A digital infrastructure performance archive management method and system based on distributed storage technology

Abstract

The present invention discloses a digital infrastructure performance archive management method and system based on distributed storage technology, which relates to the field of intelligent storage and security management technology, including: real-time collection of user metadata and preprocessing; construction of a traffic feature matrix based on the metadata of each user in the past; use of low-rank decomposition on the traffic feature matrix to obtain a residual matrix; construction of a joint optimization objective function based on the residual matrix to output an optimal residual matrix; construction of a time series prediction model based on the optimal residual matrix to output a predicted residual matrix. The residual matrix is ​​generated using low-rank decomposition, and accurate detection and prediction of abnormal behaviors are achieved through the joint optimization of the objective function and the time series prediction model, which significantly improves the detection accuracy and robustness of the system, realizes dynamic sparsity constraints and resource optimization, formulates a hierarchical security response strategy based on the abnormal category interval division, and implements refined protection for behaviors such as high-frequency access, sensitive access, and sudden traffic increases.

Description

Technical Field

[0001] The present invention relates to the field of intelligent storage and security management technology, and in particular to a digital infrastructure performance archive management method and system based on distributed storage technology. Background Art

[0002] With the rapid development of information technology and digital management, the demand for digital transformation in the infrastructure construction field is increasing. Especially in large-scale infrastructure construction projects, with the continuous accumulation of information such as engineering data, project archives, and construction records, how to efficiently and securely store and manage this huge amount of archival data has become a key technical challenge. Distributed storage technology, as a storage solution that can provide high reliability, high scalability, and high concurrency performance, has been widely used in multiple industries. By sharding data and storing it across multiple nodes, distributed storage technology not only reduces the risk of single points of failure but also significantly improves the system's throughput. However, distributed storage also has some problems in practical applications, such as the dynamic management of archive access rights, the weak real-time response capability of security protection mechanisms, and the lack of accurate identification and early warning capabilities of abnormal behavior. In addition, with the continuous development of artificial intelligence and data mining technologies, many studies have begun to explore how to dynamically optimize user behavior and data access patterns in distributed storage systems through intelligent means, thereby achieving accurate detection and response to abnormal behavior.

[0003] Existing technologies mainly focus on rule-based static security management and simple traffic analysis methods. These methods show obvious limitations when faced with complex and changeable user behaviors. Traditional archive management methods usually lack in-depth modeling of user access behaviors and find it difficult to accurately describe the changing trends of user behaviors. Most existing methods rely only on simple statistical features for anomaly detection, ignoring the dynamic correlation of user behaviors in the time dimension, resulting in poor accuracy of anomaly detection and timeliness of response. Due to the large differences in traffic characteristics and data access frequencies between nodes in distributed storage systems, existing technologies find it difficult to provide targeted and resource-optimized security protection solutions, which not only increases the system's resource consumption, but also limits the system's adaptability to a certain extent. While achieving accurate modeling of user behavior, providing efficient anomaly detection and dynamic response solutions has become a core problem that needs to be urgently solved in existing technologies. Summary of the Invention

[0004] In view of the above existing problems, the present invention is proposed.

[0005] Therefore, the present invention provides a digital infrastructure performance archive management method and system based on distributed storage technology to solve the problems of insufficient user behavior modeling, inaccurate anomaly detection, and untimely security response in the existing distributed storage technology when facing large-scale digital infrastructure performance archive management.

[0006] In order to solve the above technical problems, the present invention provides the following technical solutions:

[0007] In a first aspect, the present invention provides a method for managing digital infrastructure performance archives based on distributed storage technology, which includes:

[0008] Collect user metadata in real time and perform pre-processing;

[0009] Build a traffic feature matrix based on the metadata of each user in the past time;

[0010] Use low-rank decomposition on the traffic feature matrix to obtain the residual matrix;

[0011] According to the residual matrix, a joint optimization objective function is constructed to output the optimal residual matrix;

[0012] Based on the optimal residual matrix, a time series forecasting model is constructed to output the forecast residual matrix;

[0013] Based on the prediction residual matrix, abnormal category intervals are classified and a hierarchical safety response strategy is formulated.

[0014] As a preferred solution of the digital infrastructure performance archive management method based on distributed storage technology of the present invention, the real-time collection of user metadata and pre-processing includes:

[0015] The archivist uploads the archival files and manually enters the archival level into the archival management system;

[0016] Adjust the fragment size of archive files by archive level and use different encryption algorithms, and record the keys generated by different encryption algorithms into the data index library;

[0017] The user selects the target archive file through the archive management system and issues an operation request. After receiving the user's operation request, the archive management system collects the user's metadata in real time;

[0018] The metadata includes user ID, target archive file path, timestamp and operation request;

[0019] The archive management system verifies the user's permissions. If the operation request does not match the user's permissions, the archive management system denies the user access and records the operation request as a "failure log." Otherwise, the archive management system records the operation request as a "successful log" and performs preprocessing.

[0020] The preprocessing includes taking each data in the metadata as a feature and performing formatting and normalization processing on each feature.

[0021] As a preferred solution of the digital infrastructure performance archive management method based on distributed storage technology of the present invention, wherein: the flow feature matrix is ​​constructed based on the metadata of each user in the past time;

[0022] Extract traffic statistics based on metadata of each user over time;

[0023] The traffic statistics characteristics include the number of accesses, the number of packets, the number of destination addresses, the number of responses, the number of destination ports, the network flow size and the lifetime;

[0024] Construct a traffic feature matrix W based on traffic statistical features, where each row of the traffic feature matrix W represents all traffic statistical features of a user, and each column represents traffic statistical features of different users;

[0025] Normalize the eigenvalues ​​of each column and use cosine similarity to calculate the behavioral similarity between any two users. Set a similarity threshold based on the behavioral similarity of the users and construct the adjacency matrix A. If the behavioral similarity between the two users is greater than the similarity threshold, the behaviors of the two users are considered similar and marked as 1 in the adjacency matrix A. Otherwise, the behaviors of the two users are considered dissimilar and marked as 0 in the adjacency matrix A.

