A computer software security encryption management system and method

Abstract

This invention relates to the field of security encryption management technology, and more particularly to a computer software security encryption management system and method. The method includes the following steps: acquiring software data and extracting privacy files; then performing interleaved layering transformations on the privacy files to generate basic encryption units; the basic encryption units are mapped through grid encoding to form an encrypted grid encoding matrix; a virtual identity index is generated based on this matrix; a fake retrieval channel is simulated based on the virtual identity index and the basic encryption units to monitor computer access to data; simultaneously, illegal attacks are induced and visitor behavior patterns are recorded; potential internal threats are deduced using the collected behavior patterns and fake retrieval channels; and the basic encryption units are progressively encrypted and solidified to improve the security and effectiveness of data protection, thus constructing a comprehensive security management system. This invention achieves a more flexible and secure computer software security encryption management method.

Description

Technical Field

[0001] The present invention relates to the technical field of security encryption management, and in particular to a computer software security encryption management system and method. Background Art

[0002] Traditional data protection measures are often unable to cope with complex security threats, especially in the process of extracting and processing private files, which can easily leave security loopholes and lead to illegal access and abuse of user sensitive information. The deficiencies of existing technologies in encryption and monitoring have made the security of computer software face severe challenges. When managing computer data securely, many methods lack effective private file extraction and encryption mechanisms. Traditional encryption technologies often cannot provide sufficient flexibility and adaptability to cope with diverse attack methods, especially in the simulation of false retrieval channels and the monitoring of behavioral patterns. Existing technologies have failed to effectively identify and prevent potential internal threats, resulting in a significant reduction in the effectiveness of data protection measures. In addition, distributed mapping and the generation of virtual identity indexes have also failed to fully realize the security management of identities. Summary of the invention

[0003] Based on this, it is necessary to provide a computer software security encryption management system and method to solve at least one of the above technical problems.

[0004] To achieve the above object, a computer software security encryption management method comprises the following steps: Step S1: obtaining computer software data; extracting private files from the computer software data; performing interlaced layer transformation on the private files to obtain basic encryption units; Step S2: Performing grid coding mapping on the basic encryption unit to obtain an encrypted grid coding matrix; performing distributed mapping based on the encrypted grid coding matrix to generate a virtual identity index; Step S3: monitor computer access data; simulate a false retrieval channel based on the virtual identity index and the basic encryption unit; induce illegal attacks on computer access data based on the false retrieval channel, and record visitor behavior patterns; Step S4: deriving computer internal threats using visitor behavior patterns and false search channels; and using computer internal threats to progressively encrypt and solidify basic encryption units.

[0005] The present invention obtains computer software data and extracts privacy files, generates basic encryption units through staggered stacking transformation, improves the security and protection of privacy files, generates grid code mapping and encrypted grid code matrix, enhances the encryption complexity and security of data, applies distributed mapping technology, improves the generation efficiency and accuracy of virtual identity index, simulates false retrieval channels and monitors computer access data, effectively identifies potential security threats and records visitor behavior patterns, derives internal threats using behavior patterns, and enhances the ability to predict potential attacks. The implementation of progressive encryption solidification on basic encryption units further improves data security and protection levels. The overall method constructs a flexible and efficient computer software security encryption management system, which can effectively respond to various network attacks and data leakage risks, ensure the security and integrity of information, improve the security protection capabilities of computer systems and the privacy protection level of user data, form a comprehensive security management mechanism, and enhance the adaptability to complex network environments.

[0006] Preferably, step S1 comprises the following steps: Step S11: Acquire computer software data; filter files containing personal information in the computer software data; Step S12: marking the privacy files in the computer software data according to the personal information files; Step S13: performing substitution conversion on the privacy file to generate a file substitution structure; performing convolution diffusion processing on the privacy file based on the file substitution structure to obtain diffusion ripple data; Step S14: performing reverse track connection on the diffusion ripple data to generate track mark data; topologically flipping and reorganizing the track mark data to generate topological variant data; Step S15: Perform multi-dimensional interleaving integration on the topological variant data to obtain a basic encryption unit.

[0007] The present invention ensures accurate identification of personal information files through data acquisition and screening, improves the pertinence of privacy protection, and the process of marking privacy files enhances the effectiveness of data management. The file replacement structure generated by replacement conversion provides a basis for subsequent data processing. Convolution diffusion processing complicates the processing of privacy information, increases the security and anti-cracking ability of data, and the trajectory marking data generated by reverse trajectory connection effectively records the historical path of data processing. Topological flipping and reorganization further increase the structural complexity of data, making data recovery more difficult. The basic encryption unit formed by multi-dimensional interlaced integration has higher security protection capabilities and flexibility, provides strong technical support for computer software security encryption management, improves the overall protection level of sensitive information, builds a multi-level security system, and ensures the security and compliance of the data processing process.

[0008] Preferably, step S14 comprises the following steps: Step S141: performing pulse sampling mapping on the diffusion ripple data to generate ripple pulse data; performing time sequence reverse reconstruction on the ripple pulse data to obtain a reverse time series; Step S142: performing trajectory point cloud mapping on the reverse time series to obtain trajectory space data; fusing geometric features of the trajectory space data to generate fused feature data; Step S143: performing path gradient rendering on the fused feature data to generate trajectory marking data; Step S144: performing topological feature deconstruction on the trajectory mark data to obtain topological primitive data; symmetry flipping the topological primitive data to generate a flipping matrix; Step S145: Perform structural reorganization mapping based on the flip matrix to obtain topological variant data.

[0009] The present invention converts diffuse ripple data into ripple pulse data through pulse sampling mapping, thereby improving the timeliness and accuracy of data processing. The reverse time series generated by time series reverse reconstruction enhances the flexibility and multidimensionality of data analysis. Trajectory point cloud mapping converts the reverse time series into trajectory space data, providing a more intuitive data expression method. The fused feature data generated by fusing geometric features improves the comprehensive expressiveness and feature extraction capabilities of the data. Path gradient rendering visualizes the trajectory marker data for subsequent analysis and monitoring. Topological feature deconstruction effectively extracts the key structural information of the data. The generated topological primitive data has higher analysis value. The generation of the flip matrix increases the complexity and security of the data through the symmetry flipping technology. The topological variant data formed by the structural reorganization mapping provides a more solid foundation for subsequent encryption processing, which overall improves the system's protection and anti-attack capabilities for sensitive data and builds a more comprehensive security protection system.

[0010] Preferably, step S2 comprises the following steps: Step S21: Perform high-dimensional grid mapping on the basic encryption unit to obtain an initial grid structure; construct a multi-level grid node system based on the initial grid structure; Step S22: spatially dividing the basic encryption unit based on the multi-level grid node system, wherein the level depth range of the grid node is set to 3-5 layers, the number of nodes in each layer ranges from 10-50, the first layer contains 10 to 20 nodes, the second layer contains 15 to 30 nodes, the third layer contains 20 to 50 nodes, the fourth layer contains 25 to 60 nodes, and the fifth layer contains 30 to 70 nodes; performing code mapping on the divided basic encryption unit to generate an initial grid code; Step S23: performing redundancy analysis on the initial grid code and eliminating predictable patterns in the code to obtain an encrypted grid code matrix; Step S24: constructing a distributed mapping network based on the encrypted grid coding matrix; screening feature vectors of the distributed mapping network; performing density clustering on the feature vectors to obtain identity feature clusters; Step S25: performing corresponding virtual identifier derivation processing on each identity feature cluster to generate an identity virtual identifier; constructing a virtual mapping relationship for the identity feature cluster based on the identity virtual identifier to obtain a virtual mapping relationship; Step S26: associate and bind the virtual mapping relationship and the basic encryption unit to generate a virtual identity index.

[0011] The present invention generates an initial grid structure through high-dimensional grid mapping, which provides a solid foundation for subsequent data processing. The construction of a multi-level grid node system improves the flexibility and scalability of data organization. Spatial division realizes the detailed management of basic encryption units. The initial grid code generated by the code mapping improves the security and concealment of the data. Redundancy analysis eliminates predictable patterns and ensures the complexity and security of the encrypted grid code matrix. The construction of a distributed mapping network enhances the system's anti-attack capability and resource utilization efficiency. The screening of feature vectors and density clustering processing provide a scientific basis for identity recognition and management. The derivative processing of identity virtual identifiers ensures the security and privacy protection of user identities. The construction of virtual mapping relationships provides an efficient mapping mechanism for identity management. The virtual identity index generated by association binding realizes the close combination of identity and encryption units, which overall improves the system's protection capability and management efficiency for sensitive data and builds a more comprehensive security protection system.

