A hard disk data protection method and device based on artificial intelligence

Abstract

The present invention relates to the field of hard disk data protection, and in particular to a hard disk data protection method and device based on artificial intelligence. The method comprises the following steps: obtaining a hard disk historical monitoring log; performing a multi-period hard disk load analysis on the hard disk historical monitoring log, and performing load peak fluctuation fitting, thereby constructing a hard disk load peak fluctuation curve; performing a peak trend evolution analysis on the hard disk load peak fluctuation curve, and performing abnormal load peak detection, thereby obtaining the time period where the abnormal peak point is located; performing redundant data calculation of the hard disk in the current time period according to the time period where the abnormal peak point is located, and performing dynamic global data backup decision, thereby generating an abnormal peak global backup strategy; performing abnormal write behavior detection and attack node tracing and positioning on the hard disk historical monitoring log, and marking malicious attack tracing and positioning points. The present invention realizes safe and reliable hard disk data protection.

Description

Technical Field

[0001] The present invention relates to the field of hard disk data protection, and in particular to a hard disk data protection method and device based on artificial intelligence. Background Art

[0002] With the continuous advancement of informatization and digitalization, hard drives, as crucial storage devices in computers and servers, are tasked with storing and managing massive amounts of data. Whether for individual users or enterprise applications, the data on hard drives carries crucial business and personal information. With the dramatic increase in data volume, the risk of hard drive failure and data loss has become increasingly apparent. This is especially true over extended periods of operation, as hard drives can be affected by a variety of factors, such as physical wear and tear, overload, power fluctuations, and mechanical damage. These factors can lead to hard drive failure, data corruption, or even loss. Traditional hard drive data protection methods often rely on backup and recovery technologies, but these methods lack real-time monitoring and effective prediction of potential hard drive failure risks. Furthermore, in the face of complex attacks or hardware damage, the recovery process is often time-consuming and inefficient. Therefore, a more intelligent approach to hard drive data protection is needed. Summary of the Invention

[0003] In order to solve the above technical problems, the present invention proposes a hard disk data protection method and device based on artificial intelligence to solve at least one of the above technical problems.

[0004] To achieve the above object, the present invention provides a hard disk data protection method based on artificial intelligence, comprising the following steps:

[0005] Step S1: Obtain hard disk historical monitoring logs; perform hard disk load analysis on the hard disk historical monitoring logs over multiple time periods, and perform load peak fluctuation fitting to construct a hard disk load peak fluctuation curve;

[0006] Step S2: Analyze the peak trend evolution of the hard disk load peak fluctuation curve and detect abnormal load peaks to obtain the time period of the abnormal peak point;

[0007] Step S3: Calculate the redundant data of the hard disk in the current time period according to the time period of the abnormal peak point, and make a dynamic global data backup decision, thereby generating an abnormal peak global backup strategy;

[0008] Step S4: Detect abnormal write behavior and locate the attack node in the hard disk history monitoring log, and mark the malicious attack source location point;

[0009] Step S5: Identify the data damaged area at the malicious attack source location point, and then perform adaptive data repair on a region-by-region basis to build an adaptive data repair strategy;

[0010] Step S6: Make layered data encryption decisions based on the hard disk historical monitoring logs, and perform intelligent collaborative protection control based on the adaptive data repair strategy abnormal peak global backup strategy to build an intelligent collaborative protection model.

[0011] By collecting hard disk historical monitoring logs, the present invention can understand the performance changes of hard disks in detail, including load fluctuations, write / read operation frequencies, etc., which provides basic data for subsequent analysis. Through multi-period hard disk load analysis, the normal operating mode and potential fluctuation trends of the hard disk can be revealed, helping to determine whether the hard disk has an abnormal load state. By fitting load fluctuations, the peak trend and periodic fluctuations of the hard disk load can be identified, providing a reference for subsequent detection of abnormal peaks. Trend evolution analysis of the load fluctuation curve can effectively identify the change pattern of the hard disk load and determine whether there is a long-term abnormal trend or potential problem. Abnormal load peak detection can accurately identify abnormal fluctuations in the hard disk load, and excessively high loads can be detected. A high or low load value may mean that the hard disk is under attack or has failed. By marking the abnormal peak point, the time period of the abnormality can be accurately located, providing key clues for subsequent attack tracing and data repair. When the abnormal peak is identified, the data redundancy level of the current time period is calculated to ensure rapid recovery in the event of data abnormality or attack. The global data backup strategy is automatically determined based on the current load abnormality status, and the backup frequency and backup content can be dynamically adjusted to improve the efficiency and accuracy of data recovery. The constructed global backup strategy helps reduce the risk of data loss and provides an effective protection method when the hard disk fails or is attacked. By analyzing the historical monitoring logs, it can detect the abnormalities that appear on the hard disk. Abnormal write behavior, frequent large-scale write operations may mean that some kind of malicious attack is in progress. By marking and tracing the nodes of malicious attacks, the source of the attack can be accurately located, which is crucial for preventing data loss, responding to attacks in a timely manner, and isolating infected nodes. By identifying malicious attack behaviors, potential threats can be identified in advance, and protective measures can be taken in time to prevent the spread of attacks. After identifying the attack nodes, the damaged data areas can be accurately identified, providing precise targets for subsequent repair work and reducing unnecessary repair operations. Based on the different characteristics of the damaged data, an adaptive repair strategy is used to repair each area one by one, which not only improves the efficiency of the repair, but also reduces the impact of the repair process on system performance. An accurate data repair strategy can effectively ensure that the company's data is restored to a complete state after an attack, reducing the risk of data loss. Through historical monitoring log analysis, different encryption strategies can be formulated for different data levels (such as critical data, non-critical data, etc.). In this way, important data can be protected at a higher level, reducing the risk of data leakage. Combined with adaptive data repair and backup strategies, intelligent protection and control of the company's hard disk system can be achieved. Different protection measures work together to ensure that the hard disk is fully protected when it is attacked or fails. Through intelligent collaborative protection, the company's hard disk system can maintain higher security and stability in the face of multiple threats, ensuring data integrity and recoverability.

[0012] Preferably, step S1 includes the following steps:

[0013] Step S11: Obtaining a hard disk historical monitoring log, collecting multi-modal hard disk monitoring parameters from the hard disk historical monitoring log, and extracting the multi-modal hard disk monitoring parameters;

[0014] Step S12: performing time series data flow evolution on the multi-modal hard disk monitoring parameters, thereby generating hard disk flow data time series evolution features;

[0015] Step S13: performing multi-period hard disk load analysis on the time series evolution characteristics of the hard disk traffic data to generate hard disk load data for different time periods;

[0016] Step S14: Calculate the traffic load peak value of the hard disk load data in different time periods, and extract the hard disk traffic load peak value in each time period;

[0017] Step S15: performing load peak fluctuation fitting on the hard disk traffic load peak in each time period, thereby constructing a hard disk load peak fluctuation curve.

[0018] The present invention uses multimodal monitoring parameters that are not limited to the basic load data of the hard disk, but can also include multiple indicators such as temperature, read and write speed, I / O operation, delay, etc. This multimodal data collection can help to more comprehensively understand the operating status of the hard disk. Through multimodal collection, it can ensure that different types of hard disk performance indicators are monitored synchronously, reducing the limitations of a single monitoring method. Different indicators can complement each other, analyze hard disk performance from multiple dimensions, obtain historical monitoring logs and extract key parameters, so that the system can obtain the operating status of the hard disk in real time, and can reversely trace back to historical problems, which is convenient for better analysis of potential risks. By converting hard disk monitoring parameters into time-series data flow, it is possible to track the load, read and write operations, temperature and other parameters of the hard disk. The law of changes in data over time can help discover potential periodic changes, trend fluctuations or sudden problems. By analyzing the evolution characteristics of time series data traffic, the behavior patterns of hard drives in different time periods can be identified to help determine whether the hard drives are in normal working condition, whether there is performance degradation or other hidden dangers. The traffic evolution characteristics can provide early warning when the hard drive load changes, helping technicians to discover potential hard drive failures or performance bottlenecks in advance, so as to take measures to avoid failures. By analyzing the hard drive load in different time periods, the load patterns of hard drives in different time periods can be identified. The load performance may be different during peak working hours and idle times. By dividing the time periods, abnormal loads can be identified more accurately. This time division The analysis can help identify the regularity of load changes (such as load fluctuations during normal operation) and abnormal loads (such as load anomalies during non-working hours), so as to make more timely responses to abnormal behaviors. By analyzing load data in different time periods, it can help enterprises optimize hard disk resource allocation, especially perform necessary maintenance or backup operations when the system load is low, and improve the overall efficiency of the system. By performing peak calculations on hard disk load data in different time periods, it can help identify the load peaks of the hard disk in a specific time period. These peaks are usually the moments when the hard disk is under the greatest pressure and may affect the performance or stability of the hard disk. Calculating load peaks not only helps locate the pressure period of the hard disk, but also provides information for subsequent load balancing, fault prevention and performance optimization. The calculation of peak values ​​can not only be used to identify normal load fluctuations, but also help detect abnormal peak values. These abnormalities may be related to malicious attacks, hardware failures or other abnormal behaviors. By fitting the fluctuations of load peak values, a fluctuation curve of the hard disk load peak value can be constructed. This curve shows the load change pattern of the hard disk in different time periods and can provide an important basis for future load forecasting. Through the load fluctuation curve, enterprises can intuitively see the trend of the hard disk load and judge whether there is a gradually increasing load pressure or abnormal changes in load fluctuations. This helps to determine whether the hard disk needs to be expanded, upgraded or undergo other maintenance operations. The fitting of the load fluctuation curve can help identify abnormal patterns of load fluctuations.If the load peak in a certain period does not match the historical fluctuation pattern, it may indicate a potential hard disk failure or network attack, which can provide clues for subsequent security detection.

[0019] Preferably, the specific steps of step S12 are:

[0020] Perform outlier filtering on multimodal hard disk monitoring parameters to obtain outlier filtering monitoring parameters;

[0021] Analyze the hard disk temperature changes based on the outlier filtering monitoring parameters and extract the hard disk temperature change characteristics;

[0022] Calculate the real-time read and write rate of the outlier filtering monitoring parameters to obtain the real-time read and write rate of the hard disk;

[0023] Perform data writing error rate analysis on outlier filtering monitoring parameters to generate data writing error rate;

[0024] The hard disk real-time read and write rates and data write error rates are mined to generate hard disk real-time traffic status features;

[0025] According to the hard disk temperature change characteristics, the hard disk real-time traffic state characteristics are analyzed for time series data traffic evolution, thereby generating the hard disk traffic data time series evolution characteristics.