[0026] As a preferred solution of the digital infrastructure performance archive management method based on distributed storage technology described in the present invention, wherein: the residual matrix obtained by using low-rank decomposition of the traffic feature matrix includes:

[0027] Calculate the column norm of each column in the traffic feature matrix W, sort them in descending order by the column norm, and select the first Q most important columns as the core column sub-matrix. Calculate the row norm of each row in the traffic feature matrix W, sort them in descending order by the row norm, and select the first E most important rows as the core row sub-matrix.

[0028] The kernel matrix U is formed according to the obtained core column submatrix and core row submatrix;

[0029] Calculate the kernel matrix to obtain the low-rank approximation matrix CUR of the traffic feature matrix W;

[0030] Construct the residual matrix E to measure the deviation between the traffic feature matrix W and its low-rank approximation matrix CUR.

[0031] As a preferred solution of the digital infrastructure performance archive management method based on distributed storage technology of the present invention, the method of constructing a joint optimization objective function according to the residual matrix to output the optimal residual matrix includes:

[0032] According to the residual matrix E, the anomaly detection loss value is calculated using the anomaly detection loss function, which is expressed as:

[0033]

[0034] Among them, L represents the loss value of the anomaly detection loss function, α represents the adjustment coefficient of anomaly detection, m and n represent the number of rows and columns of the traffic feature matrix W respectively, ω ij Represents the weight of the element in the i-th row and j-th column of the residual matrix E, r ij Represents the element in the i-th row and j-th column of the residual matrix E;

[0035] The adjustment coefficient of the anomaly detection is calculated by calculating the mean and standard deviation of all elements in the residual matrix E, presetting the expected abnormal behavior ratio ρ according to actual needs, defining the detection range of abnormal behavior according to the abnormal behavior ratio, and selecting the upper quantile 1-ρ of the residual matrix E as the threshold T for anomaly detection E , the expression is:

[0036] T E =μ E +k·σ E ,

[0037] Among them, μ E represents the mean of all elements in the residual matrix E, σ E represents the standard deviation of all elements in the residual matrix E, and k is the quantile of the standard normal distribution calculated based on the upper quantile 1-ρ;

[0038] Dynamically adjust the adjustment coefficient according to the obtained threshold value. The expression is:

[0039]

[0040] Where, e represents the natural exponent, and k represents the parameter that adjusts the sensitivity of anomaly detection;

[0041] The weight is assigned according to the behavior similarity, and the expression is:

[0042]

[0043] Among them, A(i,:) and A(j,:) are the behavior similarity vectors between the i-th user and the j-th user and other different users respectively;

[0044] The nonlinear compression cost function is constructed using fractional and exponential functions, and the expression is:

[0045]

[0046] Where P represents the loss value of the compression cost function, λ represents the adjustment coefficient of the compression cost, γ represents the amplification factor of the rank control, r represents the rank after the low-rank decomposition of the traffic feature matrix W, and ψ represents the nonlinear growth rate adjustment parameter;

[0047] The rank represents the core parameter of the low-rank decomposition, and the number of ranks is at most min(Q, E), and min(Q, E) represents the maximum rank that the kernel matrix in the low-rank decomposition can represent;

[0048] The rank is dynamically adjusted according to the loss values ​​of the anomaly detection loss function and the compression cost function. The expression is:

[0049]

[0050] Among them, r * represents the optimized rank;

[0051] The sparsity constraint function is constructed by adding the core column sub-matrix to the sparsity constraint. The expression is:

[0052]

[0053] Among them, S represents the loss value of the sparsity constraint function, η represents the sparsity weight coefficient, p represents the number of columns of the core column submatrix, ||c b ||1 represents the L1 norm of the bth column in the core column submatrix;

[0054] Construct the joint optimization objective function, the expression is:

[0055]

[0056] Among them, L represents the loss value of the anomaly detection loss function, P represents the loss value of the compression cost function, and S represents the loss value of the sparsity constraint function;

[0057] The joint optimization objective function is decomposed using the augmented Lagrange multiplier method. The low-rank approximation matrix CUR is optimized by fixing the rank value. The loss value of the joint optimization objective function is recalculated by dynamically adjusting the rank value. A loss threshold is set. If the difference in the loss value between the joint optimization objective functions in two iterations is less than the loss threshold, it means that the joint optimization objective function has converged. The iteration is stopped, the optimal solution is output, and the optimal residual matrix is ​​obtained. Otherwise, the iteration is continued.

[0058] By inputting the real-time residual matrix into the joint optimization objective function, the optimal residual matrix is ​​output.

[0059] As a preferred solution of the digital infrastructure performance archive management method based on distributed storage technology described in the present invention, the method of constructing a time series prediction model based on the optimal residual matrix to output the prediction residual matrix includes:

[0060] The obtained optimal residual matrix is ​​divided into multiple time windows according to the time dimension. The abnormal fluctuation value of each column is calculated using the mean square deviation. The first H column features with the highest abnormal fluctuation value at the current time point are selected as abnormal fluctuation features. All abnormal fluctuation features in all time windows in the optimal residual matrix are extracted and normalized. All abnormal fluctuation features are divided into training set and test set.

[0061] The time series prediction model is constructed by using a long short-term memory network as a time series prediction model, including an input layer, an LSTM hidden layer, and a fully connected output layer;

[0062] The training set is input into the time series prediction model. The prediction residual matrix of the next time window is output through forward propagation. The mean square error is used as the loss function. The error between the predicted eigenvalue and the true eigenvalue is calculated through the loss function. The Adam optimizer is used to update the parameters to minimize the error. The number of iterations is set. If the loss value of the training set does not decrease for D consecutive times, the iteration is stopped early. Otherwise, the iteration is continued until the maximum number of iterations is reached.

[0063] Use the test set to test the performance of the time series forecasting model and evaluate the precision, recall, and F1 score of anomaly detection;

[0064] By inputting the real-time optimal residual matrix of all users into the time series prediction model, the prediction residual matrix of all users in the next time window is generated.

