System state recovery method based on UEFI

Abstract

The invention relates to the technical field of data processing, provides a UEFI (Unified Extensible Firmware Interface)-based system state recovery method, and aims to solve the problem that system recovery data is incomplete due to the fact that a traditional backup and recovery mechanism cannot return to any moment at will. A holographic log data set is constructed by acquiring and integrating comprehensive data such as system starting, a running track, a file system, a registry, network activities, processes, threads, user operation, system state changes and security events, a user can return to any specified time point by utilizing the holographic log data set, meanwhile, real-time monitoring of system running information is achieved, and the user experience is improved. According to the method, abnormal behaviors are early warned, program behavior modes are concluded through an artificial intelligence algorithm, potential threats are identified and prevented, the system safety protection capability is enhanced, and the flexibility of system recovery and the data integrity are improved.

Description

Technical Field

[0001] The present invention relates to the technical field of data processing, and in particular to a system state recovery method based on UEFI. Background Art

[0002] UEFI (Unified Extensible Firmware Interface) is a modern computer boot interface standard. UEFI provides a faster, safer and more flexible boot process, and supports larger hard disk capacity, more complex boot options and a graphical user interface. Compared with traditional BIOS, UEFI also enhances system security because UEFI can use digital signatures to verify the integrity of the boot code, thereby preventing the intrusion of malicious software. In addition, UEFI also supports booting from the network or other non-traditional devices, providing users with more boot options.

[0003] Existing system state recovery technology mainly relies on the backup and recovery mechanism. Users back up the system at a certain time in advance. When the system fails or data is lost, the system is rolled back to the state at the backup time by copying the backup. However, the backup and recovery mechanism has obvious limitations. In the actual application of existing system state recovery, there are the following technical pain points: the backup and recovery mechanism cannot be rolled back to any time at will, resulting in incomplete system recovery data. Summary of the invention

[0004] In view of the deficiencies in the prior art, the present invention provides a system status recovery method based on UEFI to solve the problem that the backup and recovery mechanism cannot be rolled back to any time at will, resulting in incomplete system recovery data.

[0005] In order to solve the above technical problems, the specific technical solutions of the present invention are as follows: The present invention provides a system status recovery method based on UEFI, comprising: Step S101, obtaining system data, the system data including system startup data, system operation trajectory data, file system data, registry data, network activity data, process data, thread data, user operation data, system state change data and security event data; Step S102, classify the system data to obtain the system data classification result, monitor each type of data in the system data according to the system data classification result, obtain all operation trajectory data including the operating system, extract data features from all operation trajectory data including the operating system, and obtain system operation trajectory capture features, user operation record features, system status features, and security event features; Step S103, integrating the system operation trajectory capture features, user operation record features, system status features and security event features, and preprocessing the integrated data features to obtain a holographic log data set, which includes a timestamp, event type, data content and data association relationship; Step S104, receiving user data storage configuration information, establishing a holographic log generation virtual disk according to the user data storage configuration information, the holographic log generation virtual disk is used for the user to access the data of the holographic log generation virtual disk at a specified time point, receiving the user's rollback time point information, substituting the user's rollback time point information into the preset holographic log for reverse deduction model, and outputting the data information rolled back to the specified time pair; Step S105, continuously monitor the system operation information, the monitored system operation information includes system processes, system files, system registries, system networks and system logs, obtain real-time monitoring system operation information, substitute the real-time monitoring system operation information into a preset early warning analysis model, obtain the early warning analysis results of the real-time monitoring system operation information, and when continuously monitoring the system operation information, summarize the program behavior patterns through the preset artificial intelligence algorithm, identify and prevent new program intrusions and out-of-bounds actions of existing programs.

[0006] Furthermore, the UEFI-based system status recovery method of the present invention, step S101, includes: System startup data is used to record the process data from EFI / BIOS startup to the completion of operating system loading. System startup data includes hardware self-test results, startup sequence, and loaded drivers; System operation trajectory data is used to record events and state changes during system operation. System operation trajectory data includes the creation, termination, state changes of processes and threads, and the interactive relationship between creation, termination, and state changes; File system data is used to record the read and write operations of the file system. File system data includes file creation events, modification events, deletion events, copy events, move events, file attributes, and file permission changes; Registry data records changes in the Windows registry. Registry data includes the creation, modification, and deletion of key-value pairs; Network activity data records network activity data such as network connection and data transmission. Network activity data includes source address, destination address, port number, protocol type and content of transmitted data; Process data is used to record the information of processes in the system. Process data includes process ID, name, path, start time, running status, etc. Thread data is used to record detailed information of all threads in the system. Thread data includes thread ID, process, running status and priority. User operation data is used to record the user's keyboard and mouse operations. User operation data includes input content, click location, and operation time; System status change data is used to record changes in system status, including hardware status, software installation and uninstallation, and system updates; Security event data is used to record security events that occur in the system, including virus intrusions, malware activities, and permission changes.

[0007] Furthermore, in the UEFI-based system status recovery method of the present invention, step S102 includes: The acquired system data is classified according to its nature and source to obtain system startup data, system operation trajectory data, file system data, registry data, network activity data, process data, thread data, user operation data, system status change data and security event data; According to the classification results of system data, set corresponding monitoring rules for each category of data. The monitoring rules include the type of data to be monitored, the frequency of monitoring, and the conditions for triggering monitoring; Deploy monitoring components in the system. The monitoring components monitor system data in real time according to the set monitoring rules. The monitoring components are integrated in the kernel layer or application layer of the operating system. After the monitoring component captures the system data, it records and stores it in the specified location; Integrate the captured system data to form an operation trajectory data set, which includes all operation trajectory data including the operating system, for subsequent analysis and recovery operations; Perform feature extraction on the integrated operation trajectory data to obtain system operation trajectory capture features, user operation record features, system status features, and security event features; The extracted features are stored in a feature library, and the feature library is updated in real time as the system data is continuously updated.

[0008] Furthermore, the UEFI-based system status recovery method of the present invention, step S103 includes: Integrate all extracted system operation trajectory capture features, user operation record features, system status features, and security event features to form a preliminary data set; Add a timestamp to each data item in the data set, which serves as a unified reference for the data item in time; divide the data item into different types of events based on its content, including system startup events, process creation events, file read and write events, and network connection events; Analyze the correlation between different events based on the timestamps of the events, and obtain the correlation between the file creation event and the subsequent file read and write events, and the correlation between the process creation event and the creation event of its child process; Determine the relationship between different files through attributes such as file path, file name, file size, etc. Associating the user's behavior with the events in the system, wherein associating the user's behavior with the events in the system includes associating the user's keyboard input operation with the text editing event in the system, or associating the user's mouse operation with the window switching event in the system; The data association relationships obtained through analysis are stored in the database, and the integrated data features, timestamps, event types, and data association relationships are combined to construct a holographic log data set.

