An AI-based data security traceability method and system

Abstract

The present invention discloses a data security tracing method and system based on artificial intelligence, which belongs to the field of data security tracing. The method comprises the following steps: collecting information related to abnormal data and historical abnormal data from a data source, and cleaning and standardizing the data; extracting user access data from the data, and at the same time extracting the attack methods of the historical abnormal data; eliminating models that cannot identify historical attack methods, and further screening and classifying the models based on existing data conditions, and finally randomly combining the remaining models to form a dual model and training and adjusting parameters and screening; generating an attack path through the dual model, screening the nodes in the attack path, and performing tracing analysis on the remaining nodes; the present invention proposes a data security tracing method and system based on artificial intelligence, which can achieve efficient and accurate tracing of abnormal data by screening and combining models and constructing path screening nodes, and significantly improve the resistance capability and response efficiency of the data security protection system.

Description

Technical Field

[0001] The present invention relates to the technical field of data security tracing technology, and in particular to a data security tracing method and system based on artificial intelligence. Background Art

[0002] As the wave of digitalization sweeps the world, data has become a core asset for the development of enterprises and society, and its security protection is of vital importance. Data traceability, as a key means to ensure data security, can effectively track the source of abnormal data and promptly detect and block security threats. Traditional data traceability methods often use a single traceability model for analysis. This single model exposes many shortcomings when facing complex and changeable network attack scenarios. Due to the limitations of the model, its detection accuracy is difficult to guarantee, and when encountering similar security threats for the second time, it is impossible to maintain stable and accurate detection effects. Moreover, the abnormal path constructed by a single model is not complete and is prone to missing key information, making it difficult to quickly identify the source of the attack. With the rapid development of artificial intelligence technology, its application in the field of data traceability has become a new trend. However, the current related methods still have problems such as low efficiency and weak pertinence in model screening, combination and abnormal node processing, and it is difficult to meet the increasingly complex data security traceability needs.

[0003] Currently, no effective solutions have been proposed for the problems in related technologies. Summary of the Invention

[0004] In response to the problems in the related technology, the present invention proposes a data security tracing method and system based on artificial intelligence to overcome the problems of inaccurate traceability data and low traceability efficiency in existing data security traceability.

[0005] To this end, the specific technical solutions adopted in the present invention are as follows:

[0006] A data security tracing method based on artificial intelligence, the method comprising the following steps:

[0007] S1. Collect information related to abnormal data and historical abnormal data from the data source, and clean and standardize the data;

[0008] S2. Extract user access data from the data and extract attack methods of historical abnormal data;

[0009] S3: Eliminate models that cannot identify historical attack methods, further screen and classify models based on existing data conditions, and finally randomly combine the remaining models to form a dual model, train and adjust parameters, and screen them;

[0010] S4. Generate an attack path through the dual model, filter the nodes in the attack path, and perform traceability analysis on the remaining nodes.

[0011] As a preferred embodiment, the process of collecting information related to abnormal data and historical abnormal data from a data source and performing data cleaning and standardization processing on the data includes the following steps:

[0012] S11. Collecting data-related information from various data sources, including but not limited to databases, server logs, network device logs, and application logs;

[0013] S12. Abnormal data in the collected historical data includes known attack patterns, compliance anomalies, and operational anomalies;

[0014] S13. Remove noise, duplicate data, and erroneous data from the collected data, and process missing values;

[0015] There are garbled or duplicate records in the log due to system failures, which need to be cleaned up. In addition, when processing missing values, the average value is used to fill the missing numerical values.

[0016] As a preferred embodiment, the attack method of extracting user access data from the data and extracting historical abnormal data includes the following steps:

[0017] S21. Capture the transaction ID, executing user, SQL statement, and timestamp of the data operation, as well as user login behavior, file access path, firewall interception events, and traffic characteristics;

[0018] S22. Summarize characteristics based on known attack types and filter dangerous behaviors in logs using preset rules; connect operations scattered in database, network, and application logs, use historical attack data to train AI models, automatically identify operations that deviate from normal behavior patterns, and finally classify discovered attack behaviors by type.

