Shared data filtering method based on data producer user behaviors

Abstract

The invention discloses a shared data filtering method based on data producer user behaviors. The method comprises the steps that S1, a data producer user packages encrypted shared access data; s2, the edge server calculates the request anomaly degree according to the data producer user anomaly degree and the index of the shared data; s3, the edge server filters the shared request data according to the request abnormality and the abnormal behavior rule; s4, the cloud server carries out statistics on user behaviors of the data producer and calculates an anomaly degree vector of each user; s5, the cloud server clusters the anomaly vectors of all the data producer users and calculates the weight of each dimension of the anomaly vectors; and S6, the cloud server updates the abnormal degree of each data producer user. The invention aims to improve the security and flexibility of the shared data filtering process and improve the evaluation effect of the user abnormality.

Description

Technical Field

[0001] The present invention relates to the field of data security sharing, and in particular to a method for filtering shared data by data producers. Background Art

[0002] Cloud storage services are one of the basic services provided by cloud computing, such as iCloud, Dropbox, and Google Drive. By migrating local data to the cloud, users can enjoy convenient data management at a lower cost. Compared with data storage, data sharing is also an important process because users can store, share, and access files from cloud storage services. Although cloud storage reduces the resource consumption of terminal devices, the cloud server may not meet the latency requirements due to its distance from the terminal device. Therefore, in order to improve the quality of cloud storage services for terminal devices, mobile edge computing is proposed to deploy servers on the network closer to mobile devices. In addition, edge nodes can be deployed in a distributed mode, where storage and computing resources are distributed on the edge layer close to the terminal device. Therefore, when the terminal device offloads its computing tasks to the edge node or the cloud data is cached to the edge node, the network latency between the terminal device and the cloud can be greatly reduced. Therefore, the introduction of the node-edge-cloud collaborative computing paradigm has completely changed the data sharing model, but also introduced a series of privacy or security issues. For example, outsourced private data often contains sensitive information, which may be business plans or product models. Given these issues, shared data must be protected through measures such as access control and encryption to protect privacy, and also ensure that authorized personnel can access and use the shared data.

[0003] Traditionally, fine-grained secure data sharing systems usually consider the access control of the receiver rather than the sender, which is manifested as: only the receiver with decryption rights can recover the message. Therefore, how to build a secure data sharing system that can both limit the capabilities of the sender and receiver and protect user privacy is an important and challenging problem.

[0004] However, in the study of data purification in the context of encrypted secure data sharing, existing solutions usually use predefined fixed access control policies to filter shared data first, and then randomize the encrypted data. These solutions often lack analysis of the sharing behavior of data producers, and the fixed access filtering policies make the solutions lack flexibility.

[0005] Therefore, the present invention proposes a shared data filtering method based on the user behavior of the data producer.

[0006] After searching, the application publication number is CN118713849A, which belongs to the field of data security sharing technology. The method includes providing a data security sharing method in an attribute encryption and cloud storage environment, which contains four stages and the steps are as follows: in the initialization stage, the attribute agency generates system public parameters and system master keys according to the initialization algorithm, and the system public parameters are sent to the data owner. The system master key is stored in the attribute agency, the upper limit of the number of checker attributes is determined, and the checker initialization algorithm is used to generate the checker public parameters and the checker private key according to the system public parameters; in the data encryption storage stage, the data owner uses the system public parameters and access policy to encrypt the plaintext data, generate a ciphertext file, and generate a symmetric key for the ciphertext file, arrange the checker, generate a verification component through the access policy and the checker public parameters and the ciphertext file, and embed the access policy The ciphertext and verification components are sent to the checker; in the checker policy verification stage, after receiving the ciphertext and verification components, the checker uses the checker private key to perform calculation verification to verify whether the access policy embedded in the ciphertext is compliant. If it is compliant, the ciphertext passes the verification and the checker uploads the ciphertext to the cloud server for storage. If it is not compliant, the ciphertext is directly discarded; in the data decryption stage, the user sends a data access request to the cloud server, and the cloud server sends the ciphertext to the user. The user provides his own attribute set to the attribute agency. The attribute agency uses the system master key and the attribute set provided by the user to generate a user private key and send it to the user. After receiving the ciphertext and the user private key, the user performs attribute set testing, data decryption and data verification in sequence. When the data verification is successful, the plaintext is directly returned to the user.