[0009] Furthermore, the UEFI-based system status recovery method of the present invention, step S104 includes: Receive user data storage configuration information, which includes data storage location, storage format, and data retention period. The user data storage configuration information will be used to guide the storage and management of holographic logs; According to the user's data storage configuration information, the system establishes a holographic log generation virtual disk, which is used to store and manage holographic log data; Extract information related to the user rollback time point from the virtual disk generated by the holographic log, and the information related to the user rollback time point includes all system operation tracks, user operation records, system status and security events before the time point; Using the extracted holographic log data, a reverse deduction model is constructed. The reverse deduction model reversely derives the system status and data content at the time point specified by the user; Receive the reverse deduction logic rule, the reverse deduction logic rule defines the deduction of the previous state and data from the subsequent state and data, configure the reverse deduction logic rule in the reverse deduction model, and obtain the reverse deduction model.

[0010] Receive the user's rollback time point information, substitute the user's rollback time point information into the reverse deduction model, and output the data information rolled back to the specified time point. The model reversely derives the system status and data content at that time point based on the input time point information, and outputs it to the user. The user can view the rolled-back data by accessing the holographic log to generate a virtual disk.

[0011] Furthermore, the UEFI-based system status recovery method of the present invention, step S105 includes: Receive a preset range of monitored system operation information, which includes system processes, system files, system registries, system networks, and system logs; perform data monitoring based on the monitored system operation information; pre-process the monitored data to train a data set for an early warning analysis model; the data set for training an early warning analysis model includes known normal behavior and abnormal behavior samples; Using the prepared training data set to train the early warning analysis model, to obtain a trained early warning analysis model; Deploy the trained early warning analysis model to the monitoring system so that the trained early warning analysis model can receive and process system operation information in real time; When the early warning analysis model detects abnormal behavior, the early warning mechanism is triggered and an early warning analysis report is generated, which includes abnormal behavior information.

[0012] Furthermore, the UEFI-based system status recovery method of the present invention, step S105 includes: While continuously monitoring system operation information, it uses preset artificial intelligence algorithms to summarize the program's behavior patterns, including the program's normal execution process, resource access patterns, and network communication behaviors; According to the summarized behavior patterns, when the system detects that a new program attempts to access system resources or performs abnormal behavior, it compares the new program's attempt to access system resources or perform abnormal behavior with the known behavior patterns. If it does not conform to the normal behavior pattern, it is considered a potential threat; The results of behavioral pattern induction are used to identify and prevent out-of-bounds actions of existing programs. When an existing program attempts to perform operations beyond the normal behavior range of the existing program, the system prevents the out-of-bounds behavior.

[0013] Beneficial effects of the present invention: By acquiring and integrating comprehensive system data, including system startup data, operation trajectory data, file system data, etc., the present invention can construct a holographic log containing rich information and associations, so that the system can be restored to any specified time point, solving the problem that the traditional backup and recovery mechanism cannot be rolled back to any time, resulting in incomplete data recovery. Users can roll back to any historical state of the system at any time as needed, without relying on scheduled backup, which improves the flexibility and convenience of data recovery.

[0014] The invention continuously monitors system operation information, including system processes, files, registries, networks, and logs, and combines early warning analysis models to identify and warn potential abnormal behaviors in real time, such as virus intrusions, malware activities, etc. By using artificial intelligence algorithms to summarize program behavior patterns, the system can automatically identify and prevent the intrusion of new programs and the cross-border actions of existing programs, effectively improving the system's security protection capabilities and reducing the risk of being attacked.

[0015] The present invention establishes a holographic log generation virtual disk for storing and managing holographic log data. Users can conveniently view and obtain the data status of the hard disk at any specified time point by accessing the virtual disk, thereby enhancing the manageability of the system.

[0016] Through holographic logs, the system can trace the source, operation process and association relationship of any file, process / thread, providing strong support for troubleshooting and event tracking, and improving the maintainability of the system.

[0017] In summary, the present invention has the beneficial effects of providing system status recovery at any time point, enhancing system security protection capabilities, and enhancing system manageability. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solution of the present invention, the following is a brief introduction to the drawings required for use in the embodiments. Obviously, for ordinary technicians in this field, other drawings can be obtained based on the drawings without paying any creative labor.

[0019] Figure 1 A schematic flow chart of a UEFI-based system status recovery method provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0020] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described in conjunction with the specific embodiments of the present invention and the corresponding drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention. The technical solutions provided by the embodiments of the present invention are described in detail below in conjunction with the drawings.

[0021] In order to better understand the purpose of the present invention, the present invention is described in further detail below.

[0022] The present invention provides a system status recovery method based on UEFI, comprising: Step S101, obtaining system data, the system data including system startup data, system operation trajectory data, file system data, registry data, network activity data, process data, thread data, user operation data, system state change data and security event data; System startup data: records the process data from EFI / BIOS startup to the completion of operating system loading, including hardware self-test results, startup sequence, and loaded drivers, which helps to understand the status and behavior of the system during startup.

[0023] System operation trajectory data: records events and state changes during system operation, such as the creation, termination, and state changes of processes and threads, as well as the interactions between them, reflecting the dynamic behavior of the system during operation.

[0024] File system data: records the read and write operations of the file system, including file creation, modification, deletion, copying, and moving events, as well as changes in file attributes and permissions.

[0025] Registry data: records changes in the Windows registry, such as the creation, modification, and deletion of key-value pairs. The registry is an important database for storing configuration information in the Windows system, and its changes reflect changes in the system configuration.

[0026] Network activity data: records network activities such as network connections and data transmission, including source address, destination address, port number, protocol type, and content of transmitted data, to track network behavior and identify potential security threats.

[0027] Process data: records information about processes in the system, including process ID, name, path, start time, running status, etc. A process is the basic unit of system operation, and understanding its status helps analyze system behavior.

[0028] Thread data: Records detailed information about all threads in the system, such as thread ID, process, running status, and priority. Threads are the execution units in a process, and their data is very important for analyzing system concurrency and performance issues.

[0029] User operation data: Recording the user's keyboard and mouse operations, including input content, click locations, operation time, etc., helps to reproduce user behavior and is crucial for accident analysis and evidence collection.

[0030] System status change data: records changes in system status, such as hardware status, software installation and uninstallation, and system updates, reflecting dynamic changes in system configuration.

[0031] Security event data: records security events that occur in the system, such as virus intrusions, malware activities, and permission changes, and is used to identify security threats and analyze attack behaviors.

[0032] By acquiring these comprehensive and detailed system data, the present invention provides a solid foundation for subsequent data classification, monitoring, feature extraction, holographic log generation, and rollback to any time point.

[0033] Step S102, classify the system data to obtain the system data classification result, monitor each type of data in the system data according to the system data classification result, obtain all operation trajectory data including the operating system, extract data features from all operation trajectory data including the operating system, and obtain system operation trajectory capture features, user operation record features, system status features, and security event features; In step S102, the present invention classifies the acquired system data, monitors each type of data according to the classification results, and then extracts data features. The specific execution process of this step is as follows: The obtained system data is carefully classified according to its nature and source, and the following system data classification results are obtained: System startup data: records information about the system startup process.