[0065] As a preferred solution of the digital infrastructure performance archive management method based on distributed storage technology described in the present invention, the abnormal category interval classification based on the prediction residual matrix and the formulation of a hierarchical safety response strategy include:

[0066] Based on the obtained prediction residual matrix, an abnormal threshold is set and the prediction residual matrix is ​​retrieved;

[0067] If the predicted eigenvalue in the prediction residual matrix is ​​greater than the abnormal threshold, the user corresponding to the predicted eigenvalue is extracted and marked as a future abnormal user; otherwise, no operation is performed;

[0068] Extract all predicted eigenvalues ​​of each future abnormal user in the prediction residual matrix, normalize them and construct an abnormal feature vector;

[0069] Using the K-Means clustering algorithm, based on the abnormal feature vectors of all users, set the number of clusters to 3, randomly select the abnormal feature vectors of 3 users as the initial cluster centers, calculate the Euclidean distance between each user's abnormal feature vector and all initial cluster centers, and assign the user to the cluster center closest to it. Recalculate the mean of the abnormal feature vectors of all users in each cluster as the new cluster center, set the maximum number of iterations, and repeat the steps of assigning users to the nearest cluster center and updating the cluster center until the maximum number of iterations is reached. Each cluster corresponds to an abnormal category interval;

[0070] The abnormal category intervals include high-frequency access intervals, sensitive access intervals and traffic sudden increase abnormal intervals;

[0071] Formulate hierarchical security response strategies based on abnormality category intervals;

[0072] If an abnormal user is in a high-frequency access range in the future, the user will be prompted for excessive operations and advised to try again later. The user's access frequency will be temporarily restricted and the access log will be recorded.

[0073] If an abnormal user is in a sensitive access zone in the future, the user's access rights will be temporarily restricted, and the user will be required to re-verify their identity and the administrator will be notified;

[0074] If in the future abnormal users are in the abnormal traffic surge range, the user request will be blocked and DDoS protection will be enabled.

[0075] In a second aspect, the present invention provides a digital infrastructure performance archive management system based on distributed storage technology, comprising:

[0076] Data collection module, used to collect user metadata in real time and perform preprocessing;

[0077] A matrix construction module is used to construct a traffic feature matrix based on the metadata of each user in the past time;

[0078] A low-rank decomposition module is used to obtain a residual matrix by using low-rank decomposition on the traffic feature matrix;

[0079] The optimization output module is used to construct a joint optimization objective function based on the residual matrix and output the optimal residual matrix;

[0080] Model building module, used to build a time series prediction model based on the optimal residual matrix and output the prediction residual matrix;

[0081] The classification processing module is used to classify abnormal category intervals based on the prediction residual matrix and formulate a hierarchical security response strategy.

[0082] In a third aspect, the present invention provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: when the computer program is executed by the processor, it implements any step of the digital infrastructure performance archive management method based on distributed storage technology as described in the first aspect of the present invention.

[0083] In a fourth aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein: when the computer program is executed by a processor, it implements any step of the digital infrastructure performance archive management method based on distributed storage technology as described in the first aspect of the present invention.

[0084] The beneficial effects of the present invention are: using low-rank decomposition to generate a residual matrix, and realizing accurate detection and prediction of abnormal behaviors by jointly optimizing the objective function and the time series prediction model, which significantly improves the detection accuracy and the robustness of the system, realizes dynamic sparsity constraints and resource optimization, formulates a hierarchical security response strategy based on the division of abnormal category intervals, and implements refined protection for behaviors such as high-frequency access, sensitive access and sudden traffic increases. BRIEF DESCRIPTION OF THE DRAWINGS

[0085] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0086] Figure 1 This is a flow chart of a digital infrastructure performance archive management method based on distributed storage technology in Example 1.

[0087] Figure 2 This is a schematic diagram of a digital infrastructure performance archive management system based on distributed storage technology in Example 1. DETAILED DESCRIPTION

[0088] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the specific embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0089] In the following description, many specific details are set forth to facilitate a full understanding of the present invention. However, the present invention may also be implemented in other ways different from those described herein. Those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0090] Secondly, the term "one embodiment" or "embodiment" herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The phrase "in one embodiment" appearing in various places throughout this specification does not necessarily refer to the same embodiment, nor does it refer to a separate or selective embodiment that is mutually exclusive of other embodiments.

[0091] Example 1, with reference to Figure 1 and Figure 2 , which is the first embodiment of the present invention, provides a digital infrastructure performance archive management method based on distributed storage technology, including the following steps:

[0092] S1, collect user metadata in real time and perform preprocessing;

[0093] Specifically, real-time collection of user metadata and preprocessing include:

[0094] The archivist uploads the archival files and manually enters the archival level into the archival management system;

[0095] The file levels include ordinary files, important files and confidential files;

[0096] The archive management system refers to a software system used for digital storage, classification, retrieval, sharing, security management and backup of various archive materials (such as documents, pictures, videos, engineering data, etc.);

[0097] Adjust the fragment size of archive files by archive level and use different encryption algorithms, and record the keys generated by different encryption algorithms into the data index library;

[0098] The user selects the target archive file through the archive management system and issues an operation request (such as viewing, modifying, and downloading). After receiving the user's operation request, the archive management system collects the user's metadata in real time;

[0099] The metadata includes user ID, target archive file path, timestamp and operation request;

[0100] The user ID refers to the unique identification of each user;

[0101] The target archive file path refers to the storage path of the archive file being accessed;

[0102] The archive management system verifies the user's permissions. If the operation request does not match the user's permissions (such as a general user requesting a confidential file), the archive management system denies the user access and records the operation request as a "failure log." Otherwise, the archive management system records the operation request as a "successful log" and performs preprocessing.

[0103] The preprocessing includes taking each data in the metadata as a feature and formatting and normalizing each feature;

[0104] The formatting includes converting timestamps into time intervals, mapping target archive file paths into file identifiers (such as replacing text paths with digital IDs) to reduce storage usage, and converting operation requests into discrete numerical values ​​(such as view = 1, modify = 2, download = 3).

[0105] This method adjusts the file fragment size through file level division and adopts different encryption algorithms to achieve differentiated security protection for ordinary files, important files and confidential files, significantly improving the flexibility and security of data management. It collects user metadata (such as user ID, file path, timestamp and operation request) in real time and formats and normalizes them, effectively reducing data storage occupancy and optimizing the computational efficiency of subsequent analysis. Through the permission verification mechanism, the system can promptly reject operation requests that do not meet the permission requirements and record logs, thereby enhancing the security and operation tracking capabilities of the file management system and laying a solid data foundation for anomaly detection and behavior analysis.