[0026] The present invention uses outliers that may be caused by transient errors, sensor failures or other interference factors. These outlier data may affect the accuracy of subsequent analysis. Through outlier filtering, these abnormal data can be effectively eliminated to ensure that the data quality relied on by subsequent analysis is higher. Outlier filtering helps to remove unreasonable extreme values ​​from many monitoring parameters, making the data more stable and helping to analyze the real operating status of the hard disk. After filtering out the abnormal data, the remaining data can more accurately reflect the actual operating status of the hard disk, avoiding incorrect load or performance evaluation. Hard disk temperature is an important indicator of hard disk health. Excessive temperature may cause hard disk failure or performance degradation. Through temperature change analysis, the fluctuation of hard disk temperature can be monitored in real time, and the potential problems that may cause hard disk failure can be discovered in time. The temperature anomaly that may cause hard disk damage. Extracting temperature change characteristics can reveal the changing pattern of hard disk temperature and help identify which operations or environmental factors cause temperature fluctuations (such as long-term high load, ambient temperature changes, etc.). By monitoring temperature change characteristics, the system can provide early warning of hard disk failures caused by excessive temperature, so as to take preventive measures (such as cooling, reducing load, etc.). Read and write rate is a key indicator for measuring hard disk performance. By calculating the real-time read and write rate, you can timely understand the current read and write performance of the hard disk. The real-time read and write rate reflects the level of hard disk load. Understanding the read and write rate of the hard disk helps to evaluate whether it is in a high-load state, whether there is a performance bottleneck, or whether there are potential signs of failure. A sudden drop in the read and write rate may indicate that the hard disk is The disk has bottlenecks or failures. Real-time monitoring of read and write rates can help to timely detect and respond to these problems. The write error rate is directly related to the integrity and reliability of the data. Analysis of the write error rate helps to identify abnormal conditions that occur during the hard disk write process, such as bad sectors on the hard disk, file system errors or damage, etc. A high error rate may be a sign of an impending hard disk failure. By monitoring the write error rate, enterprises can identify potential damage risks to the hard disk in advance and take measures such as data backup, migration or repair to detect data write errors in a timely manner, which helps prevent data loss, damage or inconsistency and improve the overall data security of the hard disk. Combining the real-time read and write rates of the hard disk with the data write error rate to conduct traffic status mining can provide a more comprehensive understanding of the The current load and health status of the hard disk. This multi-dimensional analysis can reveal abnormal patterns hidden under the surface and provide more accurate risk assessment. The mining of traffic status characteristics can reveal whether the hard disk has abnormal load, performance bottlenecks or data transmission anomalies, which helps to timely discover potential security threats (such as attack behaviors) or hardware failures. Through traffic status feature analysis, the normal and abnormal traffic patterns of the hard disk can be identified, which is of great significance for subsequent anomaly detection, data recovery and performance optimization. Combining temperature change characteristics with traffic status characteristics to perform time series data traffic evolution analysis can better reveal the change trend of hard disk performance over time. Excessive temperature changes may cause hard disk traffic fluctuations, which in turn affect the read and write speed of the hard disk.Time-series traffic evolution characteristics can dynamically reflect changes in hard drive operating status over different time periods, helping enterprises promptly identify hard drive performance bottlenecks or potential failures. By analyzing time-series traffic evolution characteristics, it is possible to intelligently assess the health of hard drives and, combined with factors such as temperature, predict possible hard drive failures, allowing appropriate preventive measures (such as reducing load and increasing redundancy) to be taken.

[0027] Preferably, step S2 includes the following steps:

[0028] Step S21: performing a peak trend evolution analysis on the hard disk load peak fluctuation curve to generate load peak trend evolution data;

[0029] Step S22: performing a multi-time window rolling forecast on the load peak trend evolution data to obtain load peak forecast data for multiple time windows;

[0030] Step S23: performing abnormal load peak detection on the load peak prediction data of multiple time windows and marking abnormal load peak points;

[0031] Step S24: Locate the time period of the abnormal load peak point, thereby obtaining the time period where the abnormal peak point is located.

[0032] The present invention can help discover the law of hard disk load changes over time by analyzing the trend evolution of the hard disk load peak fluctuation curve, understand the volatility of the hard disk load in different time periods, help identify the trend of load increase or decrease, and avoid hard disk failure caused by overload. The trend evolution data helps to predict future changes in load peaks. If the load fluctuates abnormally, the trend analysis can provide a basis for subsequent protective measures. By understanding the load trend, the enterprise can dynamically adjust the resource allocation and load management of the hard disk. When the load is high, it may be necessary to optimize the performance through load balancing or adjusting the write frequency. Through multi-window rolling prediction, the enterprise can obtain the load peaks in different time windows. Predictive data provides a dynamic view of short-term loads. This method can help enterprises predict upcoming high-load periods and facilitate resource scheduling or risk prevention and control in advance. By using multi-window forecasting technology, the length of the forecast time window can be adjusted according to actual needs to adapt to different load analysis needs. For peak period forecasts, a longer time window may be used, while for sudden load responses, a shorter time window can be used. Multi-window forecasting enables enterprises to respond more flexibly to load changes. For upcoming load peaks, data backup, system load adjustment, or redundant system startup can be performed in advance. By detecting abnormal load peaks on load peak forecast data, It can quickly identify abnormal load conditions in different time windows. If the load fluctuation exceeds the normal range, it may be a hard disk failure or a malicious attack. The abnormal load peak may be caused by hardware failure (such as hard disk aging, bad sectors) or external attacks (such as DDoS attacks, ransomware). Marking abnormal peak points can help companies take remedial measures in time to avoid greater impact on the system. By marking and locating abnormal load peaks, the IT operation and maintenance team can find the root cause of the problem more quickly, whether it is a hard disk failure, network problem or malicious attack, reducing the time and effort of investigation. By locating the time period, it can accurately identify the time when the abnormal load peak occurs. This is This information is crucial for further analyzing the causes of abnormal loads. If abnormal load fluctuations occur during a specific period of time, it may be related to specific operations or attack behaviors (such as a large number of write requests, attack traffic, etc.). After locating the specific time period, the enterprise can further investigate the operation records, network activities and security logs during that period to help discover whether malicious behaviors (such as ransomware, malicious access, etc.) have caused abnormal loads. By analyzing the time period when the abnormal peak occurs, it is possible to identify whether there are external attack patterns (such as certain attack tools sending requests at a high frequency at a specific time). This provides a strong basis for building the enterprise's intrusion detection system and helps avoid or defend against similar attacks in advance.

[0033] Preferably, step S3 includes the following steps:

[0034] Step S31: analyzing the hard disk storage status of the hard disk in the current time period according to the time period where the abnormal peak point is located, thereby obtaining the hard disk storage status;

[0035] Step S32: Calculate the redundant data of the hard disk in the current time period and extract the redundant data of the abnormal peak time period;

[0036] Step S33: performing redundant data cleaning on the hard disk based on the redundant data in the abnormal peak time period, thereby obtaining redundant optimized hard disk data;

[0037] Step S34: making a dynamic global data backup decision for the redundant optimized hard disk data according to the hard disk storage status, thereby generating an abnormal peak global backup strategy.

[0038] By analyzing the time period of the abnormal peak point, the present invention can deeply understand the storage status of the hard disk during the period. If the abnormal peak occurs in a certain time period, analyzing the hard disk storage status helps to understand whether the hard disk is under high load, overheating or has a performance bottleneck. Through storage status analysis, it can be identified whether the hard disk is approaching the edge of failure. Especially during the abnormal load peak period, the storage status of the hard disk may be affected. At this time, the analysis of the storage status can help enterprises discover potential risks in time. The analysis results of the storage status help enterprises adjust the load, assign tasks or take other optimization measures according to the current status of the hard disk. If some hard disk storage is in a critical state, the enterprise The industry can migrate or expand data to avoid data loss and system crashes. Redundant data calculation is a key step in ensuring data integrity and reliability. By calculating redundant data for the current time period, especially extracting redundant data for abnormal peak time periods, it can be ensured that data will not be lost or damaged when the hard disk load is abnormal. The extraction of redundant data helps to provide sufficient backup data before a failure occurs. This is especially important for data protection during periods of high system load or abnormal peaks, and can reduce data loss caused by hard disk failures or attacks. By extracting redundant data during abnormal peak time periods, it can provide accurate data support for subsequent backup strategies, making the backup process more precise. In fact, to avoid unnecessary redundancy or omission, redundant data cleaning processing helps to remove redundant and duplicate data, reduce the waste of storage space, and improve the utilization rate of hard disk resources. By optimizing redundant data, the burden of redundant storage can be effectively reduced and system efficiency can be improved. By cleaning redundant data, the management efficiency of hard disk data can be improved, ensuring that backup data is more streamlined and efficient, which is convenient for subsequent data recovery, migration and access. Redundant data cleaning can also help eliminate data inconsistency problems caused by data redundancy, ensure the consistency of enterprise data storage status, avoid errors caused by redundant data, and dynamically adjust the global data backup strategy according to the hard disk storage status to ensure that the hard disk is under load. Timely and effective backups can be performed during load anomalies, failures or high loads, which helps improve the system's disaster recovery capabilities and avoid data loss. By generating a global backup strategy for abnormal peaks, enterprises can ensure that global data can be effectively protected even in the event of abnormal hard disk loads. This strategy can comprehensively consider multiple factors such as hard disk load, redundant data and storage status to formulate the optimal backup plan. The global backup strategy not only improves data security, but also can quickly restore data when the hard disk fails or is attacked. Whether it is a hardware failure or a malicious attack (such as a ransomware virus), it helps to restore services as soon as possible when the system crashes or data is damaged, minimizing business interruption time.

[0039] Preferably, the specific steps of step S4 are:

[0040] Step S41: Detect abnormal write behavior in the hard disk history monitoring log and extract abnormal write behavior;

[0041] Step S42: Calculating the abnormal behavior frequency of the abnormal writing behavior to obtain an abnormal writing behavior frequency parameter;

[0042] Step S43: performing time series variation statistics on the abnormal write behavior frequency parameter, thereby generating abnormal write behavior frequency variation characteristics;

[0043] Step S44: performing malicious attack behavior analysis based on the frequency change characteristics of abnormal write behavior, thereby generating malicious attack behavior data;

[0044] Step S45: trace the attack node source of the malicious attack behavior data and mark the malicious attack source location point.

[0045] The present invention can quickly identify abnormalities in write patterns by detecting abnormal write behavior in the hard disk history monitoring log. Excessive number of write requests in a certain period of time, or frequent changes in write operations may be signs of abnormal behavior (malware tampering with data, ransomware encrypting files, etc.). Abnormal write behavior may be a signal that data has been tampered with, especially when certain files or data are frequently modified without normal business needs. Detecting abnormal write behavior helps prevent sensitive data from being maliciously tampered with or deleted. This detection can capture early signs of malicious attacks in a timely manner, such as attackers trying to perform a large number of data write operations without being noticed, which provides a preemptive opportunity for subsequent security protection and response. By calculating abnormal write behavior, The frequency of abnormal write operations can help determine whether these abnormal behaviors are persistent or malicious. Frequent abnormal write operations may indicate that data tampering, ransomware attacks or other malicious operations are in progress. Some attack behaviors may not break out all at once in a short period of time, but are frequent operations in a small range over a long period of time. By calculating the frequency of abnormal write behaviors, this scattered and hidden attack pattern can be captured, thereby improving the effect of early detection. The calculation of abnormal frequency parameters can be used to monitor hard disk behavior in real time, triggering alarms when frequent abnormal writes occur, helping enterprises to discover potential security issues in the first place. By statistically analyzing the time series changes in the frequency of abnormal write behaviors, the changing trend of attack behaviors can be observed, and the pattern of frequency changes may reflect the attack The attacker's strategy changes, or the intensity of the attack gradually increases. Through these time-series change characteristics, the security team can accurately assess the persistence and development trend of the attack. Many attack behaviors (such as ransomware, botnets, etc.) may show specific time-series patterns, such as sudden increases in frequency within a specific time period. Statistics on frequency changes can help reveal these hidden attack behavior patterns. Time-series change statistics can help companies promptly discover abnormal phenomena such as sudden increases in frequency, which is usually a signal of intensified attacks. As the ransomware infection gradually spreads, the write frequency may increase rapidly. Analyzing these changes allows companies to deploy protective measures in advance, such as shutting down infected devices, starting backup and recovery, etc. Combined with the frequency change characteristics of abnormal write behavior, companies can In order to more accurately identify malicious attack behaviors, especially those related to data tampering and virus propagation, by analyzing the frequency change characteristics, it is possible to effectively distinguish normal operations from malicious operations, thereby better identifying potential security threats such as ransomware attacks and data leaks. Malicious attack behavior analysis can help enterprises dynamically identify various security threats, such as DDoS attacks and malware. These attacks may conceal their attack intentions through frequent hard disk write operations. By analyzing the write behavior, potential attackers can be discovered and responded to in a timely manner. Some complex attacks (such as APT attacks) are often concealed. By analyzing the changes in abnormal write behavior, enterprises can identify these long-term latent and low-key attacks, providing early detection and prevention capabilities.By marking the source locations of malicious attacks, enterprises can track the attack source and attack path, identifying the attacker's specific range of activities. Attack node tracing helps reveal the motivation, target, and attack method behind the attack. By tracing the attack node, enterprises can quickly isolate the attacked node or device to prevent the attack from spreading to other systems. At the same time, tracing analysis helps to lock down the compromised terminal or network entrance to prevent further damage. Malicious attack tracing not only helps to respond to the current attack in a timely manner, but also provides key evidence for subsequent security incident investigations, helping enterprises analyze the source and means of the attack.

