Boundary-free data security analysis method and system based on multi-copy data

Abstract

The invention discloses a boundless data security analysis method and system based on multi-copy data, relates to the technical field of data security, and effectively reduces the risk of single point failure and improves the reliability and integrity of data through multi-copy data collection management and distributed storage. The real-time data processing unit performs preprocessing and encryption management on the data to ensure the security of transmission and storage; the distributed threat detection unit detects potential threats in real time by using distributed computing resources, and improves the timeliness and accuracy of threat identification through processing speed monitoring and accuracy evaluation; the response and automatic protection unit immediately takes protection measures after threat detection, and optimizes the protection efficiency through a response time evaluation mechanism; and the strategy dynamic adjustment unit adjusts the security strategy in real time according to the detection result, and the log generation unit provides support for subsequent auditing and system optimization, so that the security, stability and response efficiency of the system are integrally improved.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and in particular to a borderless data security analysis method and system based on multi-copy data. Background Art

[0002] With the rapid development of information technology, the importance of data security in monitoring systems has become increasingly prominent. Monitoring systems usually process a large amount of sensitive data, including video, audio, and sensor data. Once these data are leaked or tampered with, they will pose a serious threat to personal privacy, public safety, and corporate interests. Therefore, the technical background of data security covers multiple copy storage, encrypted transmission, real-time threat detection, etc., to ensure that data is protected from unauthorized access and malicious attacks during transmission, storage, and processing.

[0003] However, the existing data security analysis systems used for monitoring have the following technical shortcomings:

[0004] 1. Delayed threat detection: Traditional systems often rely on preset rules and signatures to detect threats. This approach is limited in effectiveness when facing new or complex attacks and cannot identify unknown threats in a timely manner.

[0005] 2. High data storage risk: Although many systems use encryption and multi-copy storage, there is still a risk of data leakage and tampering due to poor encryption key management or delayed synchronization of multi-copy data.

[0006] 3. Long response time: When faced with large-scale data, the system’s response time is often long, causing the attack to spread and making it impossible to take effective measures in a timely manner. Summary of the invention

[0007] In view of the above-mentioned problems, the present invention is proposed.

[0008] Therefore, the present invention provides a borderless data security analysis method and system based on multi-copy data, which can solve the problems mentioned in the background technology.

[0009] To solve the above technical problems, the present invention provides the following technical solutions: a borderless data security analysis system based on multi-copy data, comprising: a multi-copy data collection and management unit, used to collect data from a data source, and divide the collected data into multiple copies for distributed storage; a real-time data processing unit, used to pre-process the collected data, and perform data encryption and redundancy management on the pre-processed data; a distributed threat detection unit, used to use distributed computing resources to analyze the multi-copy data in real time, detect potential security threats, and monitor its own processing speed in real time, and finally perform threat detection on the pre-processed data, and calculate the accuracy of threat detection; a response and automatic protection unit, used to automatically trigger protection measures after the threat is detected, and evaluate the response time of the system; a policy dynamic adjustment unit, used to dynamically adjust the security policy used to adapt to new threat situations or environmental changes according to the evaluation results of the distributed threat detection unit and the response and automatic protection unit; a log generation unit, used to record all important events in the operation of the system, and store the generated logs for subsequent audits, compliance checks, and method adjustment analysis.

[0010] As a preferred solution of the borderless data security analysis system based on multi-copy data described in the present invention, wherein: the multi-copy data collection management unit includes a data collection module and a data copy management module; the data collection module is used to collect original data, interact with different types of data sources through an API interface, and acquire data seamlessly; the data collection module is also responsible for preliminary data integration and filtering; the data copy management module is used to distribute data copies to different storage nodes through a distributed database after data collection is completed.

[0011] As a preferred solution of the borderless data security analysis system based on multi-copy data described in the present invention, wherein: the real-time data processing unit includes a data preprocessing module and an encryption and redundancy management module; the data preprocessing module is used to make the collected data comply with the system format requirements before entering the analysis and storage stage; the encryption and redundancy management module is used to protect the data during transmission and storage; thereafter, redundancy management is performed, and the data is adjusted by generating and managing data copies.

[0012] As a preferred solution of the borderless data security analysis system based on multi-copy data described in the present invention, wherein: the distributed threat detection unit includes a distributed computing resource management module, a processing speed monitoring module, a threat analysis module and a detection accuracy evaluation module; the distributed computing resource management module is responsible for planning and utilizing the processing capacity of each computing node by managing and allocating distributed computing resources in the system during the real-time analysis of multi-copy data; and adjusting the utilization rate of computing resources through dynamic scheduling and load balancing; the processing speed monitoring module is used to monitor the processing speed of the distributed system in real time, and monitor the resource utilization, data throughput and task processing time of each node in real time by reading system log records and using distributed system monitoring tools. Secondly, after dimensionless processing of these data, the processing speed index Clsz is calculated by the following formula:

[0013]

[0014] In the formula, Sjl represents the amount of data processed by the system per unit time, Rsj represents the time required for each distributed computing node to complete the specified data processing task, Syc represents the time required from data input to processing completion, Jly represents the CPU and memory usage of each distributed computing node; N represents the number of distributed computing nodes; Sjl i 、Rsj i 、Syc i and Jly i They respectively represent the amount of data Sjl processed by the system of the i-th distributed computing node per unit time, the time Rsj required for each distributed computing node to complete the specified data processing task, the time required from data input to processing completion Syc, and the CPU and memory usage Jly of each distributed computing node.

[0015] The processing speed monitoring module compares and evaluates the preset first processing speed threshold Q with the processing speed index Clsz. The specific evaluation content is as follows: if the processing speed threshold Q> the first processing speed index Clsz, it means that the processing speed of the current distributed system is abnormal. At this time, threat detection of the pre-processed data is stopped, and the processing speed abnormality result is immediately generated, and the system administrator is notified to intervene, and the performance log is recorded at the same time; if the processing speed threshold Q≤the first processing speed index Clsz, it means that the processing speed of the current distributed system is normal, and threat detection of the pre-processed data is performed normally.

