System-based data security monitoring method, equipment and medium

Abstract

The present invention discloses a system-based data security monitoring method, device and medium, which relates to the field of data security technology. By acquiring entity data and event types in log information, a reverse engineering model is constructed, the original features of nodes and edges are encoded according to the entity data and event types, the events generated by the node path are monitored, the vector representation of the events generated by the node path is acquired, and the vectors of the events generated by the node path are clustered. If there are outliers in the cluster, it is considered that an abnormal event is monitored, the node credibility of the abnormal event in the node path is calculated, the node credibility is evaluated, and the access permission change operation is performed on the node according to the credibility evaluation result. It is helpful to understand the full picture of the attack, dynamically adjust the access permission according to the credibility of the node, improve the adaptability and security of the system, and reduce the risk of data leakage.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and in particular to a system-based data security monitoring method, device and medium. Background Art

[0002] With the advent of the information age, data has become an important asset for enterprises and institutions. However, security issues such as data leakage, tampering, and loss occur frequently, causing huge economic losses to enterprises and institutions. In the existing technology, most data security monitoring methods rely on post-event detection and cannot effectively warn and prevent data security incidents before they occur. Therefore, there is an urgent need for a data security monitoring method that can monitor in real time and warn in advance to improve data security protection capabilities.

[0003] When operating the system, when multiple users try to modify the same row of data at the same time, data inconsistency may occur, that is, when one user is modifying the data, another user is also reading the data, which may result in incorrect data being read. A transaction reads the same data multiple times in the same query, but during this period, other transactions modify the data, that is, when multiple transactions modify the same data at the same time, concurrent access conflicts will occur. Concurrent access may cause security issues. When multiple users perform database operations at the same time, there may be a risk of data leakage. Then attackers can exploit database concurrency vulnerabilities to obtain unauthorized data, modify data, destroy data integrity, etc., posing serious security threats to the system. Among the existing technologies, log information analysis technology mainly collects, integrates, stores, analyzes and utilizes log data generated by systems, applications, networks, etc. to understand system operation conditions, discover potential problems and security threats.

[0004] Although existing technologies have made some progress in log analysis, abnormal event monitoring, and node credibility assessment, there are still some shortcomings and problems:

[0005] Log information analysis: Traditional log analysis methods are inefficient when processing large-scale and diverse log data, and it is difficult to effectively identify and associate log information from different sources;

[0006] Abnormal event monitoring: Existing anomaly detection technologies are limited in their ability to describe features and have limited ability to identify abnormal behaviors in complex scenarios;

[0007] Node credibility assessment: Existing node credibility assessment methods often ignore the impact of node behavior strategies on trust values, resulting in insufficient accuracy and effectiveness of the assessment results. Summary of the invention

[0008] The technical problem to be solved by the present invention is that the monitoring depth of the existing technology is limited and potential security issues cannot be accurately discovered in real time. The purpose is to provide a system-based data security monitoring method, equipment and medium. Through anomaly detection, potential security threats can be discovered in time, and a reverse engineering model can be built to track the source and propagation path of the event, which is helpful to understand the full picture of the attack. The access rights are dynamically adjusted according to the credibility of the node, which improves the adaptability and security of the system. Through credibility assessment, the risks of the node can be quantified to provide a basis for security decision-making, and security incidents can be quickly detected and notified to security administrators, so as to respond to security threats in time. It can protect the organization's data from unauthorized and unnecessary modifications, security threats and violations, and reduce the risk of data leakage.

[0009] The present invention is achieved through the following technical solutions:

[0010] The first aspect of the present invention provides a system-based data security monitoring method, comprising the following specific steps:

[0011] Retrieve log records, pre-process the retrieved logs, and associate and merge the pre-processed log information from different data sources;

[0012] Obtain entity data and event types in the associated and merged log information, and build a reverse engineering model based on the entity data and event types;

[0013] Based on the reverse engineering model, the original features of nodes and edges are encoded according to entity data and event types to obtain node paths;

[0014] Get the distance between two connected nodes in the node path and build a node distance matrix;

[0015] Obtain the attributes of the evaluated node, analyze the similarity in the entity data and event types of the two connected nodes in combination with the node distance matrix, and obtain the attribute two-dimensional vector of each node;