[0034] System operation trajectory data: covers all events and state changes during system operation.

[0035] File system data: involves all read and write operations and file attribute changes of the file system.

[0036] Registry data: records the changes in the Windows registry.

[0037] Network activity data: includes network connection, data transmission and other network activity information.

[0038] Process data: records information about all processes in the system.

[0039] Thread data: Records detailed information of all threads in the system.

[0040] User operation data: records the user's keyboard and mouse operations.

[0041] System status change data: reflects various changes in system status.

[0042] Security event data: records security events that occur in the system.

[0043] According to the classification results of system data, corresponding monitoring rules are set for each type of data, and monitoring components are deployed in the system. The monitoring component monitors various types of data in real time according to the set rules, and can capture all operation track data including the operating system. Monitoring components are usually integrated in the kernel layer or application layer of the operating system to improve the comprehensiveness and real-time nature of monitoring.

[0044] After obtaining all the running track data including the operating system, in-depth data feature extraction is performed on these data. The key features extracted include: System operation trajectory capture features: reflects the key features of the system operation trajectory, such as the creation, termination, and state changes of processes and threads.

[0045] User operation record feature: records user operation behaviors, such as keyboard input, mouse clicks, etc.

[0046] System status characteristics: describe the characteristics of the current system status, such as hardware status, software installation status, etc.

[0047] Security event features: Extract features related to security events, such as signs of virus intrusion, malware activities, etc.

[0048] The above features provide an important basis for subsequent holographic log generation, system status recovery and security incident warning.

[0049] Through the execution of step S102, the present invention successfully classifies, monitors and extracts features of system data, laying a solid foundation for subsequent system status recovery and security monitoring.

[0050] Step S103, integrating the system operation trajectory capture features, user operation record features, system status features and security event features, and preprocessing the integrated data features to obtain a holographic log data set, which includes a timestamp, event type, data content and data association relationship; In step S103, the present invention integrates and preprocesses the previously extracted system operation trajectory capture features, user operation record features, system status features, and security event features, thereby generating a holographic log data set.

[0051] All extracted system operation trajectory capture features, user operation record features, system status features and security event features are integrated to form a preliminary data set. This data set contains comprehensive information on system operation, from the bottom-level system startup to the high-level user operation to security events.

[0052] Preprocess the integrated data features. The purpose of preprocessing is to improve the accuracy, consistency and integrity of the data and provide a reliable data foundation for subsequent analysis and recovery operations. The specific operations of preprocessing include data cleaning, deduplication, formatting, etc.

[0053] After the preprocessing is completed, the holographic log data set is constructed. This data set not only contains basic information such as timestamp, event type, data content, etc., but also establishes the relationship between data. The following is the detailed composition of the holographic log data set: Timestamps are added to each data item in a data set as a unified reference for the data item in time. Timestamps improve the temporal nature of data, allowing subsequent reverse deduction and time point rollback operations to be performed in chronological order.

[0054] Event type: According to the content of the data item, it is divided into different types of events, such as system startup events, process creation events, file read and write events, network connection events, etc. The division of event types is helpful for subsequent data analysis and processing.

[0055] Data content: records the specific content of each event, such as the process ID, name, path and other information of the process creation event, the file path, operation type (create, modify, delete, etc.) and other information of the file read and write event.

[0056] Data association: Analyze the association between different events, such as the association between the file creation event and the subsequent file read and write events, the association between the process creation event and its child process creation events, etc. At the same time, the association between different files is determined by attributes such as file path, file name, and file size. In addition, the user's behavior is also associated with events in the system, such as associating the user's keyboard input operation with the text editing event in the system.

[0057] By constructing a holographic log data set, the present invention realizes the comprehensive recording and tracking of the system operation trajectory. This data set not only provides detailed data support for subsequent reverse deduction and time point rollback, but also provides strong guarantee for the system's security monitoring and event warning.

[0058] Step S104, receiving user data storage configuration information, establishing a holographic log generation virtual disk according to the user data storage configuration information, the holographic log generation virtual disk is used for the user to access the data of the holographic log generation virtual disk at a specified time point, receiving the user's rollback time point information, substituting the user's rollback time point information into the preset holographic log for reverse deduction model, and outputting the data information rolled back to the specified time pair; In step S104, the present invention allows the user to access the data of the virtual disk generated by the holographic log at a specified time point through the virtual disk generated by the holographic log, and realizes the system state rollback based on the reverse deduction model. The following is a detailed analysis of this step: The system receives user configuration information about data storage, including but not limited to the location of data storage, storage format, and data retention period. The information is crucial for guiding the storage and management of holographic logs and improving data security and accessibility.

[0059] According to the user's data storage configuration information, the system creates a holographic log generation virtual disk. This virtual disk is not a physical hard disk, but a logical data structure used to store and manage holographic log data. By accessing the holographic log generation virtual disk, users can easily view and obtain the data status of the hard disk at any specified time point.

[0060] When the user needs to roll back to a specific point in time, the system will receive the point in time information entered by the user. The point in time information entered by the user indicates which historical state the user wants the system to recover to.

[0061] The system substitutes the user's rollback time point information into the preset holographic log reverse deduction model. The holographic log reverse deduction model can reversely deduce the system status and data content at the specified time point based on the data characteristics and correlation relationships in the holographic log.

[0062] Through the calculation of the reverse deduction model, the system finally outputs data information that rolls back to the specified time point. The information includes but is not limited to system status, file content, registry information, etc., which together constitute the system status expected by the user at the specified time point.

[0063] Users can view the rolled-back data by accessing the holographic log generation virtual disk. The holographic log generation virtual disk provides users with an intuitive and convenient interface, allowing users to easily browse and obtain the required historical data.

[0064] By executing step S104, the present invention successfully solves the problem that the backup and recovery mechanism cannot be rolled back to any time. Users can easily roll back to any historical state of the system without relying on traditional backup and recovery methods, which greatly improves the flexibility and convenience of data recovery and system management.

[0065] The holographic log generation virtual disk is a logical data structure, not a physically existing hard disk. The main function of the holographic log generation virtual disk is to store and manage holographic log data, providing users with a convenient way to access the data status of the holographic log generation virtual disk at any specified time point.

[0066] The holographic log generates a virtual disk as a storage container for holographic log data, which can safely and orderly save all key data generated during the system operation, including system operation tracks, user operation records, system status changes and security events.

[0067] In addition to the storage function, the holographic log generation virtual disk is also responsible for managing the data, including data organization, classification, indexing and retrieval, so that users can efficiently access the required data.

[0068] The holographic log generation virtual disk provides users with an intuitive and convenient data access interface. Through this interface, users can browse, query and obtain the data status of the hard disk at any specified time point, thereby meeting the needs of data recovery, troubleshooting and system maintenance.

