A data security method and application system for a server

Abstract

The application relates to the technical field of data maintenance, in particular to a data protection method for a server and an application system. The method comprises the following steps: obtaining an emergency backup request, analyzing the emergency backup request, and determining a trigger time point; according to the trigger time point, historical backup data is called, current new data is determined according to the historical backup data; the current new data is analyzed to obtain data characteristics; according to the data characteristics, the current new data is multi-dimensionally disassembled to obtain fragment data; network topology information of the current moment is obtained, and a differential backup scheme of the fragment data is determined according to the network topology information and the data characteristics to perform a data protection operation. The probability of infection data entering the backup link is reduced, and the high-sensitivity data recognition accuracy is improved. The network topology information of the current moment is obtained, the differential backup scheme of the fragment data is determined according to the network topology information and the data characteristics to perform the data protection operation, and the network resource utilization rate is improved.

Description

Technical Field

[0001] The present application relates to the technical field of data maintenance, and in particular to a data preservation method and application system for a server. Background Art

[0002] In data center operations and management, server data preservation technology is a core safeguard against emergencies like natural disasters and cyberattacks. Traditional technologies generally employ a "two-site, three-center" architecture for off-site backup, relying on a combination of regular full and incremental backups.

[0003] However, when faced with complex disaster scenarios or advanced persistent threat attacks, traditional backup systems are unable to achieve comprehensive protection, resulting in low protection efficiency, which has become a significant defect of existing technologies. Summary of the Invention

[0004] The present application provides a server data preservation method and application system to solve the above problems.

[0005] In a first aspect, the present application provides a method for securing data for a server, the method comprising:

[0006] Obtain an emergency backup request, parse the emergency backup request, and determine a trigger time point;

[0007] According to the trigger time point, historical backup data is retrieved, and the current newly added data is determined based on the historical backup data;

[0008] Analyze the newly added data to obtain data features; and perform multi-dimensional decomposition of the newly added data based on the data features to obtain fragmented data;

[0009] The network topology information at the current moment is obtained, and a differential backup scheme for the fragmented data is determined based on the network topology information and the data characteristics to perform a data preservation operation.

[0010] Through this solution, emergency backup requests are obtained, emergency backup requests are parsed, and the trigger time point is determined to avoid trigger logic confusion caused by a single clock deviation. According to the trigger time point, historical backup data is retrieved, and based on the historical backup data, the current newly added data is determined to avoid bandwidth waste caused by full backup and eliminate the risk of data overwriting caused by version misalignment. Parsing the current newly added data to obtain data characteristics will help reduce the amount of index data that is repeatedly transmitted in a single incremental backup and improve the success rate of log file recovery. Based on the data characteristics, the current newly added data is disassembled in multiple dimensions to obtain fragmented data, reducing the probability of infected data entering the backup link and improving the accuracy of highly sensitive data identification. The network topology information at the current moment is obtained, and based on the network topology information and data characteristics, a differentiated backup plan for fragmented data is determined to perform data preservation operations, which helps improve network resource utilization.

[0011] Optionally, parsing the current newly added data to obtain data features includes: using a binary mode to extract file header bytes of the current newly added data to determine the file type; matching the extracted bytes with a predefined signature database, and determining the file format signature based on the matching result; obtaining the data storage path of the current newly added data, and determining the data extension based on the data storage path; calculating the frequency of occurrence of bytes in each current newly added data; determining the content entropy value based on the frequency of occurrence; obtaining a database transaction log; determining the access frequency of the current newly added data based on the database transaction log; and determining the file type, the file format signature, the data extension, the content entropy value, and the access frequency as the data features of the current newly added data.

[0012] Optionally, the multi-dimensional decomposition of the current newly added data is performed according to the data characteristics to obtain fragmented data, including: determining structured data, unstructured data and time series data according to the data characteristics; analyzing the structured data, the unstructured data and the time series data to determine the corresponding blocking algorithm; analyzing the database transaction log to determine the log writing frequency and the written data; determining the decomposition granularity according to the log writing frequency and the written data; and performing multi-dimensional decomposition of the current newly added data according to the blocking algorithm and the decomposition granularity to obtain fragmented data.

[0013] Optionally, determining the disassembly granularity based on the log write frequency and the write data includes: parsing the write data to determine the write data block size and the write data type; determining high-frequency write data and low-frequency write data based on the write data type; determining the high-frequency update frequency of the high-frequency write data and the low-frequency update frequency of the low-frequency write data based on the log write frequency; determining the disassembly granularity based on the write data block size, the high-frequency update frequency and the low-frequency update frequency.

[0014] Optionally, determining a differential backup scheme for the fragmented data based on the network topology information and the data characteristics includes: analyzing the network topology information to determine the real-time delay, packet loss rate and remaining bandwidth; analyzing the current newly added data to determine the data sensitivity; determining the bandwidth preemption priority based on the data sensitivity and the data characteristics; determining the optimal transmission protocol based on the bandwidth preemption priority, the data sensitivity and the real-time delay; and determining a differential backup scheme for the fragmented data based on the bandwidth preemption priority and the optimal transmission protocol.

[0015] Optionally, after parsing the emergency backup request and determining the trigger time point, the process further includes: parsing the emergency backup request to determine the data to be backed up; scanning the process call chain of the data to be backed up to identify abnormal dynamic link libraries; extracting the abnormal dynamic link libraries to determine the isolated data blocks and the API call sequence of each isolated data block; matching each isolated data block with a known virus behavior feature library based on the API call sequence; determining abnormal data blocks containing abnormal features based on the matching results; transferring the abnormal data blocks to an isolated storage pool for virus feature comparison, and determining whether the abnormal data blocks carry viruses based on the virus comparison results.

[0016] Optionally, determining a differential backup scheme for the fragmented data based on the network topology information and the data characteristics includes: if the abnormal data block carries a virus, rolling back the abnormal data block in time to determine the data before infection; determining the degree of infection of the abnormal data block based on the virus comparison result; determining the data sensitivity level of each abnormal data block based on the infection level; and determining a differential backup scheme for the fragmented data based on the data sensitivity level, the network topology information and the data characteristics.

[0017] Optionally, obtaining the emergency backup request, parsing the emergency backup request, and determining the trigger time point include: obtaining environmental monitoring data and intrusion monitoring data in real time; analyzing the environmental monitoring data and the intrusion monitoring data to determine environmental changes and port access conditions; analyzing the port access conditions to determine whether there is abnormal access; if it is determined that there is abnormal access, determining the number of abnormal accesses based on the port access conditions; comparing the number of abnormal accesses with the abnormal access frequency threshold; analyzing the environmental changes to determine whether there are any two environmental parameters that exceed corresponding critical values; if the number of abnormal accesses exceeds the abnormal access frequency threshold, or there are any two environmental parameters that exceed the corresponding critical values, generating an emergency backup request; determining the time when the number of abnormal accesses exceeds the abnormal access frequency threshold, or there are any two environmental parameters that exceed the corresponding critical values ​​as the trigger time point.