[0016] The original features of nodes and edges in the reverse engineering model are obtained according to the two-dimensional attribute vector of each node;

[0017] Monitor the events generated by the node path, obtain the vector representation of the events generated by the node path based on the original features of the nodes and edges, cluster the vectors of the events generated by the node path, and if there are outliers in the cluster, it is considered that an abnormal event has been monitored;

[0018] Calculate the node credibility of abnormal events in the node path and evaluate the node credibility;

[0019] The access rights of nodes are changed according to the credibility evaluation results. In the node path, the user access data of nodes whose credibility evaluation results are less than the set threshold are encrypted, and the access rights of the encrypted access data are verified.

[0020] Furthermore, the construction of the reverse engineering model specifically includes:

[0021] Get the identification of entity data and the definition of event types;

[0022] Obtain the identification and event type of the entity data in the associated and merged log information, perform data cleaning on the collected entity information and event information, and construct a reverse engineering diagram based on the cleaned data entity information and event information, including:

[0023] Get the timestamp of event information, build the timeline of event occurrence, and get the relevance of events;

[0024] Entities and events are defined as nodes in the graph, and edges are defined between nodes according to event correlation to generate a reverse engineering model.

[0025] Furthermore, the step of obtaining the distance between two connected nodes in the node path and constructing a node distance matrix specifically includes:

[0026] Construct an adjacency matrix of the graph, where the elements of the matrix represent the distances between nodes. If there is no direct path between two nodes, the element is set to infinity to indicate unreachability.

[0027] Calculate the shortest path distance between each pair of nodes in the graph. During the calculation, a priority queue is randomly maintained to select the unprocessed nodes with the smallest distance, and update the distances of their neighbor nodes.

[0028] Furthermore, encoding the original features of nodes and edges according to entity data and event types to obtain node paths specifically includes:

[0029] Extract the original features of nodes and edges in the reverse engineering model to obtain independent attribute information of each node;

[0030] The hierarchical feature hashing technology based on node attributes encodes the features of the nodes, including: projecting the high-dimensional input vector into the low-dimensional feature space, encoding the attributes of the nodes multiple times in the low-dimensional feature space, each encoding is at a different hierarchical level, and forming a node path according to the encoded data at different hierarchical levels.

[0031] Furthermore, forming a node path according to the encoded data at different hierarchical levels specifically includes:

[0032] Determine the key characteristics of node attributes at each hierarchy level;

[0033] Select the corresponding nodes at each hierarchy level based on the key features;

[0034] Associates the selected nodes in order of hierarchy levels to form a node path.

[0035] Furthermore, the node credibility is evaluated, specifically including:

[0036] Get the credibility of each node, and the penalty coefficient for reducing the credibility of the node that maliciously participates in the verification is α (0<α<1). Each time the node maliciously participates in the verification, the credibility is reduced, and each time it is reduced by R i =α×R i-1 ;

[0037] If the node credibility drops to a set threshold, a node authority change operation is performed on the node.

[0038] Furthermore, the credibility of each node is obtained, including:

[0039] Define evaluation nodes and obtain actual credibility and reference credibility of evaluation nodes;

[0040] Determine the evaluation deviation based on the actual credibility value and the reference credibility;

[0041] If the evaluation deviation is not less than the set threshold, the historical access times between node a and node b are obtained, the number of successful accesses and the number of failed accesses are extracted, and the empirical credibility is obtained;

[0042] The weights of actual credibility, reference credibility and empirical credibility are calculated, and the credibility of each node is determined according to the weights.

[0043] Furthermore, the encryption of user access data specifically includes:

[0044] Obtain the encrypted ciphertext of access data;

[0045] Obtain the user's access rights to the node and build an authorization list for the user and the node, where the authorization list represents a mapping that records the mapping relationship between the data ciphertext hash value and the user's public key;

[0046] The data ciphertext, initial encrypted ciphertext and authorization list are sent to the storage node; the storage node verifies the data ciphertext and initial encrypted ciphertext. If the verification is successful, they are stored. During the storage process, the ciphertext hash value and address are added to the lookup table, which is used by users to query the access rights of the node.

