Data utilization method and system of digital model

Abstract

The invention relates to the technical field of data mining, and discloses a data utilization method and system for a digital model, and the method comprises the steps: receiving and analyzing first feature data of a first object, and disassembling the first feature data into a plurality of second objects; a second object is selected to be processed, and a feature framework of the second object is generated; and unifying all the second objects to form comprehensive features of the second objects, and performing comprehensive evaluation. By analyzing a network security protection architecture, the accuracy of vulnerability detection is improved by using a deep neural network and an attention mechanism, and the misjudgment rate is reduced. Multi-source heterogeneous data are effectively fused, data feature evaluation is optimized, system performance is improved, and computing resources are saved. Through a digital model method, the expandability and maintainability of the system are enhanced, and manual dependence is reduced.

Description

Technical Field

[0001] The present invention relates to the technical field of data mining, and in particular to a data utilization method and system for a digital model. Background Art

[0002] With the widespread application of large models in the field of computer technology, using large models to find computer system vulnerabilities has become a common method for computer hackers and computer security personnel. At present, the use of large models to find computer system vulnerabilities is mainly to continuously update network topology and security equipment information, which consumes a lot of computing power in the cloud. At the same time, the maintenance and summary will lead to the generation of massive security alarms. The massive threat alarms directly affect the research and judgment of real attacks. Inexperienced monitoring personnel cannot make the most effective, decisive and powerful emergency measures at the first time of security incidents, which is extremely likely to lead to more serious system privilege escalation, lateral diffusion and other events. To this end, it is necessary to propose a data utilization method and system for digital models to address the high misjudgment rate of traditional large models in finding network vulnerabilities. Summary of the invention

[0003] In view of the above-mentioned problems, the present invention is proposed.

[0004] Therefore, the technical problem solved by the present invention is: in large-scale electricity consumption data analysis, how to effectively extract user behavior characteristics and perform accurate grouping through an optimized clustering algorithm.

[0005] In order to solve the above technical problems, the present invention provides the following technical solutions: a data utilization method of a digital model, comprising:

[0006] Receiving and parsing first characteristic data of a first object, and disassembling a plurality of second objects;

[0007] selecting a second object for processing to generate a feature frame of the second object;

[0008] All second objects are unified to form the comprehensive characteristics of the second objects and conduct a comprehensive evaluation.

[0009] As a preferred solution of the data utilization method of the digital model described in the present invention, wherein:

[0010] The first characteristic data of the first object includes data reflecting basic characteristics and preliminary status of the first object.

[0011] As a preferred solution of the data utilization method of the digital model of the present invention, wherein: the disassembling of the plurality of second objects includes defining a disassembling rule using the parsed first data of the first object;

[0012] The first object is disassembled by using the disassembly rule to disassemble a plurality of second objects.

[0013] As a preferred solution of the data utilization method of the digital model of the present invention, wherein: the extracting the first feature of the second object includes selecting a second object and analyzing the purpose of the second object;

[0014] extracting a first feature of the second object based on a purpose of the second object;

[0015] A feature framework of the second object is generated by constraining the first feature of the second object by using the usage of the second object.

[0016] As a preferred solution of the data utilization method of the digital model of the present invention, wherein: the forming of the comprehensive features of the second object and the evaluation includes establishing a corresponding relationship between the feature framework of the second object and the second object, uniformly processing different second objects, extracting the data features of the second object and fusing them to form the comprehensive features of the second object;

[0017] Based on the comprehensive characteristics of the second object, a comprehensive evaluation is performed using the network model.

[0018] As a preferred solution of the data utilization method of the digital model described in the present invention, the extraction of data features of the second object for fusion includes but is not limited to, using a Bayesian fusion algorithm to fuse the data features of the second object to form comprehensive features of the second object.

[0019] As a preferred solution of the data utilization method of the digital model described in the present invention, the comprehensive evaluation using the network model includes but is not limited to the comprehensive evaluation of the comprehensive characteristics of the second object using a hierarchical clustering algorithm model.

[0020] A data utilization system for a digital model, wherein:

[0021] A disassembly module receives and analyzes the first characteristic data of the first object, and disassembles a plurality of second objects;

[0022] A processing module selects a second object for processing and generates a feature framework of the second object;

[0023] The evaluation module unifies all the second objects, forms the comprehensive characteristics of the second objects, and performs a comprehensive evaluation.

[0024] A computer device comprises: a memory and a processor; the memory stores a computer program, wherein the processor implements the steps of any one of the methods of the present invention when executing the computer program.

[0025] A computer-readable storage medium stores a computer program, wherein the computer program, when executed by a processor, implements the steps of any one of the methods of the present invention.