[0007] This patent builds an encryption system based on attribute encryption, which mainly involves verification when uploading shared data in two stages: in the data encryption storage stage, the verification component is generated through the access policy and checker public parameters and ciphertext files, and in the checker policy verification stage, the checker private key is used for calculation verification to verify whether the access policy embedded in the ciphertext is compliant. This patent mainly uses the encryption system to generate verification components, and the filtering of shared data in the process of uploading to the cloud is based on the access structure embedded in the ciphertext, which only considers the factors of the encryption system. This patent can expand the system solution based on attribute encryption by introducing the security importance of measuring the file access structure in the encryption stage, adding an additional anomaly detection process in the edge filtering stage, and adding a user anomaly measurement process in the cloud. In this way, in the process of filtering shared data, both the factors based on the attribute encryption system and other anomaly indicators are taken into account, and finally the security of the system is improved when data producers and users share data. Summary of the invention

[0008] The invention aims to solve the above problems of the prior art. A shared data filtering method based on the user behavior of the data producer is proposed. The technical solution of the invention is as follows:

[0009] A shared data filtering method based on data producer user behavior comprises the following steps:

[0010] S1. The data producer user packages the encrypted shared access data and initiates a request to the edge server;

[0011] S2. The edge server calculates the request abnormality based on the indicators of the data producer user-related data and shared data;

[0012] S3. The edge server filters the shared request data according to the request abnormality and abnormal behavior rules;

[0013] S4. The cloud server collects statistics on the user behaviors of data producers and calculates the abnormality vector of each user;

[0014] S5. The cloud server clusters the anomaly vectors of all data producer users and calculates the weight of each dimension of the anomaly vector;

[0015] S6. The cloud server updates the abnormality of each data producer user.

[0016] Furthermore, in step S1, the request initiated by the data producer user, based on the attribute encryption system, specifically includes:

[0017] The requests from data producer users are packaged and processed into three categories: uploading or updating files, deleting files, and modifying file access structures. Data encryption or calculation of file importance is performed based on the request category.

[0018] Furthermore, in step S2, the edge server calculates the request abnormality of the request initiated by the data producer, based on the data transmission rate, the producer user abnormality, and the abnormality value of the operation, specifically including:

[0019] S21. Count the data transmission rate of the request, obtain the abnormality of the producer user corresponding to the request, and obtain the abnormality value of the operation corresponding to the request;

[0020] S22. Calculate the abnormality of the request based on the data transmission rate, the abnormality of the producer user, and the abnormality added value of the operation corresponding to the request.

[0021] Furthermore, in step S3, the request filtering process is based on the abnormality threshold and abnormal behavior rules, and specifically includes:

[0022] The calculated request anomaly degree is compared with the anomaly degree threshold set by the edge server to initially filter out the request. Then, the request is further judged whether it is abnormal and filtered out based on the abnormal behavior rules set in the cloud.

[0023] Furthermore, in step S4, the calculation of the abnormality vector includes the calculation of time abnormality, data volume change abnormality, file importance change abnormality, and user operation abnormality, specifically including:

[0024] S41. The edge server generates a processing log after processing the request data initiated by the data producer and uploads it to the cloud, which collects the log;

[0025] S42. The cloud server scans the logs of each data producer user and calculates an abnormality vector, the dimensions of which include: time abnormality, data volume change abnormality, file importance change abnormality, and user operation abnormality.