[0046] Preferably, the specific steps of step S5 are:

[0047] Step S51: mining attack propagation paths for malicious attack source tracing locations to obtain multiple attack propagation paths;

[0048] Step S52: Identify data damaged areas based on multiple attack propagation paths and generate multiple malicious attack damaged areas;

[0049] Step S53: Analyze the damaged data formats of multiple malicious attack damaged areas to generate damaged area data formats;

[0050] Step S54: performing recoverability evaluation on the damaged area data format, thereby obtaining the recoverability of each damaged area;

[0051] Step S55: Based on the recoverability of each damaged area, adaptive data repair is performed on a region-by-region basis to construct an adaptive data repair strategy.

[0052] By mining attack propagation paths at the source of malicious attacks, this invention can help enterprises understand the attack's propagation path from its origin to multiple target nodes. This process reveals how attackers propagate attacks through systems or networks, facilitating analysis of the attack chain and identifying the attack source and key nodes. Mining attack propagation paths helps further identify the attack's starting point and how it propagates, enabling security teams to quickly pinpoint the attack source and reduce blind spots in defense systems. By analyzing attack paths, security teams can isolate key nodes or systems before the attack spreads, minimizing the impact of the attack on the network. Mining attack propagation paths helps create detailed audit logs of attacks, providing evidence for incident investigations and helping enterprises understand attack methods, attacker motivations, and the specific stages of vulnerability exposure. By combining multiple attack propagation paths, it is possible to identify which systems, files, or data were affected by the malicious attack. Certain areas may have been tampered with, deleted, or damaged by the attacker's actions. By identifying these areas, enterprises can focus on data recovery efforts in these areas. Identifying damaged data areas not only helps identify the current areas under attack but also predicts other areas the attacker may expand to, forming a comprehensive risk assessment. This ensures that enterprise security measures cover all potentially compromised areas. Identifying and marking damaged areas helps focus repair resources rather than blindly repairing the entire system. This makes data recovery more efficient and targeted. Analyzing the damaged data format helps enterprises identify the data format and structure within the damaged area. Attacks can cause database corruption, file format tampering, and other issues. Understanding data formats helps avoid data loss or inconsistencies during recovery. By identifying the data format of the damaged area, enterprises can select appropriate data recovery tools or methods to ensure data integrity and accuracy during the repair process. Analyzing data formats makes the recovery process more organized and efficient, avoiding issues like incorrect repairs or format mismatches, while reducing manual intervention and improving the efficiency of automated repairs. Assessing the recoverability of each damaged area provides a quantitative basis for repair, helping to determine which areas' data can be recovered and which areas may never be recovered. This assessment provides reliable data support for recovery decisions. By assessing the recoverability of different damaged areas, enterprises can prioritize data recovery. Restoration of important data or critical systems is prioritized, while alternative solutions (such as rebuilding or replacing) can be considered for areas that cannot be recovered. Recoverability assessments can help businesses efficiently allocate repair resources, ensuring that the most critical areas are restored first, saving time and money by avoiding wasting time on irrecoverable data. Repairing each damaged area individually based on its recoverability allows businesses to choose the most appropriate repair method for each damaged area. Some areas may require recovery from backups, while others may require reconstruction or data migration.Adaptive repair strategies make the recovery process more precise. Based on recoverability assessments and regional repair strategies, they improve the efficiency of the repair process, reducing unnecessary steps and wasted time. Rapidly restoring damaged areas minimizes the impact of attacks on business operations. Adaptive repair strategies adjust repair plans based on actual conditions, such as dynamically selecting backup sources, repair methods, and recovery tools, thereby increasing the success rate of the repair process and preventing data corruption or loss.

[0053] Preferably, the specific steps of step S6 are:

[0054] Step S61: Identify key storage data nodes from the hard disk history monitoring log and extract the key storage data nodes;

[0055] Step S62: performing semantic analysis on key storage data nodes one by one to obtain storage data features of each node;

[0056] Step S63: Perform dynamic data semantic sensitivity calculation on the storage data features of each node to generate the data semantic sensitivity of each node;

[0057] Step S64: making a hierarchical data encryption decision based on the data semantic sensitivity of each node, thereby obtaining a hierarchical data encryption engine;

[0058] Step S65: Perform intelligent collaborative protection control on the adaptive data repair strategy, the layered data encryption engine, and the abnormal peak global backup strategy to build an intelligent collaborative protection model.

[0059] The present invention can accurately identify the critical data nodes in the hard disk through the analysis of the hard disk historical monitoring log. These nodes may contain sensitive information or business-critical data and may become targets of attack. By locating these nodes, enterprises can focus on protecting these core data, avoid wasting resources on less important data, and focus on key storage data nodes, so that security protection measures can be more accurate and efficient, which helps to reduce the situation of excessive protection and improve the efficiency of overall security resource utilization. Identifying key storage data nodes also helps to predict in advance which data areas may be attacked or damaged, so as to implement stronger security measures (such as strengthening backup, encryption, etc.). By analyzing the semantics of each key storage node, Through data analysis, enterprises can fully understand the type, structure and sensitivity of data. Some data nodes may store financial data, while others may store employee information or customer data. In-depth understanding of the semantic characteristics of data can help enterprises determine the sensitivity level and protection priority of data. Through data semantic analysis, it can be identified whether the data contains sensitive information (such as personal information, financial data, etc.), so as to conduct accurate security assessment and protection, and ensure that highly sensitive data is protected first. After understanding the semantics of data nodes, enterprises can formulate corresponding access control policies according to the different characteristics of data to ensure that only authorized personnel can access sensitive data. Dynamic sensitivity calculation is performed based on the characteristics of stored data, and dynamic sensitivity analysis can be performed based on the actual content and changes of data. Dynamically assess the sensitivity of data. For highly sensitive data (such as financial and customer personal information), more stringent protection measures can be taken. By calculating the semantic sensitivity of data, enterprises can apply different strategies to data of different sensitivity levels in encryption, backup and other operations. For highly sensitive data, stronger encryption algorithms and more frequent backups are used, while low-sensitivity data may adopt more conventional strategies. Over time, the sensitivity of data may change (for example, some data changes from low sensitivity to high sensitivity). By dynamically calculating the semantic sensitivity of data, enterprises can adjust data protection strategies in real time to respond to changes in data sensitivity. Layered data encryption decisions can apply different encryption algorithms according to different data sensitivities. Strategy, highly sensitive data may be encrypted using the Advanced Encryption Standard (AES-256), while low-sensitivity data may use conventional encryption methods. This layered encryption strategy can significantly improve encryption efficiency and reduce the impact of encryption operations on system performance. Through layered encryption, data leakage can be effectively prevented. Even if an attacker successfully invades the system, they cannot access the encrypted data. Layered encryption can also prevent data from being intercepted or tampered with during transmission, further strengthening the confidentiality of data. Different types of data may face different laws, regulations and compliance requirements. Through layered encryption decisions, enterprises can encrypt data according to its sensitivity and compliance requirements to ensure that it meets the requirements of relevant regulations (such as GDPR, CCPA, etc.).By intelligently and collaboratively controlling the adaptive data repair strategy, the layered data encryption engine, and the global backup strategy for abnormal peaks, enterprises can form a comprehensive, multi-layered intelligent protection system. This collaborative mechanism ensures effective data protection and recovery in any situation (such as data corruption, loss, or encryption attacks). Relying solely on a single protection mechanism may pose risks (such as backup data being tampered with by attackers or encryption algorithms being cracked). Collaborative control can reduce the risk of single points of failure. Multiple protection layers and strategies complement each other to address a wider range of security threats. The intelligent collaborative protection model can dynamically adjust protection strategies based on attack patterns and data damage. When data corruption or encryption anomalies are detected, the system can automatically trigger repair and backup mechanisms. Intelligent adjustments and responses improve the system's emergency response capabilities and reduce human intervention.

[0060] In this specification, an artificial intelligence-based hard disk data protection device is provided, which is used to execute the artificial intelligence-based hard disk data protection method described above, including:

[0061] The peak fluctuation module is used to obtain hard disk historical monitoring logs; perform hard disk load analysis on the hard disk historical monitoring logs over multiple periods, and perform load peak fluctuation fitting to construct a hard disk load peak fluctuation curve;

[0062] The peak trend evolution module is used to analyze the peak trend evolution of the hard disk load peak fluctuation curve and detect abnormal load peaks to obtain the time period of the abnormal peak point;

[0063] The global backup module is used to calculate the redundant data of the hard disk in the current time period according to the time period of the abnormal peak point, and make dynamic global data backup decisions to generate the abnormal peak global backup strategy;

[0064] The attack tracing module is used to detect abnormal write behavior in the hard disk's historical monitoring logs, trace the attack nodes, and mark the malicious attack source location points;

[0065] The adaptive repair module is used to identify the damaged data area at the malicious attack source location point and then perform adaptive data repair on a region-by-region basis to build an adaptive data repair strategy;

[0066] The intelligent collaborative protection module is used to make hierarchical data encryption decisions based on the hard disk's historical monitoring logs, and to perform intelligent collaborative protection control based on the adaptive data repair strategy and abnormal peak global backup strategy to build an intelligent collaborative protection model.

[0067] By performing load analysis on historical monitoring logs, the present invention can fully understand the usage of the hard disk, load change trends and fluctuation patterns. The hard disk load peak fluctuation curve can help identify abnormal load fluctuations, which is convenient for subsequent risk prediction. Through load fluctuation fitting, the normal fluctuation range of the hard disk load can be effectively identified. Once the load fluctuates abnormally, the system can trigger an alarm or start protective measures in time to reduce the risk of failure. Load fluctuation analysis can not only identify potential risks, but also help enterprises optimize the resource utilization of the hard disk and avoid excessive load or potential hard disk failure. The trend evolution analysis of the peak fluctuation curve can help enterprises understand the long-term trend and potential changes of the hard disk load. Over time, the hard disk load may show cycles. The system can automatically detect and identify these changing trends. The detection of abnormal load peaks can accurately identify abnormal load fluctuations, thereby locating possible failure points or potential attack behaviors. Through abnormal peak detection, a clear time window can be provided for subsequent backup, data repair and other operations. The occurrence of abnormal peaks may mean that the hard disk is about to fail or there is a risk of data loss. Dynamic global backup decision-making can automatically evaluate which data is critical and prioritize backup to ensure that important data will not be lost when a hard disk fails. According to the time period of the abnormal peak and real-time data redundancy calculation, the system can dynamically adjust the backup strategy, such as increasing the backup frequency and selecting the best backup. Backup windows, etc., improve backup efficiency and effectiveness. Through intelligent decision-making on backup strategies, enterprises can recover data more quickly. Even if a hard disk failure or data loss occurs, backup data can be quickly restored to ensure business continuity. Through abnormal write behavior detection, it can quickly discover whether there are malicious attacks (such as ransomware, data tampering, etc.). Once abnormal write is detected, the system will track the specific attack node to help security personnel locate the source of intrusion. Once the attack tracing location point is determined, measures can be taken quickly, such as isolating the attack source, blocking malicious processes, etc., to prevent the attack from spreading further. The attack tracing module not only helps to deal with current attacks, but also provides detailed attack chain information for subsequent analysis, helping enterprises improve network security defense Protection, improve future threat response capabilities, by identifying the damaged areas of malicious attack source points, it can accurately determine which data areas are affected and repair them one by one. Adaptive repair can automatically select the most appropriate repair method based on the specific type, sensitivity and degree of damage of the data. The automated repair process can greatly improve repair efficiency, reduce the need for manual intervention, and reduce system recovery time. The system can flexibly adjust the repair strategy and adopt different repair methods for different damaged data. The adaptive repair module can quickly restore damaged data, thereby reducing the impact of attacks on corporate business operations, ensuring uninterrupted business operations and data loss, and reducing financial or reputation losses caused by data loss. Through layered data encryption strategies,Data of varying sensitivities will utilize different encryption methods to ensure adequate protection during storage, transmission, and use. Intelligent collaborative protection combines encryption, backup, and recovery strategies to ensure data security through multi-layered protection. The intelligent collaborative protection model not only makes decisions on data encryption but also adjusts protection measures based on the needs of recovery and backup strategies. The various protection modules work together to provide comprehensive data security. In the face of potential cyberattacks or system failures, the intelligent collaborative protection modules automatically adjust protection strategies, allowing the system to adaptively respond to various emergencies, reducing manual intervention and accelerating recovery. BRIEF DESCRIPTION OF THE DRAWINGS

[0068] Figure 1 This is a flowchart of the steps of a hard disk data protection method based on artificial intelligence of the present invention;

[0069] Figure 2 Detailed implementation flow chart of step S1;

[0070] Figure 3 Detailed implementation flow chart of step S2;

[0071] Figure 4 Schematic diagram of the detailed implementation steps of step S3. DETAILED DESCRIPTION

[0072] It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0073] This application provides an artificial intelligence-based hard disk data protection method and device. The execution entities of the artificial intelligence-based hard disk data protection method and device include, but are not limited to, mechanical equipment, data processing platforms, cloud server nodes, network upload devices, etc. that are equipped with the system, which can be regarded as general computing nodes of this application. The data processing platform includes, but is not limited to, at least one of an audio and image management system, an information management system, and a cloud data management system.

