A data protection method and system of a layered architecture security operation platform

Abstract

The application discloses a kind of data protection method and system of safe operation platform, this method includes: obtaining the original data of user side, and carries out initial analysis, to identify and encrypt the data of potential security risks;Obtain the encrypted original data, and based on homomorphic encryption mode carries out data security processing to obtain homomorphic encryption data;Homomorphic encryption data is obtained, and it is carried out depth data processing and risk assessment to it.It realizes the security protection of user side data from acquisition to processing whole process, effectively avoids data leakage risk, protects data privacy.In the process of depth data processing and risk assessment, potential security threats can be mined, providing strong support for security operation, improving the identification and response capability of security operation platform to various security risks, ensuring the stable and reliable operation of security operation platform.

Description

Technical Field

[0001] This invention relates to the field of data security technology, and in particular to a data protection method and system for a layered architecture security operation platform. Background Technology

[0002] Currently, in the security operations field, security alerts and vulnerability data from multiple tenants are typically transmitted over a network to a centralized security operations platform. To ensure data security, all data, especially raw data, is usually encrypted during transmission. Data storage within the security operations platform is also encrypted. Security operations platform personnel view or use raw data when processing it, and the platform needs to use sensitive data to train AI models. Even if data is encrypted during transmission and storage, the actions of operations personnel handling raw data, and the use of plaintext data during AI model training, can easily lead to intentional or unintentional data leakage. For example, the leakage of vulnerability data in a customer's system could compromise the user's system, causing serious losses. Traditional data encryption methods cannot effectively solve the problem of data leakage during processing on the operations platform; relying solely on encryption during transmission and storage is insufficient to guarantee the security of data throughout the entire process. Summary of the Invention

[0003] In view of this, the present invention proposes a data protection method and system for a secure operation platform, which can ensure that user data is not leaked on the operation platform during secure operation, and can process user data using a modified privacy calculation method. The present invention provides the following technical solution:

[0004] A data protection method for a secure operations platform, the method comprising:

[0005] Obtain raw data from the user side and perform initial analysis to identify and encrypt data with security vulnerabilities;

[0006] Obtain the encrypted original data and perform data security processing on it based on homomorphic encryption to obtain homomorphically encrypted data;

[0007] The homomorphic encrypted data is acquired and subjected to in-depth data processing and risk assessment.

[0008] Optionally, the method for obtaining raw data from the user side and performing initial analysis to identify and encrypt data with security vulnerabilities includes:

[0009] Deploy data acquisition and preliminary detection and analysis probes on the user side;

[0010] The probe captures raw data;

[0011] Initial analysis is performed by utilizing the probe's associated computing resources to identify and encrypt data that poses security risks.

[0012] Optionally, the method of obtaining the encrypted original data and performing data security processing on it based on homomorphic encryption to obtain homomorphically encrypted data includes:

[0013] Authentication based on zero-knowledge proofs to obtain encrypted raw data;

[0014] Identify and filter out sensitive information that requires homomorphic encryption;

[0015] The sensitive information is preprocessed;

[0016] Privacy-preserving computations are performed on preprocessed sensitive information based on a homomorphic encryption library.

[0017] Optionally, the method for performing privacy computation on preprocessed sensitive information based on a homomorphic encryption library includes:

[0018] Homomorphic encryption will be performed on the following sensitive information:

[0019] User-side IP address, specifically the user's internal network IP address and the Internet address exposed on the public network;

[0020] Vulnerability information, specifically the name of the vulnerability, its port, and the original exploitation information;

[0021] The vulnerability attack payload information includes, specifically, the attack commands and attack parameters;

[0022] Vulnerability attack response information.

[0023] Optionally, the method for identifying and filtering sensitive information that needs to be homomorphically encrypted includes: identifying and filtering sensitive information that meets the detection strategy based on a preset detection strategy;

[0024] The method for preprocessing sensitive information includes: performing Base64 processing on the sensitive information and converting the sensitive information into an integer, and performing homomorphic character concatenation operation on the sensitive information using a homomorphic encryption library.