[0106] S2, build a traffic feature matrix based on the metadata of each user in the past time;

[0107] Specifically, a traffic feature matrix is ​​constructed based on the metadata of each user in the past time;

[0108] Extract traffic statistics based on metadata of each user over time;

[0109] The traffic statistics characteristics include the number of accesses, the number of packets, the number of destination addresses, the number of responses, the number of destination ports, the network flow size and the lifetime;

[0110] The number of visits refers to the total number of times a user visits a target archive file;

[0111] The number of data packets refers to the total number of data packets sent by the user during each visit;

[0112] The number of destination addresses refers to the number of different target archive files accessed by the user;

[0113] The number of responses refers to the number of response messages returned in each user visit;

[0114] The number of destination ports refers to the total number of different destination ports involved in the user access request;

[0115] The network flow size refers to the total flow of each user's access request and response;

[0116] The lifetime refers to the duration of the user's connection to the archive management system;

[0117] Construct a traffic feature matrix W based on traffic statistical features, where each row of the traffic feature matrix W represents all traffic statistical features of a user, and each column represents traffic statistical features of different users;

[0118] Normalize each column of eigenvalues ​​and use cosine similarity to calculate the behavioral similarity between any two users. Set a similarity threshold based on the behavioral similarity of the users and construct the adjacency matrix A. If the behavioral similarity between the two users is greater than the similarity threshold, the behaviors of the two users are considered similar and marked as 1 in the adjacency matrix A. Otherwise, the behaviors of the two users are considered dissimilar and marked as 0 in the adjacency matrix A.

[0119] For new users or behavior changes, a sliding window mechanism is used to recalculate behavior similarity and update the adjacency matrix.

[0120] The present invention constructs a traffic feature matrix by extracting multi-dimensional traffic statistical features such as the number of visits, the number of data packets, and the number of destination addresses, comprehensively characterizing the user's behavior pattern. By normalizing the eigenvalues ​​and calculating the cosine similarity, the behavioral similarity between users is accurately measured, and an adjacency matrix is ​​generated based on the similarity threshold to effectively distinguish between users with similar and dissimilar behaviors. Compared with traditional methods, the present invention dynamically uses a sliding window mechanism to update the adjacency matrix in real time for new users or behavior changes, significantly improving the accuracy of user behavior modeling and the system's adaptability to dynamically changing environments, while providing an efficient data foundation for anomaly detection and security optimization.

[0121] S3. Use low-rank decomposition on the traffic feature matrix to obtain the residual matrix;

[0122] Specifically, the residual matrix obtained by using low-rank decomposition on the traffic feature matrix includes:

[0123] Calculate the column norm of each column in the traffic feature matrix W, which is the L2 norm of the column vector. Sort the columns in descending order by the size of the column norm and select the most important first Q columns as the core column sub-matrix. By selecting Q columns, the column space dimension of the traffic feature matrix W is limited. Calculate the row norm of each row in the traffic feature matrix W, which is the L2 norm of the row vector. Sort the columns in descending order by the size of the row norm and select the most important first E rows as the core row sub-matrix. By selecting E rows, the row space dimension of the traffic feature matrix W is further limited. The values ​​of Q and E are determined according to the actual application scenario and the scale of the traffic feature matrix W.

[0124] The kernel matrix U is formed based on the obtained core column submatrix and core row submatrix. The kernel matrix is ​​calculated as follows:

[0125] U=C + WR + ,

[0126] Among them, C + and R + They represent the pseudo-inverse of the core column submatrix and the core row submatrix calculated by the least squares method, and W represents the traffic feature matrix;

[0127] The low-rank approximation matrix CUR of the traffic feature matrix W is obtained by calculating the kernel matrix. The expression is:

[0128] W≈CUR,

[0129] Among them, C represents the core column submatrix, U represents the kernel matrix, and R represents the core row submatrix;

[0130] Low-rank decomposition significantly reduces the dimensionality of the traffic feature matrix W by selecting core columns and core rows, while retaining the main information of the data. Core columns and core rows represent key features and high-influence users, respectively, which helps improve the efficiency and accuracy of anomaly detection. Through CUR decomposition, only core features and user behavior need to be analyzed, significantly reducing computational overhead.

[0131] Construct the residual matrix E to measure the deviation between the traffic feature matrix W and its low-rank approximation matrix CUR. The expression is:

[0132] r ij =W ij -CUR ij ,

[0133] Among them, r ij Represents the element in the i-th row and j-th column of the residual matrix E, W ij Represents the element in row i and column j of the traffic feature matrix W, CUR ij Represents the element in row i and column j of the low-rank approximation matrix CUR;

[0134] The residual matrix directly reflects the degree to which user behavior deviates from the normal pattern and can more clearly describe the abnormal characteristics of abnormal users.

[0135] By performing CUR low-rank decomposition on the traffic feature matrix, the present invention significantly reduces the dimension of the matrix while retaining key features and main information, achieving efficient data dimensionality reduction and user behavior modeling. By selecting core columns and core rows, the column space and row space of the matrix are limited, effectively focusing on high-influence users and key features, reducing the interference of irrelevant information. The residual matrix generated by low-rank decomposition can intuitively reflect the degree of deviation of user behavior, clearly describe abnormal features, and improve the accuracy and robustness of anomaly detection. The CUR decomposition method reduces computational complexity and only needs to analyze core features and user behavior, greatly reducing computational overhead and improving the performance of the system in a dynamic network environment.