[0012] Preferably, step S25 comprises the following steps: Step S251: performing feature spectrum decomposition on the identity feature cluster, and performing nonlinear projection on the feature spectrum to generate projection label data; Step S252: performing modal separation and reconstruction on the projection mark data to obtain modal component data; evolving an identifier seed sequence according to the modal component data; Step S253: performing derivation rule expansion on the identifier seed sequence to generate an identity virtual identifier; Step S254: weaving the identity virtual identifier into a topological structure, and constructing a bidirectional link based on the topological structure to obtain a link combination; Step S255: mapping and integrating the identity feature clusters according to the link combination to obtain a virtual mapping relationship.

[0013] The present invention improves the data processing accuracy through the characteristic spectrum decomposition of identity feature clusters, increases the richness of data expression through the projection label data generated by nonlinear projection, effectively extracts the modal component data through modal separation reconstruction, ensures the diversity and adaptability of the data, and the generation of evolutionary identifier seed sequences provides a solid foundation for identity virtual identifiers. The derivative rule expansion enriches the diversity and security of identifiers, the weaving of topological structures enhances the complexity of identity virtual identifiers and provides support for subsequent security policies. The bidirectional link construction realizes efficient association between identifiers, and the mapping and integration processing of identity feature clusters by link combination improves the efficiency and accuracy of identity management. The establishment of virtual mapping relationships provides a flexible identity management mechanism for the system, which overall improves the system's protection capabilities for sensitive data and the security of identity management, and builds a more complete security protection system.

[0014] Preferably, the simulating a false retrieval channel according to the virtual identity index and the basic encryption unit in step S3 includes: Construct multiple access interfaces based on the virtual identity index to obtain the initial retrieval channel; The initial search channel is obfuscated and inserted based on the preset pseudo data nodes to generate an obfuscated search path; The basic encryption unit is embedded into the obfuscated retrieval path to generate a fake retrieval channel.

[0015] The present invention improves the access flexibility and security of the system by constructing multiple access interfaces. The generation of the initial retrieval channel provides a basic framework for data access. The random generation of pseudo data nodes increases the complexity of data access and effectively confuses potential attackers. Obfuscation insertion interferes with the initial retrieval channel, thereby enhancing the confidentiality and security of data access. The basic encryption unit is embedded in the obfuscated retrieval path, and the false retrieval channel formed makes the system appear more secure to the outside world, prevents the leakage of sensitive information, improves the overall data protection capability and anti-attack capability, and constructs a more secure access mechanism.

[0016] Preferably, the step S3 of inducing illegal attacks on computer access data based on a false retrieval channel includes: The computer access data is analyzed in time series to obtain access pattern features, where the time window is set to 10-500ms, the sampling frequency range is 100-1000Hz, the feature extraction dimension is 3-12 dimensions, and the analysis depth is controlled at 2-7 layers; Interactively map access pattern features and false retrieval channels to identify attack vectors; Enumerate the vulnerabilities of the identified attack vector to obtain attack vulnerabilities, wherein the number of enumerated vulnerabilities ranges from 1 to 10; Connect all attack vulnerabilities to generate an inducement path; Conduct attack access induction simulation based on the induction path, and track visitors to obtain visitor behavior data; Perform multi-level feature clustering on visitor behavior data to generate attacker profile data; Integrate attacker profile data and visitor behavior data to obtain visitor behavior patterns.

[0017] The present invention improves the understanding of access patterns by processing computer access data through time series analysis, and recognizes access pattern features to enhance the system's ability to distinguish between normal and abnormal behaviors. Interactive mapping combines access pattern features with false retrieval channels to provide a basis for identifying attack vectors. Vulnerability enumeration reveals potential security vulnerabilities in the system, effectively guides subsequent defense measures, and connects the induced paths generated by all attack vulnerabilities to form a controllable attack simulation environment. Attack access induced simulation is combined with visitor tracking to provide real-time monitoring of attacker behavior. The collection of visitor behavior data provides data support for the adjustment of security policies. Attacker portrait data generated by multi-level feature clustering improves the recognition accuracy of attacker features. Data integration provides a comprehensive perspective for the generation of visitor behavior patterns, which overall improves the system's response and protection capabilities to potential security threats and builds a more complete security defense mechanism.

[0018] Preferably, the step S4 of using the visitor behavior pattern and the false search channel to deduce the internal threat of the computer includes: Decompose the visitor's behavior pattern to obtain behavior characteristics; Predict attack intention based on behavioral features and obtain attack intention matrix; Reconstruct the intrusion path based on the false retrieval channel and generate the intrusion penetration vector; Perform cross-prediction modeling on the attack intention matrix and intrusion penetration vector to generate a threat prediction model; Use the threat prediction model to perform time series projection to obtain the potential threat timeline; Determine the risk level of the potential threat timeline based on the preset system resources and generate the resource risk level; Calculate critical thresholds for potential threat timelines based on resource risk levels; Perform risk self-checks on visitor behavior patterns based on critical thresholds and resource risk levels to generate computer internal threats.

[0019] The present invention enhances the in-depth understanding of user behavior through the behavioral feature decomposition of visitor behavior patterns. The attack intention matrix generated by attack intention prediction provides a quantitative basis for the system to identify potential threats. The intrusion path reconstruction enhances the visual analysis of the attack path through the false retrieval channel. The generated intrusion penetration vector provides an important reference for security protection. The cross-prediction modeling combines the attack intention matrix and the intrusion penetration vector to form a more accurate threat prediction model. The use of time series projection makes the time distribution of potential threats clearly visible. The risk level determination provides a quantitative assessment of the security status of system resources. The calculation of critical thresholds ensures the scientificity and effectiveness of resource risk management. The risk self-checking mechanism realizes the dynamic monitoring of visitor behavior patterns. The generated computer internal threats provide timely security alarms for the system, which improves the system's overall recognition and response capabilities to internal threats and builds a more comprehensive security protection system.

[0020] Preferably, the step S4 of using the internal threat of the computer to progressively encrypt and harden the basic encryption unit includes: Extract threat features of threat data inside the computer to obtain threat feature fingerprints; Structural layering of basic encryption units to generate encryption unit levels; According to the threat feature fingerprint, the encryption unit level is hierarchically mapped to obtain the vulnerabilities of each level of the encryption unit; Conduct source tracing analysis on vulnerabilities at all levels of the encryption unit to identify the source of the vulnerability; Based on the source of the vulnerability, the basic encryption unit is mapped for node reinforcement to generate an enhanced encryption unit.

[0021] The present invention provides accurate identification of internal threats through the extraction of threat feature fingerprints. The encryption unit levels generated by structural layering improve the manageability and flexibility of the system. The layered vulnerability mapping provides a visual analysis of security defects at each level. The tracing analysis of the source of the vulnerability reveals the root cause of the security vulnerability. The node reinforcement mapping specifically enhances the protection capability of the basic encryption unit. The generated enhanced encryption unit achieves effective defense against potential threats, which improves the security and stability of the system as a whole, builds a more stringent security protection mechanism, ensures the safe storage and transmission of data, and enhances the protection capability of sensitive information.

[0022] The present invention also provides a computer software security encryption management system, which is used to execute the computer software security encryption management method as described above, and the computer software security encryption management system comprises: A data extraction module is used to obtain computer software data; extract private files from computer software data; and perform interlaced and stacked transformations on private files to obtain basic encryption units; The encryption mapping module is used to perform grid code mapping on the basic encryption unit to obtain an encrypted grid code matrix; perform distributed mapping based on the encrypted grid code matrix to generate a virtual identity index; A search simulation module is used to monitor computer access data; simulate false search channels based on virtual identity indexes and basic encryption units; conduct illegal attacks on computer access data based on false search channels, and record visitor behavior patterns; The threat analysis module is used to deduce internal threats to the computer using visitor behavior patterns and false search channels; and to use internal threats to the computer to progressively encrypt and solidify the basic encryption units.