[0069] Users can access data at a specified time point by generating a virtual disk through a holographic log, and operate through software tools or system interfaces. The software tools or system interfaces provide functions such as time selectors and data type filters to help users locate the required data. By generating a virtual disk through a holographic log, users can easily roll back to any historical state of the system without relying on traditional backup and recovery methods.

[0070] Holographic log generation virtual disk provides users with a comprehensive view of system operation status, allowing users to have a deeper understanding of system operation status and history. Holographic log generation virtual disk can trace the source, operation process and association of any file, process / thread, providing strong support for troubleshooting and event tracking. By accessing the data in the virtual disk, users can more accurately locate the cause of the problem and take appropriate solutions.

[0071] In summary, the holographic log generates a virtual disk, which is used by users to access the data of the holographic log generated virtual disk at a specified time point. By providing a convenient and efficient data access interface, it greatly improves the flexibility of data recovery, the manageability of the system, and the troubleshooting and event tracking capabilities.

[0072] Step S105, continuously monitor the system operation information, the monitored system operation information includes system processes, system files, system registries, system networks and system logs, obtain real-time monitoring system operation information, substitute the real-time monitoring system operation information into a preset early warning analysis model, obtain the early warning analysis results of the real-time monitoring system operation information, and when continuously monitoring the system operation information, summarize the program behavior patterns through the preset artificial intelligence algorithm, identify and prevent new program intrusions and out-of-bounds actions of existing programs.

[0073] In step S105, the present invention realizes real-time monitoring and dynamic protection of the system security status by continuously monitoring the system operation information and combining the preset early warning analysis model and artificial intelligence algorithm. The following is a detailed analysis of this step: The system continuously monitors key operating information, including but not limited to system processes, system files, system registries, system network activities, and system logs. The information is an important indicator of the current status and operating status of the system.

[0074] Through the monitoring mechanism, the system can obtain the latest status of the above key operating information in real time. The information is dynamic and is continuously updated as the system runs.

[0075] The system will obtain the real-time monitoring system operation information into the preset early warning analysis model. The early warning analysis model is an algorithm structure based on historical data and prior knowledge, which can quickly analyze and evaluate these real-time information.

[0076] Through the calculation of the early warning analysis model, the system can obtain early warning analysis results of real-time monitoring system operation information, including whether the system status is normal, whether there are potential security threats, etc.

[0077] While continuously monitoring system operation information, the system also uses preset artificial intelligence algorithms to summarize and generalize the program's behavior patterns, including the program's normal execution process, resource access patterns, and network communication behaviors.

[0078] Based on the summarized program behavior patterns, the system can identify the intrusion behavior of new programs. When the system detects that a new program attempts to access system resources or perform abnormal operations, it will compare it with the known behavior patterns. If it does not conform to the normal behavior pattern, it is considered a potential threat and the system will take appropriate measures to block it.

[0079] In addition to identifying the intrusion behavior of newly added programs, the system can also monitor the operation of existing programs. When an existing program attempts to perform operations beyond its normal behavior range, the system will identify these out-of-bounds actions and block them in time to prevent the system from being damaged.

[0080] Through the execution of step S105, the present invention not only realizes real-time monitoring and early warning of the system security status, but also improves the self-protection capability of the system through artificial intelligence algorithms. This dynamic protection mechanism can effectively deal with various potential security threats and improve the stable operation of the system and the security of data.

[0081] Specifically, the UEFI-based system status recovery method of the present invention, step S101 includes: System startup data is used to record the process data from EFI / BIOS startup to the completion of operating system loading. System startup data includes hardware self-test results, startup sequence, and loaded drivers; System operation trajectory data is used to record events and state changes during system operation. System operation trajectory data includes the creation, termination, state changes of processes and threads, and the interactive relationship between creation, termination, and state changes; File system data is used to record the read and write operations of the file system. File system data includes file creation events, modification events, deletion events, copy events, move events, file attributes, and file permission changes; Registry data records changes in the Windows registry. Registry data includes the creation, modification, and deletion of key-value pairs; Network activity data records network activity data such as network connection and data transmission. Network activity data includes source address, destination address, port number, protocol type and content of transmitted data; Process data is used to record the information of processes in the system. Process data includes process ID, name, path, start time, running status, etc. Thread data is used to record detailed information of all threads in the system. Thread data includes thread ID, process, running status and priority. User operation data is used to record the user's keyboard and mouse operations. User operation data includes input content, click location, and operation time; System status change data is used to record changes in system status, including hardware status, software installation and uninstallation, and system updates; Security event data is used to record security events that occur in the system, including virus intrusions, malware activities, and permission changes.

[0082] Specifically, the UEFI-based system status recovery method of the present invention, step S102 includes: The acquired system data is classified according to its nature and source to obtain system startup data, system operation trajectory data, file system data, registry data, network activity data, process data, thread data, user operation data, system status change data and security event data; According to the classification results of system data, set corresponding monitoring rules for each category of data. The monitoring rules include the type of data to be monitored, the frequency of monitoring, and the conditions for triggering monitoring; Deploy monitoring components in the system. The monitoring components monitor system data in real time according to the set monitoring rules. The monitoring components are integrated in the kernel layer or application layer of the operating system. After the monitoring component captures the system data, it records and stores it in the specified location; Integrate the captured system data to form an operation trajectory data set, which includes all operation trajectory data including the operating system, for subsequent analysis and recovery operations; Perform feature extraction on the integrated operation trajectory data to obtain system operation trajectory capture features, user operation record features, system status features, and security event features; The extracted features are stored in a feature library, and the feature library is updated in real time as the system data is continuously updated.

[0083] The acquired system data is classified according to its nature and source. The categories include system startup data, system operation trajectory data, file system data, registry data, network activity data, process data, thread data, user operation data, system status change data and security event data. Each type of data represents the operating status and information of different aspects of the system.

[0084] According to the classification results of system data, corresponding monitoring rules are set for each category of data. The monitoring rules specify the type of data to be monitored, the frequency of monitoring, and the conditions for triggering monitoring. For example, for system startup data, only one monitoring is required when the system starts; while for network activity data, high-frequency monitoring is required in real time.

[0085] Deploy monitoring components in the system, and the components monitor system data in real time according to the set monitoring rules. Monitoring components can be integrated in the kernel layer or application layer of the operating system to capture all key system data. Through kernel layer integration, monitoring components can be closer to the hardware level and capture lower-level and more detailed data; while through application layer integration, it is easier to achieve cross-platform and cross-system compatibility.

[0086] After the monitoring component captures the system data, it records and stores it in a specified location, which can be a specific folder on the hard disk, a table in the database, or other storage media. The integrity and security of the data need to be improved during storage to prevent data loss or tampering.

[0087] The captured system data is integrated to form an operation trajectory data set, which includes all operation trajectory data including the operating system, and is the basis for subsequent analysis and recovery operations. Through integration, data from different sources and in different formats can be unified to facilitate subsequent processing and analysis.