[0026] Furthermore, in step S5, the weight of each dimension of the abnormality vector is calculated, which specifically includes:

[0027] S51. After the cloud server calculates the abnormality vector of each data producer user, it clusters the vector set to obtain two clusters;

[0028] S52. The plane equation y=a1x1+a2x2+a3x3+a4x4+b for separating the two clusters is calculated by the clustering model, where a1 to a4 represent the coefficients of each anomaly dimension in the plane equation. The larger the absolute value, the greater the impact on the distribution of the anomaly degree vector. Then, for each coefficient a i Calculate the absolute value divided by the sum of the absolute values ​​of all coefficients as the weight value h of the abnormal dimension i , where h i Represents the weight of the i-th dimension of the anomaly vector, indicating the contribution ratio to the user's anomaly value.

[0029] Furthermore, in step S6, updating the abnormality of each data producer user specifically includes:

[0030] The current abnormality of the data producer is updated according to the abnormality vector calculated by each data producer user and the historical abnormality of the data producer user.

[0031] An electronic device, characterized in that it includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, it implements the shared data filtering method based on the user behavior of the data producer as described in any one of claims 1 to 7.

[0032] A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that when the computer program is executed by a processor, the shared data filtering method based on the user behavior of a data producer as described in any one of claims 1 to 7 is implemented.

[0033] A computer program product, comprising a computer program, characterized in that when the computer program is executed by a processor, it implements the shared data filtering method based on the user behavior of a data producer as described in any one of claims 1 to 7.

[0034] The advantages and beneficial effects of the present invention are as follows:

[0035] 1. In step S1 of the present invention, a model is designed to quantify the importance of the access structure of the data shared by the data producer, which provides an important indicator for the data filtering process during the sharing process and reduces the time overhead caused by directly detecting the access structure during the edge data filtering process.

[0036] 2. In step S3 of the present invention, request abnormality and abnormal rules are introduced to filter the shared data uploaded by the data producer user in multiple dimensions. While ensuring that the shared data meets the filtering conditions, the user abnormality is considered, and the success rate of malicious users sharing data is reduced.

[0037] 3. In step S5 of the present invention, a clustering method is introduced to obtain the weight of each abnormal dimension using the distribution of the user abnormality vector, and the weighted sum is used to obtain the user abnormality, so that the user abnormality takes into account the abnormal vector distribution and the numerical values ​​of each dimension of the abnormal vector, thereby making the difference in the value range of the user abnormality value more obvious, thereby improving the recognition rate of abnormal users. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 It is a flow chart of the overall embodiment provided by the present invention;

[0039] Figure 2 This is an example diagram of an access control tree;

[0040] Figure 3 An example diagram of file importance calculation. DETAILED DESCRIPTION

[0041] The following will describe the technical solutions in the embodiments of the present invention in detail in conjunction with the accompanying drawings in the embodiments of the present invention. The described embodiments are only part of the embodiments of the present invention.

[0042] The technical solution of the present invention to solve the above technical problems is:

[0043] In response to the problem that data producers may have abnormal sharing behaviors and shared data is filtered only by fixed relationships in the context of attribute encryption, this paper proposes an anomaly detection model and a shared data filtering method based on the sharing history behavior of data producers. The aim is to filter the shared data of abnormal users through the abnormal degree of producer users and the indicators of transmitted data, thereby reducing the transmission success rate of abnormal shared data and increasing the flexibility of shared data filtering rules.

[0044] like Figure 1 As shown, the present invention provides a method for balancing location privacy and positioning accuracy based on trust value, characterized in that it includes the following steps:

[0045] S1. The data producer user packages the encrypted shared access data and initiates a request to the edge server;

[0046] S2. The edge server calculates the request abnormality based on the indicators of the data producer user-related data and shared data;

[0047] S3. The edge server filters the shared request data according to the request abnormality and abnormality index;

[0048] S4. The cloud server collects statistics on the user behaviors of data producers and calculates the abnormality vector of each user;

[0049] S5. The cloud server clusters the anomaly vectors of all data producer users and calculates the weight of each dimension of the anomaly vector;

[0050] S6. The cloud server updates the abnormality of each data producer user.