[0018] Optionally, the analysis of the current newly added data and determination of data sensitivity includes: determining metadata attributes of the current newly added data based on the data characteristics; obtaining historical operation data, extracting the historical operation data, determining the data creator identity, data access control list and data encryption status; querying a preset organizational structure database based on the data creator identity to determine the security level of the business department to which the data belongs; analyzing the data access control list to identify authorized user roles and permission operation scope; and calculating data sensitivity through a weighted decision tree model based on the security level, the permission operation scope and the encryption status.

[0019] In a second aspect, the present application provides a data security application system for a server, the system comprising:

[0020] A request parsing module is used to obtain an emergency backup request, parse the emergency backup request, and determine a triggering time point;

[0021] A data determination module is used to retrieve historical backup data according to the trigger time point, and determine the current newly added data based on the historical backup data;

[0022] A data decomposition module is used to analyze the newly added data to obtain data features; and based on the data features, perform multi-dimensional decomposition on the newly added data to obtain fragmented data;

[0023] The solution determination module is used to obtain the network topology information at the current moment, and determine the differential backup solution of the fragmented data according to the network topology information and the data characteristics to perform data preservation operations.

[0024] Optionally, when the data disassembly module parses the current newly added data and obtains data features, it is used to: use a binary mode to extract the file header bytes of the current newly added data to determine the file type; match the extracted bytes with a predefined signature database, and determine the file format signature based on the matching result; obtain the data storage path of the current newly added data, and determine the data extension based on the data storage path; calculate the frequency of occurrence of bytes in each current newly added data; determine the content entropy value based on the frequency of occurrence; obtain a database transaction log; determine the access frequency of the current newly added data based on the database transaction log; determine the file type, the file format signature, the data extension, the content entropy value and the access frequency as the data features of the current newly added data.

[0025] Optionally, the data disassembly module performs multi-dimensional disassembly on the current newly added data according to data characteristics, and when obtaining fragmented data, it is used to: determine structured data, unstructured data and time series data according to the data characteristics; analyze the structured data, the unstructured data and the time series data to determine the corresponding blocking algorithm; analyze the database transaction log to determine the log writing frequency and the written data; determine the disassembly granularity according to the log writing frequency and the written data; and perform multi-dimensional disassembly on the current newly added data according to the blocking algorithm and the disassembly granularity to obtain fragmented data.

[0026] Optionally, when the data disassembly module determines the disassembly granularity based on the log write frequency and the write data, it is used to: parse the write data to determine the write data block size and the write data type; determine high-frequency write data and low-frequency write data based on the write data type; determine the high-frequency update frequency of the high-frequency write data and the low-frequency update frequency of the low-frequency write data based on the log write frequency; determine the disassembly granularity based on the write data block size, the high-frequency update frequency and the low-frequency update frequency.

[0027] Optionally, when the scheme determination module determines the differential backup scheme for the fragmented data based on the network topology information and the data characteristics, it is used to: analyze the network topology information to determine the real-time delay, packet loss rate and remaining bandwidth; analyze the current newly added data to determine the data sensitivity; determine the bandwidth preemption priority based on the data sensitivity and the data characteristics; determine the optimal transmission protocol based on the bandwidth preemption priority, the data sensitivity and the real-time delay; and determine the differential backup scheme for the fragmented data based on the bandwidth preemption priority and the optimal transmission protocol.

[0028] Optionally, the server data preservation application system also includes a virus identification module, which is used to: parse the emergency backup request to determine the data to be backed up; scan the process call chain of the data to be backed up to identify abnormal dynamic link libraries; extract the abnormal dynamic link libraries to determine the isolated data blocks and the API call sequence of each isolated data block; based on the API call sequence, match each isolated data block with a known virus behavior feature library; based on the matching results, determine the abnormal data blocks containing abnormal features; transfer the abnormal data blocks to the isolation storage pool for virus feature comparison, and determine whether the abnormal data blocks carry viruses based on the virus comparison results.

[0029] Optionally, when the scheme determination module determines the differential backup scheme for the fragment data based on the network topology information and the data characteristics, it is used to: if the abnormal data block carries a virus, roll back the abnormal data block in time to determine the data before infection; determine the degree of infection of the abnormal data block based on the virus comparison result; determine the data sensitivity level of each abnormal data block based on the infection degree; and determine the differential backup scheme for the fragment data based on the data sensitivity level, the network topology information and the data characteristics.

[0030] Optionally, the request parsing module obtains an emergency backup request, parses the emergency backup request, and determines the trigger time point, and is used to: obtain environmental monitoring data and intrusion monitoring data in real time; analyze the environmental monitoring data and the intrusion monitoring data to determine environmental changes and port access conditions; analyze the port access conditions to determine whether there is abnormal access; if it is determined that there is abnormal access, determine the number of abnormal accesses based on the port access conditions; compare the number of abnormal accesses with the abnormal access frequency threshold; analyze the environmental changes to determine whether there are any two environmental parameters that exceed corresponding critical values; if the number of abnormal accesses exceeds the abnormal access frequency threshold, or there are any two environmental parameters that exceed the corresponding critical values, an emergency backup request is generated; and the time when the number of abnormal accesses exceeds the abnormal access frequency threshold, or there are any two environmental parameters that exceed the corresponding critical values ​​is determined as the trigger time point.

[0031] Optionally, when the solution determination module analyzes the current newly added data and determines the data sensitivity, it is used to: determine the metadata attributes of the current newly added data based on the data characteristics; obtain historical operation data, extract the historical operation data, and determine the data creator identity, data access control list and data encryption status; based on the data creator identity, query the preset organizational structure database to determine the security level of the business department to which the data belongs; analyze the data access control list to identify the authorized user role and the permission operation scope; and calculate the data sensitivity through a weighted decision tree model based on the security level, the permission operation scope and the encryption status. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, a brief introduction will be given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0033] Figure 1 A schematic diagram of an application scenario provided in one embodiment of the present application;

[0034] Figure 2 A flow chart of a server data preservation method provided in one embodiment of the present application;

[0035] Figure 3 A schematic diagram of the structure of a data security application system for a server provided in one embodiment of the present application. DETAILED DESCRIPTION

[0036] To make the purpose, technical solutions, and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0037] In this document, the term "and / or" simply describes a relationship between related objects, indicating that three possible relationships exist. For example, "A and / or B" can represent: A exists alone, A and B exist simultaneously, or B exists alone. Furthermore, the character " / " in this document, unless otherwise specified, generally indicates an "or" relationship between the related objects.

[0038] The embodiments of the present application are described in further detail below with reference to the accompanying drawings.

[0039] In data center operations and maintenance, server data preservation is the last line of defense against emergencies like natural disasters and cyberattacks. Traditional methods generally employ a "two-site, three-center" architecture for off-site backup, relying on a combination of periodic full and incremental backups. However, when faced with complex disaster scenarios (such as sudden changes in the server room environment) or advanced persistent threat (APT) attacks, existing technologies suffer from the following significant drawbacks:

[0040] Existing backup systems often trigger emergency procedures based on single indicator thresholds (such as environmental sensor thresholds or port scan counts), lacking the ability to correlate and analyze heterogeneous data from multiple sources. This is particularly true in network intrusion scenarios, where malicious programs often lurk within normal data streams. Relying solely on static thresholds to trigger backups can result in infected data being synchronized to remote nodes, potentially spreading the virus.