[0074] See also Figures 1 to 4 The present invention provides a hard disk data protection method based on artificial intelligence, and the hard disk data protection method based on artificial intelligence includes the following steps:

[0075] Step S1: Obtain hard disk historical monitoring logs; perform hard disk load analysis on the hard disk historical monitoring logs over multiple time periods, and perform load peak fluctuation fitting to construct a hard disk load peak fluctuation curve;

[0076] Step S2: Analyze the peak trend evolution of the hard disk load peak fluctuation curve and detect abnormal load peaks to obtain the time period of the abnormal peak point;

[0077] Step S3: Calculate the redundant data of the hard disk in the current time period according to the time period of the abnormal peak point, and make a dynamic global data backup decision, thereby generating an abnormal peak global backup strategy;

[0078] Step S4: Detect abnormal write behavior and locate the attack node in the hard disk history monitoring log, and mark the malicious attack source location point;

[0079] Step S5: Identify the data damaged area at the malicious attack source location point, and then perform adaptive data repair on a region-by-region basis to build an adaptive data repair strategy;

[0080] Step S6: Make layered data encryption decisions based on the hard disk historical monitoring logs, and perform intelligent collaborative protection control based on the adaptive data repair strategy abnormal peak global backup strategy to build an intelligent collaborative protection model.

[0081] By collecting hard disk historical monitoring logs, the present invention can understand the performance changes of hard disks in detail, including load fluctuations, write / read operation frequencies, etc., which provides basic data for subsequent analysis. Through multi-period hard disk load analysis, the normal operating mode and potential fluctuation trends of the hard disk can be revealed, helping to determine whether the hard disk has an abnormal load state. By fitting load fluctuations, the peak trend and periodic fluctuations of the hard disk load can be identified, providing a reference for subsequent detection of abnormal peaks. Trend evolution analysis of the load fluctuation curve can effectively identify the change pattern of the hard disk load and determine whether there is a long-term abnormal trend or potential problem. Abnormal load peak detection can accurately identify abnormal fluctuations in the hard disk load, and excessively high loads can be detected. A high or low load value may mean that the hard disk is under attack or has failed. By marking the abnormal peak point, the time period of the abnormality can be accurately located, providing key clues for subsequent attack tracing and data repair. When the abnormal peak is identified, the data redundancy level of the current time period is calculated to ensure rapid recovery in the event of data abnormality or attack. The global data backup strategy is automatically determined based on the current load abnormality status, and the backup frequency and backup content can be dynamically adjusted to improve the efficiency and accuracy of data recovery. The constructed global backup strategy helps reduce the risk of data loss and provides an effective protection method when the hard disk fails or is attacked. By analyzing the historical monitoring logs, it can detect the abnormalities that appear on the hard disk. Abnormal write behavior, frequent large-scale write operations may mean that some kind of malicious attack is in progress. By marking and tracing the nodes of malicious attacks, the source of the attack can be accurately located, which is crucial for preventing data loss, responding to attacks in a timely manner, and isolating infected nodes. By identifying malicious attack behaviors, potential threats can be identified in advance, and protective measures can be taken in time to prevent the spread of attacks. After identifying the attack nodes, the damaged data areas can be accurately identified, providing precise targets for subsequent repair work and reducing unnecessary repair operations. Based on the different characteristics of the damaged data, an adaptive repair strategy is used to repair each area one by one, which not only improves the efficiency of the repair, but also reduces the impact of the repair process on system performance. An accurate data repair strategy can effectively ensure that the company's data is restored to a complete state after an attack, reducing the risk of data loss. Through historical monitoring log analysis, different encryption strategies can be formulated for different data levels (such as critical data, non-critical data, etc.). In this way, important data can be protected at a higher level, reducing the risk of data leakage. Combined with adaptive data repair and backup strategies, intelligent protection and control of the company's hard disk system can be achieved. Different protection measures work together to ensure that the hard disk is fully protected when it is attacked or fails. Through intelligent collaborative protection, the company's hard disk system can maintain higher security and stability in the face of multiple threats, ensuring data integrity and recoverability.

[0082] In the embodiment of the present invention, see Figure 1 , is a flowchart of a hard disk data protection method based on artificial intelligence of the present invention. In this example, the steps of the hard disk data protection method based on artificial intelligence include:

[0083] Step S1: Obtain hard disk historical monitoring logs; perform hard disk load analysis on the hard disk historical monitoring logs over multiple time periods, and perform load peak fluctuation fitting to construct a hard disk load peak fluctuation curve;

[0084] In this embodiment, the scope and type of hard disk monitoring logs to be collected are determined. Generally speaking, these logs should contain key indicators such as timestamps, read and write operations, IOPS (input and output operations per second), latency, bandwidth, etc. System monitoring tools (such as iostat, perfmon, or custom scripts) are used to collect these monitoring data within a specific time period to ensure that the collected data covers different workloads and time periods for comprehensive analysis. Log data can be stored in CSV files, databases, or real-time monitoring systems to ensure that the data format is consistent and easy to process later. Preliminary data cleaning is performed on the acquired log data, which includes removing invalid records, processing missing values, and unifying the time format. Python's Pandas library can be used to read CSV files and perform data preprocessing. For timestamps, ensure that the time format of each record is consistent and convert it into a time series format that can be used for analysis. The cleaned data should be arranged in chronological order to facilitate subsequent processing. The cleaned data is grouped and analyzed according to different time periods (such as hours, days, and weeks). The groupby function of the Pandas library can be used to group the data and calculate statistics such as the average load, maximum load, and minimum load for each time period. Measuring indicators, analyzing load differences between different time periods (such as weekdays and weekends, and morning and evening peaks), and identifying periods with higher and lower loads helps understand drive usage patterns and load variations. After completing load analysis, use a fitting algorithm to fit the analysis results to load peak fluctuations. You can choose an appropriate mathematical model (such as polynomial regression or exponential smoothing) to fit the load data. Choosing the right model depends on the distribution characteristics of the data. Use Python's SciPy or NumPy libraries for fitting. During the fitting process, record the load values ​​for each time period and calculate the load fluctuation trend line using the fitting algorithm. Use visualization tools (such as Matplotlib or Seaborn) to visualize the raw load data and the fitted curve to help intuitively understand the changing trends of load peaks. Finally, organize the fitted load fluctuation data into a load peak fluctuation curve. Based on the fitting results, generate a corresponding fluctuation curve graph, indicating the maximum peak value, minimum valley value, and the corresponding time points. Add necessary annotations and labels to the graph to clearly convey the key points of load variation. This curve will be used for subsequent performance analysis and optimization recommendations, providing data support for drive management and maintenance.

[0085] Step S2: Analyze the peak trend evolution of the hard disk load peak fluctuation curve and detect abnormal load peaks to obtain the time period of the abnormal peak point;

[0086] In this embodiment, it is ensured that the constructed load peak fluctuation curve data is available for analysis, and the load fluctuation data from the previous analysis step is imported into the data processing environment. The Python Pandas library is usually used to read the data in the CSV file or database to ensure that the data structure is complete, including the timestamp and the corresponding load value. The data is preliminarily checked to confirm that there are no missing values ​​or outliers to ensure the accuracy of subsequent analysis. Time series analysis is performed on the load peak data to observe the trend of load changes. The moving average method can be used to smooth the fluctuation data to more clearly identify the trend. The moving average is calculated using the rolling function of Pandas. An appropriate window size (such as 3 hours or 24 hours) is set to smooth short-term fluctuations. The standard deviation and variance of the load are calculated to quantify the amplitude of the load fluctuation. The load changes in each time period are recorded to identify trend characteristics such as periodic changes and seasonal fluctuations in the load. Data visualization tools (such as Matplotlib or Seaborn) are used to draw the load fluctuation curve and its moving average line to intuitively display the peak change trend and mark obvious peaks and troughs. The detection criteria for abnormal load peaks are usually determined based on statistical methods. A threshold can be set. Points below the average load minus two standard deviations or above the average load plus two standard deviations are considered abnormal. The mean and standard deviation of the load data are calculated using Python's NumPy library, and thresholds are applied based on these statistical values ​​to detect abnormal load peaks. This can be achieved through simple conditional filtering, generating a Boolean array to identify abnormal points. For each detected abnormal peak, its corresponding timestamp and load value are recorded to form an abnormal load dataset. Once the abnormal peak points are determined, the time period in which these abnormal points are located needs to be extracted. This can be done by grouping and summarizing the timestamps of the abnormal load points to determine the start and end time of each abnormal event. Pandas' groupby function and time difference calculation are used to identify consecutive abnormal load points to determine their time period. If the abnormal peak interval is less than the set threshold (for example, a few minutes), they are considered to belong to the same event. The time period of each abnormal event is recorded, including the start time, end time and corresponding maximum load value, to form the final abnormal load time period dataset.

[0087] Step S3: Calculate the redundant data of the hard disk in the current time period according to the time period of the abnormal peak point, and make a dynamic global data backup decision, thereby generating an abnormal peak global backup strategy;

[0088] In this embodiment, Python's Pandas library is used to import data from the abnormal peak time period into the analysis environment to ensure that the data structure is complete and easy to process, and to confirm other data required for redundant data calculation, such as hard disk usage, storage capacity, current backup status, etc. in the current time period. This information will be used to evaluate the basis for redundant data calculation and backup decision-making. According to the time period where the abnormal peak occurs, all data records in the time period are extracted, and the amount of redundant data of the current hard disk is calculated. Redundant data generally refers to storage space or historical backup data that is not effectively utilized during abnormal load periods. By analyzing the current hard disk usage and calculating the proportion of redundant data, the ratio of data volume (such as GB) to available storage space can be used to quantify redundancy and identify the storage efficiency of the hard disk under abnormal load conditions. Data analysis tools (such as NumPy) are used to perform statistical analysis on the data and generate a report on redundant data, recording the size and proportion of redundant data and its impact on system performance. After calculating the redundant data, the decision criteria for the backup strategy are determined. These criteria can be used to determine the decision criteria for the backup strategy. The decision to perform a global data backup is based on set criteria, including the current amount of redundant data, system load, current backup frequency, and business importance. If the amount of redundant data exceeds a certain threshold (redundant data occupies 10% of the total storage space), the global backup process is triggered. Conditional statements or rule engines (such as Drools) are used to dynamically determine whether a global backup is required. This process should take into account the current load of the system to avoid performing backup operations during peak hours, which may affect system performance. Once a global backup is determined to be necessary, a specific backup strategy is formulated, including the backup time point, backup data type (full backup or incremental backup), and backup storage location (local or cloud). Combined with the calculation results of the redundant data, an optimal backup plan is designed. If the redundant data is high, a full backup can be selected; if the redundant data is low, an incremental backup can be selected to save storage space and time. This ensures that the backup strategy is flexible and can be dynamically adjusted according to subsequent load changes and system status to ensure a balance between data security and system performance.