[0051] In this embodiment, in step S1, the data producer user packages the encrypted shared access data and initiates a request to the edge server, which specifically includes the following steps:

[0052] In order to combine the calculation of data producer user behavior and attribute encryption system, this paper introduces file importance k∈[0,1] and user importance ku∈[0,1] to measure the importance of the attribute set contained in the file and the attribute set contained in the user, so as to improve the security recognition of file attributes and user attributes. In order to calculate the above values, for an attribute encryption system, it sets the attribute set S={s1,s1,…,s n}. In addition, the system sets the importance of each attribute. i Its corresponding importance is ka i ∈[0,1]. Each user also has its own attribute set When a user uploads a file or changes the file access structure, the file access structure A needs to be set. In attribute encryption, the file access structure represents the set of data consumers allowed by the data producer user to access the shared data. It is generally expressed as an access control tree or an LSSS access control matrix. This article mainly focuses on the attribute encryption scheme of the access control tree. Therefore, for the attribute encryption scheme of the LSSS access control matrix, it needs to be equivalently converted into an access control tree. Figure 2It is an example diagram of an access control tree, where t / n represents the threshold, which means that to satisfy this node, t child nodes need to be owned among n child nodes, and the leaf nodes represent basic attributes. After the data producer encrypts the file using this access control tree, if the attributes of the data consumer user satisfy the root node of this access control tree, then the file can be decrypted to achieve data sharing. For example, in Figure 2 when the attribute set Su = {A, B, C, D} of the data consumer user, the file can be decrypted. When the data producer user calculates the importance degree of the file based on the access structure, it is necessary to calculate from the leaf nodes of the access control tree to the root node. The importance degree of each leaf node is the importance degree of its corresponding attribute s i is ka i . For each non-leaf node, the kns value is introduced, which represents the importance degree corresponding to a node set, so as to facilitate the calculation of the importance degree of non-leaf nodes. It is calculated using the following formula:

[0053] kM = max(k(p i ))), p i ∈PS#(1)

[0054] kS = sum(k(p i ))), p i ∈PS#(2)

[0055]

[0056] where the node set PS = {p1, p2,... p m} represents the input node set, kM represents the maximum value of the importance degrees in this node set, kS represents the sum of the importance degrees in this node set, and q ∈ [0, 1] represents the influence degree of other nodes in this node set on the maximum value node.

[0057] When the t / n threshold corresponding to the non-leaf node p satisfies the condition t = n, it is equivalent to an AND gate, then the child node set of this node is used as the input set, so as to calculate the importance degree k(p) of this node. It is calculated using the following formula:

[0058] k(p) = kns({c|c is child node of p})#(4)

[0059] When the t / n threshold corresponding to the non-leaf node p satisfies t < n, it is calculated using the following formula:

[0060] kSM = kns({c|c is first t largest child node of p})#(5)

[0061] kSN=kns({c|cisfirsttsmallestchildnodeofp})#(6)

[0062] k(p)=(kSM+kSN) / 2#(7)

[0063] Among them, kSM represents the kns value corresponding to the set of the first t most important nodes among the child nodes of node p, and kSN represents the kns value corresponding to the set of the first t least important nodes among the child nodes of node p.

[0064] The following is a specific example to further illustrate:

[0065] Figure 3 This is an example of calculating the importance of a file. When the system is given q=1 and the importance of attributes A to F and the access control tree in the figure, according to formula (4), the importance of the parent node of attributes A, B, and C can be calculated to be approximately 0.96. According to formula (5), the importance of the parent node of attributes E and F can be calculated to be approximately 0.55. Then the importance of the root node is calculated. According to formula (5) and the importance of the two non-leaf nodes and the attribute D node calculated previously, the value can be obtained to be approximately 0.814. From the figure, it can be seen that when the q value increases, under the same input, the importance of the file shows an upward trend.