[0041] Existing differentiated backup solutions typically rely on preset priorities or fixed rules. When bandwidth is tight, highly sensitive data may be unable to seize resources due to the use of inefficient transmission protocols (such as FTP), while low-value data (such as temporary cache) occupies high-quality links, resulting in reduced timeliness of critical data backup.

[0042] Traditional methods usually perform virus scanning after the backup is completed, but if the backup data already carries new malicious code, the off-site storage node may become a secondary source of infection.

[0043] Based on this, the present application provides a data preservation method and application system for a server, which obtains an emergency backup request, parses the emergency backup request, determines the trigger time point, and avoids trigger logic confusion caused by a single clock deviation. According to the trigger time point, the historical backup data is retrieved, and the current newly added data is determined based on the historical backup data, avoiding bandwidth waste caused by full backup and eliminating the risk of data overwriting caused by version dislocation. Parsing the current newly added data and obtaining data features can help reduce the amount of index data that is repeatedly transmitted in a single incremental backup and improve the success rate of log file recovery. According to the data features, the current newly added data is disassembled in multiple dimensions to obtain fragmented data, reducing the probability of infected data entering the backup link and improving the accuracy of highly sensitive data identification. Obtaining the network topology information at the current moment, and determining the differentiated backup plan for the fragmented data based on the network topology information and data features to perform data preservation operations, can help improve network resource utilization.

[0044] Figure 1 This is a schematic diagram of an application scenario provided by this application. When performing data preservation on a server, the method provided by this application is applied.

[0045] Specifically, the method provided in the present application is applied to any server, and the server interacts with the built-in intrusion detection system, obtains the emergency backup request through the built-in detection device, parses the emergency backup request, determines the trigger time point, and avoids the trigger logic confusion caused by a single clock deviation. According to the trigger time point, the historical backup data is retrieved, and the current newly added data is determined based on the historical backup data, avoiding the bandwidth waste caused by the full backup and eliminating the risk of data overwriting caused by version dislocation. Parsing the current newly added data to obtain data features helps to reduce the amount of index data that is repeatedly transmitted in a single incremental backup and improve the success rate of log file recovery. According to the data features, the current newly added data is disassembled in multiple dimensions to obtain fragmented data, reducing the probability of infected data entering the backup link and improving the accuracy of highly sensitive data identification. Obtain the network topology information at the current moment, and determine the differentiated backup plan for the fragmented data based on the network topology information and data features to perform data preservation operations, which helps to improve network resource utilization. For specific implementation methods, please refer to the following embodiments.

[0046] Figure 2 This is a flow chart of a method for preserving data for a server provided in one embodiment of the present application. The method of this embodiment can be applied to the server in the above scenario. Figure 2 As shown, the method includes:

[0047] S201, obtain an emergency backup request, parse the emergency backup request, and determine a trigger time point;

[0048] The emergency backup request may be a compound exception triggering instruction.

[0049] The trigger time point may be the moment when the first event that meets the composite abnormality condition occurs among the multi-source events.

[0050] Specifically, an emergency backup request is obtained, and the trigger event type, abnormal time window, and affected data range identifier are extracted from the emergency backup request. Finally, the clocks of the primary and backup nodes are synchronized using the NTP protocol, and the trigger time point is calculated based on the earliest data source trigger moment within the abnormal time window.

[0051] In the specific implementation method, the intrusion detection system obtains real-time data streams and defines a set of data source types; then, based on the correlation strength of various data sources in the historical abnormal event library and the inherent reliability of the data source, an initial weight is assigned. When a certain type of data source continuously triggers anomalies but does not pose an effective threat, its weight is reduced through a negative feedback mechanism, thereby generating a dynamic weight coefficient; then, the heterogeneous data streams are standardized to determine the joint weight of multi-source data. When the joint weight of multi-source data exceeds the dynamic threshold built based on historical normal state data, an emergency backup request is generated.

[0052] S202: Retrieve historical backup data based on the trigger time point, and determine the current newly added data based on the historical backup data;

[0053] The historical backup data may be a metadata index of the most recent full backup.

[0054] The newly added data may be a collection of data generated or modified since the last backup.

[0055] Specifically, based on the metadata index of the most recent full backup before the trigger time point, that is, the historical backup data, the directory tree structure of the corresponding version snapshot is pulled from the off-site storage node; then, a two-layer comparison mechanism is adopted to determine the current new data: first, the modified files are quickly screened out through hash value comparison; then, according to the preset dynamic blocking rules, Rabin fingerprint is used as the sliding window hash function, and the modified files are dynamically re-blocked according to the data locality characteristics. The hash is calculated block by block and compared with the historical block records, and the blocks with inconsistent hash values ​​are screened out and marked as the current new data.

[0056] S203: Analyze the newly added data to obtain data features; and perform multi-dimensional decomposition of the newly added data based on the data features to obtain fragmented data.

[0057] Data features can be a set of labels including data type, update frequency, and security attributes.

[0058] Fragment data may be the smallest logical unit.

[0059] Specifically, metadata analysis is performed on the current newly added data to extract data features such as data type, compression ratio, and entropy value.

[0060] Based on data characteristics, the current new data is decomposed in multiple dimensions: first, fine-grained blocks are used for high-frequency update fields, and low-frequency fields are merged into coarse-grained blocks; second, unstructured files are split according to semantic units; then, for data blocks judged as high-risk in sandbox detection, isolation markers are inserted and replacement placeholders are generated; finally, fragmented data with metadata tags are obtained.

[0061] S204: Obtain the current network topology information, and determine a differential backup plan for the fragmented data based on the network topology information and data characteristics to perform data preservation operations.

[0062] The network topology information may be a set of transmission path quality indicators.

[0063] The differential backup solution can be a combination of transmission strategies generated according to the sensitivity of the fragment data and the network topology status.

[0064] Specifically, the real-time status of the entire network is obtained through the software-defined network controller to build network topology information; then, the fragmented data is graded according to sensitivity; then, highly sensitive data is allocated to low-latency paths and transmitted using AES-256-GCM encryption; low-sensitivity data uses a UDP acceleration channel and forward error correction coding is enabled; furthermore, for fragmented data detected by the sandbox as abnormal, a "fuse" mechanism is used to temporarily store it in an encrypted cache area, and after manual confirmation, the breakpoint is resumed; thus, a differentiated backup plan is generated; finally, a version rollback is performed, and the corresponding blocks are extracted from the historical clean backup, replaced, and then transmitted.