[0019] As a preferred embodiment, the method of eliminating models that cannot identify historical attack methods, further screening and classifying models based on existing data conditions, and finally randomly combining the remaining models to form a dual model and training and adjusting parameters and screening includes the following steps:

[0020] S31. Collect multiple basic models and store them in a model database;

[0021] S32. Use historical attack methods as samples to calculate the recall rate of the model. Models with a recall rate ≥ 90% are retained, and other models are removed from the database.

[0022] S33, establishing two labels, namely, known attack class and potential anomaly class, and using the known attack class and potential anomaly class labels to divide the model into class A and class B;

[0023] S34. Further screen the model based on the specific conditions of the existing data, and finally randomly combine the models within the remaining two categories of labels to form a dual model and train and adjust the parameters and screen.

[0024] As a preferred implementation, the specific steps of using historical attack methods as samples, calculating the recall rate of the model, retaining models with a recall rate ≥ 90%, and removing other models from the database are as follows:

[0025] S321. Extract data covering all known attack types from the attack sample library, label the actual attack type of each data item, and divide it into a training set and a test set.

[0026] S322. Input the test set into each candidate model in the model database, and record the detection results of each model for each type of attack;

[0027] S323. Calculate the recall rate by attack type, retain models with a recall rate ≥ 90%, and eliminate other models.

[0028] As a preferred embodiment, the method further screens the model based on the specific conditions of the existing data, and finally randomly combines the models in the remaining two types of labels to form a dual model and trains and adjusts the parameters, and the screening includes the following steps:

[0029] S341. First, filter based on data volume. If the data volume is small, models requiring large data volumes are eliminated. Then, filter based on feature dimensions and eliminate models that do not match the feature dimensions of the existing data. Finally, based on online testing requirements, eliminate models that do not meet thrust speed standards.

[0030] Filter models by data volume, feature dimension, and online detection requirements to ensure that the retained models are suitable for existing data and business scenarios, thereby improving model practicality.

[0031] S342. Randomly select one model from the A pool and one model from the B pool to form multiple dual-model combinations, and define the division of labor among the models. Model A is defined as explicit behavior chain tracing, and Model B is defined as implicit association analysis.

[0032] S343. Set the anomaly score threshold. Use the Class B model to filter the top 10% of high anomaly score data. Then use the Class A model for secondary classification. Jointly optimize the Class B anomaly threshold and the Class A confidence threshold. Finally, set the Class A output weight and the Class B anomaly score weight. The specific formula for calculating the total confidence is:

[0033] ;

[0034] in, is the total confidence after calculation, is the confidence of the class A model, is the abnormal score of the Class B model;

[0035] S344. Calculate the precision and recall rates, and obtain the F1 score based on the precision and recall rates. Set the constraints of false alarm rate ≤ 5% and response delay ≤ 100ms to obtain the optimal dual-model combination.

[0036] As a preferred embodiment, generating an attack path using the dual model, screening nodes in the attack path, and performing source tracing analysis on the remaining nodes include the following steps:

[0037] S41. Use model A to extract explicit attack behavior sequences and construct preliminary behavior chains through timestamps, operation type and permission changes; use model B to analyze unstructured data, construct node association graphs, calculate implicit association strengths, and identify potential risk nodes.

[0038] S42. Match the behavior chain of model A with the association graph of model B, and calculate the total confidence of the nodes; select nodes with a total confidence ≥ 0.85 to generate a high-confidence attack path;

[0039] S43. According to the attack path, the attack nodes are obtained and screened, unimportant nodes are eliminated, and the remaining nodes are traced and analyzed.