[0025] Optionally, the method for obtaining the homomorphically encrypted data and performing in-depth data processing and risk assessment includes:

[0026] Perform exposure surface and topology analysis on the data after data security processing;

[0027] It calls a pre-set homomorphically encrypted message and splits it into commands and parameters;

[0028] The data after security processing is compared with the commands and parameters to compare a large number of command and parameter combinations and complete the risk assessment.

[0029] Optionally, after obtaining the encrypted original data and performing data security processing based on homomorphic encryption, the method further includes:

[0030] Perform machine learning analysis on the data after data security processing to extract potential dangerous behavior patterns from the data without exposing the original data;

[0031] The extracted dangerous behavior patterns are processed and validated to train and evaluate the threat model.

[0032] This invention further discloses a data protection system for a secure operation platform, comprising:

[0033] The data processing module is used to acquire raw data from the user side and perform initial analysis to identify and encrypt data with security risks.

[0034] The data encryption module is used to obtain the encrypted original data and perform data security processing on it based on homomorphic encryption to obtain homomorphically encrypted data.

[0035] The data operations module is used to acquire the homomorphic encrypted data and perform in-depth data processing and risk assessment on it.

[0036] The present invention further discloses a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described data protection method.

[0037] The present invention further discloses an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above-described data protection method when executing the program.

[0038] According to the technical solution of this invention, the system first acquires raw user-side data, performs initial analysis to identify and encrypt data with potential security vulnerabilities, then acquires encrypted initial analysis data and performs data security processing based on homomorphic encryption, and finally acquires encrypted data that has undergone data security processing for in-depth data processing and risk assessment. This achieves full-process security protection for user-side data from acquisition to processing, effectively avoiding data leakage risks and ensuring data privacy. During in-depth data processing and risk assessment, potential security threats can be identified, providing strong support for security operations, enhancing the security operations platform's ability to identify and respond to various security vulnerabilities, and ensuring the stable and reliable operation of the security operations platform. Attached Figure Description

[0039] For illustrative and not limiting purposes, the present invention will now be described in conjunction with embodiments and accompanying drawings, wherein:

[0040] Figure 1 This is a schematic diagram of the data protection method for a secure operation platform in an embodiment of the present invention;

[0041] Figure 2 This is a schematic diagram of the data protection system of the security operation platform in an embodiment of the present invention;

[0042] Figure 3 This is a schematic diagram of the structure of the electronic device in an embodiment of the present invention. Detailed Implementation

[0043] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present application, and not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present application.

[0044] It should be noted that, where there is no conflict, the embodiments and features of the embodiments in this application can be combined with each other. The embodiments of this application will be described in detail below with reference to the accompanying drawings.

[0045] refer to Figure 1 This embodiment discloses a data protection method for a secure operation platform, used to ensure the data security of user data during the processing of user data on the secure operation platform. The method includes:

[0046] S100: Acquire raw data from the user side and perform initial analysis to identify and encrypt data with security vulnerabilities.

[0047] This method is implemented through the terminal layer of the security operations platform, that is, by deploying data acquisition and preliminary detection and analysis probes on the user side to retain raw data. In this embodiment, raw data includes, but is not limited to, operation logs, network traffic, and vulnerability scanning data. Specifically, operation logs record in detail various events and operations during system operation, providing rich and detailed information for analyzing system behavior; network traffic data reflects the real-time status of network activity, helping to discover abnormal network connections and data transmissions; vulnerability scanning data directly reveals potential security vulnerabilities in the system and is a key focus of security protection.