[0066] The entire system is based on the attribute encryption system. The requests of data producer users are divided into three categories for processing and packaging, namely uploading or updating files, deleting files, and modifying the access structure of files. The specific request forms of data producer users are as follows:

[0067]

[0068] When the request of the data producer user is to upload or update a file, set the operation code code to up and place it in the request, and place the request time time in the request. Then, after encrypting the file attributes, calculate the importance level k of the file using the file access structure A and place it in the request. After that, count the size of the encrypted file and place it in the request. Finally, upload the request and related data such as the encrypted file to the edge server. When the request of the data producer user is to delete a file, set the operation code code to del and place it in the request, and place the request time time in the request. Finally, upload the request and related data to the edge server. When the request of the data producer user is to modify the file access structure, that is, the re-encryption operation based on attribute encryption, set the operation code code to md and place it in the request, and place the request time time in the request. Then, calculate the re-encryption key based on attribute encryption, calculate the importance level k of the file using the new access structure and place it in the request. Finally, upload the request and related data such as the re-encryption key to the edge server.

[0069] Further, in step S2, the edge server calculates the request anomaly degree of the request initiated by the data producer, based on the data transmission rate, the producer user anomaly degree, and the operation anomaly degree addition value, specifically including:

[0070] S21. Obtain the request data transmission rate, the producer user anomaly degree, and the operation anomaly degree addition value

[0071] In this article, the system needs to discretize the ranges of the file importance level and the user importance level to obtain the importance level set P, which is calculated using the following formula:

[0072]

[0073] where p i represents the importance level, and its corresponding importance value is between l i and r i . It is stipulated that when i < j, the importance level of p i is higher than that of p j , and the corresponding importance values of the former are all greater than those of the latter.

[0074] When the edge server obtains the data producer's request data, measure the sequence Sv of the transmission rate, which is used to calculate the fluctuation degree of the request data transmission rate later. Then, obtain the current anomaly degree Fu of the corresponding producer user through local caching or from the cloud. After that, obtain the anomaly degree addition value of the corresponding operation under the importance level of the data producer user through the system-set anomaly degree addition value matrix, which is used to measure the anomaly sensitivity of different operations on data producer users at different levels, and is calculated using the following formula:

[0075] FOP=FOPM(Pu,a)#(9)

[0076] Among them, FOP represents the abnormality value of the operation, FOPM represents the abnormality value matrix, Pu represents the importance level corresponding to the data producer user who issues the request, and a represents the request category of the data producer user who issues the request.

[0077] S22. Calculate request abnormality

[0078] After obtaining the above data transmission rate, producer user abnormality, and corresponding operation abnormality added value, the fluctuation abnormality of the data transmission rate is calculated using the following formula:

[0079]

[0080] Among them, σ represents the standard deviation, μ represents the mean value, and stf represents the limit of fluctuation abnormality set by the system.

[0081] Finally, the request abnormality is calculated using the following formula:

[0082] FD=h*FDT+(1-h)*Fu+FOP#(11)

[0083] Among them, FD represents the request abnormality, h represents the weight factor, the fluctuation abnormality of the FDT data transmission rate, Fu represents the abnormality of the data producer user, and FOP represents the operation abnormality value.

[0084] Furthermore, in step S3, the request filtering process is based on the abnormality threshold and abnormal behavior rules, and specifically includes:

[0085] The edge server first dynamically sets the data producer request anomaly threshold FDh based on the distribution of request anomalies in the service area and service needs. When the calculated data producer request anomaly FD is greater than this value, the edge server can discard it. If the judgment passes, it needs to be further filtered according to the abnormal behavior rules. In this article, the following abnormal rules are defined for the behavior generated by the data producer:

[0086] Definition 1: When the importance level of the relevant file requested for upload, update or deletion is pf, the system sets the minimum retention time corresponding to the corresponding level to tc(pf). During this period after the file is successfully uploaded, if the data producer attempts to modify the data or access structure of the file, it is considered an exception.