[0023] The present invention ensures timely extraction and secure transformation of privacy files by efficiently acquiring and processing computer software data, thereby enhancing the generation efficiency of basic encryption units. The encryption mapping module realizes complex grid coding of basic encryption units, thereby improving the security and flexibility of encryption. The virtual identity index generated by distributed mapping provides efficient support for system identity management. The retrieval simulation module effectively monitors computer access data, timely identifies potential security threats, and enhances the ability to respond to attack methods by inducing illegal attack record behavior patterns. The threat analysis module timely derives potential internal threats by deeply analyzing visitor behavior patterns. The progressive encryption curing measures further improve the security protection level of data. The overall system constructs a multi-level security management system, thereby improving the security and anti-attack capabilities of computer software in complex environments, and ensuring the integrity and confidentiality of sensitive data. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 A flowchart of a computer software security encryption management method; Figure 2 Detailed implementation flow chart of step S2; The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0025] The technical method of the present invention is described clearly and completely below in conjunction with the accompanying drawings. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by technicians in this field without creative work are within the scope of protection of the present invention.

[0026] In addition, the accompanying drawings are only schematic illustrations of the present invention and are not necessarily drawn to scale. The same reference numerals in the figures represent the same or similar parts, and their repeated description will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities and do not necessarily correspond to physically or logically independent entities. The functional entities can be implemented in software form, or implemented in one or more hardware modules or integrated circuits, or implemented in different grids and / or processor methods and / or microcontroller methods.

[0027] It should be understood that, although the terms "first", "second", etc. may be used herein to describe various units, these units should not be limited by these terms. These terms are used only to distinguish one unit from another unit. For example, without departing from the scope of the exemplary embodiments, the first unit may be referred to as the second unit, and similarly the second unit may be referred to as the first unit. The term "and / or" used herein includes any and all combinations of one or more of the listed associated items.

[0028] To achieve this, please refer to Figure 1 to Figure 2 , a computer software security encryption management method, comprising the following steps: Step S1: obtaining computer software data; extracting private files from the computer software data; performing interlaced layer transformation on the private files to obtain basic encryption units; Step S2: Performing grid coding mapping on the basic encryption unit to obtain an encrypted grid coding matrix; performing distributed mapping based on the encrypted grid coding matrix to generate a virtual identity index; Step S3: monitor computer access data; simulate a false retrieval channel based on the virtual identity index and the basic encryption unit; induce illegal attacks on computer access data based on the false retrieval channel, and record visitor behavior patterns; Step S4: deriving computer internal threats using visitor behavior patterns and false search channels; and using computer internal threats to progressively encrypt and solidify basic encryption units.

[0029] The present invention obtains computer software data and extracts privacy files, generates basic encryption units through staggered stacking transformation, improves the security and protection of privacy files, generates grid code mapping and encrypted grid code matrix, enhances the encryption complexity and security of data, applies distributed mapping technology, improves the generation efficiency and accuracy of virtual identity index, simulates false retrieval channels and monitors computer access data, effectively identifies potential security threats and records visitor behavior patterns, derives internal threats using behavior patterns, and enhances the ability to predict potential attacks. The implementation of progressive encryption solidification on basic encryption units further improves data security and protection levels. The overall method constructs a flexible and efficient computer software security encryption management system, which can effectively respond to various network attacks and data leakage risks, ensure the security and integrity of information, improve the security protection capabilities of computer systems and the privacy protection level of user data, form a comprehensive security management mechanism, and enhance the adaptability to complex network environments.

[0030] In an embodiment of the present invention, the computer software security encryption management method comprises the following steps: Step S1: obtaining computer software data; extracting private files from the computer software data; performing interlaced layer transformation on the private files to obtain basic encryption units; In this embodiment, the storage data in the computer system is obtained, the data is parsed according to the file directory structure, all file data streams in binary format are extracted, the file data streams are marked, the privacy files are identified according to the data header information and the file extension, the privacy files are divided into data blocks, each file is divided into a number of data blocks of equal size, each data block is hierarchically indexed according to a fixed length, an index mapping table is established, the data blocks are interleaved according to the index mapping table so that adjacent data blocks belong to different index layers, all index layer data streams are reordered according to specified rules, a data stacking transformation method based on circular shift is used, the data blocks are alternately mapped according to the hierarchical relationship to form an interleaved data cluster, a hash function is used to calculate the unique identification code of the data cluster, the calculation result is used as a data check code and stored in the index mapping table, the data cluster is normalized, and finally a basic encryption unit is formed.

[0031] Step S2: Performing grid coding mapping on the basic encryption unit to obtain an encrypted grid coding matrix; performing distributed mapping based on the encrypted grid coding matrix to generate a virtual identity index; In this embodiment, the basic encryption unit is spatially mapped, and an orthogonal grid segmentation method is used to map the data cluster to a two-dimensional grid structure. Each data block corresponds to a grid unit. According to the position of the data block in the index mapping table, its coordinate position in the grid is determined, and the grid unit data is encrypted. A hierarchical perturbation method is used to perturb and encrypt the grid unit data. Each grid unit is assigned an independent random perturbation parameter, and the encrypted grid data is used to generate an encrypted grid coding matrix. The encrypted grid coding matrix is ​​distributedly mapped, and a multi-dimensional identity mapping method is used to map the matrix unit to an identity index. Each index unit is formed by a combination of multiple encryption units, and an identity index table is established to generate a virtual identity index.

[0032] Step S3: monitor computer access data; simulate a false retrieval channel based on the virtual identity index and the basic encryption unit; induce illegal attacks on computer access data based on the false retrieval channel, and record visitor behavior patterns; In this embodiment, an access retrieval model is constructed using a virtual identity index, and a false retrieval channel is established in a computer system. The false retrieval channel uses a dynamic mapping method to distinguish legal access from illegal access. An access identification technology based on a behavior pattern is used to classify and process access requests, map normal access requests to real data paths, and guide suspicious access requests to a false data area. Disguised data is deployed in the false retrieval channel. The disguised data uses data obfuscation technology to randomly replace data content to ensure that its structure is consistent with the real data but the content is invalid. The access behavior of the false retrieval channel is monitored, the behavior pattern of the visitor is recorded, and the access trajectory data generated by the visitor during the data access process is extracted. An access trajectory model is established, and a pattern matching algorithm is used to analyze the access trajectory to determine whether the visitor has abnormal behavior, and generate visitor behavior pattern data for the visitor with abnormal behavior.

[0033] Step S4: deriving computer internal threats using visitor behavior patterns and false search channels; and using computer internal threats to progressively encrypt and solidify basic encryption units.

[0034] In this embodiment, a threat assessment is performed on the visitor behavior pattern, an analysis method based on probabilistic reasoning is adopted, a hierarchical analysis is performed on the visitor's access trajectory data, the abnormal probability of the visitor's behavior is calculated, and the access behavior with an abnormal probability higher than a set threshold is marked as an internal computer threat. According to the internal computer threat data, the basic encryption unit is progressively encrypted and solidified, and a dynamic key updating technology is adopted to generate an adaptive key based on the access trajectory model, and the key of the data in the basic encryption unit is replaced. The encrypted data is stored in an independent secure storage area, and access rights are set for the secure storage area. Unauthorized access requests will be automatically blocked, and all access requests are monitored in real time to ensure the data security of the computer system.

[0035] Preferably, step S1 comprises the following steps: Step S11: Acquire computer software data; filter files containing personal information in the computer software data; Step S12: marking the privacy files in the computer software data according to the personal information files; Step S13: performing substitution conversion on the privacy file to generate a file substitution structure; performing convolution diffusion processing on the privacy file based on the file substitution structure to obtain diffusion ripple data; Step S14: performing reverse track connection on the diffusion ripple data to generate track mark data; topologically flipping and reorganizing the track mark data to generate topological variant data; Step S15: Perform multi-dimensional interleaving integration on the topological variant data to obtain a basic encryption unit.