[0047] A second aspect of the present invention provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements a system-based data security monitoring method when executing the program.

[0048] A third aspect of the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements a system-based data security monitoring method.

[0049] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0050] Through anomaly detection, potential security threats can be discovered in time, and reverse engineering models can be built to track the source and propagation path of events, which helps to understand the full picture of the attack. Access rights can be dynamically adjusted according to the credibility of the node, which improves the system's adaptability and security. Through credibility assessment, the risk of the node can be quantified to provide a basis for security decision-making, and security incidents can be quickly detected and notified to security administrators, so as to respond to security threats in a timely manner. It can protect the organization's data from unauthorized and unnecessary modifications, security threats and violations, and reduce the risk of data leakage;

[0051] Able to collect and analyze system operation status data in real time, promptly identify potential security threats, and reduce the risk of data leakage and tampering;

[0052] It can cover the entire life cycle of data operations and ensure that data security is fully protected. It not only monitors data access and operation behaviors, but also considers the security during data transmission to provide comprehensive data protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] In order to more clearly illustrate the technical solutions of the exemplary embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments. It should be understood that the following drawings only illustrate certain embodiments of the present invention and should not be regarded as limiting the scope. For those of ordinary skill in the art, other relevant drawings can be obtained based on these drawings without creative work. In the drawings:

[0054] Figure 1 Flow chart of the data security monitoring method in an embodiment of the present invention. DETAILED DESCRIPTION

[0055] In order to make the objectives, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with embodiments and drawings. The exemplary embodiments of the present invention and their description are only used to explain the present invention and are not intended to limit the present invention.

[0056] As a possible implementation, Figure 1 As shown, this embodiment provides a system-based data security monitoring method, including the following specific steps:

[0057] Retrieve log records, pre-process the retrieved logs, and associate and merge the pre-processed log information from different data sources;

[0058] Obtain entity data and event types in the associated and merged log information, and build a reverse engineering model based on the entity data and event types;

[0059] Based on the reverse engineering model, the original features of nodes and edges are encoded according to entity data and event types to obtain node paths;

[0060] Get the distance between two connected nodes in the node path and build a node distance matrix;

[0061] Obtain the attributes of the evaluated node, analyze the similarity in the entity data and event types of the two connected nodes in combination with the node distance matrix, and obtain the attribute two-dimensional vector of each node;

[0062] The original features of nodes and edges in the reverse engineering model are obtained according to the two-dimensional attribute vector of each node;

[0063] Monitor the events generated by the node path, obtain the vector representation of the events generated by the node path based on the original features of the nodes and edges, cluster the vectors of the events generated by the node path, and if there are outliers in the cluster, it is considered that an abnormal event has been monitored;

[0064] Calculate the node credibility of abnormal events in the node path and evaluate the node credibility;

[0065] The access rights of nodes are changed according to the credibility evaluation results. In the node path, the user access data of nodes whose credibility evaluation results are less than the set threshold are encrypted, and the access rights of the encrypted access data are verified.

[0066] Specifically, this embodiment can construct a comprehensive log data view by acquiring and preprocessing log information from different data sources and associating and merging them, which is helpful for subsequent analysis and monitoring. Entity data and event types are extracted from the associated and merged logs, and a reverse engineering model is constructed, which is helpful for understanding the source and propagation path of the event. Based on the reverse engineering model, the points (entities) and edges (events) in the model are feature encoded to obtain the node path, which can identify and track the propagation path of the event. By monitoring the events generated by the node path and using vector representation for cluster analysis, outliers, that is, abnormal events, can be identified. By calculating the credibility of the nodes involved in the abnormal events, the access rights of the nodes are changed according to the credibility evaluation results of the nodes, which can prevent potential malicious behaviors. That is, through anomaly detection, potential security threats can be discovered in time. By constructing a reverse engineering model, the source and propagation path of the event can be tracked, which is helpful for understanding the full picture of the attack. The access rights are dynamically adjusted according to the credibility of the node, which improves the adaptability and security of the system. Through credibility evaluation, the risks of the nodes can be quantified to provide a basis for security decision-making.