[0026] Beneficial effects of the present invention: The data utilization method of the digital model provided by the present invention analyzes the network security protection architecture, uses deep neural networks and attention mechanisms to improve the accuracy of vulnerability detection and reduce the misjudgment rate. It effectively integrates multi-source heterogeneous data, optimizes data feature evaluation, improves system performance, and saves computing resources. Through the digital model method, the scalability and maintainability of the system are enhanced, and manual dependence is reduced. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0028] Figure 1 This is an overall flow chart of the data utilization method of the digital model provided in the first embodiment of the present invention. DETAILED DESCRIPTION

[0029] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings of the specification. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without creative work should fall within the scope of protection of the present invention.

[0030] Example 1, reference Figure 1 , as an embodiment of the present invention, provides a data utilization method of a digital model, comprising:

[0031] S1: Receive and analyze first feature data of a first object, and disassemble it into a plurality of second objects.

[0032] In one implementation of this application, the first object is to improve the accuracy of network security vulnerability detection by analyzing the network security protection architecture and disassembling it into multiple ontology models, using deep neural networks to extract data features, and effectively reducing the misjudgment rate; the second object is to optimize the fusion and evaluation efficiency of multi-source heterogeneous data, using attention mechanisms and semantic programming technology to achieve effective fusion and integration of different source data, improve processing efficiency and reduce computing resource consumption. The specific implementation is to ensure the accuracy, consistency and integrity of the data through steps such as parsing and disassembling the network security architecture, feature extraction and constraints, semantic correspondence and alignment, data fusion and evaluation, and improve the accuracy of vulnerability detection and overall network security protection capabilities.

[0033] In an optional embodiment, the first object can also be to enhance the visualization and management capabilities of the network security protection architecture, and by constructing the semantic correspondence of the multi-ontology model, the comprehensive visualization of the network security architecture can be achieved, which is convenient for security managers to monitor and make decisions. The second object can also be to improve the automation and intelligence level of data processing, and use deep learning and automated process orchestration systems to achieve automated management of the data processing process, reduce manual intervention, and improve system response speed and accuracy. Through these optional objects, the present invention not only improves the accuracy and efficiency of vulnerability detection, but also optimizes the management of the network security architecture and the intelligence level of data processing, and further enhances the overall network security protection capabilities.

[0034] The first characteristic data of the first object includes data reflecting the basic characteristics and preliminary status of the network security protection architecture. These data include topological information of the network architecture, configuration parameters of various protection devices, vulnerability information, historical attack behaviors, system access logs, etc., which can provide an overview of the basic composition and current status of the network security protection system. These data are the basis for identifying and evaluating potential vulnerabilities, helping to build deep learning models for vulnerability detection and protection, further optimizing the detection process and improving accuracy.

[0035] By defining the disassembly rules, the first object data reflecting the basic characteristics and preliminary status of the network security protection architecture is disassembled into multiple second objects. First, the characteristic data of the first object is parsed, including network topology, device configuration, vulnerability information, access logs, etc. Then, according to the disassembly rules, the network topology structure, device configuration, vulnerability type, access log and other information are classified and disassembled to form multiple second objects with independent characteristics, such as firewall configuration, intrusion detection system, vulnerability type, access log and network topology information. This process provides more accurate data support for subsequent vulnerability detection and protection by refining the various components of the network security protection architecture.

[0036] S2: Select a second object for processing and generate a feature framework of the second object.

[0037] The selecting a second object for processing includes selecting a second object and analyzing the purpose of the second object.

[0038] A first feature of the second object is extracted based on a usage of the second object.

[0039] A feature framework of the second object is generated by constraining the first feature of the second object by using the usage of the second object.

[0040] Select objects related to network security protection from multi-source data, such as network devices, modules or system components. Clarify the function and role of the second object in the network security protection system, such as firewalls, intrusion detection systems (IDS), etc., which are used to prevent attacks, detect threats or record logs. Based on the purpose of the second object, extract feature data that describes the function and performance of the object, such as operating status, configuration parameters, attack detection results, etc. Constrain the first feature in combination with the purpose, and generate a feature framework for evaluating and enhancing network security protection. For example, the feature framework of a firewall may include rule sets, traffic filtering efficiency, etc., while the feature framework of an IDS may include detection rate, false alarm rate, etc.

[0041] S3: Unify all second objects, form comprehensive characteristics of the second objects, and conduct a comprehensive evaluation.

[0042] Forming a comprehensive feature of the second object and evaluating it includes establishing a corresponding relationship between the feature framework of the second object and the second object, uniformly processing different second objects, extracting data features of the second object, fusing them, and forming a comprehensive feature of the second object;

[0043] Based on the comprehensive characteristics of the second object, a comprehensive evaluation is performed using the network model.

