Information security data monitoring method and system based on encryption algorithm

Abstract

The present invention relates to the technical field of information security data monitoring, and specifically discloses an information security data monitoring method and system based on an encryption algorithm, the method comprising: collecting original information data byte stream, performing wavelet domain feature enhancement preprocessing and feature extraction, obtaining environmental sensor data, combining information data blocks and information feature matrices for context-aware dynamic encryption, obtaining information ciphertext and metadata, performing multimodal ciphertext feature extraction, outputting feature vectors, performing federal collaborative anomaly detection, constructing a multi-factor confidence decision architecture, outputting information access confidence scores and information access strategies, and adjusting context-aware dynamic encryption methods. The present invention solves the problems of insufficient real-time performance of traditional data monitoring and difficulty in fusing multi-source data, resulting in the need to improve the accuracy and recall rate of the detection model, resulting in omissions or false positives, and affecting the effectiveness of information security data monitoring.

Description

Technical Field

[0001] The present invention relates to the technical field of information security data monitoring, and in particular to an information security data monitoring method and system based on an encryption algorithm. Background Art

[0002] With the rapid development of information technology, data has become a vital asset for businesses and society. At the same time, cyberattacks are becoming increasingly sophisticated and diverse, and data breaches are becoming increasingly frequent. Encryption algorithms, as a core technology in information security, convert sensitive data into ciphertext, making it difficult for attackers to obtain the true content even if it is stolen during storage or transmission. With the continuous advancement of cryptographic theory, various advanced encryption algorithms, such as symmetric encryption algorithms (such as AES), asymmetric encryption algorithms (such as RSA), and hash algorithms (such as SHA-256), have emerged and gained widespread application in the information security field. This provides a solid technical foundation for encryption-based information security data monitoring methods. These methods can provide more direct and effective protection at the data level, ensuring the security and integrity of data regardless of where it is stored or how it is transmitted, meeting security requirements in complex network environments.

[0003] Nowadays, there are still some shortcomings in the research on information security data monitoring, which are specifically reflected in the lack of real-time performance of traditional data monitoring and the difficulty in fusing multi-source data. As a result, the accuracy and recall rate of the detection model still need to be improved, resulting in missed reports or false alarms, which affects the effectiveness of information security data monitoring. Summary of the Invention

[0004] In view of the deficiencies in the prior art, the present invention provides an information security data monitoring method and system based on an encryption algorithm, which can effectively solve the problems involved in the above-mentioned background technology.

[0005] To achieve the above objectives, the present invention is implemented through the following technical solutions: In the first aspect, the present invention provides an information security data monitoring method based on an encryption algorithm, comprising the following steps: collecting and preprocessing the original information data byte stream, outputting the preprocessed information data block and the information feature matrix; obtaining environmental sensor data, combining the information data block and the information feature matrix for context-aware dynamic encryption, obtaining information ciphertext and metadata and writing them into the security event log; based on the information ciphertext and metadata, performing multimodal ciphertext feature extraction, and outputting a feature vector; performing federal collaborative anomaly detection based on the feature vector, obtaining the global anomaly probability and the updated model parameters, and determining whether the global anomaly probability is written into the security event log; constructing a multi-factor confidence decision architecture, combining the global anomaly probability, and outputting the information access confidence score and the information access policy; obtaining the environmental context and combining the global anomaly probability to adjust the encryption method of the context-aware dynamic encryption.

[0006] As a further method, the original information data byte stream is collected and preprocessed, and the preprocessed information data block and information feature matrix are output. The specific analysis process is: the original information data byte stream is recorded as , where i is the byte number of the original information data byte stream, i=0,1,2,3,...N, N is the total number of bytes of the original information data byte stream, is the original information data byte value, , is the 255th original information data byte value; based on the Daubechies-4 wavelet basis function, the original information data byte stream is decomposed into 5 layers to obtain the coefficient set: ;in, is the detail coefficient of the kth layer, k=1,2,3,4,5, is the fifth-layer approximation coefficient;

[0007] The coefficient set Discrete inverse wavelet reconstruction outputs preprocessed information data blocks ; Energy ratio based on coefficient set calculate: ;in, is the L2 norm, is the square of the L2 norm; obtain the frequency of occurrence of each byte value of the original information data and calculate the information entropy , denoted as data sensitivity: ;in, is the frequency of occurrence of the byte value of the i-th original information data;

[0008] Output information feature matrix : Where, is the standard deviation of the noise after preprocessing, is the mean of the fifth-layer approximation coefficients.