[0089] Step S4: Detect abnormal write behavior and locate the attack node in the hard disk history monitoring log, and mark the malicious attack source location point;

[0090] In this embodiment, monitoring logs are imported into an analysis environment using data processing tools (such as the Python Pandas library). Ensure that log data is organized in chronological order to facilitate subsequent analysis. Define criteria for abnormal write behavior. These criteria can include abnormal write frequency (such as multiple writes to the same file in a short period of time), unusually large write data volumes, and unusual write destination paths (such as system files or sensitive files). Designing a write behavior detection algorithm typically employs rule-based detection methods or machine learning algorithms. Rule-based methods employ various conditions, such as defining a write frequency exceeding a certain threshold as abnormal. Machine learning methods require training models to distinguish between normal and abnormal behavior. Historical monitoring logs are scanned using the defined rules or trained models to detect abnormal write behavior. Machine learning models can be applied using the Python Scikit-learn library, or Pandas can be used to filter data directly using conditions. All detected abnormal write behavior is recorded, including information such as timestamp, source IP address, target file, and written data volume, for subsequent analysis and auditing. Within detected abnormal write behavior, the source IP address and other relevant information are further analyzed to trace the origin of the attack. Network traffic analysis tools (such as Wireshark) or IP geolocation services (such as MaxMind) can help determine the geographic location of the source IP. Combined with the time information of abnormal write behavior, identify possible attack paths and operation steps, and record detailed information about the attack nodes. If there are multiple abnormal write behaviors, analyze the correlation between them to determine whether they belong to the same attack event, and mark the relevant attack nodes. Ensure that all marked malicious attack tracing points are recorded and stored in the database to ensure that the data is structured and queryable. Record detailed information for each attack node, including source IP, abnormal behavior type, timestamp, etc. Generate a detailed attack tracing report to describe the process and results of abnormal write behavior detection and attack node tracing. The report should include a visual chart that shows the time distribution and attack path of abnormal behavior to help the security team quickly understand the attack pattern and scope of impact.

[0091] Step S5: Identify the data damaged area at the malicious attack source location point, and then perform adaptive data repair on a region-by-region basis to build an adaptive data repair strategy;

[0092] In this embodiment, by reviewing historical monitoring logs, files written or modified during the attack are identified. The modification time, size change, and content changes of these files are important indicators for determining damaged areas. Combining file system metadata (such as file creation and modification time, and access permissions), the system determines which files or data blocks were affected by the attack and marks these areas as "damaged areas." Each identified damaged area is analyzed in detail to assess its importance and impact. Factors considered include data sensitivity, business criticality, and the availability of backups. Data integrity verification methods (such as hash checks) are used to verify the data in the damaged area to determine if it is truly damaged. By comparing the hash value of the original file with the hash value of the current file, data tampering can be promptly identified. Detailed information for each damaged area is recorded, including the file path, damage level, and impact assessment results, to facilitate the development of a subsequent repair plan. An adaptive data repair strategy is developed to select the appropriate repair method for each damaged area based on its importance and impact. Common repair methods include restoring from backups, repairing through data redundancy mechanisms, or using data recovery tools. For critical damaged areas, full backups are prioritized for recovery. Automated scripts (such as those using Bash or Python scripts) can be used to extract data from backup storage and overwrite damaged areas. For areas without backups or incomplete backups, data recovery software (such as TestDisk or Recuva) can be used to attempt recovery. This software typically scans the hard drive for recoverable data blocks. During the adaptive data repair process, monitor the progress and effectiveness of the repair in real time. Record the success or failure of each repair operation, the results of the data integrity check after the repair, and other information. Use automated monitoring tools (such as Nagios or Zabbix) to track the repair process and ensure timely alerts and adjustments when problems occur. Conduct subsequent assessments of each repaired area to verify data integrity and consistency and ensure that the repaired data can be used normally.

[0093] Step S6: Make layered data encryption decisions based on the hard disk historical monitoring logs, and perform intelligent collaborative protection control based on the adaptive data repair strategy abnormal peak global backup strategy to build an intelligent collaborative protection model.

[0094] In this embodiment, the data classification standard is determined, which can generally be divided into high sensitivity (such as personal information, financial data), medium sensitivity (such as operational data) and low sensitivity (such as public information). An encryption strategy is set, and different encryption algorithms and key management strategies are applied to different categories of data. For high-sensitivity data, a strong encryption algorithm (such as AES-256) is selected; for medium-sensitivity data, a moderate encryption algorithm (such as AES-128) is used; and for low-sensitivity data, lightweight encryption or no encryption can be selected. Based on the analysis results of the previous step, the data on the hard disk is encrypted in layers, and encryption tools (such as OpenSSL or GnuPG) are used to implement specific encryption operations to ensure the automation of the encryption process to improve efficiency and security. During the implementation process, detailed information of each encryption operation is recorded, including the type of encrypted data, encryption algorithm, key generation and management methods, etc., to ensure Ensure the secure storage of encryption keys, establish a complete key management system, update keys regularly, perform integrity and availability checks on encrypted data, ensure that encryption does not affect normal business operations, use hash verification methods to verify the integrity of data during the encryption process, combine adaptive data repair strategies with abnormal peak global backup strategies, and design an intelligent collaborative protection control model. The model should be able to automatically trigger data repair and backup operations when abnormal activities are detected to ensure data security. Use rule engines (such as Drools or Apache Camel) to implement intelligent decision-making logic and set trigger conditions. When abnormal peaks or data corruption are detected, automatically perform data repair and perform global backup during the repair process. Design data flows and control flows to ensure the collaborative work between various modules in the system, define the input and output of each module, and ensure that information can be transmitted and processed in a timely manner.

[0095] In this embodiment, refer to Figure 2 , is a flowchart of the detailed implementation steps of step S1. In this embodiment, the detailed implementation steps of step S1 include:

[0096] Step S11: Obtaining a hard disk historical monitoring log, collecting multi-modal hard disk monitoring parameters from the hard disk historical monitoring log, and extracting the multi-modal hard disk monitoring parameters;

[0097] Step S12: performing time series data flow evolution on the multi-modal hard disk monitoring parameters, thereby generating hard disk flow data time series evolution features;

[0098] Step S13: performing multi-period hard disk load analysis on the time series evolution characteristics of the hard disk traffic data to generate hard disk load data for different time periods;

[0099] Step S14: Calculate the traffic load peak value of the hard disk load data in different time periods, and extract the hard disk traffic load peak value in each time period;

[0100] Step S15: performing load peak fluctuation fitting on the hard disk traffic load peak in each time period, thereby constructing a hard disk load peak fluctuation curve.

[0101] In this embodiment, the source of the hard disk monitoring log is determined. These logs may come from the operating system's monitoring tools, hard disk management software (such as SMART monitoring), third-party monitoring systems, or custom logging tools. The integrity of the log records is ensured, including important parameters such as timestamps, read and write rates, IOPS (input and output operations per second), latency, and error rates. An automated script or tool is designed to regularly extract historical monitoring logs from the determined data source. This can be done through an API interface, command line tools, or by reading directly from the log file. During the collection process, the consistency of the data format is ensured, and the data is stored in a predetermined data format (such as CSV, JSON) for subsequent processing. The collected monitoring logs are then automatically generated and stored in a predefined format (such as CSV, JSON). Clean the logs, remove invalid records, duplicate entries, and missing data, use data cleaning tools (such as Pandas) to operate on the log data to ensure data quality, further format the log data for subsequent multimodal parameter extraction, ensure that the data can be effectively parsed, and maintain the necessary fields and structures, extract multimodal monitoring parameters such as read and write rates, latency, hard disk usage, etc. from the cleaned historical logs, design corresponding extraction algorithms based on different hard disk monitoring indicators, store the extracted parameters in a structured database for subsequent analysis, ensure that each parameter is associated with its corresponding timestamp and hard disk ID, and integrate the extracted multimodal hard disk monitoring parameters into a unified time series data set to ensure All parameters are aligned with timestamps and arranged in chronological order for time series analysis. The data is standardized to ensure that different monitoring parameters are on the same scale for subsequent analysis. Time series analysis methods such as sliding windows, Fourier transform or wavelet transform are used to extract features from the integrated data, identify periodic patterns, trends and outliers, and calculate statistical features such as the mean, variance, maximum and minimum values ​​of the traffic to help understand the evolution of the traffic. Use visualization tools (such as Matplotlib or Seaborn) to draw a time series diagram of the hard disk traffic to show the trend of traffic changes over time. This will help identify the peak and trough periods of traffic. Through the visualization results, evaluate whether there is an obvious flow Abnormal or periodic fluctuations in traffic volume lay the foundation for the next load analysis. The generated time series evolution characteristics are stored in the database, and each step of the data processing process is recorded for subsequent audit and optimization. Detailed documents are written to record each step and method of data processing for future reference and improvement. According to business needs or traffic characteristics, the time series data is divided into multiple time periods, which can be divided by hour, day or week. Ensure that the amount of data in each time period is sufficient for effective analysis, determine the start and end time of each time period, ensure that all data is evenly distributed in each time period, summarize the monitoring parameters in each time period, calculate the average load, peak load and total load of each time period, and calculate the average read and write rate and total IOPS of each time period.Use aggregation functions (such as groupby in Pandas) to group and calculate data to ensure the accuracy and consistency of the results. Store hard disk load data for different time periods in the database to ensure the structure and queryability of the data. Record the load characteristics of each time period for subsequent analysis and reporting. Write documents to describe the analysis process and calculation methods for each time period in detail to facilitate subsequent auditing and optimization. Use visualization tools to display hard disk load characteristics for different time periods to help identify load change trends and peak periods. Use histograms, line charts, or heat maps to intuitively display load conditions. By comparing the visualization results with historical data, it helps identify potential load anomalies and clearly define the load peak, such as in each time period. The maximum read and write rate, IOPS, etc. of the internal hard disk are determined to ensure that this standard can effectively reflect the peak state of the load. The method for calculating the load peak may be to use a simple maximum value calculation, or to combine the sliding window technology to capture sudden load conditions. The load data of each time period is traversed to calculate the load peak of each time period. This can be achieved by writing simple code (such as the max() function in Python). The peak value of each time period is recorded and compared with other statistical data (such as the average load) to better understand the changes in the load. The calculated load peak value is stored in the database to ensure that the data is structured for subsequent query and analysis. The peak value of each time period and its corresponding timestamp are recorded, and detailed data is written. A report describing the calculation process and results of the load peak is prepared for subsequent reference and optimization. Visual tools are used to display the changing trend of the load peak to help understand the load fluctuations in different time periods. The peak load period is identified through graphical display. Comparative analysis is conducted in combination with historical data to identify potential load anomalies and provide a basis for subsequent optimization and adjustment. A suitable fitting model is selected, such as linear regression, polynomial regression, or other time series prediction models (such as ARIMA models). According to the characteristics of the load peak, a suitable model is selected to capture the fluctuation trend. The parameter settings of the model, such as the order of the polynomial and the regression variables, are determined to ensure that the model can effectively fit the peak data. The calculated load peak is organized into a suitable fitting model. The data format is ensured to include timestamps and corresponding load peak values, which provides a basis for subsequent fitting. The data is standardized to improve the fitting effect and ensure that the data is on the same scale. The sorted data is input into the selected fitting model to perform load peak fluctuation fitting. Statistical analysis tools (such as Scikit-learn and Statsmodels) are used for fitting and the fitting effect of the model is evaluated. The fitting results, including statistical indicators such as fitting parameters and R² values, are recorded to evaluate the validity and accuracy of the model. The load peak fluctuation curve is drawn using visualization tools to show the comparison between the fitting results and the actual data. The accuracy and fluctuation trend of the fitting are intuitively displayed through comparison charts. The fitting results are combined for analysis.Identify potential load fluctuation patterns and provide a basis for subsequent optimization strategies.

