data chain, generating a single data sample to be detected.

[0065] The data samples to be detected include multiple data samples to be detected and single data samples to be detected.

[0066] In one embodiment, split the data packets to be detected obtained from a single target location to generate multiple data samples to be detected, and perform security detection on the data to be detected in the data packets to be detected in a single target location more precisely; connect and merge the multi-source data packets to be detected obtained from multiple target locations to generate a single data sample to be detected, and perform security detection on the multi-source data packets to be detected obtained from multiple target locations more conveniently, reducing the detection time and improving the detection efficiency.

[0067] It should be noted that in a specific embodiment, the data samples to be detected have different data, and the included feature data, annotation data, and user features are different. It is impossible to directly merge all the data samples to be detected. Moreover, due to constraints on data privacy and security such as laws and regulations, policy supervision, business secrets, and personal privacy, multiple data source parties cannot directly exchange data. Federated learning includes horizontal federated learning, vertical federated learning, and transfer federated learning. Based on federated learning, integrate and exchange the multi-source data packets to be detected, and then complete the security detection of the data samples to be detected.

[0068] The process of obtaining the data features and user features corresponding to the data samples to be detected includes:

[0069] Mark the obtained data features and user features, and mark the data features as location ; Mark the user features as location ; wherein, represents the data feature corresponding to the data packet to be detected for the target department i in the target venue D; represents the user feature corresponding to the data packet to be detected for the target department i in the target venue D;

[0070] In step two: the generation process of the target data model includes:

[0071] Set a sample training unit and a data mining unit in the target data training model. The sample training unit is used to perform data training on the data samples to be detected; the data mining unit is used to perform data mining on the target data;

[0072] The sample training unit trains two adjacent data packets to be detected connected by a sub-data chain in multiple data samples to be detected, obtains the data feature set and the corresponding user feature set corresponding to the two adjacent data packets to be detected, and marks them respectively as and ; wherein, Q and P represent the numbers corresponding to Q data features and the numbers corresponding to P user features included in the data packet to be detected;

[0073] Train two adjacent data packets to be detected according to the data feature set and the user feature set, and then generate target training data packets; similarly, perform data training on target training data again to generate target training data packets, and so on, until 1 target training data packet is generated and then stop training, and record it as the target data packet, and then generate the corresponding target data model;

[0074] In one embodiment, it should be further noted that the target data training model based on federated learning will perform data aggregation on the data packets to be detected from different sources according to the data features and user features, and then perform federated learning according to the size of the overlapping part of the data features and user features; if the data feature has a large overlapping part and the user feature has a small overlapping part, then perform horizontal federated learning to increase the total amount of data samples to be detected. If the data feature has a small overlapping part and the user feature has a large overlapping part, then perform vertical federated learning to increase the dimension of the data samples to be detected; if the data feature and the user feature both have small overlapping parts, then perform transfer federated learning;

[0075] However, it should be further noted that in the federated learning, the data samples to be detected are directly used to generate a data model. In the present invention, based on the federated learning, the data samples to be detected are used to generate a target data model, which improves the accuracy and quality while increasing the total amount and dimension of the data samples to be detected.

[0076] The process of obtaining the target data includes:

[0077] Send the single data sample to be detected to the target data model to generate n target data models. Similarly, perform re-data training on the n target data models until 1 target training data packet is generated and then stop the training, and record it as the target data packet.

[0078] The process of obtaining the abnormal target data includes:

[0079] Obtain all the target data in the target data packet; based on the federated learning, set the standard parameter conversion criterion in the data mining unit, send the target data packet to the data mining unit, and perform parameter conversion on the target data in the target data packet according to the standard parameter conversion criterion to generate target parameters, and then judge whether the target parameters conform to the standard parameter conversion criterion.

[0080] If the target parameters conform to the standard parameter conversion criterion, mark the corresponding target data as safe target data.

[0081] Otherwise, mark the corresponding target data as abnormal target data; and set an abnormal behavior recycle bin in the data mining unit, and send the abnormal target data to the abnormal behavior recycle bin for storage.

[0082] It should be further noted that in one embodiment, obtaining the target data of the target location does not necessarily mean that all of them are safe target data. Therefore, based on the federated learning, it is converted into standard data parameters, and then it is judged whether the obtained target data is abnormal target data, and the abnormal target data is eliminated, which further ensures the security of the data.

[0083] In step three, the process of obtaining the encrypted target data includes:

[0084] The data encryption training mechanism is used to set a number of noise nodes for the safe target data, and the noise nodes are used to add noise to the safe target data.