[0009] As a further method, we obtain environmental sensor data, combine the information data block and information feature matrix to perform context-aware dynamic encryption, obtain information ciphertext and metadata and write them into the security event log. The specific analysis process is as follows: Extracting data sensitivity And use it as the initial sensitivity weight of document d. When the initial sensitivity weight of document d is greater than the sensitivity threshold stored in the database, AES-CTR is enabled to encrypt document d based on the environmental sensor data and information data block; if the initial sensitivity weight of document d is not greater than the sensitivity threshold stored in the database, the sensitivity weight of document d is updated in real time based on the sensitivity weight dynamic update formula , the dynamic update formula of sensitivity weight is:

[0010] ;

[0011] ;

[0012] Where, is the frequency of occurrence of document d in the recently processed document set D, is the compensation constant, is the total number of documents processed by the system, is the cross-document relevance, is the word frequency vector of document d, When calculating the cross-document relevance, it represents other documents in the recently processed document set D. For Documents The word frequency vector of ;

[0013] When the sensitivity weight of document d When the sensitivity weight of document d is greater than the sensitivity threshold stored in the database, AES-CTR is enabled to encrypt document d based on the environmental sensor data and information data block. If the sensitivity value is not greater than the sensitivity threshold stored in the database, the sensitivity weight of document d will continue to be updated. .

[0014] As a further method, the environmental sensor data includes latitude, longitude and Unix timestamp. AES-CTR is enabled to encrypt the document d based on the environmental sensor data and the information data block. The process is as follows: the latitude and longitude are encoded as environmental parameters to generate longitude and latitude hash values, and the Unix timestamp is modulo-operated to generate a time hash value:

[0015] ;

[0016] ;

[0017] In the formula, Lat represents latitude, Lon represents longitude, It is the longitude and latitude hash value generated by the SHA3 algorithm. The time hash value is generated by performing a modulo operation on the Unix timestamp and then using the CRC32 algorithm;

[0018] The system default basic key Generate a dynamic key by performing byte-by-byte XOR with the latitude and longitude hash value and the time hash value : ; Build a counter, including a randomly generated 12-byte initialization vector and a 4-byte counter value; use a dynamic key for the current counter Perform AES encryption to generate a 16-byte keystream block;

[0019] The pre-processed information data block The first 16-byte key stream block is XORed byte by byte to obtain the encrypted 16-byte data block, and the last 4 bytes of the counter are increased by 1 to form a new counter; a new 16-byte key stream block is repeatedly generated, and the pre-processed information data block is The next 16 bytes are XORed byte by byte with the new 16-byte keystream block until the pre-processed information data block After processing, all encrypted 16-byte data blocks are concatenated to obtain the ciphertext.

[0020] Get dynamic S-box offset , record the dynamic S-box offset, latitude and longitude hash value, time hash value and the current sensitivity weight of document d as metadata : .

[0021] As a further method, multimodal ciphertext feature extraction is performed based on the information ciphertext and metadata, and a feature vector is output. The specific analysis process is as follows: the frequency of each byte value in the information ciphertext is counted and stored in a byte distribution vector H with a length of 256. , , where a is the byte number of the byte distribution vector H, is the byte value of the jth byte of the information ciphertext, The byte value in the information ciphertext is The number of bytes, A is equal to 256;

[0022] based on Calculate the normalized entropy value : ;based on Calculate differential features : , where B is the total number of bytes in the ciphertext;

[0023] The ciphertext is input into the LSTM network with a window of 64 bytes, and the time series features based on the ciphertext are output. , , Represents the ciphertext data window from time step t−63 to time step t; the information ciphertext is input into the CNN convolution kernel as a window of 16 bytes, and the local features based on the information ciphertext are output , Where, is the weight parameter of the CNN convolution kernel, is the bias parameter of the CNN convolution kernel, is a linear rectification function, is the byte in the ciphertext starting from time step t and offset by c positions;

[0024] Obtaining hidden features based on dynamic S-box offsets in metadata :

[0025] Where, is the loop variable, is the right shift operator, is the bitwise AND operator, is 00001111 in binary;

[0026] Output feature vector : .

[0027] As a further method, federated collaborative anomaly detection is performed based on feature vectors to obtain the global anomaly probability and updated model parameters. The specific analysis process is as follows: Perform standardization to obtain anomaly detection vectors; process the anomaly detection vectors based on the multi-anomaly detection algorithm to generate multiple anomaly scores, and perform weighted summation to obtain a comprehensive anomaly score. ; Based on the locally stored anomaly score-anomaly probability mapping table, the local anomaly probability is determined as ; Obtain the dynamic weight of each node of the federal collaborative anomaly monitoring , aggregate the parameters of each node, based on the dynamic weight of each node Update the model parameters of node f to obtain updated model parameters;

[0028] Based on the dynamic weight of each node Calculating anomaly probability :

[0029] ;

[0030] Where F is the total number of nodes for federated collaborative anomaly monitoring, is the local abnormal probability of node f;

[0031] The abnormal probability Normalized as global anomaly probability .

[0032] As a further method, we can determine whether the global abnormality probability is written into the security event log. The specific analysis process is as follows: Compare with the global abnormal probability threshold stored in the database; if the global abnormal probability is not less than the global abnormal probability threshold, then write it into the security event log; if the global abnormal probability If the probability is less than the global anomaly probability threshold, it will not be written into the security event log.