[0048] Furthermore, after data collection, the probe performs preliminary detection and analysis on the data. Utilizing its onboard computing resources, it performs real-time analysis of the collected data to quickly identify potential security vulnerabilities. For example, by detecting specific error messages and abnormal operations in the operation logs, and identifying abnormal traffic patterns in network traffic, it can promptly detect potential attacks or system failures. After completing data acquisition and preliminary analysis, the terminal layer retains the raw data. On the one hand, the raw data provides the most authentic and comprehensive information for subsequent in-depth analysis, avoiding the risk of losing critical information due to data preprocessing; on the other hand, when retrospective analysis or verification is required, the raw data ensures the accuracy and reliability of the analysis results. To ensure the secure storage of the raw data, the terminal layer employs secure and reliable storage technologies and encryption methods to prevent unauthorized access, tampering, or leakage of the raw data. Available encryption methods include national or commercial cryptographic standards, such as SM or TLS.

[0049] S200: Obtain the encrypted original data and perform data security processing on it based on homomorphic encryption to obtain homomorphically encrypted data.

[0050] After processing the raw data in step S100, the privacy data computation intermediate layer of the security operation platform obtains the data after initial analysis. This includes both unencrypted data and encrypted data that poses security risks. To further ensure security during data transmission, the terminal layer and the privacy data computation intermediate layer use a zero-knowledge proof-based authentication mechanism each time a connection is established for data transmission. Under the zero-knowledge proof system, the data acquirer (the privacy data computation intermediate layer in this embodiment) acts as the prover, proving to the data provider (the terminal layer in this embodiment) that it has the legitimate ability to acquire data without disclosing any sensitive identity information or key content. The verification process is completed through a series of encrypted calculations and random challenge response mechanisms. For example, the prover generates a random number r and calculates... (in For large prime numbers, For model The prover calculates and sends the original root (c) to the verifier, who randomly selects challenge c, and the prover calculates and sends the response. ( (For the prover's key), the verifier verifies... ( The legitimacy of the certifier's identity is determined by whether the public key is valid. Only through identity verification can the encrypted, initially analyzed data be obtained, effectively preventing unauthorized data acquisition and ensuring the security of the data source.

[0051] After successfully acquiring the data, a deep analysis is performed based on a pre-defined detection strategy to accurately identify and filter sensitive information requiring homomorphic encryption. The detection strategy is developed based on numerous security threat cases and industry best practices, ensuring high targeting and accuracy. For security operation data, key sensitive information includes user-side IP addresses, vulnerability information, vulnerability attack payload information, and vulnerability attack response information. User-side IP addresses involve the topology and location information of the user's network. Whether internal network IP addresses or publicly exposed Internet addresses, they require strict protection to prevent attackers from using this information for network probing and attacks. Vulnerability information includes the vulnerability name, port, and original exploit information. This information directly reflects the system's security weaknesses, and its leakage could lead to targeted attacks by attackers. Vulnerability attack payload information contains attack commands and parameters, representing the core instructions for attackers to carry out attacks; encrypting this information effectively hides the attack intent and methods. Vulnerability attack response information records the system's feedback to the attack, helping to analyze the attack's effectiveness and the system's security status; it also requires encryption protection.

[0052] Furthermore, considering the requirements of homomorphic encryption algorithms on data format and type, as well as the need to improve encryption efficiency and security, the selected sensitive information undergoes preprocessing. Since the sensitive information contains a large amount of string data, and most homomorphic encryption algorithms are more suitable for numerical calculations, these strings are first Base64 encoded to convert them into byte sequences suitable for encryption, and then further converted into integer form. Taking the vulnerability name as an example, assuming the vulnerability name is "SQL Injection Vulnerability", after Base64 encoding, it becomes "U1FMIEluamVjdGlvbiBWdWxuZXJhYmlsaXR5", which is then converted into its corresponding integer representation. This allows for more efficient data processing during homomorphic encryption and ensures the accuracy and stability of the encryption. Simultaneously, the preprocessing process can also clean and standardize the data, removing redundant information and noisy data, improving the efficiency of subsequent encryption and analysis. After preprocessing, comprehensive privacy calculations are performed on the preprocessed sensitive information based on a homomorphic encryption library (such as Microsoft's SEAL library). The homomorphic encryption library provides a rich set of encryption algorithms and function interfaces to meet the encryption needs of different types of sensitive information.