[0136] S4, constructing a joint optimization objective function based on the residual matrix and outputting the optimal residual matrix;

[0137] Specifically, constructing a joint optimization objective function based on the residual matrix to output the optimal residual matrix includes:

[0138] According to the residual matrix E, the anomaly detection loss value is calculated using the anomaly detection loss function, which is expressed as:

[0139]

[0140] Among them, L represents the loss value of the anomaly detection loss function, α represents the adjustment coefficient of anomaly detection, m and n represent the number of rows and columns of the traffic feature matrix W respectively, ω ij Represents the weight of the element in the i-th row and j-th column of the residual matrix E, r ij Represents the element in the i-th row and j-th column of the residual matrix E;

[0141] The adjustment coefficient of the anomaly detection is calculated by calculating the mean and standard deviation of all elements in the residual matrix E, presetting the expected abnormal behavior ratio ρ according to actual needs, defining the detection range of abnormal behavior according to the abnormal behavior ratio, and selecting the upper quantile 1-ρ of the residual matrix E as the threshold T for anomaly detection E , the expression is:

[0142] T E =μ E +k·σ E ,

[0143] Among them, μ E represents the mean of all elements in the residual matrix E, σ E represents the standard deviation of all elements in the residual matrix E, k is the quantile of the standard normal distribution calculated based on the upper quantile 1-ρ, reflecting the range of normal behavior;

[0144] Dynamically adjust the adjustment coefficient according to the obtained threshold value. The expression is:

[0145]

[0146] Wherein, e represents the natural exponent, which is used to ensure the nonlinear effect of coefficient adjustment, and k represents the parameter for adjusting the sensitivity of anomaly detection (e.g., set to 0.1-1);

[0147] The weight is assigned according to the behavior similarity, and the expression is:

[0148]

[0149] Among them, A(i,:) and A(j,:) are the behavior similarity vectors between the i-th user and the j-th user and other different users respectively;

[0150] The smaller the loss value of the anomaly detection loss function, the stronger the ability of the archive management system to detect abnormal behavior. The larger the loss value, the more abnormal values ​​in the residual matrix of the archive management system, and the worse the model representation.

[0151] The nonlinear compression cost function is constructed using fractional and exponential functions, and the expression is:

[0152]

[0153] Where P represents the loss value of the compression cost function, λ represents the adjustment coefficient of the compression cost, γ represents the amplification factor of rank control, and the optimal amplification factor value is selected by fitting the compression cost function distribution using a Gaussian process. r represents the rank of the traffic feature matrix W after low-rank decomposition, and ψ represents the nonlinear growth rate adjustment parameter, which is obtained through a logistic growth model (such as the Logistic Growth Model).

[0154] The rank represents the core parameter of the low-rank decomposition, which is used to control the number of retained features. The maximum rank is min(Q, E). Min(Q, E) represents the maximum rank that the kernel matrix in the low-rank decomposition can represent. For example, the value of Q is 20 and the value of E is 15 as the kernel matrix. At this time, the initial rank is 15, and the indexes of the core columns and core rows are determined by the sorting results of the column norm and row norm, respectively.

[0155] The smaller the loss value of the compression cost function, the lower the compression resource cost, and the larger the loss value, the higher the resource consumption of the matrix decomposition rank;

[0156] The rank is dynamically adjusted according to the loss values ​​of the anomaly detection loss function and the compression cost function to optimize the computing and storage resources of the matrix decomposition. The expression is:

[0157]

[0158] Among them, r * represents the optimized rank;

[0159] The compression cost adjustment coefficient optimizes the balance between the loss value of the anomaly detection loss function and the loss value of the compression cost function through Pareto frontier analysis, dynamically adjusts the weight coefficient according to user needs, selects the optimal solution that prioritizes detection accuracy or compression cost, and normalizes the weight coefficient into a single parameter form to achieve global optimization;

[0160] The sparsity constraint function is constructed by adding the core column sub-matrix to the sparsity constraint. The expression is:

[0161]

[0162] Among them, S represents the loss value of the sparsity constraint function, η represents the sparsity weight coefficient, which is used to adjust the constraint strength, p represents the number of columns of the core column submatrix, and ||c b ||1 represents the L1 norm of the bth column in the core column submatrix;

[0163] Adjust the sparsity weight coefficient through cross-validation, set the sparsity threshold, and remove the noise of each column according to the L1 norm. If the L1 norm of the column is less than the sparsity threshold, then retain the column. Otherwise, suppress the contribution of the column through the exponential decay function in the nonlinear function, so that it presents a smaller weight in the sparsity constraint function.

[0164] The smaller the loss value of the sparsity constraint function, the higher the feature sparsity, and more redundant features are filtered out. The larger the loss value, the less sparse the model is, and it may contain too much useless information.

[0165] Construct the joint optimization objective function, the expression is:

[0166]

[0167] Among them, L represents the loss value of the anomaly detection loss function, P represents the loss value of the compression cost function, and S represents the loss value of the sparsity constraint function;

[0168] The smaller the loss value of the joint optimization objective function, the higher the anomaly detection accuracy, the lower the compression cost, and the better the model sparsity;

[0169] The joint optimization objective function is decomposed using the augmented Lagrange multiplier method (ALM). The low-rank approximation matrix CUR is optimized by fixing the rank value. The loss value of the joint optimization objective function is recalculated by dynamically adjusting the rank value. A loss threshold is set. If the difference in the loss value between the joint optimization objective functions in two iterations is less than the loss threshold, it means that the joint optimization objective function has converged, the iteration is stopped, and the optimal solution is output. Otherwise, the iteration is continued.

[0170] The optimal solution is to dynamically adjust the rank of the traffic feature matrix W by the augmented Lagrange multiplier method to obtain the optimal low-rank approximation matrix CUR, and use the optimal low-rank approximation matrix CUR to generate the optimized traffic feature matrix W * , according to the optimized traffic characteristic matrix W * Calculate the optimal residual matrix;

[0171] By inputting the real-time residual matrix into the joint optimization objective function, the optimal residual matrix is ​​output;

[0172] The goal of constructing a joint optimization objective function is to achieve a multi-objective balance between anomaly detection, resource utilization, and system robustness. By optimizing the residual matrix, anomalous features in user behavior are made explicit, accurately distinguishing between normal and anomalous behavior. Simultaneously, the rank and sparsity constraints of the matrix decomposition are dynamically adjusted to reduce the waste of storage and computing resources and enhance the system's adaptability in dynamic network environments. Compared with existing technologies, this method significantly improves the accuracy and robustness of anomaly detection by jointly optimizing detection accuracy, computational efficiency, and feature filtering, achieving effective early warning of future anomaly trends.