[0087] Definition 2: When the importance level of the request corresponding to the data producer user is Pu, the system sets the shortest time interval for uploading new files corresponding to its level as td(Pu). If the data producer attempts to upload a new file in a period shorter than this, it is considered abnormal.

[0088] Definition 3: When the importance level of the request corresponding to the data producer user is Pu, the system sets the shortest time interval for deleting files corresponding to its level as tr(Pu). If the data producer attempts to delete files in a shorter period than this, it is considered abnormal.

[0089] Definition 4: When the importance level of the relevant file before the request to upload the update is pi, and the importance level of the file when the request to upload the update is pj, the system sets the corresponding data volume change tolerance to dv(pi,pj). If the absolute value of the data volume change after the data producer uploads the update file is greater than this value, it is considered abnormal.

[0090] Definition 5: When a request is made to upload an update, the importance level of the relevant file is pf, and the importance level of the corresponding data producer user is Pu. If pf is higher than Pu, it is considered an abnormality.

[0091] When a request violates any of the above rules, the edge server can discard the request. If both exception judgments are passed, the edge server will process the different operations accordingly, synchronize the updates to the cloud, update the local cache, and upload the processing log to the cloud.

[0092] Furthermore, in step S4, the calculation of the abnormality vector includes the calculation of time abnormality, data volume change abnormality, file importance change abnormality, and user operation abnormality, specifically including:

[0093] S41. Cloud-side collection of edge server processing logs

[0094] In this article, the tuple describing the file status set by the system is fstat, which has the form<t,k,p,size> , where t represents the time when the file was last modified, k represents the current importance of the file, p represents the current importance level of the file, and size represents the current data size of the file. In a system maintenance cycle T, the cloud collects the processing log set uploaded by the edge server as {record|record={req,fstat pre ,fstat now ,einfo}}, where req represents the original information requested, fstat pre Indicates the file status before the request, fstat now Indicates the file status after the request is processed, and einfo indicates additional information about the request processing.

[0095] S42. Cloud server calculates data producer abnormality vector

[0096] In this paper, the behavior of data producers is mainly examined from four dimensions: time dimension, data volume change dimension, file importance change dimension, and operation abnormality dimension. After the cloud collects the behavior data of data producer users within a period, these indicators are calculated for each data producer user who generates an operation.

[0097] Definition 6: When measuring an abnormality indicator, x is the observed value, xT is the lower limit of abnormality judgment, and the function sf(x,xT) is defined as the abnormality change function of the abnormality indicator. The properties of this function are: the range is [0,1], the domain is [0,xT], and it is monotonically increasing.

[0098] For the calculation of the time anomaly of a single user, for a single request of the user in the operation sequence, assume that the time is tn, the time when the data producer user who initiated the request uploaded a new file most recently is tup, the time when the file was most recently deleted is tdel, the minimum retention time of the cloud file is tc, the shortest time for uploading a new file corresponding to the user is td, and the shortest time for deleting a file corresponding to the user is td. Then, the time anomaly F1 of a single user is calculated using the following formula:

[0099]

[0100] Among them, sg1 represents the time anomaly degree of a single operation at a certain moment calculated based on the conditions, and sf i represents the abnormality change function set for different request situations, w i Represents the weight factors for three different request situations, k i Indicates the importance of the target cloud file corresponding to a single request. If there is no corresponding target cloud file, k i Indicates the importance of the files included in the request.

[0101] For the calculation of the abnormality of data volume change of a single user, for a single request of the user in the operation sequence, assume that the importance level of the file carried in the request is pj, its importance is kj, and the importance level of the cloud file to be updated is pi, its importance is ki. If the operation is successful, the absolute value of the data change rate is dc, and size represents the data volume of the uploaded file. Then, for the abnormality of data volume change F2 of a single user, the following formula is used to calculate:

[0102]

[0103]

[0104] Among them, sg2 represents the abnormality of the change of the amount of data based on a certain moment of operation calculated based on a single condition, and sf i represents the abnormality change function set for different request situations, dv(pi,pj) represents the data volume change tolerance, sl represents the data volume limit for uploading new files at the corresponding file importance level, and w i Represents the weight factors for three different request situations, k f A measure of how the importance of a file changes.