[0088] The integrated operation trajectory data is subjected to feature extraction, including system operation trajectory capture features, user operation record features, system status features, and security event features. Feature extraction is an important step in data mining and machine learning. By extracting key features, raw data can be converted into more valuable information.

[0089] The extracted features are stored in the feature library, and the feature library is updated in real time as the system data is continuously updated. The feature library is the basis for subsequent analysis and early warning. By continuously updating and enriching the feature library, the accuracy of the system can be improved. At the same time, the feature library can also be used to train machine learning models to further improve the intelligence level of the system.

[0090] Through the execution of step S102, the present invention realizes comprehensive monitoring and feature extraction of system data, and provides strong support for subsequent system status recovery and safety warning.

[0091] Specifically, the UEFI-based system status recovery method of the present invention, step S103 includes: Integrate all extracted system operation trajectory capture features, user operation record features, system status features, and security event features to form a preliminary data set; Add a timestamp to each data item in the data set, which serves as a unified reference for the data item in time; divide the data item into different types of events based on its content, including system startup events, process creation events, file read and write events, and network connection events; Analyze the correlation between different events based on the timestamps of the events, and obtain the correlation between the file creation event and the subsequent file read and write events, and the correlation between the process creation event and the creation event of its child process; Determine the relationship between different files through attributes such as file path, file name, file size, etc. Associating the user's behavior with the events in the system, wherein associating the user's behavior with the events in the system includes associating the user's keyboard input operation with the text editing event in the system, or associating the user's mouse operation with the window switching event in the system; The data association relationships obtained through analysis are stored in the database, and the integrated data features, timestamps, event types, and data association relationships are combined to construct a holographic log data set.

[0092] In step S103, the present invention further processes and integrates the previously extracted system features to construct a holographic log data set. The following is a detailed analysis of this step: All extracted system operation trajectory capture features, user operation record features, system status features and security event features are integrated to form a preliminary data set. This meta-set contains data from all aspects of system operation and provides a basis for subsequent analysis and processing.

[0093] Add a timestamp to each data item in the data set. As a unified reference benchmark for data items in time, the timestamp improves the timeliness and accuracy of the data. Through the timestamp, you can clearly understand the specific time point of each event, providing a basis for subsequent event correlation analysis.

[0094] According to the content of the data item, it is divided into different types of events, including system startup events, process creation events, file read and write events, and network connection events. By dividing the event types, it is more convenient to process and analyze different types of events separately.

[0095] Analyze the correlation between different events based on the timestamps of the events. For example, you can analyze the correlation between the file creation event and the subsequent file read and write events, the correlation between the process creation event and the creation events of its child processes, etc. The correlation helps to understand the context and logical order of system operation.

[0096] The association between different files is determined by attributes such as file path, file name, and file size. The association can help identify the dependencies and transmission paths between files, which is of great significance for file recovery and system debugging.

[0097] Associating user behaviors with system events, including associating user keyboard input operations with text editing events in the system, associating user mouse operations with window switching events in the system, etc. Through this association, we can understand the impact of user behaviors on the system operation status, which is helpful for troubleshooting and system optimization.

[0098] The analyzed data relationships are stored in the database. As an efficient data storage and management tool, the database can easily query and analyze these data relationships. At the same time, the database can also ensure the integrity and consistency of the data and prevent data loss or tampering.

[0099] Finally, the integrated data features, timestamps, event types, and data associations are combined to construct a holographic log data set, which contains all the information and associations of the system operation and can be used in various scenarios such as system status recovery, security warning, and troubleshooting. Through the holographic log data set, users can fully understand the system's operating status and historical records, and improve the maintainability and security of the system.

[0100] Specifically, the UEFI-based system status recovery method of the present invention, step S104 includes: Receive user data storage configuration information, which includes data storage location, storage format, and data retention period. The user data storage configuration information will be used to guide the storage and management of holographic logs; According to the user's data storage configuration information, the system establishes a holographic log generation virtual disk, which is used to store and manage holographic log data; Determine the target of reverse derivation, that is, the data at which point in time the user wants to roll back. The target of reverse derivation will serve as the starting point of reverse derivation. Determine the target of reverse deduction, that is, the data at which point in time the user wants to roll back to. The system first needs to use this point in time as the starting reference point for reverse deduction. Based on this point in time, the system will extract all system operation trajectories, user operation records, system status, security events and other related data before this point in time from the virtual disk generated by the holographic log. Then, use these data to build a reverse deduction model. The reverse deduction model reversely derives the system status and data content at the time point specified by the user. The target of reverse deduction will serve as the starting point of reverse deduction, and finally output the data information rolled back to the specified time point.

[0101] Extract information related to the user rollback time point from the virtual disk generated by the holographic log, and the information related to the user rollback time point includes all system operation tracks, user operation records, system status and security events before the time point; Using the extracted holographic log data, a reverse deduction model is constructed. The reverse deduction model reversely derives the system status and data content at the time point specified by the user; Receive the reverse deduction logic rule, the reverse deduction logic rule defines the deduction of the previous state and data from the subsequent state and data, configure the reverse deduction logic rule in the reverse deduction model, and obtain the reverse deduction model.

[0102] Receive the time point information of the user's rollback, substitute the time point information of the user's rollback into the reverse deduction model, and output the data information rolled back to the specified time point. The reverse deduction model reversely derives the system status and data content at the time point based on the input time point information, and outputs the reversely derived system status and data content at the time point to the user. The user views the data after rollback by accessing the virtual disk generated by the holographic log.

[0103] In step S104, the present invention elaborates on how to use holographic log data to achieve reverse derivation and recovery of system status. The following is a specific analysis of this step: The system receives the user's configuration information about data storage, including the location, storage format, and data retention period of the data. The user's configuration information about data storage will be used to guide the storage and management of holographic logs and improve the security and accessibility of data.

[0104] According to the user's data storage configuration information, the system creates a holographic log generation virtual disk, which is specially used to store and manage holographic log data. Through the form of a virtual disk, the holographic log can be easily accessed and managed, while avoiding direct operations on the actual hard disk, improving data security and reliability.

[0105] Next, the system needs to determine the target of reverse deduction, that is, the data at which point in time the user wants to roll back to. This point in time will be used as the starting point of reverse deduction, and the system will reversely deduce the previous system status and data content from this point.

[0106] Information related to the user rollback time point is extracted from the virtual disk generated by the holographic log. The information includes all system operation trajectories, user operation records, system status and security events before this time point. The information is the basis of reverse deduction and will be used to build a reverse deduction model.

[0107] The extracted holographic log data is used to build a reverse deduction model, which can reversely deduce the system state and data content at the time point specified by the user. The reverse deduction model is one of the technologies for realizing system state recovery.

[0108] Receive the logic rules of reverse deduction and configure them in the reverse deduction model. The logic rules define the method of deducing the previous state and data from the subsequent state and data. By configuring the logic rules of reverse deduction, the accuracy and reliability of reverse deduction can be improved.