[0053] S300: Obtain the homomorphic encrypted data and perform in-depth data processing and risk assessment on it.

[0054] This method is processed at the centralized operation platform layer of the security operation platform. When acquiring data after data security processing, the centralized operation platform layer and the privacy data calculation intermediate layer in step S200 establish a connection and use the same zero-knowledge proof-based authentication method as in step S200.

[0055] Deep data processing and risk assessment include analyzing the exposure surface and topology of data after privacy computation. For exposure surface analysis, data analysis identifies various assets in the network, including servers, terminal devices, and network devices. For example, based on IP addresses and port information, running services and applications are identified, thus pinpointing potential exposure points in the network. Simultaneously, vulnerability information in the data is combined to perform vulnerability scanning and analysis on assets. For encrypted vulnerability data, homomorphic encryption is used for security vulnerability detection and assessment. For example, by comparing the characteristics of known vulnerabilities with information in encrypted data, it is determined whether an asset is at risk of attack. Furthermore, the network's connections to external networks are analyzed to determine which assets are directly exposed to the public internet. The security of these exposed assets is assessed, such as by checking firewall rules and access control lists, to determine if there is unnecessary external exposure. For network topology analysis, network connection information in the data is used to reconstruct the network topology. By analyzing IP address allocation, subnetting, and connections between devices, a network topology map is drawn. For encrypted IP address information, homomorphic computation methods are used for analysis. For example, modular inversion within a finite domain is used to determine whether IP addresses are in the same network segment, thereby determining the network hierarchy and connection methods. Since general homomorphic computation libraries do not support homomorphic division, this method uses modular inversion within a finite domain for special processing. For example, for homomorphically encrypted IP addresses IP1 and IP2, to determine whether they are in the same Class C network segment, the formula... , (Where E is a homomorphic encryption function) is used for calculation. If A equals B, it can be determined that they are in a Class C network segment, thus enabling effective analysis of the network topology without exposing the user's real IP address, providing crucial support for attack assessment.

[0056] When processing vulnerability information, vulnerability attack payload information, and vulnerability attack response information, functions supporting homomorphic character concatenation operations provided by the homomorphic encryption library are utilized. In this implementation, the `homomorphic_strcat` function is selected, but there are no restrictions on its use. This function performs homomorphic concatenation encryption on strings and calculates and outputs the sum of the lengths of the homomorphically concatenated string and the original string (while maintaining the homomorphic encryption state). Specifically, homomorphically encrypted attack characteristics, responses, and vulnerability exploitation information are retrieved from the pre-built database of the security operations platform. This information is pre-collected and organized, covering various known security threats and attack patterns. During the retrieval process, data security and integrity are ensured through encrypted transmission and digital signatures to prevent data from being tampered with or stolen during transmission. The homomorphically encrypted information is further decomposed, including command extraction and parameter decomposition. For command extraction, the homomorphically encrypted information is parsed to extract the attack commands. For example, for SQL injection attack information, the injected SQL statement is extracted; for command injection attacks, the executed system commands are extracted. During the extraction process, homomorphic encryption is used to analyze and identify data without decryption. For parameter splitting, command-related parameters are extracted from the information. For example, for an SQL query command with parameters, parameters such as query conditions and table names are extracted separately. This splitting operation decomposes complex attack information into finer-grained commands and parameters, facilitating subsequent comparison and analysis.

[0057] After obtaining the commands and parameters, the data processed in step S200 is compared with the commands and parameters to compare a large number of command and parameter combinations and complete a risk assessment. This embodiment provides an exemplary comparison strategy, first defining the homomorphically encrypted attack payload and payload length as follows: E(payload) , E (payload_len) The attack command, its length, and multiple parameters in the pre-set analysis database after homomorphic encryption are as follows: E (attack_cmd) , E(attack_cmd_len) , E(attack_arg1) , E(attack_arg1_len) ,…, E(attack_ argn) , E(attack_argn_len) Furthermore, let's first compare... E(payload_len) Is it equal to E(attack_cmd_ len) + E(attack_arg i _len) If they are equal, then compare them. E(payload) Is it equal to E(attack_cmd) + E (attack_argi ) Otherwise, change to the next command parameter until the end. i The two additions mentioned above are not the same; the former is the addition of homomorphic integers, while the latter is the concatenation of homomorphic characters. For risk assessment, this implementation determines the threat level of the attack based on the comparison results. For example, if the attack payload completely matches a known high-risk attack command and parameter combination, it is judged as high-risk; if it partially matches or has similarities, it is judged as medium-risk or low-risk depending on the specific circumstances.