[0067] As a possible implementation, entity data and event types generally include the following:

[0068] Event ID: a unique identifier for each event; Event initiator ID: a unique identifier for the user who initiated the event; Event initiator login name: the login name of the user who initiated the event; RepoID: a unique identifier for the file involved; Repo name: the name of the file involved; Repo organization ID: a unique identifier for the organization to which the file belongs; Repo organization name: the name of the organization to which the file belongs; Programming language: the programming language used by the file; Member ID: a unique identifier for the member involved; Identify the type of event: for example, Pull Request, Issue, Push, etc.; Event time: the specific time when the event occurred; Event behavior: a specific behavior, such as creation, update, deletion, etc.; Issue / pull_request ID: if the event is related to an issue or pull request; Issue / pull_request sequence number: the sequence number of the issue or pull request; Submission record ID: Code merge time: if it is a Pull Request event, it identifies the time when the code was merged; Number of lines of code added: the number of lines added in the code change; Number of lines of code reduced: the number of lines reduced in the code change; Number of files changed by pullrequest: Pull Request Number of files changed; Number of commits: number of commits pushed; Number of distinct commits: number of distinct commits.

[0069] As a possible implementation method, a reverse engineering model is constructed, specifically including:

[0070] Get the identification of entity data and the definition of event types;

[0071] Obtain the identification and event type of the entity data in the associated and merged log information, perform data cleaning on the collected entity information and event information, and construct a reverse engineering diagram based on the cleaned data entity information and event information, including:

[0072] Get the timestamp of event information, build the timeline of event occurrence, and get the relevance of events;

[0073] Entities and events are defined as nodes in the graph, and edges are defined between nodes according to event correlation to generate a reverse engineering model.

[0074] The original features of points (entities) and edges (events) are extracted from the reverse engineering model. These features can include the attributes of entities, the type of events, timestamps, frequencies, and other information. The independent attribute information of each node is obtained, and the features of the nodes are encoded using hierarchical feature hashing technology, which is a method of converting high-dimensional data into low-dimensional representations, which helps to reduce the complexity of the data while retaining key information. The high-dimensional input vector is projected into a low-dimensional feature space. This process can reduce the dimension of the data and reduce the computational complexity while retaining the main features of the data. The attributes of the nodes are encoded multiple times in the low-dimensional feature space, each encoding is at a different hierarchical level, which helps to capture the attributes and relationships of the nodes at different levels. According to the encoded data at different hierarchical levels, node paths are formed, which can represent the relationship between nodes and the propagation path of events. By mapping high-dimensional features to low-dimensional space, the complexity of data can be reduced and the processing efficiency can be improved. Through the hierarchical feature hashing technology, the key features of the nodes can be extracted, which helps to better understand and analyze the behavior of the nodes. Through multiple encodings and analysis at the hierarchical level, the paths between nodes can be identified, which is very important for tracking the propagation of events and understanding the network structure. By analyzing node paths, abnormal propagation patterns can be identified, which helps to detect and respond to security threats in a timely manner.

[0075] As a possible implementation method, the distance between two connected nodes in the node path is obtained, that is, a node distance matrix is ​​constructed, which contains the shortest path distances of all node pairs in the graph. After calculating the distances between all node pairs, a matrix is ​​constructed, and the rows and columns of the matrix represent the nodes in the graph. Each element in the matrix represents the distance between the corresponding node pairs. Then, the attribute information of the nodes is extracted from the graph. In the graph database, each node can have multiple attributes, which can be entity data and event types, etc. By calculating the similarity of the node attributes, the similarity in the entity data and event types of the two connected nodes is calculated. If the nodes represent entities, we can use Jaccard similarity, cosine similarity or other similarity metrics to compare the attributes of the entities. If the nodes represent events, the similarity between them is evaluated by the timestamps and other relevant attributes of the events.

[0076] As a possible implementation, a two-dimensional vector of attributes of each node is calculated, that is, the attributes of the node are converted into numerical form and then mathematical operations are performed. For example, if a node represents an entity, its attributes may include name, type, creation date, etc., and these attributes are converted into a vector, in which each dimension represents an attribute.