[0105] For the calculation of the abnormal degree of change in the importance of a single user's files, for a single request of the user in the operation sequence, assume that the importance of the file carried in the request is kj, the importance of the cloud file to be updated is ki, and the importance of the requesting user is ku. Then, for the abnormal degree of change in the amount of data of a single user F3, the following formula is used to calculate:

[0106]

[0107] Among them, sg3 represents the abnormal change of the importance of a single file that meets the conditions and is calculated based on the operation at a certain time, and sf i Indicates the abnormality change function set for different request situations.

[0108] For the calculation of the operation abnormality of a single user, assume that the user's importance level is Pu, the system upper limit of the number of erroneous operations within the period is opl(Pu), and the number of erroneous operations generated is wn. Then, for the operation abnormality F4 of a single user, the following formula is used for calculation:

[0109]

[0110] Among them, sf i Indicates the abnormality change function set for different request situations.

[0111] Furthermore, in step S5, the weight of each dimension of the abnormality vector is calculated, which specifically includes:

[0112] S51. Clustering of abnormality vector sets in the cloud

[0113] After obtaining the abnormality vector set {FV|FV=[F1,F2,F3,F4]} of the data producer user group through cloud computing, this paper uses unsupervised clustering combined with support vector machine to cluster the above set. First, unsupervised clustering is used to obtain two clusters in the abnormality vector space, and then support vector machine is used to further cluster the labeled clusters to finally obtain the clustering model. This paper uses three methods to conduct experiments and cluster the abnormality vector set with three clusters. The following are the indicators of the clustered results:

[0114]

[0115] Among them, DBI represents the ratio of cluster compactness to separation, CH represents the ratio of inter-cluster dispersion to intra-cluster dispersion, and Dunn represents the ratio of the minimum distance to the maximum distance between clusters.

[0116] S52. Calculate the weight value of each dimension of the anomaly vector

[0117] After obtaining the clustering results of the anomaly vector, the plane equation y=a1x1+a2x2+a3x3+a4x4+b that separates the two clusters can be obtained from the support vector machine model. Then the weight value of each dimension of the anomaly vector is calculated using the following formula:

[0118]

[0119] Here, as represents the sum of the absolute values ​​of a1 to a4.

[0120] Furthermore, in step S6, updating the abnormality of each data producer user specifically includes:

[0121] After the weight value of each dimension of the anomaly degree vector is calculated, the anomaly degree of the data producer user who has performed operations within the period is updated, and the calculation is performed using the following formula:

[0122] F s =(F1,F2,F3,F4)*(h1,h2,h3,h4) T #(twenty one)

[0123]

[0124] Among them, F s Indicates the user abnormality measurement value of the current cycle, FU T-1 Indicates the historical user abnormality, FU T represents the abnormality of the current user, β represents the abnormality update weight, and F l is the abnormality update threshold.

[0125] The present invention aims at the problem of lack of flexibility and security in the process of shared data filtering using fixed access filtering strategies. It models the behavior of data producer users and calculates their user abnormality. It uses the user abnormality of the producer of shared data and other measurement indicators to perform dynamic shared data filtering at the edge in multiple dimensions. The process of shared data finally filtered by the present invention is more secure and flexible. Compared with other methods, it effectively reduces the probability of data producers with abnormal behavior authorized within the system to successfully share their data, improves the overall security of the system, and has more advantages in the scalability of filtering strategies.

[0126] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0127] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0128] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0129] The above embodiments should be understood to be only used to illustrate the present invention and not to limit the protection scope of the present invention. After reading the contents of the present invention, technicians can make various changes or modifications to the present invention, and these equivalent changes and modifications also fall within the scope defined by the claims of the present invention.