[0040] As a preferred embodiment, obtaining attack nodes according to the attack path and screening them, eliminating unimportant nodes, and performing source tracing analysis on the remaining nodes include the following steps:

[0041] S431, based on the total confidence of the dual model output, set 0.85 as the threshold, automatically filter low-confidence nodes, and retain only high-confidence nodes;

[0042] S432. Verify the necessity of nodes through time series and causal relationships to ensure that the nodes conform to the attack phase sequence. Nodes with significantly deviated timestamps are removed. Nodes with no direct correlation are marked as isolated nodes and removed.

[0043] S433. Classify the remaining nodes into entry nodes, diffusion nodes, and terminal nodes, and perform reverse tracing on the entry nodes, extract process logs and memory snapshots from the diffusion nodes, and finally integrate and output the original logs associated with the nodes according to the timeline.

[0044] An artificial intelligence-based data security traceability system, which adopts any of the artificial intelligence-based data security traceability methods described above, includes a data collection and preprocessing module, a feature extraction and selection module, a random dual-model selection module, and a data anomaly monitoring and traceability analysis module:

[0045] The data collection and preprocessing module collects data-related information from various data sources and cleans the data;

[0046] The feature extraction and selection module extracts the user's access data from the data as feature data, and extracts the attack methods of historical abnormal data;

[0047] The random dual-model selection module collects traceability models, removes models that cannot identify historical attack methods, and divides the models into Class A and Class B according to their categories. After the division is completed, the models in Class A and Class B are randomly combined to form multiple dual-model combinations, and evaluation conditions are set to obtain the best model combination;

[0048] The data anomaly monitoring and traceability analysis module is used for real-time data monitoring and identifying anomalies in the data, constructing attack paths through anomalies, and screening nodes in the attack paths for traceability analysis.

[0049] The beneficial effects of the present invention are:

[0050] 1. Tracing the source of abnormal data is an important means of data security protection, and data tracing usually needs to be completed using artificial intelligence models. First of all, when selecting a tracing model, the traditional method is usually to use a single tracing model for tracing analysis. This method,

[0051] The present invention collects models to establish a database and preliminarily eliminates models in the database using historical abnormal data, which can effectively retain models with high detection accuracy, so that when facing the same security threat again, it can maintain stable and accurate detection capabilities;

[0052] By classifying the remaining models, the present invention can effectively distinguish different models, providing a strong foundation for subsequent model combination. At the same time, the dual-model tracing can construct a more complete abnormal path compared to the traditional single-model tracing. In addition, the dual-model has a clear division of labor, which can achieve complementary advantages when constructing the path.

[0053] The present invention randomly combines and screens models in categories A and B. First, it can screen out the best tracing model from the model combination. Second, this mechanism of randomly combining tracing models can greatly reduce the possibility of the attacker predicting the tracing means. The dual-model combination is generated by random extraction from the candidate model pool, and the model division mode of each combination is different. This feature makes it impossible for the attacker to know the specific tracing path and detection logic rules in advance. Even if the attacker understands the characteristics of some models, it is difficult to formulate targeted avoidance strategies for the dynamically changing random combinations, and it is impossible to effectively hide the attack behavior trajectory, thereby significantly improving the unpredictability of the tracing system in confrontation and the effectiveness of attack tracking.

[0054] 2. The present invention obtains abnormal nodes through abnormal paths and screens the abnormal nodes, which can eliminate unimportant nodes and quickly obtain key nodes. It not only simplifies the tracing analysis steps of a single node, but also accurately eliminates redundant and secondary information and focuses on key attack nodes. In addition, it greatly simplifies the tracing process of a single node and can also reduce unnecessary analysis steps and time costs, so that the source of the attack can be locked in the shortest time. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0056] Figure 1 This is a flow chart of a data security tracing method based on artificial intelligence according to an embodiment of the present invention. DETAILED DESCRIPTION

[0057] To further illustrate each embodiment, the present invention provides drawings, which are part of the disclosure of the present invention. They are mainly used to illustrate the embodiments and can be used in conjunction with the relevant descriptions in the specification to explain the operating principles of the embodiments. By referring to these contents, ordinary technicians in this field should be able to understand other possible implementation methods and advantages of the present invention. The components in the figures are not drawn to scale, and similar component symbols are generally used to represent similar components.