[0065] Through this solution, emergency backup requests are obtained, emergency backup requests are parsed, and the trigger time point is determined to avoid trigger logic confusion caused by a single clock deviation. According to the trigger time point, historical backup data is retrieved, and based on the historical backup data, the current newly added data is determined to avoid bandwidth waste caused by full backup and eliminate the risk of data overwriting caused by version misalignment. Parsing the current newly added data to obtain data characteristics will help reduce the amount of index data that is repeatedly transmitted in a single incremental backup and improve the success rate of log file recovery. Based on the data characteristics, the current newly added data is disassembled in multiple dimensions to obtain fragmented data, reducing the probability of infected data entering the backup link and improving the accuracy of highly sensitive data identification. The network topology information at the current moment is obtained, and based on the network topology information and data characteristics, a differentiated backup plan for fragmented data is determined to perform data preservation operations, which helps improve network resource utilization.

[0066] In some embodiments, a binary mode is used to extract the file header bytes of the current newly added data to determine the file type; the extracted bytes are matched with a predefined signature database, and the file format signature is determined based on the matching result; the data storage path of the current newly added data is obtained, and the data extension is determined based on the data storage path; the frequency of occurrence of bytes in each current newly added data is calculated; the content entropy value is determined based on the frequency of occurrence; the database transaction log is obtained; the access frequency of the current newly added data is determined based on the database transaction log; the file type, file format signature, data extension, content entropy value and access frequency are determined as data features of the current newly added data.

[0067] Binary mode allows you to directly read a raw binary data stream from a file.

[0068] The file type can be a category of the actual format of the data.

[0069] The extracted bytes may be binary data sequences of varying lengths intercepted from the file header.

[0070] The signature database may be a predefined comparison database containing virus signatures and legal application whitelist signatures.

[0071] The matching result can be a status label output after the extracted bytes are compared with the signature database.

[0072] The file format signature can be a file format legitimacy identifier.

[0073] The data storage path may be the complete path of the currently added data in the storage device.

[0074] The data extension can be a file extension string.

[0075] A byte is the smallest unit of data that can be processed.

[0076] The occurrence frequency may be the number of times each byte value appears in the current newly added data.

[0077] The content entropy value can be an information entropy value calculated based on the frequency of byte occurrence.

[0078] A database transaction log may be a log file that records database operations.

[0079] Access frequency can be the number of times the current newly added data is accessed per unit time.

[0080] Specifically, the first N bytes of the newly added data are read in binary mode to extract the file header byte sequence. A format feature library is then constructed based on the magic number signature of the file header byte sequence, and a predefined format rule library is matched. A successful match results in a file type identifier. The extracted bytes are then compared byte by byte with a predefined signature database. If the bytes match continuously, a file format signature is output. Subsequently, the data storage path of the newly added data in the storage device is parsed, and the file name suffix is ​​extracted to generate a data extension. The entire byte stream of the newly added data is traversed, and the frequency of occurrence of each byte value is counted. Based on this frequency, the content entropy value is calculated using the Shannon entropy formula. Through the database management log query interface, database transaction logs related to the newly added data are retrieved by data identifier field. Operation records corresponding to the newly added data are then retrieved from the database transaction logs, and the number of accesses per unit time is counted to generate the access frequency. The file type, file format signature, data extension, content entropy value, and access frequency are integrated into a JSON format. The JSON format is normalized to eliminate dimensional differences, thus forming the data features of the newly added data.

[0081] This solution uses binary mode to extract file header bytes from newly added data to determine the file type. This helps avoid misclassification caused by file extension tampering and eliminates file camouflage issues in scenarios where virus intrusion and backup processes conflict. The extracted bytes are matched against a predefined signature database, and based on the matching results, the file format signature is determined, enabling preliminary virus interception before backup and reducing the risk of infected data blocks not being isolated. The data storage path of the newly added data is obtained and, based on the data storage path, the data extension is determined, mitigating classification errors caused by the static nature of sensitivity assessment. Calculating the frequency of occurrence of bytes in each newly added data helps quantify the distribution characteristics of the data content. Determining the content entropy value based on the frequency of occurrence dynamically enhances the objectivity of sensitivity assessment and eliminates the drawback of sensitivity grading relying on manual labeling. Accessing database transaction logs helps support the differentiated segmentation strategy required for intelligent data decomposition. Determining the access frequency of the newly added data based on the database transaction log helps eliminate the problem of static network resource allocation. File type, file format signature, data extension, content entropy value, and access frequency are identified as data features of the newly added data, enabling the coordinated operation of embedded virus defense and multi-dimensional sensitivity assessment.

[0082] In some embodiments, structured data, unstructured data, and time series data are determined based on data characteristics; structured data, unstructured data, and time series data are analyzed to determine the corresponding blocking algorithm; database transaction logs are analyzed to determine the log writing frequency and written data; based on the log writing frequency and written data, the disassembly granularity is determined; based on the blocking algorithm and disassembly granularity, the current newly added data is multi-dimensionally disassembled to obtain fragmented data.

[0083] Structured data can be a collection of data with a predefined data model and fixed format.

[0084] Unstructured data can be a collection of data without a unified data model or fixed format.

[0085] Time series data can be a data stream generated and stored in chronological order.

[0086] A chunking algorithm can be a set of rules that divides a continuous data stream or file into independent processing units based on data type characteristics.

[0087] The log writing frequency can be the number of write operation triggers recorded in the database transaction log per unit time.

[0088] The written data can be the amount of data involved in a single database transaction operation.

[0089] The disassembly granularity can be a scale control parameter for a single fragment of data during data block processing.

[0090] Specifically, based on data characteristics, first, when the file type is a database table file or the data extension matches a structured data identifier, it is determined to be structured data. Second, when the file type is an image / document or the content entropy value indicates a non-random distribution, it is determined to be unstructured data. Then, when the file format signature matches the time series data identifier and the access frequency is too high, it is determined to be time series data. Based on structured data, unstructured data, and time series data, the corresponding block partitioning algorithm is determined: First, the operation range corresponding to the transaction ID in the database transaction log is parsed, and the data blocks are divided according to the transaction commit boundary, that is, the transaction boundary block partitioning algorithm is used for structured data. Second, the window size is dynamically adjusted based on the content entropy value, and the hash value is calculated slidingly at a fixed step size to trigger the block boundary, that is, the sliding window block partitioning algorithm is used for unstructured data. Finally, the time window length is set according to the log write frequency, and the data stream is aligned by timestamp, that is, the time window block partitioning algorithm is used for time series data. The log write frequency and write data associated with the current new data are extracted from the database transaction log. Furthermore, the log write frequency and write data in the database transaction log are analyzed to calculate the amount of data updated per unit time. If the log write frequency is high and the amount of data written per time is low, it is determined to be a high-frequency, low-load scenario, and fine-grained decomposition is adopted. If the log write frequency is low and the amount of data written per time is high, it is determined to be a low-frequency, high-load scenario, and coarse-grained decomposition is adopted. Based on the block algorithm and decomposition granularity, the current new data is decomposed in multiple dimensions. First, structured data is divided according to the transaction boundary block algorithm, ensuring that each block contains a complete transaction boundary and the block size is constrained by the decomposition granularity. Second, for unstructured data generated by the sliding window block algorithm, when the content entropy value is too high, the window step size is reduced to reduce the entropy value fluctuation within the block. Then, the time series data is segmented according to the time window block algorithm. If the access frequency difference between adjacent log records is too large, the time window is dynamically expanded to include the complete transaction chain. Finally, metadata tags are attached to each data block to generate fragmented data.