[0102] In this embodiment, the specific steps of step S12 are:

[0103] Perform outlier filtering on multimodal hard disk monitoring parameters to obtain outlier filtering monitoring parameters;

[0104] Analyze the hard disk temperature changes based on the outlier filtering monitoring parameters and extract the hard disk temperature change characteristics;

[0105] Calculate the real-time read and write rate of the outlier filtering monitoring parameters to obtain the real-time read and write rate of the hard disk;

[0106] Perform data writing error rate analysis on outlier filtering monitoring parameters to generate data writing error rate;

[0107] The hard disk real-time read and write rates and data write error rates are mined to generate hard disk real-time traffic status features;

[0108] According to the hard disk temperature change characteristics, the hard disk real-time traffic state characteristics are analyzed for time series data traffic evolution, thereby generating the hard disk traffic data time series evolution characteristics.

[0109] In this embodiment, the criteria for determining abnormal outliers are generally statistical methods such as Z-score and IQR (interquartile range method) to identify outliers in monitoring parameters. A threshold (Z-score>3) is defined to identify abnormal data points. Appropriate monitoring parameters are selected for analysis, such as read and write rates, latency, IOPS, temperature, etc., to ensure that these parameters can effectively reflect the status of the hard disk. Multimodal hard disk monitoring parameter data is collected and preliminarily cleaned to remove duplicate records and invalid data to ensure data integrity and consistency. Data processing libraries in programming languages ​​such as Python (such as Pandas) are used to implement data cleaning. A basic data set for outlier filtering is prepared, and the selected outlier detection method is applied. Analyze the monitoring parameters after cleaning, calculate the Z-score value of each parameter using the Z-score method, and compare it with the preset threshold. Record the detected outliers and delete them from the original data set to obtain the monitoring parameters after outlier filtering. Extract temperature-related data from the monitoring parameters after outlier filtering, ensure that the data includes timestamps and corresponding temperature values, perform preliminary cleaning on the temperature data to ensure the accuracy and completeness of the data, use tools such as Pandas to process the temperature data, and calculate the statistical characteristics of temperature changes, such as average temperature, temperature fluctuation range, maximum temperature and minimum temperature. These characteristics can help understand the temperature changes of the hard disk in different time periods. Use time series analysis methods to calculate Calculate the trend and periodicity of temperature changes, identify potential abnormal fluctuations, use visualization tools (such as Matplotlib and Seaborn) to draw temperature change graphs to show the trend of temperature changes over time. Through the graph, you can intuitively identify the peaks and troughs of temperature. Analyze abnormal fluctuations in the graph to determine whether they may affect the performance or life of the hard drive. Store the extracted temperature change characteristics in the database to ensure the structure and queryability of the data. Record the process and results of the temperature analysis for subsequent optimization. Write a detailed report describing the results and findings of the temperature change analysis to provide a basis for subsequent hard drive maintenance. Extract real-time read and write related data from the monitoring parameters after outlier filtering, and ensure that the data includes timestamps, read rate and write rate, etc. Information, clean the data, remove invalid records, ensure the integrity and accuracy of the data, calculate the real-time read and write rate, usually you can get the read and write rate in a specific time period by taking the average or using the sliding window method, you can use the read and write data of the past 5 minutes to calculate the average rate, use the Numpy or Pandas library in Python for calculation, ensure the efficiency and accuracy of the calculation process, store the calculated real-time read and write rate in the database, ensure the structure and queryability of the data, record the calculated timestamp and rate value for subsequent analysis, write detailed documents, record the process and method of calculating the real-time read and write rate, provide a basis for subsequent auditing and optimization, use visualization tools to show the changing trend of the real-time read and write rate,Help identify potential performance bottlenecks or anomalies, analyze the comparison between real-time read and write rates and historical data, determine whether the current performance is within the normal range and whether optimization is needed, extract data write error-related data from the monitoring parameters after outlier filtering, ensure that the data includes information such as timestamps and error counts, clean the data, remove invalid records, ensure data integrity and accuracy, calculate the data write error rate, usually using the formula: Error rate = (number of write errors / total number of write requests) × 100%, ensure that the number of write requests is accurately counted during the calculation process, use Python and other tools to calculate the error rate, ensure the efficiency and accuracy of the calculation, store the calculated data write error rate in the database, and ensure data Structured and queryable, record the calculated timestamps and error rate values ​​for subsequent analysis, write detailed documents, record the process and results of data write error rate calculations, provide a basis for subsequent audits and optimizations, use visualization tools to display the changing trend of data write error rates, help identify potential problems and high-risk time periods, analyze the relationship between error rates and other monitoring parameters, and determine whether there is a correlation, such as whether an increase in temperature causes an increase in error rates, integrate real-time read and write rates and data write error rates into a unified data set, ensure that data is aligned by timestamp for traffic status analysis, use data processing tools such as Pandas for integration, ensure consistency in data format, calculate hard disk traffic status characteristics, including real-time read and write The average value, peak value, fluctuation range of the rate and the average value of the data write error rate, etc., use statistical analysis methods to extract the key features of the traffic state, design evaluation indicators of the traffic state according to actual needs, help understand the health of the traffic, use visualization tools to display the hard disk traffic state characteristics, help identify traffic peaks and abnormalities, use heat maps, line graphs, etc. to intuitively display traffic changes, analyze the relationship between traffic state characteristics and hard disk performance, and determine whether traffic affects the normal operation of the hard disk. Store the generated real-time hard disk traffic state characteristics in the database to ensure the structure and queryability of the data, record the calculation process and results of each feature, provide a basis for subsequent optimization, and write detailed documents to describe the traffic state mining. The process and results are used for subsequent audit and improvement. The hard disk temperature change characteristics and real-time traffic status characteristics are integrated into a unified data set. The data are aligned by timestamp for time series analysis. Data processing tools such as Pandas are used to ensure the consistency of data format for subsequent analysis. Time series analysis methods such as moving average, exponential smoothing or correlation analysis are used to observe the relationship between temperature changes and traffic status, extract evolution characteristics, calculate the degree of impact of temperature changes on traffic status, identify potential impact patterns, extract time series evolution characteristics, including the correlation between temperature changes and traffic status, trend changes, etc., evaluate the effectiveness of these characteristics in traffic status monitoring, and use data mining technology to identify potential traffic anomaly patterns.To assist in subsequent risk assessment.

[0110] In this embodiment, refer to Figure 3 , is a flowchart of the detailed implementation steps of step S2. In this embodiment, the detailed implementation steps of step S2 include:

[0111] Step S21: performing a peak trend evolution analysis on the hard disk load peak fluctuation curve to generate load peak trend evolution data;

[0112] Step S22: performing a multi-time window rolling forecast on the load peak trend evolution data to obtain load peak forecast data for multiple time windows;

[0113] Step S23: performing abnormal load peak detection on the load peak prediction data of multiple time windows and marking abnormal load peak points;

[0114] Step S24: Locate the time period of the abnormal load peak point, thereby obtaining the time period where the abnormal peak point is located.

[0115] In this embodiment, the generated load peak fluctuation curve data is collected to ensure that the data contains timestamps and corresponding load peak values, and that the data is complete and has no missing or duplicate records. Data processing tools (such as Pandas) are used to preprocess the data, organize the load peak data into a format suitable for analysis, and select a suitable trend analysis method, such as moving average, exponential smoothing, or linear regression. Based on the characteristics of the data, it is decided which method to use to smooth fluctuations and extract trends. The analysis window length is set, for example, using data from the past 7 days to calculate the average load trend to reduce the impact of short-term fluctuations. The selected trend analysis method is applied to calculate the load peak fluctuation curve, and the moving average or linear regression model is calculated to identify the trend. Analyze the long-term load trend, record the trend changes in each time period, including rising, falling and stable states, and generate corresponding trend data reports. Use visualization tools (such as Matplotlib or Seaborn) to draw load peak trend graphs to intuitively display the changing trend and evolution process of the peak. Store the analysis results and generated trend data in the database to ensure data structure and facilitate subsequent query and analysis. At the same time, record the parameters and methods in the analysis process for subsequent audits. Select the appropriate prediction model, such as ARIMA, SARIMA, LSTM, etc., depending on specific needs. ARIMA is suitable for linear time series, while LSTM is suitable for processing more complex nonlinear data. Determine the parameter settings of the model, for example Such as the number of autoregressive terms, the number of difference orders and the number of moving average terms to ensure that the model adapts to the data characteristics, convert the load peak trend evolution data into a format suitable for model input, ensure that the data is arranged in time series, and handle missing values, divide the data according to the set time window (such as 1 hour, 1 day, etc.) for rolling forecasting, and use sliding window technology to ensure the overlap between each window. Input the data into the selected forecasting model and perform rolling forecasting step by step. Each time, use the data of the previous few time points to predict the load peak of the next time point, and repeat this process. Record the forecast results of each time window and evaluate the forecast accuracy. Use indicators such as MSE (mean square error) and MAE (mean absolute error) for evaluation to determine the abnormal load peak. Standards, usually use statistical methods such as Z-score, IQR, etc. to identify outliers in the predicted data, set thresholds (for example, Z-score>3) to identify outliers, select appropriate monitoring parameters for analysis, such as predicted load peak, actual load peak, etc., to ensure that these parameters can effectively reflect the abnormal load situation, apply the selected anomaly detection method, analyze the predicted data, calculate the Z-score of each load peak, and compare it with the set threshold, record the detected abnormal load peak, and mark the anomaly point for subsequent analysis, store the marked abnormal load peak in the database to ensure the structure and queryability of the data, record the timestamp and detection result of each anomaly point for subsequent analysis,Write a detailed report describing the process and results of abnormal load peak detection to provide a basis for subsequent risk assessment and optimization. Determine the time period of the abnormal load peak, which usually includes data before and after the abnormal point. Set a time window, such as 1 hour before and after, to facilitate detailed analysis. Ensure that the time period is reasonable and can reflect the impact of the abnormal load peak. Extract the abnormal load peak point and its corresponding time period data from the stored load peak data. Ensure that the extracted data includes timestamps, load values, and other relevant monitoring parameters. Use data processing tools (such as Pandas) to extract data to ensure data integrity and consistency. Record the time period of each abnormal load peak point and generate a report on the abnormal load peak time period, including the start and end time of the time period, load value, and its changes. Analyze the monitoring parameters within the time period to determine the cause of the abnormal load peak, such as whether it is related to factors such as system load and temperature changes.

[0116] In this embodiment, refer to Figure 4 , is a flowchart of the detailed implementation steps of step S3. In this embodiment, the detailed implementation steps of step S3 include:

[0117] Step S31: analyzing the hard disk storage status of the hard disk in the current time period according to the time period where the abnormal peak point is located, thereby obtaining the hard disk storage status;

[0118] Step S32: Calculate the redundant data of the hard disk in the current time period and extract the redundant data of the abnormal peak time period;

[0119] Step S33: performing redundant data cleaning on the hard disk based on the redundant data in the abnormal peak time period, thereby obtaining redundant optimized hard disk data;

[0120] Step S34: making a dynamic global data backup decision for the redundant optimized hard disk data according to the hard disk storage status, thereby generating an abnormal peak global backup strategy.