[0036] In this embodiment, all file data are extracted from a computer storage device, the file data is parsed at the directory level, a file index table is established, the binary data streams of all files are processed in blocks according to the file index table, each file is split according to a fixed data block size, each data block is calculated with a unique identification code by a hash algorithm, the identification code is stored in the index table, a string matching algorithm is used to perform semantic analysis on the file content, a keyword feature extraction method is used to perform feature matching on data segments containing personal information in the data block, a feature word library is constructed, the data block containing personal information is identified by word library comparison, the matched data block is labeled, a personal information file list is generated, and files containing personal information are screened in the file index table according to the personal information file list, the files are classified by permissions, a privacy file classification table is established according to the file type and access permission, a feature vector extraction method is used to perform feature encoding on the file content, the feature code is stored in the index table, a secondary screening is performed according to the feature code, duplicate data is eliminated, and finally a privacy file list is formed, the file path of the privacy file is encrypted, and path obfuscation is used to encrypt the file path of the privacy file. The method uses a nonlinear transformation to partition the data stream into layers, re-encode the data blocks according to the binary coding mode, generate a file substitution structure, and randomly hash the data blocks in the file substitution structure to make the data blocks with the same content different in storage structure, thus ensuring the structural change of the data content. The data integrity is verified by calculating the hash check code of the file substitution structure, and the replaced data structure is stored. The privacy file is subjected to convolution diffusion processing based on the file substitution structure, and an adaptive convolution kernel is used to perform the convolution diffusion processing on the privacy file. kernel) method, performs local convolution calculation on the data stream, each data block is used as the input of the convolution operation, and the convolution kernel parameters are calculated according to the characteristics of the data block by dynamic weight adjustment. The data block is convolution transformed, and after the convolution operation, a nonlinear diffusion operation is performed. The diffusion mapping method is used for the convolution output data to perform multi-dimensional diffusion on the data stream, so that the correlation between data blocks is reduced.Diffusion ripple data is generated through diffusion operation, and the interleaved storage method is used to perform reverse trajectory connection on the diffusion ripple data. The path backtracking method is used to perform backtracking analysis on the displacement trajectory of the data block during the storage process. The storage trajectory path of the data block is calculated based on the data storage index record, and the storage path of the data block is trajectory mapped to generate trajectory mark data. The trajectory association analysis method is used to analyze the association of the data block during the storage process, and the storage conversion relationship between the data blocks is extracted. The trajectory mark data is topologically flipped and reorganized. The graph structure mapping method is used to convert the trajectory data into a graph structure, and the topological connection relationship between the data blocks is constructed. The topology inversion algorithm is used to perform topological transformation on the graph structure, and the connection method of the data blocks is adjusted to change the logical relationship between the data blocks. The topology variant data is generated, and the topology variant data is multi-dimensionally interleaved and integrated. The high-dimensional data projection method is used to convert the dimension of the topology variant data, and the data blocks are projected into a multi-dimensional space. Interleaved coding (interleaved coding) is used to generate the topological variant data. The encoding method is used to interleave the arrangement order of data blocks in different dimensions to ensure that the logical relationship between adjacent data blocks is no longer linear. The vector decomposition method is used to decompose the feature vector of the data block to change the representation of the data block in different dimensions. The interleaved integrated data blocks are normalized, and the data entropy calculation method is used to evaluate the uniformity of data distribution. The storage order of data blocks is adjusted to make the data distribution more uniform, and finally the basic encryption unit is formed.

[0037] Preferably, step S14 comprises the following steps: Step S141: performing pulse sampling mapping on the diffusion ripple data to generate ripple pulse data; performing time sequence reverse reconstruction on the ripple pulse data to obtain a reverse time series; Step S142: performing trajectory point cloud mapping on the reverse time series to obtain trajectory space data; fusing geometric features of the trajectory space data to generate fused feature data; Step S143: performing path gradient rendering on the fused feature data to generate trajectory marking data; Step S144: performing topological feature deconstruction on the trajectory mark data to obtain topological primitive data; symmetry flipping the topological primitive data to generate a flipping matrix; Step S145: Perform structural reorganization mapping based on the flip matrix to obtain topological variant data.

[0038] In this embodiment, pulse sampling mapping is performed on the diffuse ripple data. A discrete pulse sampling method is used to trigger the diffuse ripple data with a fixed sampling interval. The sampling interval is adaptively adjusted according to the data fluctuation amplitude to ensure that the main features of the data are completely captured. The sampled pulse data is amplitude normalized. A standardized transformation method is used to map the pulse amplitude to a uniform numerical range to generate ripple pulse data. Based on the ripple pulse data, a time-reversed reconstruction method is used to reversely arrange the pulse data according to the time dimension to generate a reverse time series. The reverse time series is smoothed. A window filtering method is used to remove high-frequency noise in the time series. Trajectory point cloud mapping is performed on the reverse time series. A trajectory point sampling method is used to select key points from the reverse time series according to the time dimension to construct a point cloud data set. A Gaussian distribution fitting method is used to fit the Gaussian distribution. The point cloud data is spatially mapped by a fitting method, and the time series is converted into three-dimensional trajectory data to generate trajectory space data. Based on the trajectory space data, the geometric feature fusion method is used to extract geometric features such as curvature, tangent direction and point cloud density in the trajectory data, and the geometric features are vectorized. The feature vector concatenation method is used to merge data of different feature dimensions into a unified feature description to generate fused feature data. The fused feature data is rendered with path gradients. A rendering method based on gradient computation is used to perform gradient derivatives on the point cloud trajectory of the fused feature data, and the local gradient change rate of each trajectory point is calculated. The gradient data is normalized, and the values ​​of different gradient areas are mapped to a fixed range. The color-coded rendering method is used to assign different color labels to different gradient areas to generate trajectory labeling data. Based on the trajectory labeling data, the topological feature deconstruction method is used. decomposition method, calculate the topological structure of the trajectory point cloud, extract the connection relationship between the point clouds, represent the connection relationship in a matrix, convert the topological structure of the trajectory points into topological primitive data, perform symmetry flipping on the topological primitive data, and use a flipping method based on symmetry mapping.The connection relationship matrix in the topological primitive data is swapped in rows and columns to make the left and right relationship of the original topological structure change symmetrically, and a flip matrix is ​​generated. Based on the flip matrix, the structural reorganization mapping method is used to reorganize the flipped topological structure. The principal component analysis (PCA) method is used to extract the main structural features of the flip matrix. The matrix is ​​classified and aggregated according to the principal component features to generate topological variant data.

[0039] Preferably, step S2 comprises the following steps: Step S21: Perform high-dimensional grid mapping on the basic encryption unit to obtain an initial grid structure; construct a multi-level grid node system based on the initial grid structure; Step S22: spatially dividing the basic encryption unit based on the multi-level grid node system, wherein the level depth range of the grid node is set to 3-5 layers, the number of nodes in each layer ranges from 10-50, the first layer contains 10 to 20 nodes, the second layer contains 15 to 30 nodes, the third layer contains 20 to 50 nodes, the fourth layer contains 25 to 60 nodes, and the fifth layer contains 30 to 70 nodes; performing code mapping on the divided basic encryption unit to generate an initial grid code; Step S23: performing redundancy analysis on the initial grid code and eliminating predictable patterns in the code to obtain an encrypted grid code matrix; Step S24: constructing a distributed mapping network based on the encrypted grid coding matrix; screening feature vectors of the distributed mapping network; performing density clustering on the feature vectors to obtain identity feature clusters; Step S25: performing corresponding virtual identifier derivation processing on each identity feature cluster to generate an identity virtual identifier; constructing a virtual mapping relationship for the identity feature cluster based on the identity virtual identifier to obtain a virtual mapping relationship; Step S26: associate and bind the virtual mapping relationship and the basic encryption unit to generate a virtual identity index.