[0044] In one implementation of the present application, the data features of the second object are extracted and fused, and the data features of the second object are extracted and fused using a Bayesian fusion algorithm. First, the feature data of each second object is extracted from multiple feature sources (such as traffic, load, log, etc.). Then, a Bayesian model is constructed, the prior probability is set, and the conditional probability (i.e., likelihood function) of each feature source under different states is calculated. By combining the prior probability and the conditional probability through Bayes' theorem, the posterior probability is calculated under given observation data. The posterior probabilities of multiple feature sources are fused and normalized to obtain the probability distribution of each state. Finally, a decision is made based on the maximum value of the posterior probability to determine the comprehensive features and state of the second object. This method improves the accuracy and robustness of the system by fusing multi-source information.

[0045] In an optional embodiment, a method combining a weighted voting algorithm and a support vector machine (SVM) is used to fuse the data features of the second object. First, a variety of data features of the second object are extracted and standardized. Then, multiple classifiers (such as decision trees, k-NN, logistic regression, etc.) are used to classify the features, and a preliminary decision is generated based on the prediction results of the classifiers through weighted voting. Next, the weighted voting results are combined with the original features and used as input to train the SVM model, which further improves the classification accuracy through optimized decision boundaries. Finally, the comprehensive decision results are output through the SVM model to improve the accuracy and robustness of vulnerability detection and security protection. This method effectively combines the advantages of different models and can provide more accurate decision support in complex security detection tasks.

[0046] In one implementation of the present application, a hierarchical clustering algorithm model is used to comprehensively evaluate the comprehensive features of the second object. First, the comprehensive features of the second object are extracted and fused through the aforementioned steps to form a high-dimensional feature vector. Then, a hierarchical clustering algorithm is applied to gradually construct a clustering tree by calculating the similarity or distance measurement between the features to form different feature groups. The algorithm effectively identifies the potential structure in the data through a bottom-up aggregation method, thereby providing a basis for the feature grouping of the second object. By evaluating the clustering results, the importance of each feature in the network security protection architecture and its potential correlation can be further understood, helping to identify security vulnerabilities and weak links in the system. Finally, the network model optimizes the security protection strategy and vulnerability detection mechanism based on the evaluation results of the hierarchical clustering, thereby improving the system's protection capabilities and response efficiency.

[0047] In an optional embodiment, the k-nearest neighbor algorithm (KNN) can also be used to evaluate the comprehensive features of the second object. First, based on the comprehensive features of the second object previously fused, a training data set is constructed, which contains the feature values ​​of different second objects and their corresponding labels or categories. Then, the KNN algorithm is used to calculate the distance between the comprehensive features of the second object to be evaluated and each sample in the training set. Common distance measurement methods include Euclidean distance, Manhattan distance, etc. The KNN algorithm selects the nearest K neighbors and votes or weighted votes based on the labels of these neighbors to determine the predicted category or evaluation result of the second object. Finally, by adjusting the K value and the distance measurement method, the KNN model is continuously optimized to improve the accuracy and effect of the evaluation. This process helps to quickly and accurately classify and evaluate the comprehensive features of different second objects, thereby enhancing the judgment ability and response speed of the network security protection architecture.

[0048] Furthermore, by unifying the feature framework of the second object and establishing corresponding relationships, different types of second objects are integrated to form a unified and comprehensive comprehensive feature, eliminating differences between objects and enhancing the consistency of data processing. Through feature fusion, more comprehensive and accurate data features are extracted to provide a reliable basis for subsequent comprehensive evaluation. Using network models to evaluate comprehensive features can fully adapt to complex security protection needs, automatically optimize evaluation strategies, and improve the accuracy of vulnerability detection and risk identification, thereby significantly improving the intelligence level and decision support capabilities of the system.

[0049] Embodiment 2 is an embodiment of the present invention, S000, receiving a network security protection architecture.

[0050] Specifically, the database of the server is requested through the program interface, which ensures the call to the database and generates the image file. The call and mirroring of the database through the program interface can effectively prevent the Trojanization of data in the receiving network security protection architecture. The program interface can limit the rate and prevent malicious users from guessing passwords through brute force attacks or exploiting vulnerabilities and access rights to mirror data in the database, which can greatly reduce security risks.

[0051] S100, analyze the network security protection architecture to disassemble multiple ontology models.

[0052] Specifically, using probes to collect, monitor and analyze system or network operation data in real time can speed up access efficiency, and the combination of probes and mirrors is compatible. Situational awareness probes are used to monitor network dynamic data flows, and can also detect potential security threats in a timely manner, improving the organization's security situation awareness capabilities.

[0053] The network security protection architecture can have multiple ontology models such as "event system", "automated process orchestration system", "scheduled operation system", "equipment integration system" and "emergency response system".

[0054] As the management of system probes tends to be integrated, unified platform management and configuration of various types of probes can simplify operational complexity and improve management efficiency.