[0058] According to an embodiment of the present invention, a flow chart of a data security tracing method based on artificial intelligence is provided.

[0059] The present invention will now be further described with reference to the accompanying drawings and specific embodiments. Figure 1 As shown, according to an embodiment of the present invention, a data security tracing method based on artificial intelligence includes the following steps:

[0060] S1. Collect information related to abnormal data and historical abnormal data from the data source, and clean and standardize the data;

[0061] Furthermore, information related to abnormal data and historical abnormal data are collected from the data source, and the data is cleaned and standardized, including the following steps:

[0062] S11. Collecting data-related information from various data sources, including but not limited to databases, server logs, network device logs, and application logs;

[0063] It should be noted that database logs can record data addition, deletion, and modification operations, and server logs can record user login and access behaviors; the collected data types may include structured data including tabular data in relational databases and unstructured data including text logs and images.

[0064] S12. Abnormal data in the collected historical data includes known attack patterns, compliance anomalies, and operational anomalies;

[0065] S13. Remove noise, duplicate data, and erroneous data from the collected data, and process missing values;

[0066] S2. Extract user access data from the data and extract attack methods of historical abnormal data;

[0067] Furthermore, the attack method of extracting user access data from the data and extracting historical abnormal data includes the following steps:

[0068] S21. Capture the transaction ID, executing user, SQL statement, and timestamp of the data operation, as well as user login behavior, file access path, firewall interception events, and traffic characteristics;

[0069] S22. Summarize characteristics based on known attack types and filter dangerous behaviors in logs using preset rules; connect operations scattered in database, network, and application logs, use historical attack data to train AI models, automatically identify operations that deviate from normal behavior patterns, and finally classify discovered attack behaviors by type.

[0070] S3: Eliminate models that cannot identify historical attack methods, further screen and classify models based on existing data conditions, and finally randomly combine the remaining models to form a dual model, train and adjust parameters, and screen them;

[0071] Furthermore, models that cannot identify historical attack methods are eliminated, and models are further screened and classified based on existing data conditions. Finally, the remaining models are randomly combined to form a dual model and trained and adjusted. The screening process includes the following steps:

[0072] S31. Collect multiple basic models and store them in a model database;

[0073] S32. Use historical attack methods as samples to calculate the recall rate of the model. Models with a recall rate ≥ 90% are retained, and other models are removed from the database.

[0074] Furthermore, we use historical attack methods as samples to calculate the recall rate of the model. We retain models with a recall rate ≥ 90% and remove other models from the database. The specific steps are as follows:

[0075] S321. Extract data covering all known attack types from the attack sample library, label the actual attack type of each data item, and divide it into a training set and a test set.

[0076] S322. Input the test set into each candidate model in the model database, and record the detection results of each model for each type of attack;

[0077] S323. Calculate the recall rate by attack type, retain models with a recall rate ≥ 90%, and eliminate other models.

[0078] It should be noted that by calculating the recall rate by attack type and retaining models ≥90%, inefficient models are effectively eliminated, so that the retained models have higher detection accuracy and stability when facing various known attacks, significantly improving the overall reliability and effectiveness of the data security traceability system, and enhancing its ability to resist attacks and accurately trace the source.

[0079] S33, establishing two labels, namely, known attack class and potential anomaly class, and using the known attack class and potential anomaly class labels to divide the model into class A and class B;

[0080] S34. Further screen the model based on the specific conditions of the existing data, and finally randomly combine the models within the remaining two categories of labels to form a dual model and train and adjust the parameters and screen.