[0040] In this embodiment, a high-dimensional grid mapping is performed on the basic encryption unit, and a multi-dimensional layered grid method is used to divide the bit sequence of the basic encryption unit into multiple sub-blocks according to data characteristics. Each sub-block corresponds to a grid node, and a high-dimensional grid structure is constructed. The connection relationship between grid nodes is represented by an adjacency matrix. The grid resolution is adjusted according to the data distribution characteristics, and the grid nodes are hierarchically indexed. According to the hierarchical structure of the data, the grid layers are divided into grid layers of different levels. The number of nodes in each grid layer is related to the data complexity of the encryption unit. The data space is gradually refined by an adaptive recursive partitioning method to form a multi-level grid node system. The basic encryption unit is spatially divided based on the multi-level grid node system, and spatial recursive partitioning is used. The segmentation method is used to determine the number of levels of space division according to the distribution density of grid nodes. The depth range of the grid nodes is set to 3-5 layers, and the number of nodes in each layer is 10-50. The first layer: 10 to 20 nodes, the second layer: 15 to 30 nodes, the third layer: 20 to 50 nodes, the fourth layer: 25 to 60 nodes, and the fifth layer: 30 to 70 nodes. The KD tree (k-dimensional tree) structure is used to store the data after space division to ensure that the hierarchical structure of the data is traceable. The basic encryption units after division are encoded and mapped. The hierarchical encoding method is used to assign unique codes to grid nodes at different levels. The initial grid code is composed of multiple sub-coding units, each of which corresponds to a data block in the grid. The hash mapping method is used to map the original data to the encoding space. The redundancy analysis of the initial grid code is performed. The information entropy calculation method is used. The entropy of the coding sequence is calculated by using the calculation method. The predictable patterns in the coding are identified according to the entropy distribution. The sliding window statistics method is used to extract the repeated subsequences in the coding. The high-frequency patterns are marked by the pattern recognition algorithm, and the pattern elimination process is performed. The minimum redundancy maximum relevance method is used to optimize the coding features and eliminate the redundant information in the coding. The encrypted grid coding matrix is ​​generated. Each element in the coding matrix corresponds to a data block in the grid. A distributed mapping network is constructed based on the encrypted grid coding matrix.The graph structure construction method is adopted to construct the topology of encrypted data according to the adjacency relationship of the encoding matrix. The feature vector selection method is adopted to extract high-dimensional features from the feature matrix of the topology. The principal component analysis method is adopted to reduce the dimension and retain the main information. The density-based clustering method is used to cluster the feature vectors and calculate the cluster center points. The data points with similar features are classified into the same cluster to obtain the identity feature clusters. The data points in the identity feature clusters share similar encryption features. The corresponding virtual identifier is derived for each identity feature cluster. The hash chain method is adopted to generate a unique identifier according to the feature vector of the identity feature cluster. The cryptographic hash function is used to calculate the hash value of the identifier to ensure the uniqueness and irreversibility of the identifier. The virtual mapping relationship of the identity feature cluster is constructed based on the identity virtual identifier. The bidirectional mapping table is used to record the corresponding relationship between the identity feature cluster and the virtual identifier. The virtual mapping relationship and the basic encryption unit are associated and bound to generate a virtual identity index. The Merkle tree is used to generate a virtual identity index. The index construction method of the identity tree is based on the hash pointer, which is used to store the hash value of the identity index node to ensure the integrity of the index structure. Each identity index node contains the encrypted hash value of the basic encryption unit and the corresponding virtual identifier. The dynamic index update method is used to incrementally update the index when the identity feature cluster changes to avoid index data redundancy.

[0041] Preferably, step S25 comprises the following steps: Step S251: performing feature spectrum decomposition on the identity feature cluster, and performing nonlinear projection on the feature spectrum to generate projection label data; Step S252: performing modal separation and reconstruction on the projection mark data to obtain modal component data; evolving an identifier seed sequence according to the modal component data; Step S253: performing derivation rule expansion on the identifier seed sequence to generate an identity virtual identifier; Step S254: weaving the identity virtual identifier into a topological structure, and constructing a bidirectional link based on the topological structure to obtain a link combination; Step S255: mapping and integrating the identity feature clusters according to the link combination to obtain a virtual mapping relationship.

[0042] In this embodiment, the characteristic spectrum of the identity feature cluster is decomposed, and a singular value decomposition method is used to decompose the characteristic matrix of the identity feature cluster into an eigenvector matrix, an eigenvalue matrix and an orthogonal basis matrix, and the first k main components of the eigenvalue matrix are extracted to remove noise features to ensure the stability of the characteristic spectrum. A nonlinear projection method is used to perform low-dimensional mapping on the characteristic spectrum, and a locality preserving projection method based on manifold learning is selected to reduce the data dimension while maintaining the local geometric structure. The local adjacency relationship of the projection data is calculated, and the projection coordinates are adjusted so that similar feature points are kept closely distributed in the low-dimensional space. Projection label data is generated, and the projection label data includes spatial coordinate information and adjacency indexes of the feature points. The projection label data is modally separated and reconstructed, and an empirical mode decomposition method is used to decompose the projection label data into multiple intrinsic mode functions according to the intrinsic scale decomposition method of the data. The Hilbert transform is used to extract the projection label data. transform) to calculate the instantaneous frequency of the modal component, remove the low-frequency trend term, improve the time-varying feature resolution of the data, reassemble the decomposed modal components, perform hierarchical aggregation according to the statistical correlation between the modal components, obtain the modal component data, use the random walk model to perform evolution analysis on the modal component data, calculate the state transition probability between data points, use the Markov chain to generate a stable identifier seed sequence, expand the derivation rules of the identifier seed sequence, use the hash chain method to perform hash calculation on the seed sequence, generate multiple hash derivative values, select the HMAC-SHA256 algorithm based on the message authentication code to enhance the anti-collision ability of the derived identifier, use the sequential pattern mining method to analyze the time dependency of the identifier seed sequence, dynamically adjust the derivation rules according to the temporal pattern between the data, use the finite state automaton to build a rule matching model, weave the topological structure of the identity virtual identifier, and use the Delaunay triangulation method to extract the derivation rules. triangulation) method, calculate the convex hull of the identifier point set, and build the optimal connection network.The adjacency relationship of identifiers is calculated based on the Voronoi diagram to ensure the uniform spatial distribution of the topological structure. The minimum spanning tree method is used to filter out redundant connections and reduce network complexity. Bidirectional links are constructed based on the topological structure. A doubly linked list is used to store the mapping relationship between identifiers. Each identifier node contains a forward pointer and a backward pointer to ensure the efficiency of data traversal. The skip list is combined to optimize the index mechanism to improve the query efficiency of large-scale data. Link combinations are generated, and identity feature clusters are mapped and integrated according to the link combinations. The graph neural network method is used to calculate the embedding vector of the identifier node. The normalization method is used to adjust the scale of the feature space to ensure the numerical stability of the feature data. The dynamic time warping method is used to calculate the time series similarity between different identity feature clusters. The feature mapping table is constructed according to the similarity threshold. The density peak clustering method is used to identify the core points of the identity feature cluster. The cluster boundaries are adjusted according to the kernel density function to generate virtual mapping relationships.

[0043] Preferably, the simulating a false retrieval channel according to the virtual identity index and the basic encryption unit in step S3 includes: Construct multiple access interfaces based on the virtual identity index to obtain the initial retrieval channel; The initial search channel is obfuscated and inserted based on the preset pseudo data nodes to generate an obfuscated search path; The basic encryption unit is embedded into the obfuscated retrieval path to generate a fake retrieval channel.

[0044] In this embodiment, multiple access interfaces are constructed according to virtual identity indexes, and different access permission parameters are configured for each virtual identity index based on an access control list (ACL). The access permission parameters include access level, access time window and access key. Different key generation strategies are set for virtual identity indexes with different permission levels. An attribute-based encryption (ABE) method is adopted to map the access permission parameters to encryption key control strategies. A hierarchical Merkle hash tree is used to construct an access interface verification mechanism. Each access interface corresponds to a unique hash root value. The integrity of the access interface is ensured by a hash chain-based verification method. An initial retrieval channel is generated. The initial retrieval channel includes multiple independent access entries, each entry corresponds to a different identity index permission. A pseudo-random number generator (PRNG) is used to generate random data blocks. The size of each pseudo-data block varies randomly within a range of 128 bytes to 1 kilobyte. A SHA-3 hash algorithm is used to perform hash calculation on the pseudo-data block to generate a unique hash summary value. A Bloom filter is used to generate a unique hash summary value. The fast duplication check mechanism of the filter ensures that the generated pseudo data nodes are similar in structure to the real data nodes, but the content is completely unrelated. Each pseudo data node is stored in a distributed hash table (distributed hash table,The unique identifier of each pseudo data node is encoded in Base58 format to reduce storage overhead and improve indexing efficiency. The random walk model is used to calculate the insertion position of the pseudo data node. The random walk step length is set in the range of 3 to 7 steps to ensure that the inserted pseudo data nodes are nonlinearly distributed in the access path. The access hotspot area of ​​the initial retrieval channel is calculated using an unsupervised learning method. The density-based clustering method is used to identify the frequently accessed retrieval path. More pseudo data nodes are inserted into the frequently accessed path. The pseudo data node is inserted in a doubly linked list structure. The forward pointer and the backward pointer are updated during insertion to ensure that the insertion process does not affect the access integrity of the real data node. An obfuscated retrieval path is generated. The pseudo data nodes in the obfuscated retrieval path are dynamically updated according to the timestamp to prevent the long-term fixed pseudo data node pattern from being speculated. The basic encryption unit is embedded in the obfuscated retrieval path to generate a false retrieval channel. The basic encryption unit adopts AES-256 (Advanced Encryption Standards). Standard-256) encryption method, each encryption unit is stored in an independent data block, the data block size is set to 256 bytes, the storage structure of the basic encryption unit adopts the forward-secure hash chain method to ensure that the stored encrypted data block is irreversible. In the obfuscated retrieval path, the hash index mapping method is adopted to cross-map the storage address of the basic encryption unit with the storage address of the pseudo data node. Each mapping node adopts a double hash indexing mechanism to ensure that when different virtual identity indexes access the same obfuscated retrieval path, the retrieved retrieval results have different logical arrangements in structure to improve the obfuscation of the false retrieval channel. The access strategy of the false retrieval channel dynamically adjusts the access path based on the cardinality hashing method to ensure that the return result of each retrieval request contains a combination of a random number of pseudo data nodes and real data nodes. ,