[0055] S200, selecting an ontology model.

[0056] S300, determining the target and scope of the ontology model.

[0057] Specifically, since different ontology models in the database need to meet the needs of different fields and scenarios, data from different sources, formats and qualities are standardized and normalized to achieve integration, that is, to integrate scattered data to provide a comprehensive view. Through the analysis and processing of different data sources, new information or data types are generated, emphasizing the integration and conflict resolution of multi-source data. Data fusion algorithms generally refer to all methods used to perform various data processing and symbolic reasoning on multiple data obtained from multi-source systems, aiming to form a system-consistent result.

[0058] Faced with the data coverage of different targets, it is necessary to merge data from multiple data sources into a consistent data storage to provide a unified access path or address.

[0059] S400, based on the objective of the ontology model, extracting the classes, attributes, and relations of the data in the ontology model.

[0060] Specifically, based on the original nature of the data, data flexibility can be improved, allowing data to be instantiated through classes, thereby generating specific objects with multiple representational characteristics.

[0061] The same properties of multiple classes constitute attributes. Attributes are data elements that describe the characteristics of an object. These attributes define the state of the object and allow the object to adjust its state according to the needs of program logic. Simply, different data classes can be instantiated by adjusting the state of the attributes.

[0062] In this embodiment, even if the data class in the ontology model is illegally tampered with, the correctness, completeness and consistency can be judged through the data rule traceability of the class, thereby realizing vulnerability screening with a smaller amount of data.

[0063] The relationship between data is actually the mapping rule, which is a function of the instantiation of the data class.

[0064] The relationship between data can be applied in three directions: the first is the instantiation of data classes, the second is the correspondence between constraint frameworks and ontology models, and the third is the alignment of different ontology models.

[0065] S500: Using the scope of the ontology model, constrain the classes, attributes, and relationships of the data to form a constraint framework.

[0066] Specifically, the constraint framework actually has three characteristics: heterogeneous constraints, distributed constraints, and autonomous constraints. These three characteristics correspond to three data types: collaborative, complementary, and redundant.

[0067] S600: Establishing a semantic correspondence between the constraint framework and the ontology model.

[0068] Specifically, the semantic structure includes components and component structures. In this embodiment, the components of the ontology model are basically data classes, and the components of the constraint framework are attributes. The component structure is a mapping from the data classes of the ontology model to the attributes of the constraint framework.

[0069] S700, returning to the step of selecting an ontology model until all ontology models are selected.

[0070] S800, aligns different ontology models to form fused data features.

[0071] Specifically, different ontology models will correspond to different constraint frameworks. Extracting features from the attributes of different constraint frameworks is the alignment process of different ontology models, and the extracted features are the fused data features.

[0072] First, define the prior probabilities of data features in each ontology model. These priors are based on the characteristics of the model objectives and data sources. Then, the conditional probabilities between the features are calculated through the data collected and monitored in real time by the probe. The posterior probabilities of data features are updated by combining the prior and conditional probabilities using Bayesian theorem, thereby achieving weighted fusion of data features. In the feature fusion process, collaborative, complementary, and redundant data are processed separately, and the fusion results are optimized according to their posterior probabilities. Finally, the fused data is comprehensively evaluated through deep neural networks or other evaluation methods to ensure the correctness, completeness, and consistency of the data. The entire process takes advantage of the Bayesian algorithm, which not only improves the accuracy of data fusion, but also enhances the vulnerability detection capabilities of the network security protection architecture.

[0073] It is worth mentioning that the network security protection architecture is subject to network security scenarios and requirements, so the fused data features have the functions of data fusion and integration.

[0074] S900,systematically evaluates data features based on the semantic structure and semantic relations of multi-source heterogeneous data.

[0075] The present application relates to a data utilization method for a digital model. By analyzing the network security protection architecture, multiple ontology models are disassembled, and the feature extraction and representation capabilities of deep neural networks are used to determine the target and scope of each ontology model. Deep neural networks can learn multi-layer abstract representations of data, and form constraints on the classes, attributes, and relationships of the data in the extracted ontology model, thereby capturing the internal structure and external relationships in the data. The utilization of the semantic structure and semantic relationship of multi-source heterogeneous data is actually the utilization of fused data features. The attention mechanism is used to enhance the efficiency and effect of data fusion and integration. The attention mechanism can improve the efficiency of data fusion and integration because it can reduce the amount of calculation and memory consumption and improve the effect of data fusion and integration. Indicators such as interpretability, credibility, and controllability are used to evaluate and optimize the process and results of data fusion and integration. Based on the semantic structure and semantic relationship of multi-source heterogeneous data, the correctness, completeness, and consistency of the newly generated data can be judged, and a higher vulnerability search capability can be achieved.

[0076] In one embodiment of the present application, S000 includes:

[0077] S010, calling the management data of the adapter.