[0109] Receive the user's rollback time point information and substitute the user's rollback time point information into the reverse deduction model. The reverse deduction model reversely derives the system state and data content at that time point based on the input time point information and outputs it to the user. The user can view the rolled-back data by accessing the virtual disk generated by the holographic log, thereby realizing the recovery of the system state.

[0110] Through the implementation of step S104, the present invention provides an efficient and reliable system state recovery method. Even if the system crashes or data is lost, the user can restore to the previous system state and data content by reverse deduction, thereby improving the availability and stability of the system.

[0111] Determine the target of reverse derivation, that is, the data at which point in time the user wants to roll back. The target of reverse derivation will serve as the starting point of reverse derivation. Determining the goal of reverse deduction refers to the result that the user wants to achieve through reverse deduction, that is, the state at a specific point in time that the user wants the system to be able to roll back to.

[0112] That is, the data at which point in time the user wants to roll back is a further explanation of the reverse deduction goal, and clearly points out the data at the specific point in time the user wants to restore.

[0113] The target of reverse deduction will be used as the starting point of reverse deduction. This sentence means that the time point specified by the user is not only the result of reverse deduction, but also the beginning or starting point of the reverse deduction process. However, from a logical point of view, it seems that there is a lack of description of how to perform reverse deduction from the time point specified by the user.

[0114] That is, the user wants to roll back to the data at a certain time point. The system first needs to use this time point as the starting reference point for reverse deduction. Based on this time point, the system will extract all system operation tracks, user operation records, system status, security events and other related data before this time point from the virtual disk generated by the holographic log.

[0115] Finally, the extracted data is substituted into the reverse deduction model for calculation. Then, the reverse deduction model is constructed using these data. The reverse deduction model reversely derives the system state and data content at the time point specified by the user as the end point or result of the reverse deduction.

[0116] Specifically, the UEFI-based system status recovery method of the present invention, step S105 includes: Receive a preset range of monitored system operation information, which includes system processes, system files, system registries, system networks, and system logs; perform data monitoring based on the monitored system operation information; pre-process the monitored data to train a data set for an early warning analysis model; the data set for training an early warning analysis model includes known normal behavior and abnormal behavior samples; Using the prepared training data set to train the early warning analysis model, to obtain a trained early warning analysis model; Deploy the trained early warning analysis model to the monitoring system so that the trained early warning analysis model can receive and process system operation information in real time; When the early warning analysis model detects abnormal behavior, the early warning mechanism is triggered and an early warning analysis report is generated, which includes abnormal behavior information.

[0117] In step S105, the present invention further enhances the security protection capability of the system, and enables the system to operate stably through real-time monitoring and early warning analysis. The following is a detailed analysis of this step: The system receives preset monitoring scopes, which include key system components such as system processes, system files, system registries, system networks, and system logs. Components are the core of system operation. By monitoring them, potential security threats can be discovered in a timely manner.

[0118] According to the preset monitoring scope, the system monitors these key components in real time. The monitored data will be preprocessed to form a data set suitable for training the early warning analysis model. This data set includes known normal behavior and abnormal behavior samples, which will provide a basis for the training of the early warning analysis model.

[0119] Use the prepared training data set to train the early warning analysis model. Through advanced technologies such as machine learning, the model can learn and identify the characteristics of normal and abnormal behaviors. After training, the model will have the ability to analyze and identify abnormal behaviors in system operation in real time.

[0120] Deploy the trained early warning analysis model to the monitoring system, so that the model can receive and process system operation information in real time and continuously monitor and analyze the system operation status.

[0121] When the early warning analysis model detects abnormal behavior, the system will trigger the early warning mechanism, which will generate a detailed early warning analysis report. The report includes specific information about the abnormal behavior, such as the time of occurrence, the cause of the impact, etc. This information will help system administrators understand and respond to potential security threats in a timely manner.

[0122] Through the implementation of step S105, the present invention not only provides the ability to restore the system status, but also enhances the security protection capability of the system. Through real-time monitoring and early warning analysis, the system can promptly detect and respond to potential security threats, thereby improving the stable operation of the system and data security.

[0123] Specifically, the UEFI-based system status recovery method of the present invention, step S105 includes: While continuously monitoring system operation information, it uses preset artificial intelligence algorithms to summarize the program's behavior patterns, including the program's normal execution process, resource access patterns, and network communication behaviors; According to the summarized behavior patterns, when the system detects that a new program attempts to access system resources or performs abnormal behavior, it compares the new program's attempt to access system resources or perform abnormal behavior with the known behavior patterns. If it does not conform to the normal behavior pattern, it is considered a potential threat; The results of behavioral pattern induction are used to identify and prevent out-of-bounds actions of existing programs. When an existing program attempts to perform operations beyond the normal behavior range of the existing program, the system prevents the out-of-bounds behavior.

[0124] In step S105, the present invention realizes deep learning and intelligent analysis of program behavior patterns by introducing artificial intelligence algorithms, thereby further enhancing the security protection capability of the system. The following is a detailed analysis of this step: While continuously monitoring the system operation information, the present invention uses a preset artificial intelligence algorithm to summarize the program's behavior patterns, which include the program's normal execution process, resource access patterns, and network communication behaviors. By analyzing and learning a large amount of program operation data, the artificial intelligence algorithm can identify the laws and characteristics of program behavior, thereby building an accurate behavior pattern library.

[0125] When the system detects a new program trying to access system resources or perform abnormal behavior, it compares the new program's behavior pattern with a known behavior pattern library. This comparison process is designed to determine whether the new program's behavior conforms to normal behavior patterns. If the new program's behavior does not match any known normal behavior patterns, the system will treat it as a potential threat.

[0126] In addition to comparing new programs with their behavior patterns, the present invention can also identify and block existing programs from out-of-bounds actions. When an existing program attempts to perform an operation beyond its normal behavior range, the system will make a judgment based on the results of the behavior pattern induction and block these out-of-bounds actions in a timely manner. Some functions help prevent malware or viruses from exploiting system vulnerabilities to attack and damage.

[0127] Through the implementation of step S105, the present invention not only provides real-time monitoring and early warning analysis capabilities for the system operation status, but also realizes deep learning and intelligent analysis of program behavior patterns through artificial intelligence algorithms, so that the system can more accurately identify and respond to potential security threats, creating a safer and more stable computer usage environment for users.

[0128] The UEFI-based system state recovery method provided by the present invention solves the problem that the backup and recovery mechanism cannot be rolled back to any time at will, resulting in incomplete system recovery data through the following technical solutions: The present invention comprehensively acquires and integrates system data to construct a holographic log containing timestamps, event types, data content, and data associations, thereby improving the complete record of system operation. By using holographic logs and reverse deduction models, the system can be rolled back to any specified time point, solving the problem that the backup and recovery mechanism cannot be rolled back arbitrarily. By continuously monitoring system operation information and using early warning analysis models, abnormal behaviors can be identified and prevented in real time, thereby improving the system's security protection capabilities. These functions jointly solve the problem that the backup and recovery mechanism cannot be rolled back to any time, resulting in incomplete system recovery data, and provide a more flexible and reliable system status recovery and security monitoring solution.