[0045] Preferably, the step S3 of inducing illegal attacks on computer access data based on a false retrieval channel includes: The computer access data is analyzed in time series to obtain access pattern features, where the time window is set to 10-500ms, the sampling frequency range is 100-1000Hz, the feature extraction dimension is 3-12 dimensions, and the analysis depth is controlled at 2-7 layers; Interactively map access pattern features and false retrieval channels to identify attack vectors; Enumerate the vulnerabilities of the identified attack vector to obtain attack vulnerabilities, wherein the number of enumerated vulnerabilities ranges from 1 to 10; Connect all attack vulnerabilities to generate an inducement path; Conduct attack access induction simulation based on the induction path, and track visitors to obtain visitor behavior data; Perform multi-level feature clustering on visitor behavior data to generate attacker profile data; Integrate attacker profile data and visitor behavior data to obtain visitor behavior patterns.

[0046] In this embodiment, the computer access data is serialized and stored with timestamp as index, each timestamp corresponds to an access event, and the access event includes information such as access IP, request URL, access device type, access data packet size, etc. The sliding window technology is used to construct a continuous time window, where the time window is set to 10-500ms, the sampling frequency range is 100-1000Hz, the feature extraction dimension is 3-12 dimensions, and the analysis depth is controlled at 2-7 layers. The access event data in each window is subjected to feature extraction, and the extracted features include access frequency, request path distribution, data packet size change rate, access device fingerprint change, etc. The long short-term memory network (LSTM) is used. The access pattern in the continuous time window is modeled and the Euclidean distance of the access pattern in each window is calculated. The patterns with similarity greater than 0.8 are clustered to form an access pattern feature library. The access pattern standardization vector is constructed based on historical data. The cosine similarity between the current access pattern and the historical pattern is calculated. The patterns with similarity less than 0.6 are marked as abnormal access patterns and stored in the access pattern feature library. The threshold is set. When the number of abnormal patterns exceeds 10%, the abnormal access detection alarm is triggered. Based on the access pattern feature library, the access pattern is indexed by the hash mapping method to establish an access pattern feature hash table. Each hash value corresponds to an access pattern feature. The neural network model based on the attention mechanism is used to calculate the interaction relationship between each access pattern and the false retrieval channel. The false retrieval channel is composed of a data stream with obfuscated insertion. Each false data node contains multiple obfuscated data blocks. Each obfuscated data block contains randomly generated request parameters, forged HTTP request header information and false response data. The access pattern features are compared with the data stream features of the false retrieval channel, and the interaction mapping score is calculated. The score is higher than 0.75 patterns are marked as potential attack vectors, and the potential attack vectors are stored in the attack vector list. The number of vectors in the attack vector list is controlled between 5 and 20. The attack vectors in the attack vector list are deeply traversed, and the attack vulnerability enumeration method based on the ontology model is used to extract key features from the attack vectors, including access IP segments, common attack parameters, malicious payload features, etc., to establish an attack vulnerability knowledge base. Each vulnerability corresponds to at least one attack vector. The association between attack vectors is analyzed based on association rule mining, and attack feature combinations with high association are extracted. Each combination is hierarchically matched. The successfully matched combination is marked as an attack vulnerability and stored in the vulnerability list. The number of vulnerabilities in the vulnerability list is controlled between 1 and 10. All vulnerabilities in the vulnerability list are topologically sorted, and the dependency relationship between each vulnerability is calculated to construct an attack path diagram. Each node in the path diagram represents an attack vulnerability, and each edge represents the dependency relationship between two vulnerabilities. The shortest path algorithm is used to calculate the attack path. The attack path length is controlled between 5 and 15 nodes, and the priority of each node is based on the impact of the vulnerability. The weighted calculation is based on factors such as the scope of impact and the success rate of the attack. The high-priority vulnerabilities appear first at the front end of the path. The attack simulation method based on reinforcement learning is used to simulate the access induction path. The attack simulation agent simulates the attacker's behavior and attempts to attack the attack vulnerabilities in the induction path in sequence. The response time, success rate, server return status code and other information of each attack are recorded. The visitor's access data is stored according to the timestamp to build a visitor behavior database. The database stores the visitor's access IP, device fingerprint, request path, access frequency, data packet size and other information. The multi-layer perceptron (MLP) is used to Perceptron) performs cluster analysis on visitor behavior data. Each visitor behavior pattern corresponds to an attacker portrait, which includes access frequency, attack methods, target system type, etc. The attacker portrait data is integrated with the visitor behavior data, and the classification probability of the visitor behavior pattern is calculated using the Bayesian Classifier to build a visitor behavior pattern knowledge graph. Each visitor behavior pattern corresponds to multiple attacker portraits. The similarity of different attacker portraits is calculated, and portraits with a similarity of more than 0.85 are merged to form a complete visitor behavior pattern. The behavior sequence prediction is performed for each behavior pattern, predicting possible future access behaviors and marking high-risk behavior patterns.

[0047] Preferably, the step S4 of using the visitor behavior pattern and the false search channel to deduce the internal threat of the computer includes: Decompose the visitor's behavior pattern to obtain behavior characteristics; Predict attack intention based on behavioral features and obtain attack intention matrix; Reconstruct the intrusion path based on the false retrieval channel and generate the intrusion penetration vector; Perform cross-prediction modeling on the attack intention matrix and intrusion penetration vector to generate a threat prediction model; Use the threat prediction model to perform time series projection to obtain the potential threat timeline; Determine the risk level of the potential threat timeline based on the preset system resources and generate the resource risk level; Calculate critical thresholds for potential threat timelines based on resource risk levels; Perform risk self-checks on visitor behavior patterns based on critical thresholds and resource risk levels to generate computer internal threats.