[0033] As a further method, a multi-factor confidence decision architecture is constructed, combined with the global abnormal probability, to output the information access confidence score and information access strategy. The specific analysis process is as follows: The form of the multi-factor confidence decision architecture is:

[0034] ;

[0035] ;

[0036] in, Access confidence signals for information output by a multi-factor confidence decision architecture, is the global abnormal probability, is a data sensitive item, e is a natural constant, is the adjustment factor, is the sensitivity critical point, is the IP address difference, is the difference of geographical location information;

[0037] The information access strategy is: compare the information access confidence signal with the information access confidence threshold stored in the database; if the information access confidence signal is higher than the information access confidence threshold, allow information access; if the information access confidence signal is not higher than the information access confidence threshold, then verify the information access confidence twice.

[0038] As a further method, the environmental context is obtained and combined with the global abnormal probability to adjust the encryption method of context-aware dynamic encryption. The specific analysis process is: obtaining environmental context, including operation frequency and number of threat intelligence; obtaining data sensitivity , operation frequency, number of threat intelligence and data sensitivity Perform weighted summation to obtain the environmental risk coefficient RE; obtain the comprehensive risk coefficient R:

[0039] ,in, is the global abnormal probability, for The weight factor of

[0040] The encryption method of the following perceived dynamic encryption is determined based on the comprehensive risk factor-encryption method strategy table stored in the database.

[0041] A second aspect of the present invention provides an information security data monitoring system based on an encryption algorithm, comprising an information data preprocessing module, a perception dynamic encryption module, a feature vector output module, a global anomaly probability acquisition module, a confidence score output module, and an encryption mode adjustment module, wherein: the information data preprocessing module is used to collect and preprocess the original information data byte stream, and output the preprocessed information data block and information feature matrix; the perception dynamic encryption module is used to obtain environmental sensor data, perform context-aware dynamic encryption in combination with the information data block and the information feature matrix, obtain information ciphertext and metadata, and write them into a security event log; the feature vector output module is used to perform multimodal ciphertext feature extraction based on the information ciphertext and metadata, and output a feature vector; the global anomaly probability acquisition module is used to perform federated collaborative anomaly detection based on the feature vector, obtain the global anomaly probability and updated model parameters, and determine whether the global anomaly probability is written into the security event log; the confidence score output module is used to construct a multi-factor confidence decision architecture, and output the information access confidence score and information access policy in combination with the global anomaly probability; the encryption mode adjustment module is used to obtain the environmental context and adjust the encryption mode of the context-aware dynamic encryption in combination with the global anomaly probability.

[0042] Compared with the prior art, the embodiments of the present invention have at least the following advantages or beneficial effects:

[0043] (1) The present invention provides an information security data monitoring method and system based on an encryption algorithm, which performs wavelet domain feature enhancement preprocessing and feature extraction on the original information data byte stream, thereby highlighting the key features of the data and improving the quality and availability of the data. Context-aware dynamic encryption is performed by combining environmental sensor data, information data blocks, and information feature matrices, so that the encryption process can be adaptively adjusted according to the specific environment and data characteristics, thereby improving the pertinence and effectiveness of the encryption. By extracting and outputting feature vectors through multimodal ciphertext features, the ciphertext can be described from multiple perspectives, more comprehensively capturing the information contained in the ciphertext, thereby improving the accuracy and reliability of detection.

[0044] (2) By performing federated collaborative anomaly detection based on feature vectors, the present invention can utilize the data of multiple participants for joint detection without leaking data privacy, giving full play to the advantages of distributed computing. The obtained global anomaly probability can more comprehensively reflect the security situation of the entire system. The updated model parameters help to continuously optimize the detection model and improve detection performance. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] The present invention is further described with reference to the accompanying drawings. However, the embodiments in the accompanying drawings do not constitute any limitation to the present invention. A person skilled in the art can obtain other drawings based on the following drawings without creative effort.

[0046] Figure 1 Schematic diagram of the method steps of the present invention.

[0047] Figure 2 This is a schematic diagram of system module connections of the present invention. DETAILED DESCRIPTION

[0048] The technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0049] Reference Figure 1 As shown, the first aspect of the present invention provides an information security data monitoring method based on an encryption algorithm, comprising: collecting and preprocessing the original information data byte stream, and outputting the preprocessed information data block and information feature matrix.