[0091] This solution identifies structured, unstructured, and time-series data based on data characteristics, eliminating the problem of single-partition strategies due to a failure to consider data type differences and preventing partition failures caused by misjudgment of data attributes. By analyzing structured, unstructured, and time-series data and determining corresponding partitioning algorithms, this approach avoids repeated transmission of unmodified data during incremental backups, reducing bandwidth waste and preventing semantically coherent content from being fragmented due to fixed partitioning, thereby lowering the risk of recovery failures. It also avoids transmission delays caused by overly large partitions for high-frequency data and redundancy caused by overly detailed partitioning for low-frequency data. Analyzing database transaction logs to determine log write frequency and data helps quantify the characteristics of dynamic data updates and eliminates the problem of unreasonable partitioning granularity caused by ignoring transaction operation patterns. Determining the partitioning granularity based on log write frequency and data helps prevent incremental backup data confusion caused by cross-transaction partitioning, enhances the accuracy of virus scanning and isolation, and balances partitioning timeliness with transmission efficiency. Based on the partitioning algorithm and partitioning granularity, newly added data is partitioned multi-dimensionally to generate fragmented data, eliminating the disconnect between partitioning results and transmission or detection processes.

[0092] In some embodiments, the write data is parsed to determine the write data block size and the write data type; based on the write data type, high-frequency write data and low-frequency write data are determined; based on the log write frequency, the high-frequency update frequency of the high-frequency write data and the low-frequency update frequency of the low-frequency write data are determined; based on the write data block size, the high-frequency update frequency and the low-frequency update frequency, the disassembly granularity is determined.

[0093] The write data block size may be the amount of data involved in a single write operation.

[0094] The write data type may be a format category of the write data.

[0095] The high-frequency write data may be a type of data that needs to be updated frequently.

[0096] The infrequently written data may be a data type with a long update interval.

[0097] The high-frequency update frequency may be an average number of write operations for high-frequency write data per unit time.

[0098] The low-frequency update frequency may be an average write operation interval of low-frequency write data per unit time.

[0099] Specifically, based on the written data, the original data content of a single database transaction operation is extracted, the byte stream length is parsed, and the write data block size is determined. The write data type is also identified based on the file format signature. The write data type is then associated with a preset update feature rule library to determine high-frequency and low-frequency write data. First, tables frequently operated on in the database transaction log are marked as high-frequency write data. Second, periodically generated log files or image backups are marked as low-frequency write data. Based on the log write frequency, the number of operations triggered by high-frequency write data in the database transaction log per unit time is counted to calculate the high-frequency update frequency. Then, the interval between operations triggered by low-frequency write data in the database transaction log per unit time is counted to calculate the low-frequency update frequency. The upper limit of the block size is set inversely proportional to the high-frequency update frequency. The lower limit of the block size is then set based on the product of the write data block size and the low-frequency update frequency. Finally, the intersection of the high-frequency block upper limit and the low-frequency block lower limit is taken as the decomposition granularity.

[0100] This solution parses the written data to determine the write data block size and write data type, avoiding disassembly failures caused by misjudgment of data size and format. Based on the write data type, high-frequency write data and low-frequency write data are determined to prevent low-frequency data from occupying high-frequency channel bandwidth. Based on the log write frequency, the high-frequency update frequency of high-frequency write data and the low-frequency update frequency of low-frequency write data are determined, dynamically quantifying the data update intensity and providing a calculation basis for block granularity. Determining the disassembly granularity based on the write data block size, high-frequency update frequency, and low-frequency update frequency helps reduce the amount of duplicate data during incremental backups and avoids the complexity of recovery logic caused by excessive disassembly.

[0101] In some embodiments, network topology information is analyzed to determine real-time delay, packet loss rate and remaining bandwidth; current new data is analyzed to determine data sensitivity; bandwidth preemption priority is determined based on data sensitivity and data characteristics; the optimal transmission protocol is determined based on bandwidth preemption priority, data sensitivity and real-time delay; and a differentiated backup plan for fragmented data is determined based on bandwidth preemption priority and the optimal transmission protocol.

[0102] Real-time latency can be the end-to-end transmission delay required for data to be transmitted from the source node to the destination node.

[0103] The packet loss rate can be the percentage of data packets lost during transmission per unit time to the total number of data packets sent.

[0104] The remaining bandwidth may be the available transmission bandwidth that is not occupied in the current network link.

[0105] Data sensitivity can be a data security level, which can be divided into three levels: high, medium, and low.

[0106] The bandwidth preemption priority may be a network resource preemption level, which may be divided into four levels: emergency, high, medium, and low.

[0107] The optimal transmission protocol may be an optimal data transmission rule.

[0108] Specifically, based on network topology information, distributed probes collect real-time latency, packet loss rate, and remaining bandwidth between network nodes. Then, based on information entropy theory and a multi-dimensional access control model, the metadata attributes and real-time operation logs of newly added data are analyzed. Multi-dimensional feature vectors are extracted and input into a pre-set sensitivity grading rule base, which then outputs data sensitivity through a rule-based inference engine. Subsequently, a dynamic weighting model is constructed based on the weighted relationship between data sensitivity and data features using the analytic hierarchy process and fuzzy comprehensive evaluation method to calculate bandwidth preemption priorities. Furthermore, based on bandwidth preemption priorities and data sensitivity, protocol decision tree branches are triggered according to real-time latency. Security policies corresponding to data sensitivity are then superimposed to generate the optimal transport protocol. Bandwidth preemption priority levels are analyzed to define sharding control rules. Path selection policies are then bound to the transport protocol type. An exception handling mechanism is then injected to generate the optimal transport protocol. Finally, differentiated transport strategies are implemented based on bandwidth preemption priorities and the optimal transport protocol.

[0109] This solution analyzes network topology information, determines real-time latency, packet loss rate, and remaining bandwidth, quantifies current network transmission capacity and stability, eliminates static network resource allocation and transmission protocols, and avoids link resource waste or data delays caused by reliance on preset rules. It also analyzes newly added data to determine data sensitivity, breaking through the limitations of relying on manual labeling or static rules. By dynamically associating data attributes with operational characteristics, it improves the accuracy of sensitivity determination and prevents imbalanced resource allocation. Based on data sensitivity and data characteristics, it determines bandwidth preemption priority to ensure that highly sensitive data prioritizes high-quality network resources, prevents low-value data from occupying high-priority links, and improves data backup timeliness. Based on bandwidth preemption priority, data sensitivity, and real-time latency, it determines the optimal transmission protocol, helping to eliminate the disconnect between protocol selection and network status. Based on bandwidth preemption priority and the optimal transmission protocol, it determines a differentiated backup plan for fragmented data, helping to eliminate bandwidth waste and semantic relevance loss caused by fixed blocks.