[0016] As a preferred solution of the borderless data security analysis system based on multi-copy data described in the present invention, the threat analysis module is used to use a pattern recognition algorithm to conduct in-depth analysis of the pre-processed data to detect potential security threats; at the same time, by analyzing abnormal behaviors and patterns in multi-copy data, known and unknown security risks are identified and threat reports are generated.

[0017] The detection accuracy evaluation unit is used to obtain the real positive rate Zzl, the false alarm rate Wbl and the missed alarm rate Lbl through the simulation test environment and the false alarm analysis tool after the threat analysis is completed; then the real positive rate Zzl, the false alarm rate Wbl and the missed alarm rate Lbl are extracted and dimensionless processed, and the detection accuracy Jzql is calculated by the following formula:

[0018]

[0019] In the formula, a is represented by the adjustment coefficient, which is used to strengthen the weight of the real positive interest rate Zzl and the product, and its specific value is adjusted by the user.

[0020] The detection accuracy evaluation module compares and evaluates the detection accuracy rate Jzql by preset detection accuracy threshold W, and the specific contents are as follows: if the detection accuracy rate Jzql ≥ detection accuracy threshold W, it indicates that the detection effect and threat identification ability of the system are normal, and threat response measures are taken through the response and automatic protection module; if the detection accuracy rate Jzql < detection accuracy threshold W, it indicates that the detection effect and threat identification ability of the system are abnormal, and an abnormal threat identification accuracy result is generated at this time, and the parameters of the threat detection model are adjusted, the strictness of data preprocessing is enhanced, or an early warning is issued to notify the administrator to take manual intervention measures.

[0021] As a preferred solution of the borderless data security analysis system based on multi-copy data described in the present invention, the response and automatic protection unit includes a protection self-starting module and a response time evaluation module; the protection self-starting module uses an intrusion detection system and a behavior analysis tool to analyze and identify threat reports, and after identifying abnormal behaviors and potential threats, automatically selects protection measures according to the detected threat type and severity.

[0022] The response time evaluation module obtains the relevant parameters of the system response time by reading the system event log records and response simulation tests, and after dimensionless processing of the relevant parameters of the system response time, calculates the response time index Xysj by the following formula:

[0023]

[0024] Where Wxy represents the time from threat detection to the system starting to take response measures, Xzx represents the response execution time, and Wfs represents the threat blocking time.

[0025] The response time evaluation module compares and evaluates the preset response threshold E with the response time index Xysj, and the specific evaluation content is as follows: if the preset response threshold E≥response time index Xysj, it means that the response speed of the system in this threat event is qualified, and the execution speed of the protection measures and the response capability of the system are normal; if the preset response threshold E<response time index Xysj, it means that the response speed of the system in this threat event is unqualified, and a response time abnormality result is generated at this time, and the cause of the delay is further analyzed, including the timeliness of threat detection, the decision-making efficiency of protection measures or bottlenecks in the execution process.

[0026] As a preferred solution of the borderless data security analysis system based on multi-copy data described in the present invention, wherein: the data source includes sensors, servers and user devices; the preprocessing includes cleaning, deduplication, normalization and data integrity verification; the protection measures include data isolation, access permission adjustment and blocking potential attack paths.

[0027] To further solve the above technical problems, the present invention provides the following technical solutions: a borderless data security analysis method based on multi-copy data, comprising: collecting data from a data source, and dividing the collected data into multiple copies for distributed storage; preprocessing the collected data, and performing data encryption and redundancy management on the preprocessed data; using distributed computing resources to analyze multiple copies of data in real time, detect potential security threats, and monitor its own processing speed in real time, and finally perform threat detection on the preprocessed data, and calculate the accuracy of threat detection; after the threat is detected, automatically trigger protective measures and evaluate the response time of the system; according to the evaluation results of the distributed threat detection unit and the response and automatic protection unit, dynamically adjust the security policy used to adapt to new threat situations or environmental changes; record all important events in the operation of the system, and store the generated logs for subsequent audits, compliance checks, and method adjustment analysis.

[0028] A computer device includes a memory and a processor, wherein the memory stores a computer program, and is characterized in that when the processor executes the computer program, the steps of the borderless data security analysis system based on multiple copies of data are implemented as described above.

[0029] A computer-readable storage medium having a computer program stored thereon, characterized in that when the computer program is executed by a processor, the steps of the borderless data security analysis system based on multiple copies of data as described above are implemented.

[0030] The beneficial effects of the present invention are as follows: (1) The borderless data security analysis method and system based on multi-copy data collects data from multiple data sources through a multi-copy data collection management unit, and divides the data into multiple copies for distributed storage. This design effectively reduces the risk of single point failure, improves the availability and integrity of data, and ensures that the system can maintain high reliability and security of data in the face of potential threats; in addition, the real-time data processing unit performs comprehensive pre-processing and encryption management on the collected data, ensuring the security of the data during transmission and storage; these measures jointly solve the problems of data loss, damage and illegal access existing in traditional data storage methods.

[0031] (2) Based on the borderless data security analysis method and system of multi-copy data, the distributed threat detection unit of the system uses distributed computing resources to perform real-time analysis on multi-copy data, and ensures that potential security threats can be detected in a timely manner through efficient threat detection algorithms and distributed computing capabilities. At the same time, the unit also has the functions of processing speed monitoring and threat detection accuracy evaluation. By real-time monitoring of the processing speed of the distributed system and the accuracy of threat detection, it ensures that the system can quickly and accurately identify and respond to security threats. In this way, the system effectively solves the lag problem existing in traditional threat detection solutions and improves the response speed and accuracy of security protection.