[0050] The specific analysis process is: the original information data byte stream is recorded as , where i is the byte number of the original information data byte stream, i=0,1,2,3,...N, N is the total number of bytes of the original information data byte stream, is the original information data byte value, , is the 255th original information data byte value; based on the Daubechies-4 wavelet basis function, the original information data byte stream is decomposed into 5 layers to obtain the coefficient set: ;in, is the detail coefficient of the kth layer, k=1,2,3,4,5, is the fifth-layer approximation coefficient;

[0051] The coefficient set Discrete inverse wavelet reconstruction outputs preprocessed information data blocks ; Energy ratio based on coefficient set calculate: ;in, is the L2 norm, is the square of the L2 norm; obtain the frequency of occurrence of each byte value of the original information data and calculate the information entropy , denoted as data sensitivity: ;in, is the frequency of occurrence of the byte value of the i-th original information data;

[0052] Output information feature matrix : Where, is the standard deviation of the noise after preprocessing (the highest frequency coefficient in the coefficient set is obtained, calculated based on the MAD method), is the mean of the fifth-layer approximation coefficients.

[0053] After collecting the raw information data byte stream, we perform preprocessing using wavelet domain feature enhancement. Using the Daubechies-4 wavelet basis function, we perform a five-layer decomposition, breaking the data down into different frequency levels. This helps remove noise and highlight key features. The preprocessed information data blocks, obtained through discrete inverse wavelet reconstruction, are cleaner and more distinct than the original data, providing a better foundation for subsequent analysis.

[0054] Calculating the energy ratio of each layer's detail coefficients to the fifth-layer approximation coefficients reflects the contribution of different frequency components to the data, characterizing the data from an energy perspective. Calculating information entropy, a measure of data sensitivity, reflects the uncertainty and complexity of the data. Combining these features into an information feature matrix comprehensively describes the data from multiple dimensions, providing rich and valuable information for subsequent anomaly detection, encryption strategy development, and other tasks.

[0055] The processed data blocks and feature matrices can be used in context-aware dynamic encryption and combined with other data to better protect data; they can also be used for subsequent operations such as anomaly detection. Different features can meet the needs of different security analysis links and improve the effectiveness and flexibility of the entire information security monitoring system.

[0056] Acquire environmental sensor data, combine it with information data blocks and information feature matrices for context-aware dynamic encryption, obtain information ciphertext and metadata, and write them into the security event log.

[0057] The specific analysis process is as follows: Extracting data sensitivity And use it as the initial sensitivity weight of document d. When the initial sensitivity weight of document d is greater than the sensitivity threshold stored in the database, AES-CTR is enabled to encrypt document d based on the environmental sensor data and information data block; if the initial sensitivity weight of document d is not greater than the sensitivity threshold stored in the database, the sensitivity weight of document d is updated in real time based on the sensitivity weight dynamic update formula , the dynamic update formula of sensitivity weight is:

[0058] ;

[0059] ;

[0060] Where, is the frequency of occurrence of document d in the recently processed document set D, is the compensation constant, is the total number of documents processed by the system, is the cross-document relevance, is the word frequency vector of document d, When calculating the cross-document relevance, it represents other documents in the recently processed document set D. For Documents The word frequency vector of ;

[0061] When the sensitivity weight of document d When the sensitivity weight of document d is greater than the sensitivity threshold stored in the database, AES-CTR is enabled to encrypt document d based on the environmental sensor data and information data block. If the sensitivity value is not greater than the sensitivity threshold stored in the database, the sensitivity weight of document d will continue to be updated. .

[0062] Environmental sensor data includes latitude, longitude, and Unix timestamp. AES-CTR is enabled to encrypt document d based on the environmental sensor data and information data block. The process is as follows: the latitude and longitude are encoded as environmental parameters to generate longitude and latitude hash values, and the Unix timestamp is modulo-operated to generate a time hash value:

[0063] ;

[0064] ;

[0065] In the formula, Lat represents latitude, Lon represents longitude, It is the longitude and latitude hash value generated by the SHA3 algorithm. The time hash value is generated by performing a modulo operation on the Unix timestamp and then using the CRC32 algorithm;

[0066] The system default basic key Generate a dynamic key by performing byte-by-byte XOR with the latitude and longitude hash value and the time hash value : ; Build a counter, including a randomly generated 12-byte initialization vector and a 4-byte counter value; use a dynamic key for the current counter Perform AES encryption to generate a 16-byte keystream block;

[0067] The pre-processed information data block The first 16-byte key stream block is XORed byte by byte to obtain the encrypted 16-byte data block, and the last 4 bytes of the counter are increased by 1 to form a new counter; a new 16-byte key stream block is repeatedly generated, and the pre-processed information data block is The next 16 bytes are XORed byte by byte with the new 16-byte keystream block until the pre-processed information data block After processing, all encrypted 16-byte data blocks are concatenated to obtain the ciphertext.

[0068] Get dynamic S-box offset , record the dynamic S-box offset, latitude and longitude hash value, time hash value and the current sensitivity weight of document d as metadata : .

[0069] Initial weights are determined based on the information entropy in the information feature matrix, and sensitivity weights are calculated based on cross-document correlation. AES-CTR encryption is activated when the weight exceeds a threshold. This approach flexibly determines data sensitivity based on the data's characteristics and its correlation with other documents, allowing for high-strength encryption of truly sensitive data while ensuring security without over-consuming resources on encrypting non-sensitive data.