[0110] In some embodiments, an emergency backup request is parsed to determine the data to be backed up; the process call chain of the data to be backed up is scanned to identify abnormal dynamic link libraries; the abnormal dynamic link libraries are extracted to determine isolated data blocks and the API call sequence of each isolated data block; based on the API call sequence, each isolated data block is matched with a known virus behavior feature library; based on the matching results, abnormal data blocks containing abnormal features are determined; the abnormal data blocks are transferred to an isolated storage pool for virus feature comparison, and based on the virus comparison results, it is determined whether the abnormal data blocks carry viruses.

[0111] The data to be backed up may be a collection of data that needs to be protected.

[0112] The process call chain can be a dynamic call relationship graph formed during the execution of different processes.

[0113] The abnormal dynamic link library may be a suspicious dynamic link library file.

[0114] The isolated data block may be a data segment separated from the data to be backed up and containing an abnormal dynamic link library or an abnormal API call sequence.

[0115] The API call sequence may be a sequential record of the API names, parameters, and call timings called by the dynamic link library during operation.

[0116] The known virus behavior feature library may be a database that stores static features and dynamic behavior patterns of known virus families.

[0117] Abnormal characteristics can be indicators of deviations from normal behavior patterns.

[0118] The abnormal data block may be an isolated data block carrying a known virus variant or a suspected unknown threat.

[0119] An isolated storage pool can be an encrypted storage area that is separate from the production environment.

[0120] The virus comparison result can be a judgment conclusion generated through static feature matching, dynamic behavior analysis and sandbox verification.

[0121] A virus can be a program code that tamper with data and hijack processes to achieve malicious purposes.

[0122] Specifically, the trigger timestamp and data identifier in the emergency backup request are parsed to extract the storage path and metadata index of the data to be backed up; then, based on the metadata index, the data to be backed up is quickly located from the storage path. The kernel debugging interface of the device is mounted to capture the call chain topology of the process associated with the data to be backed up; the dynamic link library loading records in the process call chain are traversed to identify abnormal dynamic link libraries. Memory mapping analysis is performed on the abnormal dynamic link library to extract the API call sequence of each isolated data block: first, the physical address of the associated data block is traced back through the memory paging table; second, a dynamic link library-data block mapping table is established to record the file path, memory start / end address and last modification timestamp of each data block; then, the call records in the time window before and after the trigger time point are intercepted; finally, the API operations involving the isolated data block are arranged in chronological order. The API call sequence is input into a known virus behavior signature library, and a multi-dimensional match is performed: first, the API call sequence is compared with the malicious code fingerprint in the known virus behavior signature library; then, the cosine similarity between the API call sequence and the known virus behavior signature library is calculated. If the similarity is high, it is determined to be a potential threat; finally, the matching results are output, and abnormal data blocks with abnormal characteristics are marked. Then, the abnormal data blocks are transferred to an isolated storage pool, and the sandbox environment is started to load the data blocks. The process creation and file modification behavior of the abnormal data blocks are monitored; then, a dynamic taint tracking probe is injected to record the memory read and write traces; finally, the sandbox behavior log is compared with the attack chain pattern in the known virus signature library to determine whether the abnormal data blocks carry viruses.

[0123] Through this solution, emergency backup requests are parsed, the data to be backed up is determined, and the backup target range is quickly locked in complex abnormal scenarios, avoiding response delays caused by manual retrieval. Scanning the process call chain of the data to be backed up and identifying abnormal dynamic link libraries helps to filter legitimate processes hijacked by rootkit-type viruses and eliminate the problem of missed detection due to lack of call chain tracking. Extracting abnormal dynamic link libraries, determining isolated data blocks and the API call sequence of each isolated data block helps to break through the blind spot of static feature scanning for unsigned viruses. Based on the API call sequence, each isolated data block is matched with a known virus behavior feature library, which helps to ensure the rapid identification of known virus variants and detect zero-day attacks through behavioral pattern similarity. Based on the matching results, abnormal data blocks containing abnormal features are determined to avoid the incorrect isolation of normal data due to oversensitivity. The abnormal data blocks are transferred to the isolated storage pool for virus feature comparison. Based on the virus comparison results, it is determined whether the abnormal data blocks carry viruses, which helps to capture hidden attack chains that static scanning cannot detect.

[0124] In some embodiments, if the abnormal data block carries a virus, the abnormal data block is rolled back in time to determine the data before infection; based on the virus comparison results, the degree of infection of the abnormal data block is determined; based on the degree of infection, the data sensitivity level of each abnormal data block is determined; based on the data sensitivity level, network topology information and data characteristics, a differentiated backup plan for the fragmented data is determined.

[0125] Pre-infection data may be a version of the data that has not been tampered with or contaminated.

[0126] The infection degree may be a quantitative evaluation indicator of the scope of virus influence in the abnormal data block.

[0127] The data sensitivity level may be a data security requirement level.

[0128] Specifically, based on transaction logs or snapshots recorded in the version control repository, the anomalous data blocks carrying viruses are rolled back to the last trusted version before infection, extracting pre-infection data. Then, based on statistical analysis of virus behavioral characteristics and a hazard propagation rate quantification model, the dynamic operation sequence of malicious behavior is mapped into a behavioral harm index. Subsequently, the infection range indicator and behavioral harm index from the virus comparison results are analyzed and combined with a pre-defined infection threshold table established through cluster analysis to determine different threat levels. The infection level of the anomalous data block is then output. The sensitivity level of each anomalous data block is then determined by dynamically adjusting the classification weights based on the infection level and the sensitivity label of the original data. Data is then divided into priority queues based on the sensitivity level weights. Furthermore, combining real-time link bandwidth and packet loss rates from network topology information with data characteristics, dedicated encrypted channels are allocated for highly sensitive data, while compressed transmission protocols are used for less sensitive data. Furthermore, incremental block verification is enabled for frequently updated data, transmitting only difference blocks with mismatched hash values. Finally, a differentiated backup scheme for the fragmented data is determined.

[0129] Through this solution, if the abnormal data block carries a virus, the abnormal data block will be rolled back in time to determine the data before the infection, so as to prevent the virus from spreading to remote nodes through the backup link and eliminate the risk of secondary infection caused by the conflict between the virus invasion and the backup process and the failure to isolate it. According to the virus comparison results, the infection level of the abnormal data block is determined to avoid false positives or missed detections caused by the abnormal data block not being accurately located. According to the infection level, the data sensitivity level of each abnormal data block is determined, which helps to eliminate the resource mismatch problem caused by the static nature of the sensitivity assessment. According to the data sensitivity level, network topology information and data characteristics, a differentiated backup plan for fragmented data is determined, which helps to eliminate data delay problems caused by the static defects of network resource allocation, reduce the amount of redundant data transmission, and alleviate bandwidth waste caused by insufficient data disassembly granularity adaptation.