[0077] As a possible implementation method, the original features of nodes and edges in the reverse engineering model are obtained based on the attribute two-dimensional vector of each node. Machine learning technology can be used to analyze the node vector and extract features from it. These features can be used to build the reverse engineering model.

[0078] As a possible implementation, constructing the adjacency matrix of the graph and calculating the shortest path distance between each node pair can be performed as follows:

[0079] Step 1: Construct an adjacency matrix: Create a matrix A of size n×n, where n is the number of nodes in the graph, and the rows and columns of the matrix correspond to the nodes in the graph. For each element in the matrix A ij , if there is a direct path between node i and node j, A ij is the weight (distance) of this path. If there is no direct path between node i and node j, then A ij Set to infinity, the diagonal elements of the matrix A ii Indicates the distance from the node to itself, usually set to 0.

[0080] Step 2: Calculate the shortest path distance and create a matrix D of size n×n, where D ijDenotes the shortest path distance from node i to node j. Initially, D is the same as the adjacency matrix A. The Floyd-Warshall algorithm is used to calculate the shortest path distance between all node pairs. The algorithm updates the distance matrix D by considering all possible intermediate nodes. The specific steps are as follows: For each node k (from 1 to n):

[0081] For each node i (from 1 to n):

[0082] For each node j (from 1 to n):

[0083] If D ik +D kj <D ij , then update D ij =D ik +D kj .

[0084] Step 3: Use the Dijkstra algorithm of the priority queue to create a priority queue for selecting unprocessed nodes with the smallest distance. For each node s (as the starting point): set the distances of all nodes to infinity, except for the starting point s, whose distance is set to 0. Add the starting point s to the priority queue. When the priority queue is not empty: take out the node u with the smallest distance from the priority queue; for each neighbor node v of node u: calculate the new distance d=D from s to v su +D uv , if d <D sv , then update D s =d, and add node v to the priority queue.

[0085] After the above steps, the element D in the matrix D ij represents the shortest path distance from node i to node j. If D ij It is still infinite, indicating that there is no path from node i to node j.

[0086] As a possible implementation method, the original features of nodes and edges are encoded according to entity data and event types to obtain node paths, which specifically include:

[0087] Extract the original features of nodes and edges in the reverse engineering model to obtain the independent attribute information of each node. Extract the original features of each point (node) and edge (line connecting nodes) from the reverse engineering model. These features may include the attributes of nodes (such as type, status, etc.) and the attributes of edges (such as connection type, weight, etc.). The purpose of this step is to obtain the independent attribute information of each node. Based on the hierarchical feature hashing technique of node attributes, the features of nodes are encoded, including: projecting the high-dimensional input vector into a low-dimensional feature space, encoding the attributes of nodes multiple times in the low-dimensional feature space, each encoding at a different hierarchical structure level, determining the key features of the node attributes at each hierarchical structure level according to the encoded data at different hierarchical structure levels; selecting the corresponding nodes at each hierarchical structure level according to the key features; associating the selected nodes in the order of the hierarchical structure levels to form a node path. Among them, the hierarchical feature hashing technique is a method of mapping high-dimensional feature vectors to low-dimensional feature spaces. By encoding the attributes of nodes multiple times at different hierarchical structure levels, the purpose of dimensionality reduction is achieved. In each encoding process, it is carried out at different hierarchical structure levels, so that more original feature information can be retained and information loss can be reduced. The goal of the feature hashing method is to compress the original high-dimensional feature vector into a lower-dimensional feature vector while minimizing the loss of the expressive ability of the original features. In this way, the original N-dimensional feature vector can be compressed into an M-dimensional (M < N) feature vector. After multiple encodings, according to the encoded data at different hierarchical structure levels, a node path can be formed. A node path refers to the path from one node to another in the graph structure, and these paths can contain rich structural information.

[0088] As a possible implementation, when forming a node path according to the encoded data at different hierarchical structure levels, before forming the node path, it is first necessary to identify the key features of nodes at each hierarchical structure level. These key features can be the attributes of nodes, such as the type, status, weight, etc. of the nodes, so as to be able to select and associate nodes. After determining the key features, the next step is to select the corresponding nodes at each hierarchical structure level according to these features to ensure that the selected nodes meet specific feature requirements. Finally, the nodes selected according to the key features are associated in the order of the hierarchical structure levels to form a node path. This process is similar to the path construction in the path planning algorithm, where the order and connection relationship of nodes are the key to forming an effective path.