[0070] Dynamic key generation combines longitude and latitude information with timestamp information, using different hash algorithms to generate intermediate values, which are then calculated with the base key. Because the key is dependent on the real-time environment and time, it increases randomness and variability, making it difficult for attackers to predict and crack the key, thereby improving the security of the encryption system.

[0071] The output metadata includes information such as dynamic S-box offset, geolocation hash value, timestamp hash value, and sensitivity weight. This metadata provides rich information for subsequent data tracking, decryption, and security audits, facilitating understanding of the environment and sensitivity of data encryption, and enabling traceability and analysis when security issues arise.

[0072] Based on the information ciphertext and metadata, multimodal ciphertext feature extraction is performed and the feature vector is output.

[0073] The specific analysis process is as follows: the frequency of occurrence of each byte value in the ciphertext is counted and stored in a byte distribution vector H of length 256. , , where a is the byte number of the byte distribution vector H, is the byte value of the jth byte of the information ciphertext, The byte value in the information ciphertext is The number of bytes, A is equal to 256;

[0074] based on Calculate the normalized entropy value : ;based on Calculate differential features : , where B is the total number of bytes in the ciphertext;

[0075] The ciphertext is input into the LSTM network with a window of 64 bytes, and the time series features based on the ciphertext are output. , , Represents the ciphertext data window from time step t−63 to time step t; the information ciphertext is input into the CNN convolution kernel as a window of 16 bytes, and the local features based on the information ciphertext are output , Where, is the weight parameter of the CNN convolution kernel, is the bias parameter of the CNN convolution kernel, is a linear rectification function, is the byte in the ciphertext starting from time step t and offset by c positions;

[0076] Obtaining hidden features based on dynamic S-box offsets in metadata :

[0077] Where, is the loop variable, is the right shift operator, is the bitwise AND operator, is 00001111 in binary;

[0078] Output feature vector : .

[0079] By calculating statistical features, we can comprehensively characterize the byte distribution and information entropy of the ciphertext, understanding the data distribution characteristics of the ciphertext. Calculating differential features can reveal the variations between ciphertext bytes, helping to discover local variations in the ciphertext data. These statistical features provide fundamental and comprehensive information for ciphertext analysis.

[0080] Using an LSTM network to process 64-byte windows of ciphertext data effectively captures the dependencies and contextual information of ciphertext over time series. For ciphertext data with time series characteristics, LSTM can uncover potential patterns and regularities, improving the ability to understand and represent ciphertext features.

[0081] The CNN convolution kernel processes a 16-byte window, automatically extracting local features from ciphertext, such as specific byte patterns. The weight-sharing and local connectivity of the convolution operation make it efficient and targeted when processing ciphertext data, enabling rapid discovery of key local features within the ciphertext.

[0082] Parsing the dynamic S-box offset in metadata to generate hidden features fully utilizes the additional information in the encryption process. These hidden features may contain important information related to the characteristics of the encryption algorithm, facilitating a deeper analysis of the security and encryption status of the ciphertext, and increasing the dimensionality and depth of feature extraction.

[0083] Based on the feature vector, federal collaborative anomaly detection is performed to obtain the global anomaly probability and updated model parameters, and determine whether the global anomaly probability should be written into the security event log.

[0084] The specific analysis process is as follows: Perform standardization to obtain anomaly detection vectors; process the anomaly detection vectors based on multiple anomaly detection algorithms (such as Isolation Forest, One-Class SVM, Autoencoder), generate multiple anomaly scores, and perform weighted summation to obtain a comprehensive anomaly score. ; Based on the locally stored anomaly score-anomaly probability mapping table, the local anomaly probability is determined as ; Obtain the dynamic weight of each node of the federal collaborative anomaly monitoring , aggregate the parameters of each node, based on the dynamic weight of each node Update the model parameters of node f to obtain updated model parameters;

[0085] Based on the dynamic weight of each node Calculating anomaly probability :

[0086] ;

[0087] Where F is the total number of nodes for federated collaborative anomaly monitoring, is the local abnormal probability of node f;

[0088] The abnormal probability Normalized as global anomaly probability .

[0089] The global anomaly probability Compare with the global abnormal probability threshold stored in the database; if the global abnormal probability is not less than the global abnormal probability threshold, then write it into the security event log; if the global abnormal probability If the probability is less than the global anomaly probability threshold, it will not be written into the security event log.

[0090] In the federated learning model, each node does not need to share original data, but only needs to upload parameters to participate in model training and aggregation. While achieving anomaly detection, it avoids the risk of privacy leakage during data transmission and sharing, and meets the data security and privacy protection needs of different data owners.

[0091] Updating model parameters after each federation aggregation allows the model to continuously adapt to new data characteristics and distribution changes. Over time and as data accumulates, the model can be continuously optimized, maintaining its efficient detection capabilities for anomalies and adapting to the complex and ever-changing information security environment.