[0130] In some embodiments, environmental monitoring data and intrusion monitoring data are acquired in real time; the environmental monitoring data and intrusion monitoring data are analyzed to determine environmental changes and port access conditions; the port access conditions are analyzed to determine whether there is abnormal access; if it is determined that there is abnormal access, the number of abnormal accesses is determined based on the port access conditions; the number of abnormal accesses is compared with the abnormal access frequency threshold; environmental changes are analyzed to determine whether there are any two environmental parameters that exceed corresponding critical values; if the number of abnormal accesses exceeds the abnormal access frequency threshold, or there are any two environmental parameters that exceed the corresponding critical values, an emergency backup request is generated; the time when the number of abnormal accesses exceeds the abnormal access frequency threshold, or there are any two environmental parameters that exceed the corresponding critical values ​​is determined as the trigger time point.

[0131] Environmental monitoring data can be real-time physical environmental parameter values.

[0132] Intrusion monitoring data can be records of network behavior captured by network security devices.

[0133] Environmental changes may be a state where environmental parameters are determined to be outside of a normal fluctuation range.

[0134] The port access situation may be statistics of access behaviors to the server port in different time periods.

[0135] Abnormal access can be port access behavior that does not comply with preset whitelist rules or has attack characteristics.

[0136] The number of abnormal access times may be the cumulative number of abnormal port access events counted within a unit time window.

[0137] The abnormal access frequency threshold may be a critical value of the number of abnormal accesses that is dynamically set according to the business scenario.

[0138] Environmental parameters can be quantitative indicators used to describe the state of the physical environment.

[0139] The corresponding critical value may be a safety threshold preset for each environmental parameter.

[0140] Specifically, environmental monitoring data is acquired in real time through the readings of sensors such as temperature, humidity, and voltage fluctuations deployed on monitoring nodes. Simultaneously, intrusion monitoring data is captured synchronously through port access records and traffic characteristics. The environmental monitoring data stream is parsed, and the real-time values ​​of temperature and humidity are extracted. Time series analysis of the real-time values ​​of temperature and humidity is performed to mark environmental changes. Then, access behavior clustering is performed on the intrusion monitoring data to identify irregular port access situations. Furthermore, the number of visits to irregular ports by the same source IP within a unit time is counted to determine whether there are abnormal accesses. If the number of visits exceeds the total number of normal business port visits, it is determined that an abnormal access exists. Subsequently, the cumulative number of abnormal accesses within consecutive time units is counted to generate the number of abnormal accesses. An abnormal access frequency threshold is set based on the average number of visits in the same historical time period. The number of abnormal accesses within the current time window is compared with the preset abnormal access frequency threshold. Environmental changes are traversed to check whether any two environmental parameters exceed the corresponding critical values. Abnormal port access events are counted. If the number of abnormal accesses per unit time exceeds the abnormal access frequency threshold, or if any two environmental parameters exceed corresponding critical values, the trigger type, list of exceeded parameters or list of abnormal access IP addresses, and trigger time are packaged into a structured request message, generating an emergency backup request. Furthermore, a retrospective verification is performed on the time point when the number of abnormal accesses exceeds the abnormal access frequency threshold, or when any two environmental parameters exceed corresponding critical values, eliminating instantaneous jitter interference. Ultimately, the time starting from the first sustained limit violation is used as the backup trigger time point.

[0141] This solution acquires environmental monitoring and intrusion detection data in real time, eliminating trigger delays caused by a single data source and providing multi-source input for complex anomaly detection. Environmental monitoring and intrusion detection data are analyzed to identify environmental changes and port access, avoiding potential risks of misjudging a single indicator. Analyzing port access to determine whether there are any abnormal accesses helps eliminate the problem of failing to identify covert scans. If abnormal access is confirmed, the number of abnormal accesses is determined based on the port access situation, quantifying the intensity of the attack behavior. This provides a dynamic statistical basis for threshold comparison, replacing the underreporting caused by fixed-period sampling. Comparing the number of abnormal accesses with the abnormal access frequency threshold avoids false triggers caused by traffic tidal phenomena while ensuring that high-frequency attacks trigger backups promptly. Analyzing environmental changes to determine whether any two environmental parameters exceed their corresponding critical values ​​helps identify false alarms caused by single sensor failures or local environmental fluctuations, improving the accuracy of complex disaster detection. If the number of abnormal accesses exceeds the abnormal access frequency threshold, or if any two environmental parameters exceed their corresponding critical values, an emergency backup request is generated, ensuring that any high-risk event can independently trigger a backup. The trigger time point is determined as the time when the number of abnormal accesses exceeds the abnormal access frequency threshold, or when any two environmental parameters exceed the corresponding critical values, to avoid the time ambiguity of the full backup causing recovery data pollution.

[0142] In some embodiments, based on the data characteristics, the metadata attributes of the current newly added data are determined; historical operation data is obtained and extracted to determine the identity of the data creator, the data access control list and the data encryption status; based on the identity of the data creator, the preset organizational structure database is queried to determine the security level of the business department to which the data belongs; the data access control list is analyzed to identify the authorized user role and the scope of permission operation; based on the security level, the scope of permission operation and the encryption status, the data sensitivity is calculated through a weighted decision tree model.

[0143] Metadata attributes can be descriptive information about the data itself.

[0144] Historical operation data can be audit log records of operations related to the data over a period of time in the past. This period of time can be selected based on experience or manually specified.

[0145] The data creator identity may be an identifier of a user account that generates or first writes the data.

[0146] The data access control list may be a list of data access permissions.

[0147] The data encryption status may be a flag identifying whether the data is encrypted.

[0148] The preset organizational structure database may be a pre-set database storing the mapping relationship between accounts and their respective business departments, which is pre-stored in the server and called when used.

[0149] The business department to which the data belongs can be the organizational department to which the data creator belongs.

[0150] The security level can be a level value set based on the security policy of the business department.

[0151] The authorized user role can be a user identity category defined in the data access control list.

[0152] The permission operation scope can be a set of specific operations that the authorized user is allowed to perform in the data access control list.

[0153] The weighted decision tree model can be a computational logic for fusing multi-dimensional parameter output sensitivity values.

[0154] Specifically, based on the data characteristics, metadata attributes are extracted from the file header, database table structure or log record of the current newly added data. The operation audit log interface is called to retrieve the historical operation records associated with the current newly added data, thereby extracting the creator account recorded in the historical operation log and reading the authorized user list and user operation permissions from the database permission configuration, and simultaneously parsing the file metadata database attributes to determine whether the data has been encrypted. Furthermore, based on the enterprise organizational hierarchy model and the principle of separation of duties, the preset organizational structure database is mapped through the department tree structure; based on the identity identifier of the data creator, the preset organizational structure database is queried to obtain the business department to which it belongs; then, based on the department security policy configuration file, the corresponding security level of the business department is matched. Subsequently, the grammatical structure of the data access control list is parsed to identify the authorized user role; then, following the principle of least privilege, the role and operation permission are orthogonally mapped according to the access control matrix model, thereby presetting the role permission table; based on the preset role permission table, the role is mapped to the permission operation range. The security level is converted into a weight base, the permission operation range is converted into a permission strength coefficient according to the bit mask value, and the encryption status is converted into a Boolean value. Subsequently, the weight base, permission strength coefficient and Boolean value are input into the weighted decision tree model, and the decision tree calculation logic is executed to output the normalized data sensitivity.