[0173] This method constructs a joint optimization objective function based on the residual matrix, takes into account anomaly detection loss, compression cost and sparsity constraints, dynamically adjusts the rank of matrix decomposition, and optimizes the low-rank approximation matrix CUR, significantly improving the accuracy, robustness and computational efficiency of anomaly detection. Combined with Pareto frontier analysis and equilibrium strategy, it achieves the optimal balance between detection accuracy and resource utilization, and effectively filters redundant features through sparsity constraints, reducing the waste of storage and computing resources. This method can make user behavior anomalies explicit, accurately distinguish normal from abnormal behavior, and dynamically adapt to complex network environments, enhancing the robustness and foresight of the system, and achieving effective early warning of future abnormal trends.

[0174] S5. Construct a time series prediction model based on the optimal residual matrix and output a prediction residual matrix;

[0175] Specifically, the output prediction residual matrix of the time series prediction model based on the optimal residual matrix includes:

[0176] The obtained optimal residual matrix is ​​divided into multiple time windows according to the time dimension. The abnormal fluctuation value of each column is calculated using the mean square deviation. The first H column features with the highest abnormal fluctuation value at the current time point are selected as abnormal fluctuation features. The value of H is determined according to the actual situation. All abnormal fluctuation features in all time windows in the optimal residual matrix are extracted and normalized. All abnormal fluctuation features are divided into training set and test set.

[0177] The time series prediction model is constructed by using a long short-term memory network as a time series prediction model, including an input layer, an LSTM hidden layer, and a fully connected output layer. Features are input into the input layer with the goal of minimizing prediction errors. The number of units in the LSTM hidden layer is set. The LSTM hidden layer includes two layers. The first layer receives features and outputs hidden states. The second layer further extracts time series features. Tanh is used as an activation function. The fully connected output layer maps the LSTM hidden states to predicted values.

[0178] The training set is input into the time series prediction model. The prediction residual matrix of the next time window is output through forward propagation to detect potential abnormal behavior in advance. The mean square error is used as the loss function. The error between the predicted eigenvalue and the true eigenvalue is calculated through the loss function. The Adam optimizer is used to update the parameters to minimize the error. The number of iterations is set. If the loss value of the training set does not decrease for D consecutive times, the iteration is stopped early to prevent overfitting. The value of D is determined according to the actual situation. Otherwise, the iteration is continued until the maximum number of iterations is reached.

[0179] The true characteristic value is obtained through real-time collection at the next time point;

[0180] Use the test set to test the performance of the time series forecasting model and evaluate the precision, recall, and F1 score of anomaly detection;

[0181] By inputting the real-time optimal residual matrix of all users into the time series prediction model, the prediction residual matrix of all users in the next time window is generated.

[0182] This paper constructs a time series prediction model based on the optimal residual matrix, which can accurately capture the temporal characteristics and abnormal fluctuation trends of user behavior. It uses a long short-term memory network (LSTM) to extract key abnormal features in multiple time windows, and improves the prediction accuracy of the model by minimizing the prediction error, effectively achieving early warning of potential abnormal behavior in the future. Compared with existing technologies, it uses mean square error and Adam optimizer to dynamically adjust model parameters to avoid overfitting and improve training efficiency. At the same time, the precision, recall rate and F1 score of anomaly detection are evaluated through a test set to ensure the stability and robustness of the model in different scenarios. This method significantly improves the accuracy and timeliness of anomaly detection and enhances the system's adaptability to complex dynamic behaviors.

[0183] S6. Classify abnormal category intervals based on the prediction residual matrix and formulate a hierarchical safety response strategy;

[0184] Specifically, the abnormal category interval classification based on the prediction residual matrix and the formulation of a hierarchical safety response strategy include:

[0185] Based on the obtained prediction residual matrix, an abnormal threshold is set and the prediction residual matrix is ​​retrieved;

[0186] If the predicted eigenvalue in the prediction residual matrix is ​​greater than the abnormal threshold, the user corresponding to the predicted eigenvalue is extracted and marked as a future abnormal user; otherwise, no operation is performed;

[0187] Extract all predicted eigenvalues ​​of each future abnormal user in the prediction residual matrix, normalize them and construct an abnormal feature vector;

[0188] Using the K-Means clustering algorithm, based on the abnormal feature vectors of all users, set the number of clusters to 3, randomly select the abnormal feature vectors of 3 users as the initial cluster centers, calculate the Euclidean distance between each user's abnormal feature vector and all initial cluster centers, and assign the user to the cluster center closest to it. Recalculate the mean of the abnormal feature vectors of all users in each cluster as the new cluster center, set the maximum number of iterations, and repeat the steps of assigning users to the nearest cluster center and updating the cluster center until the maximum number of iterations is reached. Each cluster corresponds to an abnormal category interval;

[0189] The abnormal category intervals include high-frequency access intervals, sensitive access intervals and traffic sudden increase abnormal intervals;

[0190] The high-frequency access interval indicates that the residual value of the number of data packets and access frequency of the future abnormal user is abnormal relative to other users;

[0191] The sensitive access interval indicates that the number of destination addresses of the future abnormal user is abnormal compared to other users;

[0192] The abnormal traffic surge interval indicates that network traffic-related characteristics (such as packet size) surge in a short period of time;

[0193] After clustering is completed, the silhouette coefficient is used to measure the similarity of each user to the cluster in which they belong and to other clusters;

[0194] Formulate hierarchical security response strategies based on abnormality category intervals;

[0195] If an abnormal user is in a high-frequency access range in the future, the user will be prompted for excessive operations and advised to try again later. The user's access frequency will be temporarily restricted (e.g., once per minute) and the access log will be recorded.

[0196] If an abnormal user is in a sensitive access zone in the future, the user's access rights will be temporarily restricted, and the user will be required to re-verify their identity and the administrator will be notified;

[0197] If abnormal users are in the abnormal traffic surge range in the future, the user request will be blocked and DDoS protection (such as current limiting, blacklisting, etc.) will be enabled.

[0198] The present invention implements abnormal category interval classification and hierarchical security response strategy based on the prediction residual matrix, and uses the K-Means clustering algorithm to accurately divide abnormal categories (high-frequency access, sensitive access and traffic surge), thereby realizing dynamic classification and detailed management of future abnormal users. Through abnormal feature normalization and clustering iterative optimization, it can accurately identify different types of abnormal behaviors, evaluate the classification effect in combination with the silhouette coefficient, and provide targeted security response strategies according to the abnormal category, such as access frequency restriction, permission verification and DDoS protection, thereby improving the accuracy of abnormal detection, the timeliness of response and the protection capability of the system, and effectively ensuring the security and stability of the distributed storage system.