[0085] Obtain the privacy target data corresponding to the safe target data, add noise nodes to the privacy target data, and then generate the encrypted target data.

[0086] Generate the corresponding noise digital signature for the noise node corresponding to the encrypted target data, obtain the private key corresponding to the noise digital signature, and then connect the noise digital signature and the corresponding private key to generate a noise node database;

[0087] In one embodiment, the privacy target data includes but is not limited to identity cards, passwords, accounts, important numbers, and important methods, etc.;

[0088] Set up a data encryption chain for connecting the encrypted target data pairwise to generate an encrypted target data model;

[0089] Set up an interaction node in the data encryption chain for data interaction of the encrypted target data and obtain the interaction account corresponding to the interactors performing the data interaction;

[0090] It should be further noted that in one embodiment, during the data interaction process of privacy computing, the data itself does not move. Through parameter exchange, based on privacy computing, the data is digitally signed to obtain the corresponding private key and generate the corresponding database. In data interaction, it can not only protect the privacy of the data but also better interact with the data;

[0091] The process of obtaining the abnormal behavior includes:

[0092] Establish a data trust model, wirelessly communicate with the encrypted target data model, and pre-store the interactor's authorized account in the data trust model for detecting the trust level of the interactor;

[0093] The interactor enters the encrypted target data model through the interaction node for data interaction. The interaction node obtains the interaction account corresponding to the interactor and sends the interaction account to the data trust model for interaction account matching to determine whether it is an authorized account;

[0094] If the interaction account matches the pre-stored authorized account of the interactor successfully, it is marked as an authorized account, and the corresponding data interaction behavior of the interactor is marked as an authorized behavior;

[0095] Otherwise, an abnormal behavior is generated;

[0096] In one embodiment, the data interaction behavior of the interactor corresponding to the unsuccessful matching of the interaction account and the pre-stored authorized account of the interactor is marked as an abnormal behavior, and the corresponding interactor is marked as a rejected interactor. If the rejected interactor needs to enter the encrypted target data model for data interaction, the interaction account needs to be pre-stored in the data trust model first;

[0097] The interactor enters the encrypted target model for data interaction, obtains the encrypted target data, and matches the private key with several noise digital signatures corresponding to the encrypted target data according to the noise node database;

[0098] If the match is successful, it is marked as an authorized action, and then the noisy digital signature is decrypted to obtain the privacy target data corresponding to the noisy digital signature;

[0099] Otherwise, an abnormal behavior is generated;

[0100] According to the authorized action and the abnormal behavior, the trustworthiness of the authorized account of the interactant in the data trust model is detected to obtain a trust score;

[0101] Set one point for the authorized action and subtract one point for the abnormal behavior. If the trust score of the interactant account is less than three points, the interactant account is removed from the data trust model, and then the encrypted target data in the encrypted target model cannot be continuously interacted with. Therefore, it is necessary to pre-store the authorized account for interaction in the data trust model again.

[0102] The features and exemplary embodiments of various aspects of the present application will be described in detail above. In order to make the purpose, technical solution and advantages of the present application clearer, the present application will be further described in detail below with reference to the accompanying drawings and specific embodiments; it should be understood that the specific embodiments described herein are only intended to explain the present application, rather than limiting the present application; for those skilled in the art, the present application can be implemented without some of these specific details; the above description of the embodiments is only to provide a better understanding of the present application by showing examples of the present application.

[0103] The above embodiments are only used to illustrate the technical method of the present invention and not to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those of ordinary skill in the art should understand that the technical method of the present invention can be modified or equivalently replaced without departing from the spirit and scope of the technical method of the present invention.

Claims

1. An internal security detection method for federated learning and privacy computing, characterized in that: The method comprises the following steps: Step 1: Obtain multi-source to-be-detected data packets corresponding to the target scene, perform data connection on the multi-source to-be-detected data packets, generate to-be-detected data samples, and obtain data features and user features corresponding to the to-be-detected data samples; Step 2: Set up a target data training model based on federated learning, obtain the target data model corresponding to the data sample to be detected according to the data characteristics and user characteristics, and then obtain the target data packet, and perform data mining on the target data packet to obtain the security target data; Step 3: Set up a data encryption training mechanism, perform encryption training on the security target data, obtain the encrypted target data, establish an encrypted target data model based on the encrypted target data, and then obtain abnormal behavior; The process of generating the data sample to be detected includes: Obtain all target departments corresponding to the target location, and number the target departments without duplication, denoted as i, where i is a natural number greater than 2; obtain the data packets to be detected corresponding to the target departments in sequence according to the numbering sequence; and align the data packets to be detected according to the numbering sequence, thereby obtaining multi-source data packets to be detected; The multi-source to-be-detected data packets are encoded according to the target location, which is recorded as location D, where D is a positive integer; Obtaining the number of target locations according to the code, and then processing the multi-source to-be-detected data packets according to the number of target locations, wherein the target locations include 1 or n; wherein n is a natural number greater than 1; If there is one target location, a sub-data chain is set up to connect the data packets to be detected from multiple sources in sequence through the sub-data chain according to the numbering order to generate multiple data samples to be detected; If there are n target locations, a data link is set up to connect the multiple data samples to be detected corresponding to the n multi-source data packets to be detected through the data link to generate a single data sample to be detected; The data samples to be detected include multiple data samples to be detected and single data samples to be detected.