[0048] In this embodiment, the behavior characteristics of the visitor behavior pattern are decomposed, and a behavior sequence parsing method based on a hidden Markov model (HMM) is used to decompose the visitor's behavior pattern in chronological order, and a feature vector of each access behavior is extracted. The feature vector includes parameters such as the number of access path jumps, access duration, data interaction frequency, and access data packet size. The characteristics of different visitor behavior patterns are classified, and the Kullback-Leibler divergence method is used to calculate the information gain between different behavior characteristics, and high-impact behavior characteristics are screened out. A behavior feature data set is generated, and attack intentions are predicted for the behavior characteristics. A recurrent neural network (RNN) is used to build an attack intention prediction model, and the behavior feature data set is input. Time series modeling is performed on the behavior features, and the time dependency of different access behaviors is calculated. A bidirectional long short-term memory network (BiLSTM) is used to extract attack intention features. The prediction window size is set to 50 access events, and the similarity between access events is calculated. The attention mechanism (Attention Mechanism) is used to predict the attack intention of the behavior characteristics. The contribution of behavioral features to attack intent is calculated to generate an attack intent matrix. The element values ​​of the attack intent matrix represent the weight of the influence of specific behavioral features on attack intent. The intrusion path is reconstructed based on the false retrieval channel. The path reconstruction algorithm based on depth first search (DFS) is used to extract suspicious access paths from the access log of the false retrieval channel. The jump sequence of the access path is used as input to calculate the similarity between the paths. The Levenshtein edit distance method is used to calculate the change pattern of the access path, and the path with abnormal access pattern is screened out. The abnormal path is traced back. The key nodes of the access path are extracted by a method based on graph traversal. All key nodes are connected to generate an intrusion penetration vector. The intrusion penetration vector is used to describe the penetration path of the attacker. The attack intention matrix and the intrusion penetration vector are cross-predicted and modeled to generate a threat prediction model. The multilayer perceptron (Multilayer Perceptron,The threat prediction network is constructed by using MLP, and the attack intention matrix and intrusion penetration vector are used as input features. The dropout regularization method is used to prevent overfitting. The number of hidden layer nodes is set to 128, and the input features are nonlinearly transformed. The correlation between different attack intentions and penetration paths is calculated. The attack behaviors are classified by the Softmax classification method, and different types of attack behaviors are rated for risk. The threat prediction model is generated. The output of the threat prediction model includes information such as the type of attack, the probability of attack success, and the impact of the attack target. The threat prediction model is used for time series projection to obtain the potential threat timeline. The time series prediction method is used to perform time deduction on the output of the threat prediction model. The autoregressive integrated moving average model (Autoregressive Integrated Moving Average, ARIMA calculates the time trend of attack events, inputs the timestamp data of the past 1,000 attack events, calculates the time point of future attack events, and generates a potential threat timeline. The potential threat timeline uses the timestamp as the horizontal axis and the threat level as the vertical axis to represent the time distribution of future attack behaviors. The risk level of the potential threat timeline is determined according to the preset system resources, and the resource risk level is generated. The risk assessment method based on resource occupancy rate is used to calculate the current system resource usage, including CPU utilization, memory occupancy, disk I / O load, network traffic load and other parameters, and the risk weights of different resource occupancy rates are set. The Analytic Hierarchy Process (AHP) is used to evaluate the risk level of the potential threat timeline.AHP is used to calculate the resource risk level. According to the usage of system resources, the risk level is divided into three levels: low risk, medium risk, and high risk. The resource risk level data set is generated. The critical threshold of the potential threat timeline is calculated based on the resource risk level. The threshold calculation method based on dynamic window is used to input the resource risk level data set. The frequency of attack events under different resource loads is statistically analyzed. Quantile regression is used to calculate the distribution range of attack events. A 95% confidence interval is set to dynamically segment the threat timeline, calculate the critical point of the attack event, and generate critical threshold data. The critical threshold data is used to determine whether the attack behavior exceeds the system's tolerance range. According to the critical threshold and resource risk level, the visitor behavior pattern is self-checked to generate computer internal threats. The XGBoost (Extreme Gaussian Boosting) based method is used to generate the internal threat of the computer. GradientBoosting) risk assessment model, conducts risk analysis on visitor behavior patterns, inputs visitor historical behavior data, attack intent matrix, intrusion penetration vector, resource risk level, potential threat timeline and other data, calculates the risk score of access behavior, sets the risk score threshold, marks the access behavior with risk score exceeding the threshold, and generates computer internal threat data set, which is indexed and stored according to attack source, attack means and attack target.

[0049] Preferably, the step S4 of using the internal threat of the computer to progressively encrypt and harden the basic encryption unit includes: Extract threat features of threat data inside the computer to obtain threat feature fingerprints; Structural layering of basic encryption units to generate encryption unit levels; According to the threat feature fingerprint, the encryption unit level is hierarchically mapped to obtain the vulnerabilities of each level of the encryption unit; Conduct source tracing analysis on vulnerabilities at all levels of the encryption unit to identify the source of the vulnerability; Based on the source of the vulnerability, the basic encryption unit is mapped for node reinforcement to generate an enhanced encryption unit.

[0050] In this embodiment, threat features of computer internal threat data are extracted to obtain threat feature fingerprints. A feature extraction method based on a convolutional neural network (CNN) is used to classify computer internal threat data according to attack paths, attack methods, and attack time series. Different categories of threat data are independently encoded. A sliding window mechanism is used to extract key features of attack behaviors. The window length is set to 128 data points and the step length is set to 8 data points. The data in the window is normalized. A maximum pooling layer is used to extract local features. A ReLU (Rectified Linear Unit) activation function is used to perform nonlinear transformation on the features. The similarity between features is calculated. The cosine similarity is used to calculate the correlation between different threat data. Threat features with high correlation are screened out. The SHA-256 hash algorithm is used to fingerprint the screened threat features to generate threat feature fingerprints. The threat feature fingerprints are used to identify different types of computer internal threat data. The basic encryption units are structurally layered to generate encryption unit hierarchies. A directed acyclic graph (DAG) based DAG is used to generate a SHA-256 hash algorithm.The encryption unit hierarchy construction method based on DAG is proposed. The basic encryption unit is divided into key layer, data layer and access control layer. The key layer contains key data such as symmetric key, asymmetric key and session key. The data layer contains encrypted storage data, transmission data and calculation data. The access control layer contains user permission data, access log data and identity authentication data. The graph traversal algorithm is used to parse the internal association relationship of the encryption unit and calculate the dependency relationship between different encryption units. The PageRank algorithm is used to calculate the importance of the encryption unit. The hierarchical weights are assigned to different encryption units to generate the encryption unit hierarchy structure. The hierarchical vulnerability mapping of the encryption unit hierarchy is carried out according to the threat feature fingerprint to obtain the vulnerability of each level of the encryption unit. The fast matching method based on Bloom Filter is adopted. The threat feature fingerprint is used as the query key value to match in the encryption unit hierarchy structure. The number of hash functions of Bloom filter is set to 4 and the bit array size is set to 1024 bits. The key layer, data layer and access control layer of the encryption unit are matched respectively. The number of encryption units containing threat features in each level is calculated. The TF-IDF (TermFrequency-Inverse Document The impact weight of threat features on encryption units is calculated by the method of frequency analysis, and encryption units whose impact weight exceeds the set threshold are marked to generate vulnerability data at all levels of encryption units. Vulnerabilities at all levels of encryption units are traced and analyzed to obtain the source of the vulnerability. A causal reasoning method based on Bayesian Network is used to construct an encryption unit vulnerability propagation model. The vulnerability data at all levels of encryption units are used as input to calculate the propagation probability between different vulnerabilities. The Markov Chain Monte Carlo (Markov Chain Monte Carlo) is used to analyze the vulnerability propagation model.The vulnerability propagation path is simulated by the MCMC method, the number of iterations is set to 5000, the vulnerability propagation path of each iteration is recorded, the convergence of the vulnerability propagation path is calculated, the probability of the converged vulnerability propagation path is sorted, the top 10% paths with the highest probability are selected as the vulnerability tracing path, the starting vulnerabilities in the tracing path are screened, the source data of the vulnerability is generated, the node reinforcement mapping of the basic encryption unit is performed based on the vulnerability source, and the enhanced encryption unit is generated. The encryption unit reinforcement method based on differential privacy is adopted to enhance the structure of the encryption unit at the source of the vulnerability, the privacy budget parameter ε (epsilon) is set to 0.5, the key layer data is perturbed by Laplace noise, and differential privacy key data is generated. The data layer encryption algorithm is upgraded, the AES-128 algorithm is upgraded to the AES-256 algorithm, the key length is adjusted, the data encryption strength is improved, the two-factor authentication mechanism (Two-Factor Authentication, 2FA) is added to the access control layer, and the time-synchronized one-time password (Time-based One-Time Password, TOTP) is used for user authentication, and encryption performance tests are performed on all the reinforced encryption units. The OpenSSL performance test tool is used to calculate the encrypted data throughput, and the test data packet size is set to 1MB. The encryption speed and decryption speed are measured to verify the encryption strength of the enhanced encryption unit and generate the final enhanced encryption unit data.

[0051] The present invention also provides a computer software security encryption management system, which is used to execute the computer software security encryption management method as described above, and the computer software security encryption management system comprises: A data extraction module is used to obtain computer software data; extract private files from computer software data; and perform interlaced and stacked transformations on private files to obtain basic encryption units; The encryption mapping module is used to perform grid code mapping on the basic encryption unit to obtain an encrypted grid code matrix; perform distributed mapping based on the encrypted grid code matrix to generate a virtual identity index; A search simulation module is used to monitor computer access data; simulate false search channels based on virtual identity indexes and basic encryption units; conduct illegal attacks on computer access data based on false search channels, and record visitor behavior patterns; The threat analysis module is used to deduce internal threats to the computer using visitor behavior patterns and false search channels; and to use internal threats to the computer to progressively encrypt and solidify the basic encryption units.

[0052] The present invention ensures timely extraction and secure transformation of privacy files by efficiently acquiring and processing computer software data, thereby enhancing the generation efficiency of basic encryption units. The encryption mapping module realizes complex grid coding of basic encryption units, thereby improving the security and flexibility of encryption. The virtual identity index generated by distributed mapping provides efficient support for system identity management. The retrieval simulation module effectively monitors computer access data, timely identifies potential security threats, and enhances the ability to respond to attack methods by inducing illegal attack record behavior patterns. The threat analysis module timely derives potential internal threats by deeply analyzing visitor behavior patterns. The progressive encryption curing measures further improve the security protection level of data. The overall system constructs a multi-level security management system, thereby improving the security and anti-attack capabilities of computer software in complex environments, and ensuring the integrity and confidentiality of sensitive data.