[0199] This embodiment also provides a digital infrastructure performance archive management system based on distributed storage technology, including:

[0200] Data collection module, used to collect user metadata in real time and perform preprocessing;

[0201] A matrix construction module is used to construct a traffic feature matrix based on the metadata of each user in the past time;

[0202] A low-rank decomposition module is used to obtain a residual matrix by using low-rank decomposition on the traffic feature matrix;

[0203] The optimization output module is used to construct a joint optimization objective function based on the residual matrix and output the optimal residual matrix;

[0204] Model building module, used to build a time series prediction model based on the optimal residual matrix and output the prediction residual matrix;

[0205] The classification processing module is used to classify abnormal category intervals based on the prediction residual matrix and formulate a hierarchical security response strategy.

[0206] This embodiment also provides a computer device, which is suitable for the digital infrastructure performance archive management method based on distributed storage technology, including: a memory and a processor; the memory is used to store computer-executable instructions, and the processor is used to execute computer-executable instructions, thereby realizing the digital infrastructure performance archive management method based on distributed storage technology proposed in the above embodiment.

[0207] The computer device may be a terminal, comprising a processor, a memory, a communication interface, a display screen and an input device connected via a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device comprises a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner may be achieved through WIFI, an operator network, NFC (near field communication) or other technologies. The display screen of the computer device may be a liquid crystal display or an electronic ink display screen, and the input device of the computer device may be a touch layer covering the display screen, or a button, trackball or touchpad provided on the housing of the computer device, or an external keyboard, touchpad or mouse.

[0208] This embodiment also provides a storage medium having a computer program stored thereon, which, when executed by a processor, implements the digital infrastructure performance archive management method based on distributed storage technology proposed in the above embodiment; the storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, disk or optical disk.

[0209] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A digital infrastructure performance archive management method based on distributed storage technology, characterized by: include: Collect user metadata in real time and perform pre-processing; Build a traffic feature matrix based on the metadata of each user in the past time; Use low-rank decomposition on the traffic feature matrix to obtain the residual matrix; According to the residual matrix, a joint optimization objective function is constructed to output the optimal residual matrix; Based on the optimal residual matrix, a time series forecasting model is constructed to output the forecast residual matrix; Classify abnormal category intervals based on the prediction residual matrix and formulate hierarchical safety response strategies; The real-time collection of user metadata and pre-processing includes: The archivist uploads the archival files and manually enters the archival level into the archival management system; Adjust the fragment size of archive files by archive level and use different encryption algorithms, and record the keys generated by different encryption algorithms into the data index library; The user selects the target archive file through the archive management system and issues an operation request. After receiving the user's operation request, the archive management system collects the user's metadata in real time; The metadata includes user ID, target archive file path, timestamp and operation request; The archive management system verifies the user's permissions. If the operation request does not match the user's permissions, the archive management system denies the user access and records the operation request as a "failure log." Otherwise, the archive management system records the operation request as a "success log" and performs preprocessing. The preprocessing includes taking each data in the metadata as a feature and formatting and normalizing each feature; The traffic feature matrix is ​​constructed based on the metadata of each user in the past time; Extract traffic statistics based on metadata of each user over time; The traffic statistics characteristics include the number of accesses, the number of packets, the number of destination addresses, the number of responses, the number of destination ports, the network flow size and the lifetime; Construct a traffic feature matrix W based on traffic statistical features, where each row of the traffic feature matrix W represents all traffic statistical features of a user, and each column represents traffic statistical features of different users; Normalize the eigenvalues ​​of each column and use cosine similarity to calculate the behavioral similarity between any two users. Set a similarity threshold based on the behavioral similarity of the users and construct the adjacency matrix A. If the behavioral similarity between the two users is greater than the similarity threshold, the behaviors of the two users are considered similar and marked as 1 in the adjacency matrix A. Otherwise, the behaviors of the two users are considered dissimilar and marked as 0 in the adjacency matrix A.

2. The digital infrastructure performance archive management method based on distributed storage technology according to claim 1, characterized in that: The method of using low-rank decomposition of the traffic feature matrix to obtain a residual matrix includes: Calculate the column norm of each column in the traffic feature matrix W, sort them in descending order by the column norm, and select the first Q most important columns as the core column sub-matrix. Calculate the row norm of each row in the traffic feature matrix W, sort them in descending order by the row norm, and select the first E most important rows as the core row sub-matrix. The kernel matrix U is formed according to the obtained core column submatrix and core row submatrix; Calculate the kernel matrix to obtain the low-rank approximation matrix CUR of the traffic feature matrix W; Construct the residual matrix E to measure the deviation between the traffic feature matrix W and its low-rank approximation matrix CUR.