[0121] In this embodiment, hard disk monitoring data within the time period corresponding to the abnormal peak point is collected, including multiple parameters such as hard disk read and write rate, IOPS, latency, temperature, etc., to ensure data integrity and consistency. Database query tools are used to extract relevant monitoring data within the specified time period to ensure a unified data format for subsequent analysis. Key indicators of hard disk storage status are defined, such as storage utilization, activity, error rate, etc. These indicators can effectively reflect the health status of the hard disk during the abnormal peak time period. The calculation method for each indicator is determined. Storage utilization can be expressed as the ratio of used space to total space. The collected data is analyzed to calculate the defined storage status indicators. Data processing tools (such as Python's Pandas) are used to calculate the storage status indicators. s library) to calculate and analyze data, identify hard disk status characteristics during abnormal peak time periods, such as whether overloads or errors occur, and whether there are performance bottlenecks. Use visualization tools (such as Matplotlib or Seaborn) to plot hard disk storage status indicators into charts to intuitively display changes in storage status and abnormal phenomena. Generate a detailed analysis report that summarizes the storage status of the current time period and proposes possible improvement suggestions. Record the analysis process for subsequent audits, determine the definition of redundant data, including data backup, duplicate data, and useless data, clarify which data can be considered redundant, set relevant calculation standards, and design indicators for redundant data calculation, such as the proportion of redundant data to total data and the amount of redundant data. Extract relevant data from the abnormal peak time period from the stored monitoring data, clean it, remove duplicate records and invalid data to ensure data accuracy, use data processing tools (such as Pandas) to process the data to ensure accurate identification of redundant data, apply the defined standards to calculate the redundant data in the current time period, and judge whether the data is repeated by comparing the hash value of the data block to identify redundant data, and record the calculation results of redundant data, including the number and proportion of redundant data, to provide a basis for subsequent optimization. According to the calculation results of redundant data, design a cleaning strategy, and consider completely deleting redundant data, migrating to low-cost storage, or compressing it, etc., to determine the priority of cleaning, such as giving priority to processing occupied space For large amounts of redundant data, before performing redundant data cleaning, ensure that all important data is backed up to prevent data loss caused by cleaning operations. Use backup tools to back up data and record the backup time and content for subsequent recovery. Perform redundant data cleaning according to the designed cleaning strategy. You can use automated scripts or manual operations to clear redundant data based on its markings. Record the timestamp and type of each cleaned data for subsequent auditing and recovery. Evaluate existing data backup strategies and analyze their effectiveness and feasibility during abnormal peak periods. Consider the current storage status and the impact of redundant data, determine backup goals, such as reducing loss risks and improving recovery speed, and ensure that the backup strategy can meet these goals.Based on the analyzed hard drive storage status, determine current backup needs. Considering the risk of data loss caused by abnormal peaks, adjust the backup frequency and content, and design a dynamic backup strategy. For example, increase the backup frequency during abnormal peaks and reduce the backup frequency during normal conditions to ensure the rational use of resources. Make global data backup decisions, including the backup time, content, and method (such as incremental backup, full backup, etc.). Ensure that the backup strategy can adapt to the current hard drive status. Use backup software or tools to perform data backup according to the established strategy to ensure the automation and efficiency of the backup process.

[0122] In this embodiment, step S4 includes the following steps:

[0123] Step S41: Detect abnormal write behavior in the hard disk history monitoring log and extract abnormal write behavior;

[0124] Step S42: Calculating the abnormal behavior frequency of the abnormal writing behavior to obtain an abnormal writing behavior frequency parameter;

[0125] Step S43: performing time series variation statistics on the abnormal write behavior frequency parameter, thereby generating abnormal write behavior frequency variation characteristics;

[0126] Step S44: performing malicious attack behavior analysis based on the frequency change characteristics of abnormal write behavior, thereby generating malicious attack behavior data;

[0127] Step S45: trace the attack node source of the malicious attack behavior data and mark the malicious attack source location point.

[0128] In this embodiment, the hard disk historical monitoring log is collected and organized to ensure that the data contains information such as timestamp, write operation type, write amount, write failure record, etc. The data should be complete and in a unified format for subsequent analysis. Tools such as Python's Pandas library are used to import and process log data, remove invalid records and fill missing values, and determine the standards for abnormal write behavior, such as abnormal write rate, excessive number of write failures, frequent write operations, etc. Historical data can be referenced to set reasonable thresholds, and statistical methods (such as Z-score and IQR method) can be used to determine what kind of behavior can be considered abnormal. The set abnormal standards are applied to detect historical monitoring logs, and by writing detection algorithms, the behavior that is significantly different from normal behavior can be identified. Different write operations are performed, and the detected abnormal write behaviors are recorded, including their types, frequencies, and timestamps. Data is prepared for subsequent analysis. The standard for calculating the frequency of abnormal write behaviors is determined, such as the number of abnormal write behaviors within a certain time window. The time window is set (such as hourly, daily, etc.) to facilitate frequency statistics. The frequency calculation formula is designed, which is usually: frequency = number of abnormal behaviors / total number of records within the time window. The necessary data, including timestamps and abnormal behavior types, are extracted from the stored abnormal write behavior records to ensure data integrity for frequency calculation. Data processing tools (such as Pandas) are used to organize the data, and abnormal behaviors are grouped by time window. The set frequency calculation method is applied to the abnormal Frequently write behaviors are counted, and the number of abnormal behaviors and the corresponding frequency in each time window are recorded. A frequency data set is generated to ensure that the calculation results of each time window are recorded, including the timestamp and the frequency of abnormal behaviors. The calculated abnormal write behavior frequency parameters are organized into time series data to ensure that the data is arranged by timestamp, and missing values ​​and abnormal points are processed. Data processing tools (such as Pandas) are used to clean the frequency data to ensure the accuracy and completeness of the data. The calculation method of frequency change characteristics is defined, such as the moving average, percentage change, standard deviation, etc. of the frequency. These characteristics can reflect the changing trend of the frequency over time. The calculation period of the change characteristics can be selected as day, week or month, depending on the volatility of the data. The set feature calculation method performs statistical analysis on the frequency parameters of abnormal write behavior, generates a frequency change feature data set, and records the frequency characteristics of each time period, including the magnitude of change, trend direction, etc., to provide a reference for subsequent analysis. Based on the frequency change characteristics, a malicious attack behavior recognition model is established. Machine learning algorithms (such as decision trees and random forests) can be used to train the model to identify potential attack patterns, collect historical attack data, and annotate different types of attack behaviors for model training and verification. Relevant features are selected from the generated frequency change features as input variables of the model to ensure that the features can effectively reflect the characteristics of the attack behavior. The time series data is converted into a format suitable for model input to ensure data integrity and consistency.Use the training set to train the malicious attack behavior recognition model, adjust the model parameters to optimize the performance, evaluate the accuracy of the model through cross-validation and other methods, use the test set to verify the model, record the model's accuracy, recall rate and other indicators to ensure the effectiveness of the model in practical applications, apply the trained model to analyze the frequency change characteristics of abnormal write behavior, identify possible malicious attack behaviors, generate relevant attack behavior data, record the type, timestamp and frequency characteristics of each identified attack behavior, so as to facilitate subsequent traceability analysis, determine the standards and methods for tracing the source of the attack node, usually based on the timestamp, source IP address, log records and other information of the abnormal behavior. To track, we design a traceability model, combining historical log data and attack behavior data to establish an attack path identification framework. We extract necessary traceability information from malicious attack behavior data, including time, source, target, etc., to ensure the integrity and accuracy of the data for subsequent analysis. We use data processing tools (such as Pandas) to clean the extracted data and remove invalid records. According to the set traceability strategy, we analyze the malicious attack behavior data to identify the attack source node and its path. By comparing log information with historical records, we can track the starting point and propagation path of the attack behavior and record detailed information for each attack node, including attack type, attack time, source IP, etc.

[0129] In this embodiment, step S5 includes the following steps:

[0130] Step S51: mining attack propagation paths for malicious attack source tracing locations to obtain multiple attack propagation paths;

[0131] Step S52: Identify data damaged areas based on multiple attack propagation paths and generate multiple malicious attack damaged areas;

[0132] Step S53: Analyze the damaged data formats of multiple malicious attack damaged areas to generate damaged area data formats;

[0133] Step S54: performing recoverability evaluation on the damaged area data format, thereby obtaining the recoverability of each damaged area;

[0134] Step S55: Based on the recoverability of each damaged area, adaptive data repair is performed on a region-by-region basis to construct an adaptive data repair strategy.

[0135] In this embodiment, historical monitoring logs related to malicious attacks are collected, including information such as timestamps, source IP addresses, target IP addresses, and operation types. These data will be used to analyze the propagation path of the attack. Data processing tools (such as Elasticsearch or Splunk) are used to extract necessary log data, ensuring that their format is unified and complete. Appropriate path mining algorithms are selected, such as graph-based algorithms (such as Dijkstra algorithm or depth-first search) to identify the attack propagation path. The attack source and target can be regarded as nodes in the graph, and the operations as edges. The path mining criteria, such as the time sequence of attack propagation and the nature of the attack, are determined. The selected algorithm is used to analyze the interaction between the attack source and target to identify the propagation path of the attack. The attack propagation path is recorded, the nodes and operation types of each path are recorded, an attack propagation graph is constructed, multiple attack propagation paths are generated, and a unique identifier is assigned to each path for subsequent analysis and tracking. The mined attack propagation paths are stored in the database to ensure that the data is structured and queryable, and detailed information of each path is recorded, including nodes, operations and timestamps. The attack propagation path is displayed using visualization tools (such as Graphviz or Gephi), which can intuitively show the spread of the attack and the scope of impact, to help with subsequent analysis and determine the standards for data damaged areas, including system components, database tables, files, etc. affected by the attack. They can be defined according to the target nodes in the attack path and combined with historical data to establish classification standards for damaged areas. , in order to better identify and manage, extract the affected nodes and related data from the attack propagation path, analyze the damage level and type of each node, record the access frequency and data modification of each node, use data processing tools (such as Pandas) to clean and organize the extracted data to ensure the accuracy of the data, and identify multiple malicious attack damaged areas based on the set standards and extracted data. By analyzing the connectivity and degree of impact of the nodes, it is possible to determine which areas are affected by the attack, record the detailed information of each damaged area, including name, type and degree of damage, to provide basic data for subsequent analysis, determine the standard of the damaged data format, including file type, data structure, encoding method, etc., and clarify which data formats are affected. The data may be affected by malicious attacks. Design indicators for data format analysis, such as field integrity and data type consistency, extract relevant data from the damaged area, analyze its format and structure, ensure the extracted data is complete and accurate for analysis, use data processing tools (such as Pandas) to clean the extracted data, remove invalid records and duplicate data, perform format analysis on the damaged data according to the set standards and indicators, record the specific data format information of each damaged area, including field type, data length, constraints, etc., generate a report on the data format of the damaged area, record the data structure characteristics and potential problems of each area, and determine the standards for recoverability assessment, including data backup status, data integrity, data redundancy, etc.Identify factors that affect data recoverability, design an assessment model, and evaluate the recoverability of each damaged area based on the damaged area's data format and historical backup records. Extract relevant data from the damaged area, analyze its backup status and integrity, and ensure data accuracy for the recoverability assessment. Use data processing tools (such as Pandas) to clean and organize the extracted data to ensure data accuracy and completeness. Apply the established assessment criteria and model to conduct a recoverability assessment for each damaged area, recording each area's recoverability indicators, such as backup frequency and data integrity index. Generate a recoverability assessment report, documenting the assessment results and potential risks for each damaged area, to facilitate subsequent decision-making.

[0136] In this embodiment, step S6 includes the following steps:

[0137] Step S61: Identify key storage data nodes from the hard disk history monitoring log and extract the key storage data nodes;

[0138] Step S62: performing semantic analysis on key storage data nodes one by one to obtain storage data features of each node;

[0139] Step S63: Perform dynamic data semantic sensitivity calculation on the storage data features of each node to generate the data semantic sensitivity of each node;

[0140] Step S64: making a hierarchical data encryption decision based on the data semantic sensitivity of each node, thereby obtaining a hierarchical data encryption engine;

[0141] Step S65: Perform intelligent collaborative protection control on the adaptive data repair strategy, the layered data encryption engine, and the abnormal peak global backup strategy to build an intelligent collaborative protection model.