[0129] Holographic log reverse deduction model: The holographic log reverse deduction model is a reverse deduction algorithm model based on the holographic log data set, which is used to reversely deduce the system status and data content at the time point specified by the user.

[0130] Steps to build the holographic log reverse deduction model: Data preparation: Extract information related to the user rollback time point from the virtual disk generated by the holographic log, including all system operation tracks, user operation records, system status, security events and other data before that time point.

[0131] Model configuration: Receive the reverse derivation logic rules, which define the method of deducing the previous state and data from the subsequent state and data. Configure the reverse derivation logic rules in the reverse derivation model.

[0132] Reverse deduction: Substitute the user's rollback time point information into the reverse deduction model. The reverse deduction model reversely deduces the system status and data content at that time point based on the input time point information and the timestamp, event type, data content, and data association relationship in the holographic log data set.

[0133] Result output: The reverse derived system status and data content are output to the user, and the user can view the rolled-back data by accessing the virtual disk generated by the holographic log.

[0134] Early warning analysis model: The early warning analysis model is a machine learning-based model that is used to analyze real-time monitoring system operation information, identify potential security threats, and generate early warning analysis reports.

[0135] Steps to build the early warning analysis model: Data preprocessing: Receive the preset monitored system operation information range, including system processes, system files, system registry, system network, and system logs, etc. Preprocess the monitored data to form a data set suitable for training early warning analysis models. The data set includes known normal behavior and abnormal behavior samples.

[0136] Model training: Use the prepared training data set to train the early warning analysis model. Through machine learning algorithms, the model can learn and identify the characteristics of normal and abnormal behaviors.

[0137] Model deployment: Deploy the trained early warning analysis model to the monitoring system so that the model can receive and process system operation information in real time.

[0138] Anomaly detection and warning: When the warning analysis model detects abnormal behavior, the warning mechanism is triggered and a warning analysis report is generated. The report includes specific information about the abnormal behavior, such as the time of occurrence, scope of impact, possible causes, etc., to help system administrators understand and respond to potential security threats in a timely manner.

[0139] Program behavior pattern induction model (based on artificial intelligence algorithm): The program behavior pattern induction model is a model based on artificial intelligence algorithm, which is used to summarize and conclude the behavior patterns of programs, including the normal execution process of programs, resource access patterns, and network communication behaviors.

[0140] Build steps: Data collection: While continuously monitoring system operation information, collect program behavior data, including program execution process, resource access records, network communication behavior, etc.

[0141] Behavior pattern induction: Analyze and learn the collected program behavior data using the preset artificial intelligence algorithm to summarize the program's behavior patterns. These behavior patterns will be stored in the behavior pattern library as a benchmark for subsequent abnormal behavior identification.

[0142] Abnormal behavior identification: When the system detects a new program trying to access system resources or perform abnormal behavior, the new program's behavior pattern is compared with a known behavior pattern library. If the new program's behavior pattern does not match any known normal behavior pattern, it is considered a potential threat.

[0143] Out-of-bounds action prevention: Use the results of behavior pattern induction to identify and prevent out-of-bounds actions of existing programs. When an existing program attempts to perform operations beyond its normal behavior range, the system makes a judgment based on the results of behavior pattern induction and promptly prevents these out-of-bounds actions.

[0144] Through the construction and application of the above models, the present invention realizes rollback of system status at any time point, real-time monitoring and early warning, and intelligent analysis of program behavior patterns, effectively improving the system's data recovery flexibility, security protection capabilities, and manageability.

[0145] System data monitoring rules: System data monitoring rules define the types of system data that need to be monitored, the frequency of monitoring, and the conditions for triggering monitoring, so that the system can capture key operation trajectory data comprehensively and in real time.

[0146] Construction steps: First, carefully classify the acquired system data according to its nature and source, such as system startup data, system operation trajectory data, file system data, registry data, network activity data, process data, thread data, user operation data, system status change data, and security event data. Determine the necessity of monitoring each type of data based on the needs of system security and data recovery. Set a reasonable monitoring frequency for each type of data based on the dynamic nature and importance of the data. For example, system startup data may only need to be monitored once when the system starts, while network activity data requires real-time and high-frequency monitoring. Set trigger monitoring conditions for certain types of data, such as triggering detailed monitoring and data recording when file permission changes or abnormal process behavior are detected. Integrate monitoring rules into monitoring components and deploy monitoring components in the system. The monitoring component monitors system data in real time according to the set rules, and records and stores the captured data in the specified location.

[0147] Reverse deduction logic rules: Reverse deduction logic rules define the method of deducing previous states and data from subsequent states and data, which is used to build a holographic log reverse deduction model to achieve system rollback to any specified time point.

[0148] Construction steps: Clarify the goal of reverse deduction, that is, the data at which point in time the user wants to roll back to. Analyze the data association relationships in the holographic log data set, such as the association between the creation event of a file and the subsequent file read and write events, the association between the creation event of a process and the creation event of its child processes, etc. Design a reverse deduction algorithm based on the data association relationship. The algorithm needs to be able to reversely deduce the system status and data content at the time point specified by the user. Convert the reverse deduction algorithm into specific logical rules and verify them in a simulation environment to ensure the accuracy and effectiveness of the rules. Configure the reverse deduction logical rules in the reverse deduction model so that the model can use the holographic log data set for reverse deduction based on the input time point information.

[0149] Early warning analysis rules: Early warning analysis rules define the identification standards and early warning mechanisms for abnormal behaviors, and are used to build early warning analysis models to achieve real-time monitoring and early warning of system operation status.

[0150] Construction steps: Based on the requirements of system security and data integrity, define the standards for abnormal behavior, such as unauthorized file access, abnormal network connection, abnormal process behavior, etc. Extract the characteristics of abnormal behavior from the training data set, and use these characteristics to train the early warning analysis model. During the training process, the model will learn and identify the characteristics of normal and abnormal behaviors. Set the threshold for early warning analysis based on the training results and actual needs. When the system detects that the behavior characteristics exceed the early warning threshold, the early warning mechanism is triggered. Define the rules for generating early warning reports, including the content, format, and sending method of the report. The early warning report should contain specific information about the abnormal behavior, such as the time of occurrence, scope of impact, possible causes, etc. Deploy the early warning analysis rules to the monitoring system so that the system can receive and process system operation information in real time. When abnormal behavior is detected, the early warning mechanism is triggered and an early warning report is generated.