[0032] (3) Based on the borderless data security analysis method and system with multi-copy data, the response and automatic protection unit can immediately trigger automatic protection measures, such as data isolation, access permission adjustment and blocking of potential attack paths, after the threat is detected, and monitor the length of time from threat detection to the implementation of protection measures through the response time evaluation mechanism; the policy dynamic adjustment unit dynamically adjusts the security policy according to the detection results to adapt to new threat situations and environmental changes; the log generation unit records all important events in the system operation and provides support for subsequent audits, compliance checks and system optimization; overall, the system effectively solves the problems of long response time, delayed threat detection and high data storage risk through the coordinated operation of multiple levels and units, and significantly improves the security, stability and response efficiency of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0034] Figure 1This is a schematic diagram of the structure of the borderless data security analysis system based on multi-copy data proposed by the present invention;

[0035] Figure 2 A flowchart of a borderless data security analysis method based on multi-copy data proposed by the present invention. DETAILED DESCRIPTION

[0036] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings of the specification. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without creative work should fall within the scope of protection of the present invention.

[0037] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0038] Example 1, reference Figure 1 , which is an embodiment of the present invention, provides a borderless data security analysis system based on multiple copies of data.

[0039] The present application provides an effective solution to the above-mentioned problems. Next, multiple embodiments will be combined to explain in detail how to implement the borderless data security analysis system based on multi-copy data.

[0040] Figure 1 A structural diagram of a borderless data security analysis system based on multi-copy data is shown, including: a multi-copy data collection management unit 100, a real-time data processing unit 200, a distributed threat detection unit 300, a response and automatic protection unit 400, a policy dynamic adjustment unit 500, and a log generation unit 600.

[0041] In this embodiment, on the basis of traditional data security solutions, the efficiency and security of data collection, storage and processing are significantly improved; the multi-copy data collection management unit 100 divides the data into multiple copies for distributed storage, solves the single point failure and data integrity problems, and improves the availability of data; the real-time data processing unit 200 pre-processes and encrypts the data to ensure the security of the data during transmission and storage, and reduces the storage pressure caused by data redundancy; the distributed threat detection unit 300 uses distributed computing resources for real-time analysis to achieve efficient and accurate threat detection, and ensures that the system can detect complex threats by monitoring the processing speed and accuracy. The system has the ability to respond quickly to threats; the response and automatic protection unit 400 can take effective protection measures immediately after the threat is detected, and further optimize the protection efficiency of the system by evaluating the response time; the policy dynamic adjustment unit 500 dynamically adjusts the security policy according to the actual detection results, ensuring that the system can flexibly respond to new threat situations and environmental changes; the log generation unit 600 not only ensures the transparency of system operation, but also provides solid data support for subsequent audits, compliance checks and system optimization; overall, the system has achieved higher security, flexibility and system response speed through modular design, providing a more comprehensive solution for borderless data security analysis.

[0042] Specifically, the multi-copy data collection management unit 100 is used to collect data from a data source, and divide the collected data into multiple copies for distributed storage.

[0043] Furthermore, the multi-copy data collection management unit 100 includes a data collection module 101 and a data copy management module 102 .

[0044] The data collection module 101 is used to collect raw data, interact with different types of data sources through API interfaces, and obtain data seamlessly; the data collection module 101 is also responsible for preliminary data integration and filtering. Data sources include sensors, servers, and user devices.

[0045] The data copy management module 102 is used to distribute the data copies to different storage nodes through the distributed database after the data collection is completed.

[0046] In this embodiment, seamless data acquisition is achieved through the data collection module 101; and it is compatible with different data formats and protocols to ensure access to a wide range of data sources; the collected raw data is preliminarily integrated and filtered to remove redundant and noise information to ensure the reliability and consistency of data quality; in this process, the data collection module 101 is also responsible for preliminarily standardizing the format of the data for subsequent processing; then, the data copy management module 102 divides the processed data into multiple copies, and intelligently distributes these copies to different storage nodes through distributed database technology; this allocation process takes into account the load balancing and geographical distribution of the storage nodes to improve the redundancy and storage reliability of the data; at the same time, the module dynamically monitors the status and integrity of the copies to ensure that when any storage node fails, the system can quickly dispatch other copies to ensure high data availability; ultimately, through the distributed storage and copy management mechanism, the system's fault tolerance and data security are effectively improved.

[0047] The real-time data processing unit 200 is used to pre-process the collected data and perform data encryption and redundancy management on the pre-processed data. The pre-processing includes cleaning, deduplication, normalization and data integrity verification.

[0048] Furthermore, the real-time data processing unit 200 includes a data preprocessing module 201 and an encryption and redundancy management module 202 .

[0049] Among them, the data preprocessing module 201 is used to make the collected data meet the system format requirements before entering the analysis and storage stage; the encryption and redundancy management module 202 is used to protect the data during transmission and storage; after that, redundancy management is performed, and the data is adjusted by generating and managing data copies.

[0050] In this embodiment, the data cleaning process removes erroneous data or noise data to ensure data accuracy; the deduplication process eliminates redundant data to ensure data consistency; the normalization process converts the data into a standardized format to facilitate subsequent analysis and storage; the data integrity check ensures that the integrity of the data is not lost during the processing process;

[0051] After preprocessing, the data is transmitted to the encryption and redundancy management module 202; the data is encrypted by advanced encryption algorithms to ensure the security of the data during transmission and storage, and to prevent unauthorized access and tampering; at the same time, the encryption and redundancy management module 202 is also responsible for the redundant management of the data, by generating multiple data copies and reasonably distributing them to different storage nodes, to achieve redundant protection of the data; the redundancy management process not only improves the data security of the system, but also enhances the availability and recovery capabilities of the data through copy management; finally, the real-time data processing unit 200 ensures the security and consistency of the data before entering the analysis and storage stage, providing a solid foundation for subsequent data analysis and threat detection.