[0078] Specifically, program interfaces can be classified according to the granularity of the services they provide. Adapters can manage program interfaces of multiple different granularities.

[0079] S020, determining a program interface set of a system module based on management data of the adapter.

[0080] Specifically, program interfaces usually appear in the form of classes and methods. These interfaces define how objects interact with each other. When different program interfaces are called, various system modules of the network security protection architecture can be connected.

[0081] S030, select a program interface for a system module.

[0082] S040, using the program interface of the system module to access the system module.

[0083] S050, mirror the system module.

[0084] Specifically, mirroring provides a high degree of data consistency because data is updated almost simultaneously in two places, preventing delays in system data updates that could cause vulnerabilities to be missed.

[0085] S060, returning to the process of selecting a program interface of a system module until the program interfaces of all system modules are selected.

[0086] S070, generating a mirror system of a network security protection architecture based on the mirror data; and defining the mirror system as a target system.

[0087] This embodiment relates to a receiving network security protection architecture. A mirror system of the network security protection architecture is generated by a mirroring method, which improves the efficiency of data synchronization. The program interface can be rate-limited to prevent malicious users from guessing passwords or exploiting vulnerabilities through brute force attacks and using access rights to mirror data in the database, which can greatly reduce security risks.

[0088] In one embodiment of the present application, S100 includes:

[0089] S110, calling the target system.

[0090] S120, using a system probe, determining the architecture of the target system.

[0091] Specifically, in the field of network security, situational awareness probes are mainly used to monitor network traffic and detect potential security threats, and can also improve the organization's security situational awareness capabilities.

[0092] The dynamic data of the target system can be detected in real time through system probes, and the architecture of the target system can be determined by analyzing the dynamic data.

[0093] S130, based on the architecture of the target system, determining the core architecture of the target system and the non-core architecture of the target system.

[0094] Specifically, the network security protection architecture includes five core architectures: "event system", "automated process orchestration system", "scheduled operation system", "equipment integration system" and "emergency response system", and three non-core architectures: "security homepage", "work order system" and "settings center".

[0095] S140, select the core architecture of the target system.

[0096] S150,parses the various components of the core architecture through query language and data acquisition protocol.

[0097] Specifically, SPARQL and RDF are data acquisition protocols and query languages, which together support efficient management and query of complex data such as knowledge graphs.

[0098] S160, select a component in a non-core architecture of the target system.

[0099] S170, determining a program interface between the component in the non-core architecture and each component in the core architecture.

[0100] Specifically, there are two types of data interaction between the core architecture and the non-core architecture: collaborative and complementary. Data interaction can be achieved through program interfaces.

[0101] S180, returning to the process of selecting a component in the non-core architecture of the target system until all components in the non-core architecture of the target system are selected.

[0102] This embodiment involves disassembling the ontology model. Using probes to collect, monitor and analyze system or network operation data in real time can speed up access efficiency, and the combination of probes and mirrors is compatible. Situation awareness probes are used to monitor network dynamic data flows, and can also detect potential security threats in a timely manner, improving the organization's security situation awareness capabilities.

[0103] In one embodiment of the present application, S150 includes:

[0104] S151, select the event system of the core architecture.

[0105] S152, determine the ontology model of the event system.

[0106] Specifically, the event system can be used to accurately manage, aggregate, and respond to various events connected to various devices and products. It can quickly locate security events and effectively implement automated responses to security events.

[0107] S153, select the automated process orchestration system of the core architecture.

[0108] S154, determining an ontology model of the automated process orchestration system.

[0109] Specifically, the automated process orchestration system orchestrates automated response processes in an intuitive way and improves the work efficiency of the security operations team.

[0110] S155, select the scheduled operation system of the core architecture.

[0111] S156, determining the ontology model of the scheduled operation system.

[0112] Specifically, the security automation orchestration and response platform can write daily inspections and other behaviors into scripts, perform regular scheduling, and save daily operation and maintenance time.

[0113] S157, select the core architecture of the equipment integration system.

[0114] S158, determine the ontology model of the equipment integration system.

[0115] Specifically, through the device integration system, many security devices and products are integrated into one platform, and their core capabilities are abstracted into functions. The security products and various devices inherent in the platform and information center are linked together through simple configuration, so that all products and devices can be easily managed and used.

[0116] S159, select the core architecture of the emergency response system.

[0117] S159a, determine the ontology model of the emergency response system.

[0118] Specifically, the emergency response system supports multiple security personnel to communicate and work instantly on a unified interface. At the same time, the device interface and script can be called through a quick call list or command line call statement. The team can stay on the same page and connect "personnel, equipment, and event process" in series to achieve a comprehensive response and disposal of security alerts.

[0119] In one embodiment of the present application, S300 includes:

[0120] S310, parsing the data type processed by the ontology model.