3. The digital infrastructure performance archive management method based on distributed storage technology according to claim 2, characterized in that: The method of constructing a joint optimization objective function according to the residual matrix to output the optimal residual matrix includes: According to the residual matrix E, the anomaly detection loss value is calculated using the anomaly detection loss function, which is expressed as: Among them, L represents the loss value of the anomaly detection loss function, α represents the adjustment coefficient of anomaly detection, m and n represent the number of rows and columns of the traffic feature matrix W respectively, ω ij Represents the weight of the element in the i-th row and j-th column of the residual matrix E, r ij Represents the element in the i-th row and j-th column of the residual matrix E; The adjustment coefficient of the anomaly detection is calculated by calculating the mean and standard deviation of all elements in the residual matrix E, presetting the expected abnormal behavior ratio ρ according to actual needs, defining the detection range of abnormal behavior according to the abnormal behavior ratio, and selecting the upper quantile 1-ρ of the residual matrix E as the threshold T for anomaly detection E , the expression is: T E =μ E +k·s E , Among them, μ E represents the mean of all elements in the residual matrix E, σ E represents the standard deviation of all elements in the residual matrix E, and k is the quantile of the standard normal distribution calculated based on the upper quantile 1-ρ; Dynamically adjust the adjustment coefficient according to the obtained threshold value. The expression is: Where, e represents the natural exponent, and k represents the parameter that adjusts the sensitivity of anomaly detection; The weight is assigned according to the behavior similarity, and the expression is: Among them, A(i,:) and A(j,:) are the behavior similarity vectors between the i-th user and the j-th user and other different users respectively; The nonlinear compression cost function is constructed using fractional and exponential functions, and the expression is: Where P represents the loss value of the compression cost function, λ represents the adjustment coefficient of the compression cost, γ represents the amplification factor of the rank control, r represents the rank after the low-rank decomposition of the traffic feature matrix W, and ψ represents the nonlinear growth rate adjustment parameter; The rank represents the core parameter of the low-rank decomposition, and the number of ranks is at most min(Q, E), and min(Q, E) represents the maximum rank that the kernel matrix in the low-rank decomposition can represent; The rank is dynamically adjusted according to the loss values ​​of the anomaly detection loss function and the compression cost function. The expression is: Among them, r * represents the optimized rank; The sparsity constraint function is constructed by adding the core column sub-matrix to the sparsity constraint. The expression is: Among them, S represents the loss value of the sparsity constraint function, η represents the sparsity weight coefficient, p represents the number of columns of the core column submatrix, ||c b ||1 represents the L1 norm of the bth column in the core column submatrix; Construct the joint optimization objective function, the expression is: Among them, L represents the loss value of the anomaly detection loss function, P represents the loss value of the compression cost function, and S represents the loss value of the sparsity constraint function; The joint optimization objective function is decomposed using the augmented Lagrange multiplier method. The low-rank approximation matrix CUR is optimized by fixing the rank value. The loss value of the joint optimization objective function is recalculated by dynamically adjusting the rank value. A loss threshold is set. If the difference in the loss value between the joint optimization objective functions in two iterations is less than the loss threshold, it means that the joint optimization objective function has converged. The iteration is stopped, the optimal solution is output, and the optimal residual matrix is ​​obtained. Otherwise, the iteration is continued. By inputting the real-time residual matrix into the joint optimization objective function, the optimal residual matrix is ​​output.

4. The digital infrastructure performance archive management method based on distributed storage technology according to claim 3, characterized in that: The method of constructing a time series prediction model based on the optimal residual matrix to output a prediction residual matrix includes: The obtained optimal residual matrix is ​​divided into multiple time windows according to the time dimension. The abnormal fluctuation value of each column is calculated using the mean square deviation. The first H column features with the highest abnormal fluctuation value at the current time point are selected as abnormal fluctuation features. All abnormal fluctuation features in all time windows in the optimal residual matrix are extracted and normalized. All abnormal fluctuation features are divided into training set and test set. The time series prediction model is constructed by using a long short-term memory network as a time series prediction model, including an input layer, an LSTM hidden layer, and a fully connected output layer; The training set is input into the time series prediction model. The prediction residual matrix of the next time window is output through forward propagation. The mean square error is used as the loss function. The error between the predicted eigenvalue and the true eigenvalue is calculated through the loss function. The Adam optimizer is used to update the parameters to minimize the error. The number of iterations is set. If the loss value of the training set does not decrease for D consecutive times, the iteration is stopped early. Otherwise, the iteration is continued until the maximum number of iterations is reached. Use the test set to test the performance of the time series forecasting model and evaluate the precision, recall, and F1 score of anomaly detection; By inputting the real-time optimal residual matrix of all users into the time series prediction model, the prediction residual matrix of all users in the next time window is generated.

5. The digital infrastructure performance archive management method based on distributed storage technology according to claim 4 is characterized in that: The abnormal category interval classification based on the prediction residual matrix and the formulation of a hierarchical safety response strategy include: Based on the obtained prediction residual matrix, an abnormal threshold is set and the prediction residual matrix is ​​retrieved; If the predicted eigenvalue in the prediction residual matrix is ​​greater than the abnormal threshold, the user corresponding to the predicted eigenvalue is extracted and marked as a future abnormal user; otherwise, no operation is performed; Extract all predicted eigenvalues ​​of each future abnormal user in the prediction residual matrix, normalize them and construct an abnormal feature vector; Using the K-Means clustering algorithm, based on the abnormal feature vectors of all users, set the number of clusters to 3, randomly select the abnormal feature vectors of 3 users as the initial cluster centers, calculate the Euclidean distance between each user's abnormal feature vector and all initial cluster centers, and assign the user to the cluster center closest to it. Recalculate the mean of the abnormal feature vectors of all users in each cluster as the new cluster center, set the maximum number of iterations, and repeat the steps of assigning users to the nearest cluster center and updating the cluster center until the maximum number of iterations is reached. Each cluster corresponds to an abnormal category interval; The abnormal category intervals include high-frequency access intervals, sensitive access intervals and traffic sudden increase abnormal intervals; Formulate hierarchical security response strategies based on abnormality category intervals; If an abnormal user is in a high-frequency access range in the future, the user will be prompted for excessive operations and advised to try again later. The user's access frequency will be temporarily restricted and the access log will be recorded. If an abnormal user is in a sensitive access zone in the future, the user's access rights will be temporarily restricted, and the user will be required to re-verify their identity and the administrator will be notified; If in the future abnormal users are in the abnormal traffic surge range, the user request will be blocked and DDoS protection will be enabled.

6. A digital infrastructure performance archive management system based on distributed storage technology based on the digital infrastructure performance archive management method based on distributed storage technology according to any one of claims 1 to 5, characterized in that: include: Data collection module, used to collect user metadata in real time and perform preprocessing; A matrix construction module is used to construct a traffic feature matrix based on the metadata of each user in the past time; A low-rank decomposition module is used to obtain a residual matrix by using low-rank decomposition on the traffic feature matrix; The optimization output module is used to construct a joint optimization objective function based on the residual matrix and output the optimal residual matrix; Model building module, used to build a time series prediction model based on the optimal residual matrix and output the prediction residual matrix; The classification processing module is used to classify abnormal category intervals based on the prediction residual matrix and formulate a hierarchical security response strategy.

7. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the digital infrastructure performance archive management method based on distributed storage technology described in any one of claims 1 to 5 are implemented.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the digital infrastructure performance archive management method based on distributed storage technology described in any one of claims 1 to 5 are implemented.

Images