[0058] After obtaining the encrypted original data and performing data security processing based on homomorphic encryption, the data protection method of this embodiment further includes:

[0059] Machine learning analysis is performed on the data after it has undergone security processing to extract potential dangerous behavior patterns without exposing the original data. These extracted patterns are then processed and validated to train and evaluate threat models. Specifically, the security-processed data is transmitted to the machine learning layer of the security operations platform. During this process, sensitive information has already undergone deep processing using homomorphic encryption. When this encrypted sensitive information reaches the machine learning layer, a dedicated learning framework adapted to homomorphically encrypted data must be built to meet the operational requirements of the machine learning algorithm and ensure data privacy. For example, based on the characteristics of homomorphic encryption algorithms, a feature extraction module that can directly operate on encrypted data is designed. Taking the identification of network attack behavior as an example, this module can extract potential risk features such as abnormal traffic patterns and suspicious command sequences from the encrypted data without decryption, through mathematical operations supported by homomorphic encryption. This allows the machine learning model to learn and train based on these encrypted features. During the model training phase, the federated learning concept is used, with multiple data owners participating in the training process. All parties only need to upload homomorphically encrypted data, and the interaction and updates of model parameters are conducted within the encrypted domain, ensuring that the original data of each party remains confidential throughout the entire process. For example, different branches of an enterprise each possess some user behavior data. Through federated learning, they collaboratively train and optimize a model used to detect malware intrusions. This enriches the diversity of training data, improves model performance, and eliminates the risk of privacy leaks caused by data aggregation. In the model verification stage, zero-knowledge proof technology is introduced to verify the reliability of the model's output results. When the model draws a risk assessment conclusion based on encrypted data, the zero-knowledge proof mechanism proves the accuracy of the conclusion to the verifier, without disclosing any information about the original data or the details of the model's internal operations. For example, when determining whether a network connection has a security risk, the model can provide credible risk assessment evidence to operations personnel without revealing specific connection data, ensuring that no information that should not be disclosed is exposed throughout the entire machine learning process, from data input and model training to result output, thus protecting data privacy and security.

[0060] In summary, the data protection method for the security operation platform disclosed in this embodiment constructs a comprehensive protection system from data collection to analysis and processing, demonstrating significant technical effectiveness. First, at the data collection source, i.e., the user side, probes are deployed to retain raw data. This raw data encompasses diverse information such as operation logs, network traffic, and vulnerability scanning data, providing detailed evidence for subsequent analysis. Simultaneously, the probes utilize their own computing resources to initially detect potential vulnerabilities, ensuring data source security. Next, through a privacy data computation intermediate layer, zero-knowledge proof authentication is used when transmitting data with the terminal layer to ensure the legitimacy of the data source. After acquiring the data, sensitive information, such as user-side IP addresses and vulnerability-related information, is identified and filtered according to precise strategies, and preprocessed to conform to homomorphic encryption. Then, deep privacy computation is performed using a powerful homomorphic encryption library to rigorously protect the data. Furthermore, at the centralized operation platform layer, zero-knowledge proofs are also used to ensure connection security. Subsequently, deep data processing and risk assessment are conducted, using homomorphic computation to analyze network topology and asset exposure surfaces, and using homomorphic character concatenation functions to disassemble attack information and compare data to determine the risk level. Finally, the machine learning layer uses homomorphic encrypted data to train the model and build a dedicated learning framework. By combining federated learning and zero-knowledge proofs, it can not only discover potential dangerous behavior patterns to optimize the threat model, but also ensure data privacy in all aspects. From beginning to end, the data is in a state of being usable but not visible, which can effectively protect data privacy and security.