[0092] Comparing the global anomaly probability with the threshold determines whether to write to the security event log, avoiding the recording of excessive and meaningless information and reducing log storage overhead. By only recording anomalies that could potentially pose a security risk, security personnel can quickly locate and address potential security incidents, improving the efficiency of information security management.

[0093] The multi-factor confidence decision architecture is as follows:

[0094] ;

[0095] ;

[0096] in, Access confidence signals for information output by a multi-factor confidence decision architecture, is the global abnormal probability, is a data sensitive item, e is a natural constant, is the adjustment factor, is the sensitivity critical point, is the IP address difference, is the difference of geographical location information;

[0097] The information access strategy is: compare the information access confidence signal with the information access confidence threshold stored in the database; if the information access confidence signal is higher than the information access confidence threshold, allow information access; if the information access confidence signal is not higher than the information access confidence threshold, then verify the information access confidence twice.

[0098] This comprehensive assessment of information access security combines multiple factors, including global anomaly probability, data sensitivity, user credentials, historical log information, and the IP address and geographic location of the information access environment. This overcomes the limitations of single-factor assessments, enabling more accurate judgments on the credibility of access requests and reducing the risk of misjudgment.

[0099] By calculating sensitivity items, the assessment strategy can be flexibly adjusted based on the sensitivity of the data. For highly sensitive data, stricter access conditions are set; for less sensitive data, relatively looser conditions are set. This ensures data security while taking into account the usage needs of different data, improving the applicability of the system.

[0100] By collecting IP addresses and geographic location information from information access environments and assessing environmental differences, we can promptly identify abnormal access environments, such as unfamiliar IP addresses or significant location changes. This helps prevent access from untrusted environments and improves the security of information systems in complex network environments.

[0101] The calculated information access confidence signal is compared with the threshold to make a clear access decision. For high-confidence access requests, quick access is allowed to improve work efficiency; for low-confidence requests, secondary verification is performed to further ensure data security, achieving a balance between security and convenience.

[0102] Obtain environmental context and combine it with the global anomaly probability to adjust the encryption method of context-aware dynamic encryption.

[0103] The specific analysis process is as follows: obtaining environmental context, including operation frequency and number of threat intelligence; obtaining data sensitivity , operation frequency, number of threat intelligence and data sensitivity Perform weighted summation to obtain the environmental risk coefficient RE; obtain the comprehensive risk coefficient R:

[0104] ,in, is the global abnormal probability, for The weight factor of

[0105] The encryption method of the following perceived dynamic encryption is determined based on the comprehensive risk factor-encryption method strategy table stored in the database.

[0106] By combining environmental context (operation frequency, threat intelligence volume) and global anomaly probability, encryption key strength can be dynamically adjusted based on the actual security situation. When operations become frequent, threat intelligence increases, or anomaly probability rises, encryption key strength is promptly increased; otherwise, it is appropriately reduced, ensuring that encryption policies always adapt to the current environment and effectively address evolving security risks.

[0107] Reference Figure 2 As shown, the second aspect of the present invention provides an information security data monitoring system based on an encryption algorithm, including an information data preprocessing module, a perception dynamic encryption module, a feature vector output module, a global anomaly probability acquisition module, a confidence score output module and an encryption method adjustment module.

[0108] The information data preprocessing module is used to collect and preprocess the original information data byte stream, and output the preprocessed information data block and information feature matrix; the perception dynamic encryption module is used to obtain environmental sensor data, combine the information data block and the information feature matrix to perform context-aware dynamic encryption, obtain information ciphertext and metadata, and write them into the security event log; the feature vector output module is used to perform multimodal ciphertext feature extraction based on the information ciphertext and metadata, and output the feature vector; the global anomaly probability acquisition module is used to perform federal collaborative anomaly detection based on the feature vector, obtain the global anomaly probability and updated model parameters, and determine whether the global anomaly probability is written into the security event log; the confidence score output module is used to construct a multi-factor confidence decision architecture, combine the global anomaly probability, and output the information access confidence score and information access policy; the encryption method adjustment module is used to obtain the environmental context and adjust the encryption method of the context-aware dynamic encryption in combination with the global anomaly probability.

[0109] The above content is merely an example and explanation of the structure of the present invention. Those skilled in the art may make various modifications or additions to the described specific embodiments or replace them in a similar manner. As long as they do not deviate from the structure of the invention or exceed the scope defined by the claims, they should all fall within the scope of protection of the present invention.