[0089] As a possible implementation, evaluate the node credibility, specifically including:

[0090] Define the evaluation node, obtain the actual credibility and reference credibility of the evaluation node; determine the evaluation deviation based on the actual credibility value and the reference credibility; if the evaluation deviation is not less than the set threshold, obtain the historical access times between node a and node b, extract the number of successful accesses and the number of failed accesses, and obtain the empirical credibility; calculate the weights of the actual credibility, reference credibility and empirical credibility, and determine the credibility of each node based on the weights; the penalty coefficient for reducing the credibility of nodes that maliciously participate in verification is α (0<α<1), and the credibility of the node is reduced every time it maliciously participates in verification, and each time it is reduced by R i =α×R i-1 ; If the node credibility drops to the set threshold, the node authority change operation is performed on the node. The credibility of each node is comprehensively determined based on the calculated weight, which will be used for subsequent decisions, such as the adjustment of access rights. The effects of evaluating node credibility include: by combining multiple credibility indicators, the credibility of the node can be more comprehensively evaluated, and its credibility assessment can be dynamically adjusted to reflect the latest status based on the actual performance and historical data of the node. By identifying nodes with low credibility, timely measures can be taken to reduce potential security risks.

[0091] As a possible implementation method, the access permission of the node is changed according to the credibility evaluation result, specifically including:

[0092] In the node path, the user access data is encrypted for the nodes whose credibility evaluation results are less than the set threshold;

[0093] The access rights of the encrypted access data are verified, specifically including: obtaining the encrypted ciphertext of the access data; obtaining the user's access rights to the node, and building an authorization list between the user and the node, wherein the authorization list represents a mapping for recording the mapping relationship between the data ciphertext hash value and the user's public key; sending the data ciphertext, the initial encrypted ciphertext and the authorization list to the storage node; the storage node verifies the data ciphertext and the initial encrypted ciphertext, and if the verification result is successful, it is stored. During the storage process, the ciphertext hash value and address are added to the lookup table, and the lookup table is used to query the user's access rights to the node. For nodes whose credibility evaluation results are lower than the threshold, their user access data needs to be encrypted. This can be achieved by selecting an appropriate encryption algorithm and generating a key. The purpose of encryption is to convert data into an unreadable form to protect the security of the data. The encrypted data needs to be verified for access rights. This includes obtaining the encrypted ciphertext of the access data and the user's access rights to the node. Access rights can be managed by building an authorization list, which is a mapping that records the relationship between the data ciphertext hash value and the user's public key. Sending the data ciphertext, initial encrypted ciphertext and authorization list to the storage node ensures the security of the data during transmission and provides the storage node with the necessary information for subsequent verification and storage. During the storage process, the ciphertext hash value and address are added to the lookup table so that users can query the access rights of the node. The lookup table maps the key code value to the position in the table through a hash function to speed up the search, where the lookup table is used for users to query the access rights of the node. The implementation of the hash table can adopt a variety of methods, such as direct addressing method, digital analysis method, etc., as well as methods for handling conflicts, such as open addressing method, chain address method, etc. This method can ensure that only users with appropriate permissions can access the encrypted data, while protecting the security and privacy of the data during transmission and storage. This process involves credibility assessment, data encryption, permission verification and the use of hash tables.

[0094] As a possible implementation, this embodiment provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, a system-based data security monitoring method is implemented.

[0095] As a possible implementation, this embodiment provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, a system-based data security monitoring method is implemented.