[0061] refer to Figure 2 This embodiment further discloses a data protection system for a secure operation platform, including:

[0062] The data processing module 21 is used to acquire raw data from the user side and perform initial analysis to identify and encrypt data with security risks; it is also used to deploy data acquisition and preliminary detection and analysis probes on the user side; capture raw data through the probes; and call computing resources related to the probes to perform initial analysis to identify and encrypt data with security risks.

[0063] The data encryption module 22 is used to obtain the encrypted original data and perform data security processing on it based on homomorphic encryption to obtain homomorphically encrypted data; it is also used to obtain the encrypted original data based on zero-knowledge proof authentication; identify and filter sensitive information that needs to be homomorphically encrypted; preprocess the sensitive information; and perform privacy calculations on the preprocessed sensitive information based on the homomorphic encryption basic library.

[0064] The data operation module 23 is used to acquire the homomorphically encrypted data, perform in-depth data processing and risk assessment on it, and also to perform exposure surface and topology analysis on the data after security processing; call the pre-set homomorphically encrypted information and split it into commands and parameters; compare the data after security processing with the commands and parameters to compare a large number of command and parameter combinations and complete risk assessment; and also to perform machine learning analysis on the data after security processing to extract potential dangerous behavior patterns from the data without exposing the original data; and to perform model processing and verification on the extracted dangerous behavior patterns to train and evaluate the threat model.

[0065] Figure 3 A schematic diagram of the physical structure of an electronic device provided in an embodiment of the present invention, such as... Figure 3 As shown, the electronic device 50 includes: a processor 501, a memory 502, and a bus 503;

[0066] The processor 501 and the memory 502 communicate with each other via the bus 503; the processor 501 is used to call the program instructions in the memory 502 to execute the methods provided in the above-described embodiments.

[0067] This embodiment provides a non-transitory computer-readable storage medium that stores computer instructions that cause a computer to execute the methods provided in the above-described embodiments.

[0068] Those skilled in the art will understand that all or part of the steps of the above-described method implementation can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it performs the steps of the above-described method implementation. The aforementioned storage medium includes various storage media capable of storing program code, such as ROM, RAM, magnetic disk, or optical disk.

[0069] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0070] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., including several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods of each embodiment or some parts of the embodiments.

[0071] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can occur depending on design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A data protection method for a layered security operation platform, the architecture comprising a terminal layer, a privacy data computation intermediate layer, and a centralized operation platform layer, characterized in that, The method includes: Obtain raw data from the user side and perform initial analysis to identify and encrypt data with security vulnerabilities; The process involves obtaining encrypted raw data and performing data security processing on it based on homomorphic encryption to obtain homomorphically encrypted data. This includes: obtaining encrypted raw data through authentication based on zero-knowledge proofs; identifying and filtering sensitive information that requires homomorphic encryption; and preprocessing the sensitive information, wherein the preprocessing method includes: performing Base64 processing on the sensitive information and converting the sensitive information into an integer; and performing privacy calculations on the preprocessed sensitive information based on a homomorphic encryption library. The process involves acquiring the homomorphically encrypted data and performing in-depth data processing and risk assessment, including: analyzing the exposure surface and topology of the data after security processing; for encrypted IP address information, using a finite-domain modulo inverse homomorphic calculation method to determine whether the IP addresses are in the same network segment, thereby determining the network hierarchy and connection method; calling pre-set homomorphically encrypted information and splitting it into commands and parameters; comparing the data after security processing with the commands and parameters to perform comparisons on a large number of command and parameter combinations and complete risk assessment; the comparison includes: comparing whether the length of the homomorphically encrypted attack payload is equal to the sum of the length of the homomorphically encrypted attack command and the length of the attack parameters; if so, comparing whether the homomorphically encrypted attack payload is equal to the homomorphic character concatenation result of the homomorphically encrypted attack command and attack parameters. Machine learning analysis is performed on the results of the deep data processing and risk assessment to extract potential dangerous behavior patterns and train a threat model; and zero-knowledge proof technology is introduced to verify the reliability of the output results of the threat model.