[0052] The distributed threat detection unit 300 is used to utilize distributed computing resources to analyze multiple copies of data in real time, detect potential security threats, and monitor its own processing speed in real time. Finally, it performs threat detection on the pre-processed data and calculates the accuracy of threat detection.

[0053] Specifically, the distributed threat detection unit 300 includes a distributed computing resource management module 301 , a processing speed monitoring module 302 , a threat analysis module 303 , and a detection accuracy evaluation module 304 .

[0054] Among them, the distributed computing resource management module 301 is responsible for planning and utilizing the processing power of each computing node by managing and allocating distributed computing resources in the system during the real-time analysis of multiple copies of data; and adjusting the utilization of computing resources through dynamic scheduling and load balancing.

[0055] The processing speed monitoring module 302 is used to monitor the processing speed of the distributed system in real time. By reading system log records and using distributed system monitoring tools, the resource utilization, data throughput and task processing time of each node are monitored in real time. After dimensionless processing of these data, the processing speed index Clsz is calculated by the following formula:

[0056]

[0057] In the formula, Sjl represents the amount of data processed by the system per unit time, Rsj represents the time required for each distributed computing node to complete the specified data processing task, Syc represents the time required from data input to processing completion, Jly represents the CPU and memory usage of each distributed computing node; N represents the number of distributed computing nodes; Sjl i 、Rsj i 、Syc i and Jly iThey represent the amount of data processed by the system of the i-th distributed computing node in unit time Sjl, the time required for each distributed computing node to complete the specified data processing task Rsj, the time required from data input to processing completion Syc, and the CPU and memory usage Jly of each distributed computing node;

[0058] The processing speed monitoring module 302 compares and evaluates the processing speed index Clsz by presetting the first processing speed threshold Q. The specific evaluation content is as follows:

[0059] If the processing speed threshold Q> the first processing speed index Clsz, it means that the processing speed of the current distributed system is abnormal. At this time, the threat detection of the pre-processed data is stopped, and the processing speed abnormality result is immediately generated to notify the system administrator to intervene and record the performance log;

[0060] If the processing speed threshold Q ≤ the first processing speed index Clsz, it means that the processing speed of the current distributed system is normal, and threat detection is performed normally on the pre-processed data.

[0061] Furthermore, the threat analysis module 303 is used to perform in-depth analysis on the pre-processed data using a pattern recognition algorithm to detect potential security threats; at the same time, by analyzing abnormal behaviors and patterns in multiple copies of data, it identifies known and unknown security risks and generates a threat report;

[0062] The detection accuracy evaluation unit is used to obtain the true positive rate Zzl, false alarm rate Wbl and missed alarm rate Lbl through the simulation test environment and false alarm analysis tool after the threat analysis is completed; then the true positive rate Zzl, false alarm rate Wbl and missed alarm rate Lbl are extracted and dimensionlessly processed, and the detection accuracy Jzql is calculated by the following formula:

[0063]

[0064] In the formula, a is the adjustment coefficient, which is used to strengthen the weight of the product of the real positive interest rate Zzl and 1-Wbl, and its specific value is adjusted by the user;

[0065] The detection accuracy evaluation module 304 compares and evaluates the detection accuracy rate Jzql by presetting the detection accuracy threshold W, and the specific contents are as follows:

[0066] If the detection accuracy Jzql ≥ the detection accuracy threshold W, it indicates that the system's detection effect and threat identification capabilities are normal. At this time, threat response measures are taken through the response and automatic protection module;

[0067] If the detection accuracy Jzql is less than the detection accuracy threshold W, it indicates that the detection effect and threat identification ability of the system are abnormal. At this time, an abnormal threat identification accuracy result is generated, and the parameters of the threat detection model are adjusted, the strictness of data preprocessing is enhanced, or an early warning is issued to notify the administrator to take manual intervention measures.

[0068] In this embodiment, the amount of data processed per unit time Sjl represents the total amount of data processed by the system in a specific time period. This parameter reflects the throughput of the system, that is, the workload that the system can handle per unit time. The larger the amount of data processed per unit time Sjl, the more efficient the system is in terms of data processing capabilities, and the more data can be processed in a short time; the time required for each distributed computing node to complete a specified data processing task Rsj represents the time it takes for a single computing node to complete a specified task. This is an important parameter that reflects the efficiency of the system, which directly affects the response time of the entire distributed system; if the time is shorter, it means that the node processes the task faster and the overall efficiency of the system is higher; conversely, a longer time may indicate that the node performance is insufficient or the task complexity is higher; the time required from data input to processing completion Syc represents the total time required from data entering the system to processing completion, covering all links such as data transmission, processing, and output. This parameter is a time evaluation of the overall processing flow of the system, reflecting the overall response speed and processing efficiency of the system. A shorter Syc indicates that the system has a higher efficiency in receiving and processing data; the CPU and memory utilization rate Jly of each distributed computing node reflects the resource utilization of the distributed computing node when processing tasks, including the CPU and memory usage ratio. This parameter is used to measure the load of the computing node and its efficiency in resource utilization. A higher Jly may indicate that the system is working under high load and resources are fully utilized; however, too high utilization can also lead to resource bottlenecks, affecting system stability and processing speed.

[0069] The true positive rate Zzl indicates the system's ability to correctly identify threats, reflecting the accuracy of the detection algorithm when facing actual threats; specifically, the true positive rate Zzl is the ratio of real threats successfully detected by the system to all actual threats. A higher true positive rate Zzl indicates that the system can effectively identify and report real threats, reduce missed reports, and improve the security and reliability of the system; the false alarm rate Wbl indicates the frequency with which the system mistakenly determines normal behavior as a threat; it is the ratio of false alarms to all detected threat events; a lower false alarm rate Wbl indicates that the system performs well in terms of accuracy, can reduce the number of false alarms, thereby avoiding unnecessary interference and waste of resources, and improving the practicality of the system and user trust; the missed alarm rate Lbl indicates the frequency with which the system fails to detect actual threats, which is the situation where the system misses detection when facing threats. A lower missed alarm rate Lbl means that the system is more comprehensive and reliable in threat detection, can better identify all potential security risks, reduce the risk of the system being attacked without detection, and ensure the overall security of the system.