[0081] Furthermore, the model is further screened based on the specific conditions of the existing data, and finally the models within the remaining two categories of labels are randomly combined to form a dual model and trained and adjusted. The screening includes the following steps:

[0082] S341. First, filter based on data volume. If the data volume is small, models requiring large data volumes are eliminated. Then, filter based on feature dimensions and eliminate models that do not match the feature dimensions of the existing data. Finally, based on online testing requirements, eliminate models that do not meet thrust speed standards.

[0083] S342. Randomly select one model from the A pool and one model from the B pool to form multiple dual-model combinations, and define the division of labor among the models. Model A is defined as explicit behavior chain tracing, and Model B is defined as implicit association analysis.

[0084] S343. Set the anomaly score threshold. Use the Class B model to filter the top 10% of high anomaly score data. Then use the Class A model for secondary classification. Jointly optimize the Class B anomaly threshold and the Class A confidence threshold. Finally, set the Class A output weight and the Class B anomaly score weight. The specific formula for calculating the total confidence is:

[0085] ;

[0086] in, is the total confidence after calculation, is the confidence of the class A model, is the abnormal score of the Class B model;

[0087] S344. Calculate the precision and recall rates, and obtain the F1 score based on the precision and recall rates. Set the constraints of false alarm rate ≤ 5% and response delay ≤ 100ms to obtain the optimal dual-model combination.

[0088] It should be noted that randomly combining type A and type B models and clearly dividing their work can leverage the unique strengths of different models in explicit behavior chain tracking and implicit association analysis, achieving complementary advantages. Furthermore, by setting anomaly thresholds, allowing the two models to collaborate on data screening and secondary classification, jointly optimizing thresholds and setting weights, and combining them with constraints such as precision, recall, F1 score, false alarm rate, and response delay, an optimal dual-model combination with high detection accuracy, low false alarm rate, and rapid response can be achieved.

[0089] This method of randomly combining tracing models can also effectively avoid the attacker's predictability of tracing methods. Since the dual-model combination is randomly drawn from a pool of candidate models, and the model division of labor, anomaly thresholds, and weight settings of each combination are not fixed, it is difficult for attackers to grasp the specific tracing path and detection logic in advance. Even if the attacker is familiar with some model characteristics, it is impossible to formulate avoidance strategies for specific combinations in advance, making it even more difficult to hide the traces of the attack.

[0090] S4. Generate an attack path through the dual model, filter the nodes in the attack path, and perform traceability analysis on the remaining nodes.

[0091] Furthermore, generating an attack path using the dual model, filtering nodes in the attack path, and performing source tracing analysis on the remaining nodes include the following steps:

[0092] S41. Use model A to extract explicit attack behavior sequences and construct preliminary behavior chains through timestamps, operation type and permission changes; use model B to analyze unstructured data, construct node association graphs, calculate implicit association strengths, and identify potential risk nodes.

[0093] S42. Match the behavior chain of model A with the association graph of model B, and calculate the total confidence of the nodes; select nodes with a total confidence ≥ 0.85 to generate a high-confidence attack path;

[0094] S43. According to the attack path, the attack nodes are obtained and screened, unimportant nodes are eliminated, and the remaining nodes are traced and analyzed.

[0095] An AI-based data security traceability system, which adopts any of the above AI-based data security traceability methods, includes a data collection and preprocessing module, a feature extraction and selection module, a random dual-model selection module, and a data anomaly monitoring and traceability analysis module:

[0096] Data collection and preprocessing module collects data-related information from various data sources and cleans the data;

[0097] Feature extraction and selection module extracts user access data from the data as feature data and extracts attack methods from historical abnormal data;

[0098] The random dual-model selection module collects traceability models, removes models that cannot identify historical attack methods, and divides the models into categories A and B. After the division is completed, the models in categories A and B are randomly combined to form multiple dual-model combinations, and evaluation conditions are set to obtain the optimal model combination;

[0099] The data anomaly monitoring and traceability analysis module is used for real-time data monitoring and identifying anomalies in the data. It constructs attack paths based on anomalies and filters nodes in the attack paths for traceability analysis.