Claims

1. A shared data filtering method based on the user behavior of data producers, characterized in that: The following steps are involved: S1. The data producer user packages the encrypted shared access data and initiates a request to the edge server; S2. The edge server calculates the request abnormality based on the indicators of the data producer user-related data and shared data; S3. The edge server filters the shared request data according to the request abnormality and abnormal behavior rules; S4. The cloud server collects statistics on the user behaviors of data producers and calculates the abnormality vector of each user; S5. The cloud server clusters the anomaly vectors of all data producer users and calculates the weight of each dimension of the anomaly vector; S6. The cloud server updates the abnormality of each data producer user.

2. A shared data filtering method based on data producer user behavior according to claim 1, characterized in that: In step S1, the request initiated by the data producer user, based on the attribute encryption system, specifically includes: The requests from data producer users are packaged and processed into three categories: uploading or updating files, deleting files, and modifying file access structures. Data encryption or calculation of file importance is performed based on the request category.

3. A shared data filtering method based on data producer user behavior according to claim 1, characterized in that: In step S2, the edge server calculates the request abnormality of the request initiated by the data producer, based on the data transmission rate, the producer user abnormality, and the operation abnormality value, specifically including: S21. Count the data transmission rate of the request, obtain the abnormality of the producer user corresponding to the request, and obtain the abnormality value of the operation corresponding to the request; S22. Calculate the abnormality of the request based on the data transmission rate, the abnormality of the producer user, and the abnormality added value of the operation corresponding to the request.

4. A shared data filtering method based on data producer user behavior according to claim 1, characterized in that: In step S3, the request filtering process is based on the abnormality threshold and abnormal behavior rules, and specifically includes: The calculated request anomaly degree is compared with the anomaly degree threshold set by the edge server to initially filter out the request. Then, the request is further judged whether it is abnormal and filtered out based on the abnormal behavior rules set in the cloud.

5. A shared data filtering method based on data producer user behavior according to claim 1, characterized in that: In step S4, the calculation of the abnormality vector includes the calculation of time abnormality, data volume change abnormality, file importance change abnormality, and user operation abnormality, specifically including: S41. The edge server generates a processing log after processing the request data initiated by the data producer and uploads it to the cloud, which collects the log; S42. The cloud server scans the logs of each data producer user and calculates an abnormality vector, the dimensions of which include: time abnormality, data volume change abnormality, file importance change abnormality, and user operation abnormality.

6. A shared data filtering method based on data producer user behavior according to claim 1, characterized in that: In step S5, the weight of each dimension of the abnormality vector is calculated, which specifically includes: S51. After the cloud server calculates the abnormality vector of each data producer user, it clusters the vector set to obtain two clusters; S52. The plane equation y=a1x1+a2x2+a3x3+a4x4+b for separating the two clusters is calculated by the clustering model, where a1 to a4 represent the coefficients of each anomaly dimension in the plane equation. The larger the absolute value, the greater the impact on the distribution of the anomaly degree vector. Then, for each coefficient a i Calculate the absolute value divided by the sum of the absolute values ​​of all coefficients as the weight value h of the abnormal dimension i , where h i Represents the weight of the i-th dimension of the anomaly vector, indicating the contribution ratio to the user's anomaly value.

7. A shared data filtering method based on data producer user behavior according to claim 1, characterized in that: In step S6, updating the abnormality degree of each data producer user specifically includes: The current abnormality of the data producer is updated according to the abnormality vector calculated by each data producer user and the historical abnormality of the data producer user.

8. An electronic device, characterized in that: It includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, it implements the shared data filtering method based on the user behavior of the data producer as described in any one of claims 1 to 7.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the shared data filtering method based on the user behavior of the data producer is implemented as described in any one of claims 1 to 7.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the shared data filtering method based on the user behavior of the data producer is implemented as described in any one of claims 1 to 7.

Images