[0121] Specifically, the data types include collaborative, complementary, and redundant.

[0122] S320: Based on the parsing result, determine whether the data processed by the ontology model is collaborative.

[0123] S330: If the data processed by the ontology model is collaborative, determine that the goal of the ontology model is data fusion and integration.

[0124] Specifically, collaborative data provides more comprehensive information through cooperation. For example, in multimodal recognition, voice and image information are used simultaneously to improve the accuracy and robustness of recognition. This type of data fusion can make up for the limitations of a single data source and enhance the overall performance of the system through the complementarity and synergy between different data sources.

[0125] S340: Based on the objective of the ontology model, determine the scope of data processed by the ontology model.

[0126] S350: If the data processed by the ontology model is not of a collaborative type, determine whether the data processed by the ontology model is of a complementary type.

[0127] S360, if the data processed by the ontology model is complementary, then the program interface between each component in the non-core architecture and each component in the core architecture is called.

[0128] Specifically, complementary data usually belongs to the same category but covers different aspects or dimensions. For example, voice data may come from recordings at different times or angles. The integration of such data helps to build a more complete and rich data set, thereby improving the depth and breadth of data analysis. By integrating this data, a more comprehensive perspective can be obtained to better understand and solve problems.

[0129] S370, based on the program interface, determine the goal and scope of the ontology model.

[0130] S380: If the data processed by the ontology model is not complementary, determine that the data processed by the ontology model is redundant.

[0131] Specifically, redundant data also belongs to the same category, but the data itself has more overlap, such as data captured by two cameras with overlapping coverage. In fact, redundant data plays an important role in improving the reliability and fault tolerance of the system. For example, when a data source fails or data is lost, redundant data can be used to recover or replace the lost information to ensure the continuous operation of the system and data integrity.

[0132] S390, using multimodal data analysis on the data processed by the ontology model to determine the goal and scope of the ontology model.

[0133] This embodiment involves determining the objectives and scope of the ontology model.Data fusion technology combines data from multiple information sources and information of related data to achieve higher accuracy and more specific inferences than can be achieved using a single information source alone.

[0134] In one embodiment of the present application, S400 includes:

[0135] S410, selecting an ontology model.

[0136] S420, determining the technical architecture of the data based on the purpose of the data processed by the ontology model.

[0137] S430, uses the technical architecture of data to perform semantic programming.

[0138] Specifically, based on Prolog, lists and trees are used as basic data structures to transform variables and constants in the technical architecture of the data into classes, attributes, and relationships of the data in the ontology model.

[0139] It is also possible to form the classes, attributes and relationships of the data in the ontology model based on Mercury's type system and modular design.

[0140] S440, based on the preprocessing of semantic programming, generating classes, attributes, and relations of data in the ontology model.

[0141] S450, returning to the step of selecting an ontology model until all ontology models are selected.

[0142] Specifically, based on the original nature of the data, data flexibility can be improved, allowing data to be instantiated through classes, thereby generating specific objects with multiple representational characteristics.

[0143] The same properties of multiple classes constitute attributes. Attributes are data elements that describe the characteristics of an object. These attributes define the state of the object and allow the object to adjust its state according to the needs of program logic. Simply, different data classes can be instantiated by adjusting the state of the attributes.

[0144] In this embodiment, even if the data class in the ontology model is illegally tampered with, the correctness, completeness and consistency can be judged through the data rule traceability of the class, thereby realizing vulnerability screening with a smaller amount of data.

[0145] In one embodiment of the present application, S500 includes:

[0146] S510, selecting an ontology model.

[0147] S520, calling the classes, attributes, and relationships of the data in the ontology model.

[0148] S530, parsing the hierarchical structure among classes, attributes, and relationships.

[0149] Specifically, data fusion technology is not only used for simple data integration, but also involves complex data processing and analysis. Effective data fusion can significantly improve data quality and provide stronger support for decision-making.

[0150] In practical applications, selecting appropriate data fusion strategies according to specific needs can maximize the utility of data and improve the efficiency and intelligence level of the system.

[0151] S540, generating constraint conditions of the ontology model by using the hierarchical structure and the scope of the ontology model.

[0152] S550, constrain data classes, attributes, and relationships in a standardized language.

[0153] In fact, the constraint framework has three characteristics: heterogeneous constraints, distributed constraints and autonomous constraints. These three characteristics correspond to three data types: collaborative, complementary and redundant.

[0154] In one embodiment of the present application, S600 includes:

[0155] S610: Select a constraint framework.

[0156] S620, preprocessing the constraint framework.

[0157] Specifically, OWL can be used for preprocessing. OWL provides a rich set of constructors to define classes and attributes, and supports complex class expressions such as intersection, union, complement, etc. This enables OWL to describe complex class relationships and constraints and support advanced logical reasoning functions.