[0096] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A system-based data security monitoring method, characterized in that: The specific steps include: Retrieve log records, pre-process the retrieved logs, and associate and merge the pre-processed log information from different data sources; Obtain entity data and event types in the associated and merged log information, and build a reverse engineering model based on the entity data and event types; The construction of the reverse engineering model specifically includes: obtaining the identification of entity data and the definition of event types; obtaining the identification of entity data and event types in the associated and merged log information, performing data cleaning on the collected entity information and event information, and constructing a reverse engineering graph based on the cleaned data entity information and event information, including: obtaining the timestamp of the event information, constructing a timeline of the event occurrence, and obtaining the relevance of the event; defining entities and events as nodes in the graph, defining edges between nodes according to the event relevance, and generating a reverse engineering model; Based on the reverse engineering model, the original features of nodes and edges are encoded according to entity data and event types to obtain node paths; Obtaining the distance between two connected nodes in a node path and constructing a node distance matrix; the obtaining the distance between two connected nodes in a node path and constructing a node distance matrix specifically includes: constructing an adjacency matrix of a graph, wherein the elements of the matrix represent the distance between nodes, and if there is no direct path between two nodes, the element is set to infinity to express unreachability; calculating the shortest path distance between each pair of nodes in the graph, and during the calculation, selecting an unprocessed node with the smallest distance by randomly maintaining a priority queue, and updating the distance of its neighbor node; Obtain the attributes of the evaluated node, analyze the similarity in the entity data and event types of the two connected nodes in combination with the node distance matrix, and obtain the attribute two-dimensional vector of each node; The original features of nodes and edges in the reverse engineering model are obtained according to the two-dimensional attribute vector of each node; Monitor the events generated by the node path, obtain the vector representation of the events generated by the node path based on the original features of the nodes and edges, cluster the vectors of the events generated by the node path, and if there are outliers in the cluster, it is considered that an abnormal event has been monitored; Calculate the node credibility of abnormal events in the node path and evaluate the node credibility; the node credibility evaluation specifically includes: obtaining the credibility of each node, and reducing the credibility of the node maliciously participating in the verification by a penalty coefficient of α (0<α<1). Each time the node maliciously participates in the verification, the credibility is reduced, and each time the R is reduced i =α×R i-1 ; If the node credibility drops to a set threshold, the node authority change operation is performed on the node; Perform access rights change operations on nodes according to the credibility evaluation results. In the node path, encrypt user access data for nodes whose credibility evaluation results are less than the set threshold, and verify access rights for the encrypted access data. The encryption of user access data specifically includes: obtaining the encrypted ciphertext of the access data; obtaining the user's access rights to the node, and constructing an authorization list of the user and the node, wherein the authorization list represents a mapping for recording the mapping relationship between the data ciphertext hash value and the user's public key; sending the data ciphertext, the initial encrypted ciphertext and the authorization list to the storage node; the storage node verifies the data ciphertext and the initial encrypted ciphertext, and if the verification is successful, stores them, and during the storage process, adds the ciphertext hash value and the address to a lookup table, and the lookup table is used to query the user's access rights to the node.

2. The system-based data security monitoring method according to claim 1, characterized in that: The original features of nodes and edges are encoded according to entity data and event types to obtain node paths, specifically including: Extract the original features of nodes and edges in the reverse engineering model to obtain independent attribute information of each node; The hierarchical feature hashing technology based on node attributes encodes the features of the nodes, including: projecting the high-dimensional input vector into the low-dimensional feature space, encoding the attributes of the nodes multiple times in the low-dimensional feature space, each encoding is at a different hierarchical level, and forming a node path according to the encoded data at different hierarchical levels.

3. The system-based data security monitoring method according to claim 1, characterized in that: The forming of a node path according to the encoded data at different hierarchical levels specifically includes: Determine the key characteristics of node attributes at each hierarchy level; Select the corresponding nodes at each hierarchy level based on the key features; Associates the selected nodes in order of hierarchy levels to form a node path.

4. The system-based data security monitoring method according to claim 1, characterized in that: Get the credibility of each node, including: Define evaluation nodes and obtain actual credibility and reference credibility of evaluation nodes; Determine the evaluation deviation based on the actual credibility value and the reference credibility; If the evaluation deviation is not less than the set threshold, the historical access times between node a and node b are obtained, the number of successful accesses and the number of failed accesses are extracted, and the empirical credibility is obtained; The weights of actual credibility, reference credibility and empirical credibility are calculated, and the credibility of each node is determined according to the weights.

5. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the system-based data security monitoring method as described in any one of claims 1 to 4 is implemented.

6. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the system-based data security monitoring method as described in any one of claims 1 to 4 is implemented.

Images