2. The internal security detection method for federated learning and privacy computing according to claim 1, characterized in that: The process of acquiring the data features and user features includes: The data features and user features corresponding to the data packets to be detected in the target department corresponding to the target location are obtained; and the data features and user features are marked.

3. The internal security detection method for federated learning and privacy computing according to claim 2 is characterized in that: The generation process of the target data model includes: A sample training unit and a data mining unit are set in the target data training model, wherein the sample training unit is used to perform data training on the data sample to be detected; and the data mining unit is used to perform data mining on the target data; The sample training unit trains two adjacent data packets to be detected connected by a sub-data link in the plurality of data samples to be detected, and obtains a data feature set and a corresponding user feature set corresponding to the two adjacent data packets to be detected; According to the data feature set and the user feature set, two adjacent data packets to be detected are trained to generate target training data packets; similarly, Continue data training with target training data to generate The training is stopped when one target training data packet is generated, and the corresponding target data model is generated.

4. The internal security detection method for federated learning and privacy computing according to claim 3 is characterized in that: The process of acquiring the target data packet includes: The single data sample to be detected is sent to the target data model to generate n target training data packets. Similarly, the n target training data packets are continuously trained until one target training data packet is generated, then the training is stopped and marked as the target data packet.

5. The internal security detection method for federated learning and privacy computing according to claim 4 is characterized in that: The process of obtaining the security target data includes: Acquire all target data in the target data packet; set a standard parameter conversion criterion in the data mining unit based on federated learning, send the target data packet to the data mining unit, and perform parameter conversion on the target data in the target data packet according to the standard parameter conversion criterion to generate target parameters, and then determine whether the target parameters meet the standard parameter conversion criterion; If the target parameter meets the standard parameter conversion criteria, the corresponding target data is marked as safe target data; Otherwise, the corresponding target data is marked as abnormal target data; and an abnormal behavior recycling bin is set in the data mining unit, and the abnormal target data is sent to the abnormal behavior recycling bin for storage.

6. The internal security detection method for federated learning and privacy computing according to claim 5, characterized in that: The process of obtaining the encrypted target data includes: The data encryption training mechanism is used to set a number of noise nodes in the security target data, and the noise nodes are used to add noise to the security target data; Obtaining privacy target data corresponding to the security target data, adding noise nodes to the privacy target data, and then generating encrypted target data; Generate a corresponding noise digital signature for the noise node corresponding to the encrypted target data, obtain the private key corresponding to the noise digital signature, and then connect the noise digital signature and the corresponding private key to generate a noise node database; Setting up a data encryption chain to connect encrypted target data in pairs and generate an encrypted target data model; An interaction node is set in the data encryption chain to interact with the encrypted target data and obtain the interaction account corresponding to the interactor who interacts with the data.

7. The internal security detection method for federated learning and privacy computing according to claim 6, characterized in that: The process of obtaining the abnormal behavior includes: Establish a data trust model, wirelessly connect and encrypt the target data model, and pre-store the authorized account of the interactor in the data trust model to detect the trustworthiness of the interactor; The interactor enters the encrypted target data model through the interaction node to interact with data. The interaction node obtains the interaction account corresponding to the interactor and sends the interaction account to the data trust model for interaction account matching to determine whether it is an authorized account. If the interaction account successfully matches the pre-stored authorization account of the interactor, it is marked as the authorized account, and the corresponding interaction behavior of the interactor data is marked as the authorized behavior; Otherwise, abnormal behavior is generated; The interactor enters the encrypted target model to interact with the data, obtains the encrypted target data, and matches the private key with several noise digital signatures corresponding to the encrypted target data according to the noise node database; If the match is successful, it is marked as an authorized behavior, and then the noise digital signature is decrypted to obtain the privacy target data corresponding to the noise digital signature; Otherwise, abnormal behavior is generated.

Images