[0158] Data cleaning and preprocessing are key steps to ensure data quality. This includes removing duplicate data, correcting errors, and handling missing values. In particular, data from different sources needs to be standardized to ensure data consistency and comparability. For example, the format of timestamps and currency unit conversion are common preprocessing tasks.

[0159] S630, matching the preprocessed constraint framework with the ontology model to determine a corresponding relationship.

[0160] Specifically, the semantic structure includes components and component structures. In this embodiment, the components of the ontology model are basically data classes, and the components of the constraint framework are attributes. The component structure is a mapping from the data classes of the ontology model to the attributes of the constraint framework.

[0161] S640, using the corresponding relationship, aligning the constraint framework with the ontology model.

[0162] S650, returning to the step of selecting a constraint frame until all constraint frames are selected.

[0163] S660, verify the consistency of all constraint frameworks to achieve preliminary alignment of the ontology model.

[0164] Specifically, the semantic structure includes components and component structures. In this embodiment, the components of the ontology model are basically data classes, and the components of the constraint framework are attributes. The component structure is a mapping from the data classes of the ontology model to the attributes of the constraint framework.

[0165] In one embodiment of the present application, S900 includes:

[0166] The fused data features obtained from the previous step S800 include feature alignment results of different ontology models, and these features are standardized to ensure data consistency.

[0167] Feature formatting: All features are unified into vector representation to facilitate processing by hierarchical clustering algorithms.

[0168] The hierarchical clustering algorithm builds a tree structure by recursively merging or splitting data. The specific implementation is as follows:

[0169] According to the comprehensive features of the second object, a distance matrix between all features is calculated using a suitable distance metric method (such as Euclidean distance, Manhattan distance or cosine similarity).

[0170] The distance matrix represents the similarity or difference between every two data points (comprehensive features) and is the basis of hierarchical clustering.

[0171] Using bottom-up agglomerative hierarchical clustering:

[0172] Initially, each feature point is considered as an independent cluster.

[0173] Recursively merge the two closest clusters until the set level or number of clusters is reached.

[0174] Or use top-down divisive hierarchical clustering:

[0175] Start with an overall cluster and gradually divide it into multiple subclusters.

[0176] Based on the calculation results of the distance matrix, a clustering algorithm (such as the single linkage method, the complete linkage method, or the average linkage method) is used to construct a clustering tree (Dendrogram) to visualize the relationship between different features.

[0177] By observing the branch structure of the clustering tree and setting an appropriate cutting threshold, the optimal number of clusters can be obtained. The characteristics of each cluster group are analyzed to evaluate its internal consistency and inter-group differences. Specific evaluation indicators include:

[0178] Intra-cluster distance: The smaller the average distance between features in the same group, the better the clustering effect. Inter-cluster distance: The larger the distance between different groups, the better the clustering effect. According to the above evaluation results, the distance measurement method or clustering parameters are adjusted to optimize the clustering effect.

[0179] Assign a category label to each cluster group to describe its main features, such as collaborative features, complementary features, or redundant features. Compare the clustering results with existing security models or rules to identify possible abnormal feature points (such as feature isolated points or points that do not belong to any cluster) to indicate potential vulnerabilities. Based on the clustering results, adjust the weight of the feature in the subsequent model to enhance the influence of key features.

[0180] Embodiment 3, one embodiment of the present invention provides a data utilization system for a digital model, comprising:

[0181] The disassembly module receives and analyzes the first characteristic data of the first object, and disassembles a plurality of second objects.

[0182] The processing module selects a second object for processing and generates a feature framework of the second object.

[0183] The evaluation module unifies all the second objects, forms the comprehensive characteristics of the second objects, and performs a comprehensive evaluation.

[0184] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc., which can store program code.

[0185] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.

[0186] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or, if necessary, processing in another suitable manner, and then stored in a computer memory.

[0187] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0188] In Example 4, three devices in different fields are selected as the first object, such as smart meters, household air conditioners, and smart refrigerators. Each device collects usage data within 30 days, including characteristics such as power consumption, operating time, and working status. Its characteristic data includes basic information such as device number, frequency of use, duration of use, and power. According to the disassembly rules, each piece of data of the first object is disassembled into multiple second objects. For example, the usage data of the smart meter is disassembled into multiple "power consumption time period" objects, "power" objects for each time period, etc.

[0189] First, the system receives and parses the original data of the first object, and identifies the valid features in the data through rules. For example, the frequency and time period characteristics of the use of smart meters. For the disassembled data of each device object, a representative second object is selected for further processing. Taking the smart meter as an example, "power consumption period" is selected as the second object, the actual use of the object is analyzed, and the first feature of the second object (such as the change in power consumption within the time period) is further extracted. Through the analysis of the use of the second object, a feature framework is further generated. Different second objects are constrained by the feature framework to ensure the consistency and comparability of the data. The features of multiple second objects are fused, for example, the "power consumption period" and "power data" are weighted and fused using the Bayesian algorithm to form a comprehensive feature of the second object.