2. The data protection method for a secure operation platform according to claim 1, characterized in that, The method for acquiring raw user-side data and performing initial analysis to identify and encrypt data with security vulnerabilities includes: Deploy data acquisition and preliminary detection and analysis probes on the user side; The probe captures raw data; Initial analysis is performed by utilizing the probe's associated computing resources to identify and encrypt data that poses security risks.

3. The data protection method for a secure operation platform according to claim 1, characterized in that, The method for performing privacy computations on preprocessed sensitive information based on a homomorphic encryption library includes: Homomorphic encryption will be performed on the following sensitive information: User-side IP address, specifically the user's internal network IP address and the Internet address exposed on the public network; Vulnerability information, specifically the name of the vulnerability, its port, and the original exploitation information; The vulnerability attack payload information includes, specifically, the attack commands and attack parameters; Vulnerability attack response information.

4. The data protection method for a secure operation platform according to claim 1, characterized in that, The method for identifying and filtering sensitive information that needs to be homomorphically encrypted includes: Based on a preset detection strategy, sensitive information that meets the detection strategy is identified and filtered out; The method for preprocessing sensitive information includes: performing Base64 processing on the sensitive information and converting the sensitive information into an integer, and performing homomorphic character concatenation operation on the sensitive information using a homomorphic encryption library.

5. The data protection method for a secure operation platform according to claim 1, characterized in that, After obtaining the encrypted original data and performing data security processing based on homomorphic encryption, the method further includes: Perform machine learning analysis on the data after data security processing to extract potential dangerous behavior patterns from the data without exposing the original data; The extracted dangerous behavior patterns are processed and validated to train and evaluate the threat model.

6. A data protection system for a layered security operation platform, the architecture comprising a terminal layer, a privacy data computation intermediate layer, and a centralized operation platform layer, characterized in that, include: The data processing module is used to acquire raw data from the user side and perform initial analysis to identify and encrypt data with security risks. A data encryption module is used to acquire encrypted original data and perform data security processing on it based on homomorphic encryption to obtain homomorphically encrypted data. This includes: acquiring encrypted original data through authentication based on zero-knowledge proofs; identifying and filtering sensitive information that needs homomorphic encryption processing; and preprocessing the sensitive information, wherein the preprocessing method includes: performing Base64 processing on the sensitive information and converting the sensitive information into an integer; and performing privacy calculations on the preprocessed sensitive information based on a homomorphic encryption library. The data operation module is used to acquire the homomorphically encrypted data and perform in-depth data processing and risk assessment on it, including: performing exposure surface and topology analysis on the data after security processing; for encrypted IP address information, using a finite-domain modulo inverse homomorphic computation method to determine whether the IP addresses are in the same network segment, thereby determining the network hierarchy and connection method; calling pre-set homomorphically encrypted information and splitting it into commands and parameters; comparing the data after security processing with the commands and parameters to compare a large number of command and parameter combinations and complete the risk assessment; the comparison includes: comparing whether the length of the homomorphically encrypted attack payload is equal to the sum of the length of the homomorphically encrypted attack command and the length of the attack parameters; if so, comparing whether the homomorphically encrypted attack payload is equal to the homomorphic character concatenation result of the homomorphically encrypted attack command and attack parameters; performing machine learning analysis on the results of the in-depth data processing and risk assessment to extract potential dangerous behavior patterns and train a threat model; and introducing zero-knowledge proof technology to verify the reliability of the output results of the threat model.

7. A computer-readable storage medium, characterized in that, The storage medium stores a computer program, which, when executed by a processor, implements the method described in any one of claims 1-5.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the method described in any one of claims 1-5.

Images