[0070] The response and automatic protection unit 400 is used to automatically trigger protection measures after a threat is detected and evaluate the response time of the system. The protection measures include data isolation, access permission adjustment and blocking of potential attack paths.

[0071] Specifically, the response and automatic protection unit 400 includes a protection self-starting module 401 and a response time evaluation module 402 .

[0072] Among them, the protection self-starting module 401 uses the intrusion detection system and behavior analysis tools to analyze and identify the threat report, and after identifying abnormal behavior and potential threats, automatically selects protection measures according to the type and severity of the detected threat. Specific protection measures can be to cut off the connection between the infected system and the network, temporarily revoke the permissions of the affected users, and block malicious traffic.

[0073] The response time evaluation module 402 obtains the relevant parameters of the system response time by reading the event log records of the system and responding to the simulation test, and after dimensionless processing of the relevant parameters of the system response time, obtains the response time index Xysj by calculating the following formula:

[0074]

[0075] Where Wxy represents the time from threat detection to the system starting to take response measures, Xzx represents the response execution time, and Wfs represents the threat blocking time.

[0076] The response time evaluation module 402 compares and evaluates the response time index Xysj by using the preset response threshold E. The specific evaluation contents are as follows:

[0077] If the preset response threshold E ≥ response time index Xysj, it means that the system's response speed in this threat event is qualified, and the execution speed of the protection measures and the system's response capability are normal;

[0078] If the preset response threshold E is less than the response time index Xysj, it means that the system's response speed in this threat event is unqualified. At this time, an abnormal response time result is generated, and the cause of the delay is further analyzed, including the timeliness of threat detection, the decision-making efficiency of protective measures, or bottlenecks in the execution process.

[0079] In this embodiment, the time Wxy from threat detection to the system starting to take response measures represents the time interval from the threat being detected by the system to the system starting to take countermeasures. It reflects the reaction speed of the system, that is, how quickly the system can start the protection mechanism after the threat is initially identified. A shorter time Wxy from threat detection to the system starting to take response measures indicates that the system can quickly identify the threat and take immediate action to effectively reduce the harm of potential attacks; the response execution time Xzx is the time required for the system to start responding to complete the entire protection process. It measures the efficiency of the system in executing response measures, including implementing protection strategies, isolating affected areas, adjusting permissions and other operations. A shorter response execution time Xzx indicates that the system's response measures are properly and efficiently executed, and can quickly contain threats and reduce the impact of attacks on the system; the threat blocking time Wfs indicates the time required for the system to completely block the threat, which means that the threat is completely controlled or eliminated, and the system returns to normal operation. The shorter threat blocking time Wfs indicates that the system has a strong protection capability and can completely eliminate the threat in the shortest time to ensure the stability and security of the system.

[0080] The policy dynamic adjustment unit 500 is used to dynamically adjust the security policy to adapt to new threat situations or environmental changes according to the evaluation results of the distributed threat detection unit 300 and the response and automatic protection unit 400.

[0081] Furthermore, the policy dynamic adjustment unit 500 is used to generate the following security policies respectively according to the abnormal processing speed result, the abnormal threat identification accuracy result and the abnormal response time result:

[0082] When abnormal processing speed results occur, adjust resource allocation, algorithms or hardware performance;

[0083] When an abnormal result of threat identification accuracy occurs, the threat identification model is adjusted, including updating the threat identification model, adding or replacing the training data set, and adjusting the threshold parameters;

[0084] When abnormal response time results occur, adjust the protection process, including adjusting the response speed of network and system resources.

[0085] In this embodiment, through the policy dynamic adjustment unit 500, the system can automatically generate and implement corresponding security policies according to the abnormal results of processing speed, threat identification accuracy and response time, thereby significantly improving the adaptability and protection capabilities of the system; when the processing speed is abnormal, by adjusting resource allocation, algorithms or hardware performance, the system can promptly restore efficient processing capabilities to ensure the continuity and stability of data processing; in the case of abnormal threat identification accuracy, the policy dynamic adjustment unit 500 can dynamically update the recognition model, optimize the training data set, and adjust the threshold, thereby improving the accuracy of threat detection and reducing false alarms and missed alarms; in the face of abnormal response time, the module can streamline the protection process and accelerate the response speed of network and system resources, thereby shortening the threat blocking time and minimizing the potential damage to the system; overall, the policy dynamic adjustment unit 500 significantly improves the system's adaptability and overall security performance in a changing environment.

[0086] The log generation unit 600 is used to record all important events in the operation of the system, and store the generated logs for subsequent auditing, compliance checking, and method adjustment analysis.

[0087] Specifically, the log generation unit 600 monitors and records various important activities of the system in real time through an integrated event capture mechanism, including the execution process of security protection measures, threat detection and response time, policy adjustment decisions and their implementation results. After each event is captured, a structured log is automatically generated to record in detail the event timestamp, event type, execution content, participating components and related parameters, and then the log data is stored in the storage medium specified by the module.

[0088] In this embodiment, the log generation unit 600 ensures that all important activities of the system are monitored and recorded in real time through an integrated event capture mechanism, greatly enhancing the traceability and transparency of the system; in key links such as the execution of security protection measures, threat detection and response time recording, policy adjustment decisions and implementation results, the automatically generated structured log records the event timestamp, type, execution content, participating components and related parameters in detail, providing a comprehensive and accurate basis for subsequent audits and compliance checks; at the same time, the storage and management of these log data not only supports the system's operation monitoring, but also provides an important reference for system optimization and adjustment analysis, helping to quickly identify problems and take targeted improvement measures, thereby improving the overall security and operational efficiency of the system.