[0053] Therefore, the embodiments should be regarded as illustrative and non-restrictive from all points, and the scope of the present invention is limited by the appended claims rather than the above description, and it is therefore intended that all changes falling within the meaning and range of equivalent elements of the application documents are included in the present invention.

[0054] The above description is only a specific embodiment of the present invention, so that those skilled in the art can understand or implement the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but should conform to the widest scope consistent with the principles and novel features invented herein.

Claims

1. A computer software security encryption management method, characterized in that: The following steps are involved: Step S1: obtaining computer software data; extracting private files from the computer software data; performing interlaced layer transformation on the private files to obtain basic encryption units; Step S2: Performing grid coding mapping on the basic encryption unit to obtain an encrypted grid coding matrix; performing distributed mapping based on the encrypted grid coding matrix to generate a virtual identity index; Step S3: monitor computer access data; simulate a false retrieval channel according to the virtual identity index and the basic encryption unit; Conduct illegal attacks on computer access data based on false retrieval channels and record visitor behavior patterns; Step S4: derive computer internal threats using visitor behavior patterns and false search channels; and progressively encrypt and solidify basic encryption units using computer internal threats.

2. The computer software security encryption management method according to claim 1, characterized in that: Step S1 includes the following steps: Step S11: Acquire computer software data; filter files containing personal information in the computer software data; Step S12: marking the privacy files in the computer software data according to the personal information files; Step S13: performing substitution conversion on the privacy file to generate a file substitution structure; performing convolution diffusion processing on the privacy file based on the file substitution structure to obtain diffusion ripple data; Step S14: performing reverse track connection on the diffusion ripple data to generate track mark data; topologically flipping and reorganizing the track mark data to generate topological variant data; Step S15: Perform multi-dimensional interleaving integration on the topological variant data to obtain a basic encryption unit.

3. The computer software security encryption management method according to claim 2, characterized in that: Step S14 includes the following steps: Step S141: performing pulse sampling mapping on the diffusion ripple data to generate ripple pulse data; performing time sequence reverse reconstruction on the ripple pulse data to obtain a reverse time series; Step S142: performing trajectory point cloud mapping on the reverse time series to obtain trajectory space data; fusing geometric features of the trajectory space data to generate fused feature data; Step S143: performing path gradient rendering on the fused feature data to generate trajectory marking data; Step S144: performing topological feature deconstruction on the trajectory mark data to obtain topological primitive data; symmetry flipping the topological primitive data to generate a flipping matrix; Step S145: Perform structural reorganization mapping based on the flip matrix to obtain topological variant data.

4. The computer software security encryption management method according to claim 1, characterized in that: Step S2 includes the following steps: Step S21: Perform high-dimensional grid mapping on the basic encryption unit to obtain an initial grid structure; construct a multi-level grid node system based on the initial grid structure; Step S22: spatially dividing the basic encryption unit based on the multi-level grid node system, wherein the level depth range of the grid node is set to 3-5 layers, the number of nodes in each layer ranges from 10 to 50, the first layer contains 10 to 20 nodes, the second layer contains 15 to 30 nodes, the third layer contains 20 to 50 nodes, the fourth layer contains 25 to 60 nodes, and the fifth layer contains 30 to 70 nodes; performing code mapping on the divided basic encryption unit to generate an initial grid code; Step S23: performing redundancy analysis on the initial grid code and eliminating predictable patterns in the code to obtain an encrypted grid code matrix; Step S24: constructing a distributed mapping network based on the encrypted grid coding matrix; screening feature vectors of the distributed mapping network; performing density clustering on the feature vectors to obtain identity feature clusters; Step S25: performing corresponding virtual identifier derivation processing on each identity feature cluster to generate an identity virtual identifier; constructing a virtual mapping relationship for the identity feature cluster based on the identity virtual identifier to obtain a virtual mapping relationship; Step S26: associate and bind the virtual mapping relationship and the basic encryption unit to generate a virtual identity index.

5. The computer software security encryption management method according to claim 4, characterized in that: Step S25 includes the following steps: Step S251: performing feature spectrum decomposition on the identity feature cluster, and performing nonlinear projection on the feature spectrum to generate projection label data; Step S252: performing modal separation and reconstruction on the projection mark data to obtain modal component data; evolving an identifier seed sequence according to the modal component data; Step S253: performing derivation rule expansion on the identifier seed sequence to generate an identity virtual identifier; Step S254: weaving the identity virtual identifier into a topological structure, and constructing a bidirectional link based on the topological structure to obtain a link combination; Step S255: mapping and integrating the identity feature clusters according to the link combination to obtain a virtual mapping relationship.

6. The computer software security encryption management method according to claim 1, characterized in that: The step S3 of simulating a false search channel according to the virtual identity index and the basic encryption unit includes: Construct multiple access interfaces based on the virtual identity index to obtain the initial retrieval channel; The initial search channel is obfuscated and inserted based on the preset pseudo data nodes to generate an obfuscated search path; The basic encryption unit is embedded into the obfuscated retrieval path to generate a fake retrieval channel.

7. The computer software security encryption management method according to claim 1, characterized in that: The illegal attack inducing computer access data based on the false retrieval channel in step S3 includes: The computer access data is analyzed in time series to obtain access pattern features, where the time window is set to 10-500ms, the sampling frequency range is 100-1000Hz, the feature extraction dimension is 3-12 dimensions, and the analysis depth is controlled at 2-7 layers; Interactively map access pattern features and false retrieval channels to identify attack vectors; Enumerate the vulnerabilities of the identified attack vector to obtain attack vulnerabilities, wherein the number of enumerated vulnerabilities ranges from 1 to 10; Connect all attack vulnerabilities to generate an inducement path; Conduct attack access induction simulation based on the induction path, and track visitors to obtain visitor behavior data; Perform multi-level feature clustering on visitor behavior data to generate attacker profile data; Integrate attacker profile data and visitor behavior data to obtain visitor behavior patterns.

8. The computer software security encryption management method according to claim 1, characterized in that: The method of using visitor behavior patterns and false search channels to deduce computer internal threats in step S4 includes: Decompose the visitor's behavior pattern to obtain behavior characteristics; Predict attack intention based on behavioral features and obtain attack intention matrix; Reconstruct the intrusion path based on the false retrieval channel and generate the intrusion penetration vector; Perform cross-prediction modeling on the attack intention matrix and intrusion penetration vector to generate a threat prediction model; Use the threat prediction model to perform time series projection to obtain the potential threat timeline; Determine the risk level of the potential threat timeline based on the preset system resources and generate the resource risk level; Calculate critical thresholds for potential threat timelines based on resource risk levels; Perform risk self-checks on visitor behavior patterns based on critical thresholds and resource risk levels to generate computer internal threats.

9. The computer software security encryption management method according to claim 1, characterized in that: The step S4 of using the internal threat of the computer to progressively encrypt and solidify the basic encryption unit includes: Extract threat features of threat data inside the computer to obtain threat feature fingerprints; Structural layering of basic encryption units to generate encryption unit levels; According to the threat feature fingerprint, the encryption unit level is hierarchically mapped to obtain the vulnerabilities of each level of the encryption unit; Conduct source tracing analysis on vulnerabilities at all levels of the encryption unit to identify the source of the vulnerability; Based on the source of the vulnerability, the basic encryption unit is mapped for node reinforcement to generate an enhanced encryption unit.

10. A computer software security encryption management system, characterized in that: Used to execute the computer software security encryption management method as claimed in claim 1, the computer software security encryption management system comprises: A data extraction module is used to obtain computer software data; extract private files from computer software data; and perform interlaced and stacked transformations on private files to obtain basic encryption units; The encryption mapping module is used to perform grid code mapping on the basic encryption unit to obtain an encrypted grid code matrix; perform distributed mapping based on the encrypted grid code matrix to generate a virtual identity index; A search simulation module is used to monitor computer access data; simulate false search channels based on virtual identity indexes and basic encryption units; conduct illegal attacks on computer access data based on false search channels, and record visitor behavior patterns; The threat analysis module is used to deduce internal threats to the computer using visitor behavior patterns and false search channels; and to use internal threats to the computer to progressively encrypt and solidify the basic encryption units.

Images