Claims

1. An information security data monitoring method based on encryption algorithm, characterized in that: The following steps are involved: Collect the original information data byte stream and preprocess it, and output the preprocessed information data block and information feature matrix; Acquire environmental sensor data, combine it with information data blocks and information feature matrices for context-aware dynamic encryption, obtain information ciphertext and metadata, and write them into the security event log; Based on the information ciphertext and metadata, multimodal ciphertext feature extraction is performed and feature vectors are output; Perform federated collaborative anomaly detection based on feature vectors to obtain the global anomaly probability and updated model parameters, and determine whether the global anomaly probability should be written into the security event log. Construct a multi-factor confidence decision architecture, combine the global anomaly probability, and output information access confidence score and information access strategy; Obtain environmental context and combine it with the global anomaly probability to adjust the encryption method of context-aware dynamic encryption.

2. The information security data monitoring method based on encryption algorithm according to claim 1 is characterized in that: Collect the original information data byte stream and preprocess it, output the preprocessed information data block and information feature matrix. The specific analysis process is as follows: The original information data byte stream is recorded as , where i is the byte number of the original information data byte stream, i=0,1,2,3,...N, N is the total number of bytes of the original information data byte stream, is the original information data byte value, , The value of the 255th original information data byte; Based on the Daubechies-4 wavelet basis function, the original information data byte stream is decomposed into 5 layers to obtain the coefficient set: ;in, is the detail coefficient of the kth layer, k=1,2,3,4,5, is the fifth-layer approximation coefficient; The coefficient set Discrete inverse wavelet reconstruction outputs preprocessed information data blocks ; Energy ratio based on coefficient set calculate: ; in, is the L2 norm, is the square of the L2 norm; Obtain the frequency of occurrence of each byte value of the original information data and calculate the information entropy , denoted as data sensitivity: ; in, is the frequency of occurrence of the byte value of the i-th original information data; Output information feature matrix : ； Where, is the standard deviation of the noise after preprocessing, is the mean of the fifth-layer approximation coefficients.

3. The information security data monitoring method based on encryption algorithm according to claim 2 is characterized in that: Acquire environmental sensor data, combine it with information data blocks and information feature matrices for context-aware dynamic encryption, obtain information ciphertext and metadata, and write them into the security event log. The specific analysis process is as follows: from Extracting data sensitivity and use it as the initial sensitivity weight of document d. When the initial sensitivity weight of document d is greater than the sensitivity threshold stored in the database, AES-CTR is enabled to encrypt document d based on the environmental sensor data and the information data block. If the initial sensitivity weight of document d is not greater than the sensitivity threshold stored in the database, the sensitivity weight of document d is updated in real time based on the sensitivity weight dynamic update formula. , the dynamic update formula of sensitivity weight is: ； ； Where, is the frequency of occurrence of document d in the recently processed document set D, is the compensation constant, is the total number of documents processed by the system, is the cross-document relevance, is the word frequency vector of document d, When calculating the cross-document relevance, it represents other documents in the recently processed document set D. For Documents The word frequency vector of ; When the sensitivity weight of document d When the sensitivity weight of document d is greater than the sensitivity threshold stored in the database, AES-CTR is enabled to encrypt document d based on the environmental sensor data and information data block. If the sensitivity value is not greater than the sensitivity threshold stored in the database, the sensitivity weight of document d will continue to be updated. .

4. The information security data monitoring method based on encryption algorithm according to claim 3 is characterized in that: Environmental sensor data includes latitude, longitude, and Unix timestamp. AES-CTR is enabled to encrypt document d based on the environmental sensor data and information data block. The process is as follows: The environment parameters of latitude and longitude are encoded to generate longitude and latitude hash values, and the time hash value is generated after performing a modulo operation on the Unix timestamp: ； ； In the formula, Lat represents latitude, Lon represents longitude, It is the longitude and latitude hash value generated by the SHA3 algorithm. The time hash value is generated by performing a modulo operation on the Unix timestamp and then using the CRC32 algorithm; The system default basic key Generate a dynamic key by performing byte-by-byte XOR with the latitude and longitude hash value and the time hash value : ; Construct a counter, including a randomly generated 12-byte initialization vector and a 4-byte counter value; Use dynamic key for current counter Perform AES encryption to generate a 16-byte keystream block; The pre-processed information data block The first 16-byte key stream block is XORed byte by byte to obtain the encrypted 16-byte data block, and the last 4 bytes of the counter are increased by 1 to form a new counter; Repeatedly generate new 16-byte key stream blocks and pre-process the information data blocks The next 16 bytes are XORed byte by byte with the new 16-byte keystream block until the pre-processed information data block Processing completed; All encrypted 16-byte data blocks are concatenated to obtain the ciphertext; Get dynamic S-box offset , record the dynamic S-box offset, latitude and longitude hash value, time hash value and the current sensitivity weight of document d as metadata : 。 5. The information security data monitoring method based on encryption algorithm according to claim 4 is characterized in that: Based on the information ciphertext and metadata, multimodal ciphertext feature extraction is performed and feature vectors are output. The specific analysis process is as follows: The frequency of occurrence of each byte value in the statistical information ciphertext is stored in a byte distribution vector H of length 256. , , where a is the byte number of the byte distribution vector H, is the byte value of the jth byte of the information ciphertext, The byte value in the information ciphertext is The number of bytes, A is equal to 256; based on Calculate the normalized entropy value : ; based on Calculate differential features : , where B is the total number of bytes in the ciphertext; The ciphertext is input into the LSTM network with a window of 64 bytes, and the time series features based on the ciphertext are output. , , represents the ciphertext data window from time step t−63 to time step t; The ciphertext is input into the CNN convolution kernel with a window of 16 bytes, and the local features based on the ciphertext are output. , Where, is the weight parameter of the CNN convolution kernel, is the bias parameter of the CNN convolution kernel, is a linear rectification function, is the byte in the ciphertext starting from time step t and offset by c positions; Obtaining hidden features based on dynamic S-box offsets in metadata : ； Where, is the loop variable, is the right shift operator, is the bitwise AND operator, is 00001111 in binary; Output feature vector : .