[0089] In summary, compared with the prior art, the present invention has the following beneficial effects: 1. The borderless data security analysis method and system based on multi-copy data collects data from multiple data sources through a multi-copy data collection management unit, and divides it into multiple copies for distributed storage. This design effectively reduces the risk of single point failure, improves the availability and integrity of data, and ensures that the system can maintain high reliability and security of data in the face of potential threats; in addition, the real-time data processing unit performs comprehensive pre-processing and encryption management on the collected data, ensuring the security of data during transmission and storage; these measures jointly solve the problems of data loss, damage and illegal access existing in traditional data storage methods.

[0090] 2 Based on the borderless data security analysis method and system of multi-copy data, the distributed threat detection unit of the system uses distributed computing resources to perform real-time analysis on multi-copy data, and ensures that potential security threats can be detected in a timely manner through efficient threat detection algorithms and distributed computing capabilities; at the same time, the unit also has the functions of processing speed monitoring and threat detection accuracy evaluation, and ensures that the system can quickly and accurately identify and respond to security threats by real-time monitoring of the processing speed of the distributed system and the accuracy of threat detection; in this way, the system effectively solves the lag problem existing in traditional threat detection solutions and improves the response speed and accuracy of security protection.

[0091] 3. Based on the borderless data security analysis method and system with multi-copy data, the response and automatic protection unit can immediately trigger automatic protection measures such as data isolation, access permission adjustment and blocking of potential attack paths after the threat is detected, and monitor the length of time from threat detection to the implementation of protection measures through the response time evaluation mechanism; the policy dynamic adjustment unit dynamically adjusts the security policy according to the detection results to adapt to new threat situations and environmental changes; the log generation unit records all important events in the system operation and provides support for subsequent audits, compliance checks and system optimization; overall, the system effectively solves the problems of long response time, delayed threat detection and high data storage risk through multi-level and multi-unit collaborative operation, and significantly improves the security, stability and response efficiency of the system.

[0092] Example 2, reference Figure 2 , is an embodiment of the present invention, and provides a borderless data security analysis method based on multi-copy data, comprising:

[0093] S1: collects data from the data source and divides the collected data into multiple copies for distributed storage;

[0094] S2: pre-process the collected data, and perform data encryption and redundancy management on the pre-processed data;

[0095] S3: Use distributed computing resources to analyze multiple copies of data in real time, detect potential security threats, and monitor its own processing speed in real time. Finally, perform threat detection on the pre-processed data and calculate the accuracy of threat detection.

[0096] S4: After a threat is detected, protection measures are automatically triggered and the system response time is evaluated;

[0097] S5: dynamically adjusting the security policy for adapting to new threat situations or environmental changes according to the evaluation results of the distributed threat detection unit 300 and the response and automatic protection unit 400;

[0098] S6: Record all important events in the system operation, and store the generated logs for subsequent audits, compliance checks, and method adjustment analysis.

[0099] In this embodiment, step S1 collects data from multiple sources and divides it into multiple copies for distributed storage, which effectively improves the availability and fault tolerance of data, ensuring that the system can still operate stably and does not lose key data in the event of data source failure or attack; step S2 ensures the security and integrity of data during transmission and storage by preprocessing and encrypting the collected data; redundancy management further enhances the system's ability to cope with data damage or loss and improves the reliability of overall data management; step S3 uses distributed computing resources to analyze data in real time, effectively improving the efficiency and accuracy of threat detection, and monitors the processing speed in real time to ensure that the system can still respond quickly to security threats under high load conditions and avoid the expansion of security risks; step S4 After detecting a threat, the system can automatically Automatically trigger protective measures to quickly isolate affected data, adjust access permissions and block attack paths, greatly reducing the harm of potential threats to the system. At the same time, through response time evaluation, the protection process is optimized to improve the system's response speed and defense capabilities; Step S5: According to the actual effect of threat detection and protection, the system can dynamically adjust the security policy to ensure that security measures always match the latest threat situation, thereby improving the system's protection level and adaptability, and maintaining the effectiveness and foresight of the security policy; Step S6: By real-time recording and storage of various important events of the system, detailed operation records and data support are provided, providing a reliable basis for subsequent audits, compliance checks, system adjustments and optimization analysis, thereby enhancing the traceability and transparency of the system and ensuring the security and stability of system operation.

[0100] Example 3, reference Figure 2, is an embodiment of the present invention, which is different from the previous embodiment in that: if the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device, such as a personal computer, a server, or a network device, to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory ROM, Read-Only Memory, random access memory RAM, RandomAccess Memory, disk or optical disk, and other media that can store program codes.

[0101] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus, such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute the instructions, or in conjunction with such instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.

[0102] A non-exhaustive list of more specific examples of computer-readable media includes the following: an electronic device with one or more wiring electrical connections, a portable computer disk cartridge magnetic device, a random access memory RAM, a read-only memory ROM, an erasable and programmable read-only memory EPROM or flash memory, an optical fiber device, and a portable compact disk read-only memory CDROM. In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or, if necessary, processing in another suitable manner, and then stored in a computer memory.

[0103] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, multiple steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array PGA, a field programmable gate array FPGA, etc.

[0104] Example 4 is an embodiment of the present invention, which provides a borderless data security analysis system based on multi-copy data. In order to verify the beneficial effects of the present invention, scientific demonstration is carried out through economic benefit calculation and simulation experiments.