[0100] In summary, the present invention establishes a database by collecting models and preliminarily eliminates the models in the database using historical abnormal data, which can effectively retain models with high detection accuracy, so that when facing the same security threat for the second time, it can maintain stable and accurate detection capabilities; the present invention can effectively distinguish different models by classifying the remaining models, providing a strong foundation for subsequent model combination. At the same time, the dual-model tracing can construct a more complete abnormal path compared to the traditional single-model tracing. In addition, this dual-type model has a clear division of labor and can achieve complementary advantages when constructing the path; the present invention randomly combines and screens the models in Class A and Class B. First, it can screen out the best tracing model from the model combination. Secondly, this mechanism of randomly combining tracing models can greatly reduce the possibility of the attacker predicting the tracing means. The dual-model combination The combination is generated by random extraction from the candidate model pool, and the model division mode of each combination is different. This feature makes it impossible for attackers to know the specific tracing path and detection logic rules in advance. Even if the attacker masters the characteristics of some models, it is difficult to formulate targeted avoidance strategies for the dynamically changing random combination, and it is impossible to effectively hide the attack behavior trajectory, thereby significantly improving the unpredictability of the tracing system in confrontation and the effectiveness of attack tracking; the present invention obtains abnormal nodes through abnormal paths and screens abnormal nodes, which can eliminate unimportant nodes and quickly obtain key nodes. It not only simplifies the tracing analysis steps of a single node, but also accurately eliminates redundant and secondary information, and focuses on key attack nodes. In addition, it greatly simplifies the tracing process of a single node, and can also reduce unnecessary analysis steps and time costs, so that the source of the attack can be locked in the shortest time.

[0101] The above are only preferred embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A data security tracing method based on artificial intelligence, characterized in that: The method comprises the following steps: S1. Collect information related to abnormal data and historical abnormal data from the data source, and clean and standardize the data; S2. Extract user access data from the data and extract attack methods of historical abnormal data; S3: Eliminate models that cannot identify historical attack methods, further screen and classify models based on existing data conditions, and finally randomly combine the remaining models to form a dual model, train and adjust parameters, and screen them; S31. Collect multiple basic models and store them in a model database; S32. Use historical attack methods as samples to calculate the recall rate of the model, retain models with a recall rate ≥ 90%, and remove other models from the database; S321. Extract data covering all known attack types from the attack sample library, label the actual attack type of each data item, and divide it into a training set and a test set. S322. Input the test set into each candidate model in the model database, and record the detection results of each model for each type of attack; S323. Calculate the recall rate by attack type, retain models with a recall rate ≥ 90%, and eliminate other models; S33, establishing two labels, namely, known attack class and potential anomaly class, and using the known attack class and potential anomaly class labels to divide the model into class A and class B; S34. Further screen the model based on the specific conditions of the existing data, and finally randomly combine the models within the remaining two categories of labels to form a dual model and train and adjust the parameters and screen; S341. First, filter based on data volume. If the data volume is small, models requiring large data volumes are eliminated. Then, filter based on feature dimensions and eliminate models that do not match the feature dimensions of the existing data. Finally, based on online testing requirements, eliminate models that do not meet thrust speed standards. S342. Randomly select one model from the A pool and one model from the B pool to form multiple dual-model combinations, and define the division of labor among the models. Model A is defined as explicit behavior chain tracing, and Model B is defined as implicit association analysis. S343. Set the anomaly score threshold. Use the Class B model to filter the top 10% of high anomaly score data. Then use the Class A model for secondary classification. Jointly optimize the Class B anomaly threshold and the Class A confidence threshold. Finally, set the Class A output weight and Class B anomaly score weight. The specific formula for calculating the total confidence is: Z=0.7 Z A +0.3·Z B ; Among them, Z is the total confidence after calculation, Z A is the confidence of the model of type A, Z B is the abnormal score of the Class B model; S344. Calculate the precision and recall, and obtain an F1 score based on the precision and recall. Set the constraints of false alarm rate ≤ 5% and response delay ≤ 100ms to obtain the optimal dual-model combination. S4. Generate an attack path through the dual model, filter the nodes in the attack path, and perform traceability analysis on the remaining nodes.