6. The information security data monitoring method based on encryption algorithm according to claim 1 is characterized in that: Based on the feature vector, federated collaborative anomaly detection is performed to obtain the global anomaly probability and updated model parameters. The specific analysis process is as follows: For the eigenvector Perform standardization processing to obtain anomaly detection vector; The anomaly detection vector is processed based on the multi-anomaly detection algorithm to generate multiple anomaly scores, and the weighted sum is performed to obtain the comprehensive anomaly score. ; Based on the locally stored anomaly score-anomaly probability mapping table, the local anomaly probability is determined as ; Obtain the dynamic weight of each node in the federated collaborative anomaly monitoring , aggregate the parameters of each node, based on the dynamic weight of each node Update the model parameters of node f to obtain updated model parameters; Based on the dynamic weight of each node Calculating anomaly probability : ； Where F is the total number of nodes for federated collaborative anomaly monitoring, is the local abnormal probability of node f; The abnormal probability Normalized as global anomaly probability .

7. The information security data monitoring method based on encryption algorithm according to claim 6 is characterized in that: Determine whether the global abnormal probability is written into the security event log. The specific analysis process is as follows: The global anomaly probability Compare with the global anomaly probability threshold stored in the database; If the global abnormal probability If the probability is not less than the global abnormality probability threshold, it will be written into the security event log; If the global abnormal probability If the probability is less than the global anomaly probability threshold, it will not be written into the security event log.

8. The information security data monitoring method based on encryption algorithm according to claim 1 is characterized in that: Construct a multi-factor confidence decision architecture, combine the global abnormal probability, and output the information access confidence score and information access strategy. The specific analysis process is as follows: The multi-factor confidence decision architecture is as follows: ； ； in, Access confidence signals for information output by a multi-factor confidence decision architecture, is the global abnormal probability, is a data sensitive item, e is a natural constant, is the adjustment factor, is the sensitivity critical point, is the IP address difference, is the difference of geographical location information; The information access policy is: comparing the information access confidence signal with an information access confidence threshold stored in a database; If the information access confidence signal is higher than the information access confidence threshold, information access is allowed; If the information access confidence signal is not higher than the information access confidence threshold, the information access confidence is verified again.

9. The information security data monitoring method based on encryption algorithm according to claim 1, characterized in that: The environmental context is obtained and combined with the global anomaly probability to adjust the encryption method of context-aware dynamic encryption. The specific analysis process is as follows: Obtaining environmental context, including operation frequency and threat intelligence count; Get data sensitivity , operation frequency, number of threat intelligence and data sensitivity Perform weighted summation to obtain the environmental risk coefficient RE; Get the comprehensive risk factor R: ,in, is the global abnormal probability, for The weight factor of The encryption method of the following perceived dynamic encryption is determined based on the comprehensive risk factor-encryption method strategy table stored in the database.

10. An information security data monitoring system based on an encryption algorithm, applied to an information security data monitoring method based on an encryption algorithm according to any one of claims 1 to 9, characterized in that: It includes information data preprocessing module, perception dynamic encryption module, feature vector output module, global anomaly probability acquisition module, confidence score output module and encryption mode adjustment module, among which: The information data preprocessing module is used to collect the original information data byte stream and preprocess it, and output the preprocessed information data block and information feature matrix; The perceptual dynamic encryption module is used to obtain environmental sensor data, combine the information data block and the information feature matrix to perform context-aware dynamic encryption, obtain information ciphertext and metadata, and write them into the security event log; The feature vector output module is used to extract multimodal ciphertext features based on the information ciphertext and metadata, and output a feature vector; The global anomaly probability acquisition module is used to perform federated collaborative anomaly detection based on the feature vector, obtain the global anomaly probability and updated model parameters, and determine whether the global anomaly probability is written into the security event log; The confidence score output module is used to construct a multi-factor confidence decision architecture, combine the global abnormality probability, and output the information access confidence score and information access strategy; The encryption mode adjustment module is used to obtain the environmental context and adjust the encryption mode of the context-aware dynamic encryption in combination with the global abnormality probability.

Images