[0105] The experimental process of the present invention designs multi-dimensional tests to verify key performance indicators such as data storage reliability, threat detection accuracy, processing speed, and response time. First, the experiment creates a simulated data system in a multi-node distributed environment to test the storage reliability of multiple copies of data. By deliberately introducing a single node failure, observing the data recovery capability of the system, and recording the data loss rate and recovery time, compared with the traditional single-copy system, the present invention ensures high data availability by automatically allocating multiple copies of data to other nodes. Subsequently, in a simulated threat environment, the experiment tests the accuracy of threat detection through various types of malicious behaviors such as abnormal traffic and data tampering, and uses parameters such as true positive rate, false alarm rate, and missed alarm rate to quantify the detection capability of the system, ensuring that the detection algorithm has superior performance in accurately identifying and reducing false alarms.

[0106] Next, the experiment conducted a detailed test on the processing speed and response time of the present invention. By setting the simulation conditions of high data throughput, recording the amount of data processed by the system per unit time and the task completion time of each distributed node, the processing speed index of the system under different loads is calculated. The response time test simulates the complete process from detecting the threat to triggering the protective measures, and records the time consumption of threat detection, response initiation, and execution of protection stages to calculate the response efficiency of the system under various threat scenarios. Compared with the response speed of traditional systems, the present invention can complete the initiation and execution of response protection measures within 0.3 seconds after detecting the threat, which significantly improves the threat control efficiency. These tests ensure that the system still maintains a fast and accurate response capability when dealing with complex threats, and effectively verifies the superiority of the present invention in actual application scenarios.

[0107] Table 1 Comparison with existing technology

[0108] index The present invention Traditional Technology Data storage reliability % 99.8 95.0 Threat Detection Accuracy % 97.5 85.0 Average processing speed bars / second 5000 3000 False Positive Rate % 1.5 5.0 Response time seconds 0.3 1.2

[0109] As shown in Table 1, the "boundaryless data security analysis system based on multi-copy data" of the present invention has been verified through theoretical experiments from core indicators such as storage reliability, threat detection accuracy, processing speed and response time, and has been comprehensively compared with the traditional single-copy system. First, in terms of the reliability of multi-copy data storage, the present invention can ensure the integrity and availability of data by storing multi-copy data in a distributed environment even if single or multiple points of failure occur. The experiment set up multiple storage nodes and tested the data integrity under the failure of a single node. The results showed that the data recovery rate of the present invention reached 99.8%, which is significantly higher than the 95.0% of the traditional single-copy system. This design greatly improves the data reliability of the system, making it more suitable for scenarios with higher requirements for data fault tolerance.

[0110] In the test of threat detection accuracy, by constructing a simulated threat environment, the threat detection module of the present invention performs well in identifying real threats and reducing false alarm and missed alarm rates. Test data show that the detection accuracy of the present invention reaches 97.5%, and the false alarm rate is only 1.5%. Compared with the 85.0% accuracy and 5.0% false alarm rate of traditional systems, the present invention has significant advantages in detection effect and threat identification accuracy. Thanks to the use of distributed computing resource management and pattern recognition algorithms, the system can quickly analyze abnormal behaviors in multiple copies of data, achieve more accurate threat identification, effectively reduce false alarm and missed alarm rates, and improve the reliability of security protection and user trust.

[0111] In addition, the present invention also excels in processing speed and response time. The theoretical experiment recorded the data processing volume of the system per unit time and the average processing speed of each node. The results showed that the average processing speed of the present invention was 5,000 data per second, which is higher than the 3,000 per second of the traditional system; in terms of the time from threat detection to response execution, the response time of the present invention is only 0.3 seconds, which is much lower than the 1.2 seconds of the traditional system. The system's rapid response capability means that protective measures can be executed immediately after a threat is detected, quickly preventing the spread of malicious activities, and greatly improving the system's defense efficiency and stability. These experimental results show that the borderless data security analysis system of the present invention is significantly superior to traditional systems as a whole through multi-copy distributed storage, distributed threat detection and real-time response mechanisms, providing a more reliable and efficient solution for data security management.

[0112] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A borderless data security analysis system based on multi-copy data, characterized by: include: A multi-copy data collection management unit (100), used to collect data from a data source and divide the collected data into multiple copies for distributed storage; A real-time data processing unit (200) is used to pre-process the collected data and perform data encryption and redundancy management on the pre-processed data; A distributed threat detection unit (300) is used to use distributed computing resources to analyze multiple copies of data in real time, detect potential security threats, and monitor its own processing speed in real time, and finally perform threat detection on the pre-processed data and calculate the accuracy of threat detection; A response and automatic protection unit (400), used to automatically trigger protection measures after a threat is detected, and to evaluate the response time of the system; A policy dynamic adjustment unit (500) is used to dynamically adjust the security policy for adapting to new threat situations or environmental changes according to the evaluation results of the distributed threat detection unit (300) and the response and automatic protection unit (400); The log generation unit (600) is used to record all important events in the operation of the system, and store the generated logs for subsequent auditing, compliance checking and method adjustment analysis.

2. The borderless data security analysis system based on multi-copy data according to claim 1, characterized in that: The multi-copy data collection management unit (100) comprises a data collection module (101) and a data copy management module (102); the data collection module (101) is used to collect original data, interact with different types of data sources through an API interface, and obtain data seamlessly; The data collection module (101) is also responsible for preliminary data integration and filtering; The data copy management module (102) is used to distribute the data copies to different storage nodes through the distributed database after the data collection is completed.

3. The borderless data security analysis system based on multi-copy data according to claim 2, characterized in that: The real-time data processing unit (200) comprises a data preprocessing module (201) and an encryption and redundancy management module (202); the data preprocessing module (201) is used to make the collected data meet the format requirements of the system before entering the analysis and storage phase; The encryption and redundancy management module (202) is used to protect data during transmission and storage; After that, redundancy management is performed and data is aligned by generating and managing data copies.