2. The data security tracing method based on artificial intelligence according to claim 1 is characterized in that: The process of collecting information related to abnormal data and historical abnormal data from the data source and cleaning and standardizing the data includes the following steps: S11. Collecting data-related information from various data sources, including but not limited to databases, server logs, network device logs, and application logs; S12. Abnormal data in the collected historical data includes known attack patterns, compliance anomalies, and operational anomalies; S13. Remove noise, duplicate data and erroneous data from the collected data, and process missing values.

3. The data security tracing method based on artificial intelligence according to claim 1 is characterized in that: The attack method of extracting user access data from the data and extracting historical abnormal data includes the following steps: S21. Capture the transaction ID, executing user, SQL statement, and timestamp of the data operation, as well as user login behavior, file access path, firewall interception events, and traffic characteristics; S22. Summarize characteristics based on known attack types and filter dangerous behaviors in logs using preset rules; connect operations scattered in database, network, and application logs, use historical attack data to train AI models, automatically identify operations that deviate from normal behavior patterns, and finally classify discovered attack behaviors by type.

4. The data security tracing method based on artificial intelligence according to claim 1 is characterized in that: Generating an attack path using the dual model, filtering nodes in the attack path, and performing source tracing analysis on the remaining nodes include the following steps: S41. Use model A to extract explicit attack behavior sequences and construct preliminary behavior chains through timestamps, operation type and permission changes; use model B to analyze unstructured data, construct node association graphs, calculate implicit association strengths, and identify potential risk nodes. S42. Match the behavior chain of model A with the association graph of model B, and calculate the total confidence of the nodes; select nodes with a total confidence ≥ 0.85 to generate a high-confidence attack path; S43. According to the attack path, the attack nodes are obtained and screened, unimportant nodes are eliminated, and the remaining nodes are traced and analyzed.

5. The data security tracing method based on artificial intelligence according to claim 4 is characterized in that: Obtaining attack nodes according to the attack path and screening them, eliminating unimportant nodes, and performing source tracing analysis on the remaining nodes includes the following steps: S431, based on the total confidence of the dual model output, set 0.85 as the threshold, automatically filter low-confidence nodes, and retain only high-confidence nodes; S432. Verify the necessity of nodes through time series and causal relationships to ensure that the nodes conform to the attack phase sequence. Nodes with significantly deviated timestamps are removed. Nodes with no direct correlation are marked as isolated nodes and removed. S433. Classify the remaining nodes into entry nodes, diffusion nodes, and terminal nodes, and perform reverse tracing on the entry nodes, extract process logs and memory snapshots from the diffusion nodes, and finally integrate and output the original logs associated with the nodes according to the timeline.

6. A data security tracing system based on artificial intelligence, characterized by: The system adopts an artificial intelligence-based data security traceability method as described in any one of claims 1 to 5, including a data collection and preprocessing module, a feature extraction and selection module, a random dual-model selection module, and a data anomaly monitoring and traceability analysis module: The data collection and preprocessing module collects data-related information from various data sources and cleans the data; The feature extraction and selection module extracts the user's access data from the data as feature data, and extracts the attack methods of historical abnormal data; The random dual-model selection module collects traceability models, removes models that cannot identify historical attack methods, and divides the models into Class A and Class B according to their categories. After the division is completed, the models in Class A and Class B are randomly combined to form multiple dual-model combinations, and evaluation conditions are set to obtain the best model combination; The data anomaly monitoring and traceability analysis module is used for real-time data monitoring and identifying anomalies in the data, constructing attack paths through anomalies, and screening nodes in the attack paths for traceability analysis.

Images