[0190] The comprehensive features of all second objects are evaluated by a hierarchical clustering algorithm, and finally the objects of different categories are grouped and the effect is evaluated to determine the differences in power consumption behaviors of different devices. The experimental data is shown in Table 1.

[0191] Table 1 Experimental data table

[0192]

[0193]

[0194] According to the data in the table, we can see that the comprehensive feature scores of different test objects are evaluated by the hierarchical clustering algorithm. First, the table shows the different usage behaviors of the three devices (smart meter, home air conditioner, smart refrigerator) and their respective characteristics, including frequency of use, usage duration, power, and power usage period. The comprehensive feature score is the result of the fusion and evaluation of these feature data.

[0195] It is clear from the data that different devices in the same category have different comprehensive feature scores, reflecting the effectiveness and innovation of the invention:

[0196] Smart meter: The two meter devices with scores of 0.85 and 0.82 indicate that different devices have different evaluation results under the same application. The power consumption pattern of smart meters varies in multiple time periods, which is evaluated by disassembling multiple second objects (power consumption time periods). The hierarchical clustering algorithm can accurately identify these differences and perform weighted evaluation on them.

[0197] Household air conditioners: The two air conditioners with scores of 0.88 and 0.80 have similar power, but their evaluation results have different scores due to large differences in usage periods and frequencies. This shows that the hierarchical clustering algorithm can effectively handle the second object with complex data characteristics and reasonably constrain it through the feature framework.

[0198] Smart refrigerators: The two refrigerators scored high, 0.92 and 0.90 respectively. This shows that under 24-hour continuous use, the power consumption behavior of smart refrigerators is relatively stable, and the comprehensive feature evaluation is relatively accurate, reflecting the advantages of the invented method in long-term data evaluation.

[0199] By comparing with the traditional single feature evaluation method, it can be found that the hierarchical clustering algorithm improves the accuracy of device usage behavior analysis by evaluating comprehensive features. Traditional methods may only rely on simple single features such as power or usage period, while the present invention can more comprehensively reflect the actual usage of the device through the fusion and weighted evaluation of multiple data features, with higher accuracy and better discrimination.

[0200] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A method for utilizing data of a digital model, characterized in that: include: Receiving and parsing first characteristic data of a first object, and disassembling a plurality of second objects; selecting a second object for processing to generate a feature frame of the second object; All second objects are unified to form the comprehensive characteristics of the second objects and conduct a comprehensive evaluation.

2. The method for utilizing data of a digital model according to claim 1, characterized in that: The first characteristic data of the first object includes data reflecting basic characteristics and preliminary status of the first object.

3. The method for utilizing data of a digital model as claimed in claim 2, characterized in that: The disassembling of the plurality of second objects comprises defining a disassembling rule using the parsed first data of the first object; The first object is disassembled by using the disassembly rule to disassemble a plurality of second objects.

4. The method for utilizing data of a digital model as claimed in claim 3, characterized in that: The selecting a second object for processing includes selecting a second object and analyzing the purpose of the second object; extracting a first feature of the second object based on a purpose of the second object; A feature framework of the second object is generated by constraining the first feature of the second object by using the usage of the second object.

5. The method for utilizing digital model data as claimed in claim 4, characterized in that: The forming and evaluating the comprehensive features of the second object includes establishing a corresponding relationship between the feature framework of the second object and the second object, uniformly processing different second objects, extracting and fusing data features of the second objects, and forming the comprehensive features of the second object; Based on the comprehensive characteristics of the second object, a comprehensive evaluation is performed using the network model.

6. The method for utilizing data of a digital model as claimed in claim 5, characterized in that: The extracting and fusing the data features of the second object includes, but is not limited to, fusing the data features of the second object using a Bayesian fusion algorithm to form comprehensive features of the second object.

7. The method for utilizing digital model data as claimed in claim 6, characterized in that: The comprehensive evaluation using the network model includes, but is not limited to, comprehensive evaluation of the comprehensive characteristics of the second object using a hierarchical clustering algorithm model.

8. A data utilization system for a digital model using the method according to any one of claims 1 to 7, characterized in that: A disassembly module receives and analyzes the first characteristic data of the first object, and disassembles a plurality of second objects; A processing module selects a second object for processing and generates a feature framework of the second object; The evaluation module unifies all the second objects, forms the comprehensive characteristics of the second objects, and performs a comprehensive evaluation.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the digital model data utilization method described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the digital model data utilization method described in any one of claims 1 to 7 are implemented.

Images