4. The borderless data security analysis system based on multi-copy data according to claim 3, characterized in that: The distributed threat detection unit (300) comprises a distributed computing resource management module (301), a processing speed monitoring module (302), a threat analysis module (303), and a detection accuracy evaluation module (304); the distributed computing resource management module (301) is responsible for planning and utilizing the processing capacity of each computing node by managing and allocating distributed computing resources in the system during the real-time analysis of multiple copies of data; and adjusting the utilization rate of computing resources through dynamic scheduling and load balancing; The processing speed monitoring module (302) is used to monitor the processing speed of the distributed system in real time. By reading the system log records and using the distributed system monitoring tool, the resource utilization of each node, data throughput and task processing time related data are monitored in real time. After these data are dimensionlessly processed, the processing speed index Clsz is calculated by the following formula: In the formula, Sjl represents the amount of data processed by the system per unit time, Rsj represents the time required for each distributed computing node to complete the specified data processing task, Syc represents the time required from data input to processing completion, Jly represents the CPU and memory usage of each distributed computing node; N represents the number of distributed computing nodes; Sjl i 、Rsj i 、Syc i and Jly i They represent the amount of data processed by the system of the i-th distributed computing node in unit time Sjl, the time required for each distributed computing node to complete the specified data processing task Rsj, the time required from data input to processing completion Syc, and the CPU and memory usage Jly of each distributed computing node; The processing speed monitoring module (302) compares and evaluates the processing speed index Clsz by presetting the first processing speed threshold Q. The specific evaluation content is as follows: If the processing speed threshold Q> the first processing speed index Clsz, it means that the processing speed of the current distributed system is abnormal. At this time, the threat detection of the pre-processed data is stopped, and the processing speed abnormality result is immediately generated to notify the system administrator to intervene and record the performance log; If the processing speed threshold Q ≤ the first processing speed index Clsz, it means that the processing speed of the current distributed system is normal, and threat detection is performed normally on the pre-processed data.

5. The borderless data security analysis system based on multi-copy data according to claim 4, characterized in that: The threat analysis module (303) is used to perform in-depth analysis on the pre-processed data using a pattern recognition algorithm to detect potential security threats; at the same time, by analyzing abnormal behaviors and patterns in multiple copies of data, it identifies known and unknown security risks and generates a threat report; The detection accuracy evaluation unit is used to obtain the real positive rate Zzl, the false alarm rate Wbl and the missed alarm rate Lbl through the simulation test environment and the false alarm analysis tool after the threat analysis is completed; then the real positive rate Zzl, the false alarm rate Wbl and the missed alarm rate Lbl are extracted and dimensionless processed, and the detection accuracy Jzql is calculated by the following formula: In the formula, a is the adjustment coefficient, which is used to strengthen the weight of the product of the real positive interest rate Zzl and (1-Wbl), and its specific value is adjusted by the user; The detection accuracy evaluation module (304) performs a comparative evaluation by presetting the detection accuracy threshold W and the detection accuracy Jzql, and the specific contents are as follows: If the detection accuracy Jzql ≥ the detection accuracy threshold W, it indicates that the system's detection effect and threat identification capabilities are normal. At this time, threat response measures are taken through the response and automatic protection module; If the detection accuracy Jzql is less than the detection accuracy threshold W, it indicates that the detection effect and threat identification ability of the system are abnormal. At this time, an abnormal threat identification accuracy result is generated, and the parameters of the threat detection model are adjusted, the strictness of data preprocessing is enhanced, or an early warning is issued to notify the administrator to take manual intervention measures.

6. The borderless data security analysis system based on multi-copy data according to claim 5, characterized in that: The response and automatic protection unit (400) comprises a protection self-starting module (401) and a response time evaluation module (402); the protection self-starting module (401) uses an intrusion detection system and a behavior analysis tool to analyze and identify threat reports, and after identifying abnormal behaviors and potential threats, automatically selects protection measures according to the detected threat type and severity; The response time evaluation module (402) obtains the relevant parameters of the system response time by reading the event log records of the system and responding to the simulation test, and after dimensionless processing of the relevant parameters of the system response time, obtains the response time index Xysj by calculating through the following formula: Where Wxy represents the time from threat detection to the system starting to take response measures, Xzx represents the response execution time, and Wfs represents the threat blocking time; The response time evaluation module (402) compares and evaluates the response time index Xysj by using the preset response threshold E. The specific evaluation contents are as follows: If the preset response threshold E ≥ response time index Xysj, it means that the system's response speed in this threat event is qualified, and the execution speed of the protection measures and the system's response capability are normal; If the preset response threshold E is less than the response time index Xysj, it means that the system's response speed in this threat event is unqualified. At this time, an abnormal response time result is generated, and the cause of the delay is further analyzed, including the timeliness of threat detection, the decision-making efficiency of protective measures, or bottlenecks in the execution process.

7. The borderless data security analysis system based on multi-copy data according to claim 6, characterized in that: The data sources include sensors, servers and user devices; The preprocessing includes cleaning, deduplication, normalization and data integrity verification; The protection measures include data isolation, access permission adjustment and blocking potential attack paths.

8. A method using the borderless data security analysis system based on multi-copy data as claimed in any one of claims 1 to 7, characterized in that: include: Collect data from data sources and split the collected data into multiple copies for distributed storage; Preprocess the collected data, and perform data encryption and redundancy management on the preprocessed data; Use distributed computing resources to analyze multiple copies of data in real time, detect potential security threats, and monitor its own processing speed in real time. Finally, perform threat detection on the pre-processed data and calculate the accuracy of threat detection. After a threat is detected, protection measures are automatically triggered and the system response time is evaluated; Dynamically adjusting security policies for adapting to new threat situations or environmental changes based on evaluation results of the distributed threat detection unit (300) and the response and automatic protection unit (400); Record all important events in system operation, store the generated logs and use them for subsequent audits, compliance checks and method adjustment analysis.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the borderless data security analysis method based on multi-copy data described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the borderless data security analysis method based on multi-copy data described in any one of claims 1 to 7 are implemented.

Images