[0142] In this embodiment, the hard disk historical monitoring log is collected to ensure that the log contains information such as timestamps, data write and read operations, and data block identifiers. The data should be complete and in a unified format for subsequent analysis. Data processing tools (such as Python's Pandas library) are used to import and organize log data to ensure data integrity. It is determined what kind of storage data nodes can be regarded as key nodes. Generally, key nodes include frequently accessed files, important database tables, system configuration files, etc. Key node identification standards are designed, such as access frequency, data importance, data sensitivity, etc. Reasonable thresholds are set. The set standards and thresholds are applied to analyze the historical monitoring logs to identify key storage data nodes that meet the conditions. Statistical analysis methods, such as high-frequency access statistics, record the information of identified key nodes, including node identifiers, access frequency, data types, etc., for subsequent analysis, store the identified key storage data nodes in the database, ensure that the data is structured and queryable, record the detailed information of each node and its identification process, use visualization tools (such as Tableau or PowerBI) to display the distribution of key nodes, help intuitively understand the characteristics and importance of key data, determine the standards for data semantic analysis, including data type, data structure, data content, etc., clarify which features can be used to describe the semantics of stored data, and design parsing indicators, such as field type, data length, data relationship, etc., to conduct detailed semantic analysis. Extract relevant data from the identified key storage data nodes, analyze their structure and content, ensure that the extracted data is complete and accurate for subsequent analysis, use data processing tools (such as Pandas) to clean the extracted data, remove invalid records and duplicate data, and perform semantic analysis on each key storage data node according to the set standards and indicators. Record the storage data characteristics of each node, including type, format, constraints, etc., generate a semantic feature data set for each node, ensure that the feature information of each node is complete and structured, and facilitate subsequent analysis. Determine the calculation standard of data semantic sensitivity, including data confidentiality, integrity, availability, etc., set sensitivity evaluation indicators and calculation methods, design a sensitivity scoring system, and pass A scoring scale of 0 to 5 or 0 to 10 is often used for quantitative analysis. The necessary information is extracted from the stored data features, and its sensitivity is analyzed to ensure the accuracy of the analyzed data in order to perform dynamic sensitivity calculations. The extracted data is processed using data analysis tools (such as Python's NumPy or SciPy), and the sensitivity score of each node is calculated. The set sensitivity calculation standard is applied to perform dynamic sensitivity assessments on each key storage data node, and the sensitivity score and related parameters of each node are recorded to generate a sensitivity data set. The sensitivity information of each node is ensured to be complete and structured for subsequent decision-making. The calculated data semantic sensitivity of each node is stored in the database to ensure that the data is structured and queryable.Record the calculation process and results of each node, use visualization tools to display the sensitivity distribution of nodes, and help intuitively understand the sensitivity and protection needs of the data. Design a layered data encryption strategy based on the semantic sensitivity of the data of each node. Use strong encryption algorithms (such as AES-256) for highly sensitive data and lightweight encryption algorithms (such as RSA) for low-sensitivity data. Determine encryption priorities and implementation rules to ensure that sensitive data is protected first. Establish a layered encryption model, define the encryption algorithms and processing procedures for each layer, and ensure that the model can dynamically adapt to changes in node sensitivity. Design an encryption key management strategy to ensure that keys at different levels can be securely stored and managed. Implement data encryption node by node according to the designed layered encryption strategy, record the encryption process and results of each node for subsequent audits, perform post-encryption verification, ensure the integrity and security of encrypted data, and ensure that it can be correctly decrypted during recovery.

[0143] In this embodiment, an artificial intelligence-based hard disk data protection device is provided, which is used to execute the artificial intelligence-based hard disk data protection method described above, including:

[0144] The peak fluctuation module is used to obtain hard disk historical monitoring logs; perform hard disk load analysis on the hard disk historical monitoring logs over multiple periods, and perform load peak fluctuation fitting to construct a hard disk load peak fluctuation curve;

[0145] The peak trend evolution module is used to analyze the peak trend evolution of the hard disk load peak fluctuation curve and detect abnormal load peaks to obtain the time period of the abnormal peak point;

[0146] The global backup module is used to calculate the redundant data of the hard disk in the current time period according to the time period of the abnormal peak point, and make dynamic global data backup decisions to generate the abnormal peak global backup strategy;

[0147] The attack tracing module is used to detect abnormal write behavior in the hard disk's historical monitoring logs, trace the attack nodes, and mark the malicious attack source location points;

[0148] The adaptive repair module is used to identify the damaged data area at the malicious attack source location point and then perform adaptive data repair on a region-by-region basis to build an adaptive data repair strategy;

[0149] The intelligent collaborative protection module is used to make hierarchical data encryption decisions based on the hard disk's historical monitoring logs, and to perform intelligent collaborative protection control based on the adaptive data repair strategy and abnormal peak global backup strategy to build an intelligent collaborative protection model.

[0150] The present invention is therefore intended to be illustrative and non-restrictive in all respects, with the scope of the invention being defined by the appended claims rather than the foregoing description, and all changes that come within the meaning and range of equivalents of the application documents are intended to be embraced therein.

[0151] The foregoing description is intended only to provide specific embodiments of the present invention, which will enable those skilled in the art to understand and implement the present invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention is not intended to be limited to the embodiments shown herein, but is to be construed in the widest possible manner consistent with the principles and novel features disclosed herein.

Claims

1. A hard disk data protection method based on artificial intelligence, characterized in that: The following steps are involved: Step S1: Obtain hard disk historical monitoring logs; perform hard disk load analysis for multiple periods on the hard disk historical monitoring logs, and perform load peak fluctuation fitting to construct a hard disk load peak fluctuation curve; Step S2: performing a peak trend evolution analysis on the hard disk load peak fluctuation curve and performing abnormal load peak detection to obtain the time period where the abnormal peak point is located; Step S3: Calculate the redundant data of the hard disk in the current time period according to the time period where the abnormal peak point is located, and make a dynamic global data backup decision, so as to generate an abnormal peak global backup strategy; Step S4: Detect abnormal write behavior and locate attack nodes in the hard disk history monitoring log, and mark malicious attack tracing points; Step S5: Identify the damaged data area of ​​the malicious attack source tracing location point, and then perform adaptive data repair on each area to build an adaptive data repair strategy; Step S6: making layered data encryption decisions based on the hard disk historical monitoring logs, and performing intelligent collaborative protection control based on the adaptive data repair strategy and abnormal peak global backup strategy to build an intelligent collaborative protection model; The specific steps of step S5 are: Step S51: mining attack propagation paths for malicious attack source tracing locations to obtain multiple attack propagation paths; Step S52: identifying data damaged areas according to multiple attack propagation paths, and generating multiple malicious attack damaged areas; Step S53: analyzing the damaged data formats of multiple malicious attack damaged areas to generate damaged area data formats; Step S54: Evaluate the recoverability of the damaged area data format, so as to obtain the recoverability of each damaged area; Step S55: performing adaptive data repair on a region-by-region basis based on the recoverability of each damaged region to construct an adaptive data repair strategy; The specific steps of step S6 are: Step S61: Identify key storage data nodes from the hard disk history monitoring log and extract key storage data nodes; Step S62: performing semantic analysis on key storage data nodes one by one to obtain storage data features of each node; Step S63: Perform dynamic data semantic sensitivity calculation on the storage data features of each node to generate data semantic sensitivity of each node; Step S64: making a hierarchical data encryption decision according to the data semantic sensitivity of each node, thereby obtaining a hierarchical data encryption engine; the hierarchical data encryption decision is specifically: designing a hierarchical data encryption strategy according to the data semantic sensitivity of each node, using a strong encryption algorithm for high-sensitivity data and a lightweight encryption algorithm for low-sensitivity data; Step S65: Perform intelligent collaborative protection control on the adaptive data repair strategy, the layered data encryption engine and the abnormal peak global backup strategy to build an intelligent collaborative protection model.

2. The hard disk data protection method based on artificial intelligence according to claim 1, characterized in that: The specific steps of step S1 are: Step S11: obtaining a hard disk historical monitoring log, collecting multi-modal hard disk monitoring parameters from the hard disk historical monitoring log, and extracting multi-modal hard disk monitoring parameters; Step S12: performing time series data flow evolution on the multi-modal hard disk monitoring parameters, thereby generating hard disk flow data time series evolution characteristics; Step S13: performing multi-period hard disk load analysis on the time series evolution characteristics of the hard disk traffic data to generate hard disk load data of different time periods; Step S14: Calculate the traffic load peak value of the hard disk load data in different time periods, and extract the hard disk traffic load peak value in each time period; Step S15: performing load peak fluctuation fitting on the hard disk traffic load peak in each time period, thereby constructing a hard disk load peak fluctuation curve.

3. The method according to claim 2, characterized in that The specific steps of step S12 are: Perform abnormal outlier filtering on multi-modal hard disk monitoring parameters to obtain outlier filtering monitoring parameters; Analyze the hard disk temperature changes of the outlier filtering monitoring parameters and extract the hard disk temperature change characteristics; Calculate the real-time read and write rate of the outlier filtering monitoring parameters to obtain the real-time read and write rate of the hard disk; Perform data writing error rate analysis on outlier filtering monitoring parameters to generate data writing error rate; The hard disk real-time read and write rate and data write error rate are mined to generate the hard disk real-time traffic state characteristics; According to the hard disk temperature change characteristics, the hard disk real-time traffic state characteristics are subjected to time series data flow evolution, thereby generating hard disk traffic data time series evolution characteristics.

4. The method according to claim 1, characterized in that: The specific steps of step S2 are: Step S21: performing a peak trend evolution analysis on the hard disk load peak fluctuation curve to generate load peak trend evolution data; Step S22: performing multi-time window rolling prediction on the load peak trend evolution data to obtain load peak prediction data of multiple time windows; Step S23: performing abnormal load peak detection on the load peak prediction data of multiple time windows, and marking abnormal load peak points; Step S24: Locate the time period of the abnormal load peak point, thereby obtaining the time period where the abnormal peak point is located.

5. The hard disk data protection method based on artificial intelligence according to claim 1, characterized in that: The specific steps of step S3 are: Step S31: analyzing the hard disk storage status of the hard disk in the current time period according to the time period where the abnormal peak point is located, thereby obtaining the hard disk storage status; Step S32: Calculate the redundant data of the hard disk in the current time period, and extract the redundant data of the abnormal peak time period; Step S33: performing redundant data cleaning processing on the hard disk based on the redundant data in the abnormal peak time period, thereby obtaining redundant optimized hard disk data; Step S34: making a dynamic global data backup decision for the redundant optimized hard disk data according to the hard disk storage status, thereby generating an abnormal peak global backup strategy.

6. The hard disk data protection method based on artificial intelligence according to claim 1, characterized in that: The specific steps of step S4 are: Step S41: Detect abnormal writing behavior on the hard disk history monitoring log and extract abnormal writing behavior; Step S42: calculating the abnormal behavior frequency of the abnormal writing behavior to obtain the abnormal writing behavior frequency parameter; Step S43: performing time series variation statistics on the abnormal write behavior frequency parameter, thereby generating abnormal write behavior frequency variation characteristics; Step S44: performing malicious attack behavior analysis based on the abnormal write behavior frequency change characteristics, thereby generating malicious attack behavior data; Step S45: trace the attack node source of the malicious attack behavior data and mark the malicious attack source tracing location point.

7. A hard disk data protection device based on artificial intelligence, characterized in that: Used to execute the hard disk data protection method based on artificial intelligence as claimed in claim 1, comprising: The peak fluctuation module is used to obtain the hard disk historical monitoring log; perform hard disk load analysis in multiple periods on the hard disk historical monitoring log, and perform load peak fluctuation fitting to construct the hard disk load peak fluctuation curve; The peak trend evolution module is used to analyze the peak trend evolution of the hard disk load peak fluctuation curve and detect abnormal load peaks to obtain the time period where the abnormal peak point is located; The global backup module is used to calculate the redundant data of the hard disk in the current time period according to the time period of the abnormal peak point, and make dynamic global data backup decisions, so as to generate the abnormal peak global backup strategy; The attack source tracing module is used to detect abnormal write behavior in the hard disk history monitoring log and trace the attack node, marking the malicious attack source location point; The adaptive repair module is used to identify the damaged data area at the malicious attack source location point, and then adaptively repair the data area by area to build an adaptive data repair strategy; The intelligent collaborative protection module is used to make hierarchical data encryption decisions based on the hard disk historical monitoring log, and to perform intelligent collaborative protection control based on the adaptive data repair strategy abnormal peak global backup strategy to build an intelligent collaborative protection model.

Images