Claims

1. A system status recovery method based on UEFI, characterized in that: include: Step S101, obtaining system data, the system data including system startup data, system operation trajectory data, file system data, registry data, network activity data, process data, thread data, user operation data, system state change data and security event data; Step S102, classify the system data to obtain the system data classification result, monitor each type of data in the system data according to the system data classification result, obtain all operation trajectory data including the operating system, extract data features from all operation trajectory data including the operating system, and obtain system operation trajectory capture features, user operation record features, system status features, and security event features; Step S103, integrating the system operation trajectory capture features, user operation record features, system status features and security event features, and preprocessing the integrated data features to obtain a holographic log data set, which includes a timestamp, event type, data content and data association relationship; Step S104, receiving user data storage configuration information, establishing a holographic log generation virtual disk according to the user data storage configuration information, the holographic log generation virtual disk is used for the user to access the data of the holographic log generation virtual disk at a specified time point, receiving the user's rollback time point information, substituting the user's rollback time point information into the preset holographic log for reverse deduction model, and outputting the data information rolled back to the specified time pair; Step S105, continuously monitor the system operation information, the monitored system operation information includes system processes, system files, system registries, system networks and system logs, obtain real-time monitoring system operation information, substitute the real-time monitoring system operation information into a preset early warning analysis model, obtain the early warning analysis results of the real-time monitoring system operation information, and when continuously monitoring the system operation information, summarize the program behavior patterns through the preset artificial intelligence algorithm, identify and prevent new program intrusions and out-of-bounds actions of existing programs.

2. The UEFI-based system status recovery method according to claim 1, characterized in that: The step S101 includes: System startup data is used to record the process data from EFI / BIOS startup to the completion of operating system loading. System startup data includes hardware self-test results, startup sequence, and loaded drivers; System operation trajectory data is used to record events and state changes during system operation. System operation trajectory data includes the creation, termination, state changes of processes and threads, and the interactive relationship between creation, termination, and state changes; File system data is used to record the read and write operations of the file system. File system data includes file creation events, modification events, deletion events, copy events, move events, file attributes, and file permission changes; Registry data records changes in the Windows registry. Registry data includes the creation, modification, and deletion of key-value pairs; Network activity data records network connection and data transmission network activity data, including source address, destination address, port number, protocol type and transmitted data content; Process data is used to record the information of processes in the system. Process data includes process ID, name, path, start time and running status; Thread data is used to record detailed information of all threads in the system. Thread data includes thread ID, process, running status and priority. User operation data is used to record the user's keyboard and mouse operations. User operation data includes input content, click location, and operation time; System status change data is used to record changes in system status, including hardware status, software installation and uninstallation, and system updates; Security event data is used to record security events that occur in the system, including virus intrusions, malware activities, and permission changes.

3. The UEFI-based system status recovery method according to claim 1, characterized in that: The step S102 includes: The acquired system data is classified according to its nature and source to obtain system startup data, system operation trajectory data, file system data, registry data, network activity data, process data, thread data, user operation data, system status change data and security event data; According to the classification results of system data, set corresponding monitoring rules for each category of data. The monitoring rules include the type of data to be monitored, the frequency of monitoring, and the conditions for triggering monitoring; Deploy monitoring components in the system. The monitoring components monitor system data in real time according to the set monitoring rules. The monitoring components are integrated in the kernel layer or application layer of the operating system. After the monitoring component captures the system data, it records and stores it in the specified location; Integrate the captured system data to form an operation trajectory data set, which includes all operation trajectory data including the operating system, for subsequent analysis and recovery operations; Perform feature extraction on the integrated operation trajectory data to obtain system operation trajectory capture features, user operation record features, system status features, and security event features; The extracted features are stored in a feature library, and the feature library is updated in real time as the system data is continuously updated.

4. The UEFI-based system status recovery method according to claim 1, characterized in that: The step S103 includes: Integrate all extracted system operation trajectory capture features, user operation record features, system status features, and security event features to form a preliminary data set; Add a timestamp to each data item in the data set, which serves as a unified reference for the data item in time; divide the data item into different types of events based on its content, including system startup events, process creation events, file read and write events, and network connection events; Analyze the correlation between different events based on the timestamps of the events, and obtain the correlation between the file creation event and the subsequent file read and write events, and the correlation between the process creation event and the creation event of its child process; Determine the association between different files through file path, file name and file size attributes; Associating the user's behavior with the events in the system, wherein associating the user's behavior with the events in the system includes associating the user's keyboard input operation with the text editing event in the system, or associating the user's mouse operation with the window switching event in the system; The data association relationships obtained through analysis are stored in the database, and the integrated data features, timestamps, event types, and data association relationships are combined to construct a holographic log data set.

5. The UEFI-based system status recovery method according to claim 1, characterized in that: The step S104 includes: Receive user data storage configuration information, which includes data storage location, storage format, and data retention period. The user data storage configuration information will be used to guide the storage and management of holographic logs; According to the user's data storage configuration information, the system establishes a holographic log generation virtual disk, which is used to store and manage holographic log data; Extract information related to the user rollback time point from the virtual disk generated by the holographic log, and the information related to the user rollback time point includes all system operation tracks, user operation records, system status and security events before the time point; Using the extracted holographic log data, a reverse deduction model is constructed. The reverse deduction model reversely derives the system status and data content at the time point specified by the user; Receiving a reverse derivation logic rule, the reverse derivation logic rule defines derivation of a previous state and data from a subsequent state and data, configuring the reverse derivation logic rule in a reverse derivation model, and obtaining a reverse derivation model; Receive the user's rollback time point information, substitute the user's rollback time point information into the reverse deduction model, and output the data information rolled back to the specified time point. The reverse deduction model reversely derives the system status and data content at the time point based on the input time point information, and outputs it to the user. The user can view the rolled-back data by accessing the holographic log to generate a virtual disk.

6. The UEFI-based system status recovery method according to claim 1, characterized in that: The step S105 includes: Receive a preset range of monitored system operation information, which includes system processes, system files, system registries, system networks, and system logs; perform data monitoring based on the monitored system operation information; pre-process the monitored data to train a data set for an early warning analysis model; the data set for training an early warning analysis model includes known normal behavior and abnormal behavior samples; Using the prepared training data set to train the early warning analysis model, to obtain a trained early warning analysis model; Deploy the trained early warning analysis model to the monitoring system so that the trained early warning analysis model can receive and process system operation information in real time; When the early warning analysis model detects abnormal behavior, the early warning mechanism is triggered and an early warning analysis report is generated, which includes abnormal behavior information.

7. The UEFI-based system status recovery method according to claim 6, characterized in that: The step S105 includes: While continuously monitoring system operation information, it uses preset artificial intelligence algorithms to summarize the program's behavior patterns, including the program's normal execution process, resource access patterns, and network communication behaviors; According to the summarized behavior patterns, when the system detects that a new program attempts to access system resources or performs abnormal behavior, it compares the new program's attempt to access system resources or perform abnormal behavior with the known behavior patterns. If it does not conform to the normal behavior pattern, it is considered a potential threat; The results of behavioral pattern induction are used to identify and prevent out-of-bounds actions of existing programs. When an existing program attempts to perform operations beyond the normal behavior range of the existing program, the system prevents the out-of-bounds behavior.

Images