[0155] Through this solution, the metadata attributes of the current newly added data are determined based on the data characteristics, providing a classification basis for data sensitivity analysis and avoiding assessment bias due to confusion of data types. Obtaining historical operation data, extracting historical operation data, determining the identity of the data creator, the data access control list and the data encryption status will help eliminate the static problems of relying on manual labeling. Based on the identity of the data creator, query the preset organizational structure database to determine the security level of the business department to which the data belongs, and realize real-time linkage between sensitivity assessment and organizational security policy. Analyze the data access control list, identify the authorized user role and permission operation scope, quantify the access control strength of the data, identify potential risks of unauthorized use, and avoid sensitivity misjudgments caused by simple rules. Calculating data sensitivity through a weighted decision tree model based on security level, permission operation scope, and encryption status will help eliminate the defects of one-sided reliance on a single dimension.

[0156] Figure 3 This is a structural diagram of a server data security application system provided in one embodiment of the present application. Figure 3 As shown, the server data preservation application system 300 of this embodiment includes a request parsing module 301 , a data determination module 302 , a data decomposition module 303 , and a solution determination module 304 .

[0157] Request parsing module 301, used to obtain emergency backup request, parse the emergency backup request, and determine the trigger time point;

[0158] The data determination module 302 is used to retrieve historical backup data according to the trigger time point and determine the current newly added data based on the historical backup data;

[0159] The data decomposition module 303 is used to analyze the newly added data and obtain data features; based on the data features, the newly added data is decomposed into multiple dimensions to obtain fragmented data;

[0160] The solution determination module 304 is used to obtain the current network topology information and determine the differential backup solution for the segmented data based on the network topology information and data characteristics to perform data preservation operations.

[0161] Optionally, when the data disassembly module 303 parses the current newly added data and obtains data features, it is used to: use binary mode to extract the file header bytes of the current newly added data to determine the file type; match the extracted bytes with a predefined signature database, and determine the file format signature based on the matching results; obtain the data storage path of the current newly added data, and determine the data extension based on the data storage path; calculate the frequency of occurrence of bytes in each current newly added data; determine the content entropy value based on the frequency of occurrence; obtain the database transaction log; determine the access frequency of the current newly added data based on the database transaction log; determine the file type, file format signature, data extension, content entropy value and access frequency as data features of the current newly added data.

[0162] Optionally, the data disassembly module 303 performs multi-dimensional disassembly on the current newly added data according to the data characteristics, and when obtaining the fragmented data, it is used to: determine the structured data, unstructured data and time series data according to the data characteristics; analyze the structured data, unstructured data and time series data to determine the corresponding blocking algorithm; analyze the database transaction log to determine the log writing frequency and the written data; determine the disassembly granularity according to the log writing frequency and the written data; perform multi-dimensional disassembly on the current newly added data according to the blocking algorithm and the disassembly granularity to obtain the fragmented data.

[0163] Optionally, when the data disassembly module 303 determines the disassembly granularity based on the log write frequency and the write data, it is used to: parse the write data to determine the write data block size and the write data type; determine the high-frequency write data and the low-frequency write data based on the write data type; determine the high-frequency update frequency of the high-frequency write data and the low-frequency update frequency of the low-frequency write data based on the log write frequency; determine the disassembly granularity based on the write data block size, the high-frequency update frequency and the low-frequency update frequency.

[0164] Optionally, when the scheme determination module 304 determines the differential backup scheme for the fragmented data based on the network topology information and data characteristics, it is used to: analyze the network topology information to determine the real-time delay, packet loss rate and remaining bandwidth; analyze the current newly added data to determine the data sensitivity; determine the bandwidth preemption priority based on the data sensitivity and data characteristics; determine the optimal transmission protocol based on the bandwidth preemption priority, data sensitivity and real-time delay; determine the differential backup scheme for the fragmented data based on the bandwidth preemption priority and the optimal transmission protocol.

[0165] Optionally, the server data preservation application system also includes a virus determination module 305, which is used to: parse emergency backup requests and determine the data to be backed up; scan the process call chain of the data to be backed up and identify abnormal dynamic link libraries; extract abnormal dynamic link libraries and determine isolated data blocks and the API call sequence of each isolated data block; based on the API call sequence, match each isolated data block with a known virus behavior feature library; based on the matching results, determine the abnormal data blocks containing abnormal features; transfer the abnormal data blocks to the isolation storage pool for virus feature comparison, and determine whether the abnormal data blocks carry viruses based on the virus comparison results.

[0166] Optionally, when the scheme determination module 304 determines the differential backup scheme for the fragmented data based on the network topology information and data characteristics, it is used to: if the abnormal data block carries a virus, then roll back the abnormal data block in time to determine the data before infection; determine the degree of infection of the abnormal data block based on the virus comparison result; determine the data sensitivity level of each abnormal data block based on the degree of infection; and determine the differential backup scheme for the fragmented data based on the data sensitivity level, network topology information and data characteristics.

[0167] Optionally, the request parsing module 301 obtains an emergency backup request, parses the emergency backup request, and determines the trigger time point, which is used to: obtain environmental monitoring data and intrusion monitoring data in real time; analyze the environmental monitoring data and intrusion monitoring data to determine environmental changes and port access conditions; analyze the port access conditions to determine whether there is abnormal access; if it is determined that there is abnormal access, determine the number of abnormal accesses based on the port access conditions; compare the number of abnormal accesses with the abnormal access frequency threshold; analyze environmental changes to determine whether there are any two environmental parameters that exceed the corresponding critical values; if the number of abnormal accesses exceeds the abnormal access frequency threshold, or there are any two environmental parameters that exceed the corresponding critical values, an emergency backup request is generated; and the time when the number of abnormal accesses exceeds the abnormal access frequency threshold, or there are any two environmental parameters that exceed the corresponding critical values ​​is determined as the trigger time point.

[0168] Optionally, when the solution determination module 304 analyzes the current newly added data and determines the data sensitivity, it is used to: determine the metadata attributes of the current newly added data based on the data characteristics; obtain historical operation data, extract historical operation data, determine the data creator identity, data access control list and data encryption status; query the preset organizational structure database based on the data creator identity, and determine the security level of the business department to which the data belongs; analyze the data access control list, identify the authorized user role and the permission operation scope; calculate the data sensitivity through a weighted decision tree model based on the security level, permission operation scope and encryption status.

[0169] The system of this embodiment can be used to execute the method of any of the above embodiments. Its implementation principles and technical effects are similar and will not be described in detail here.

Claims

1. A method for securing data for a server, characterized in that: include: Obtain an emergency backup request, parse the emergency backup request, and determine a trigger time point; According to the trigger time point, historical backup data is retrieved, and the current newly added data is determined based on the historical backup data; Analyze the newly added data to obtain data features; and perform multi-dimensional decomposition of the newly added data based on the data features to obtain fragmented data; Obtaining the current network topology information, and determining a differential backup scheme for the fragmented data based on the network topology information and the data characteristics to perform data preservation operations; After parsing the emergency backup request and determining the trigger time point, the method further includes: Parsing the emergency backup request to determine the data to be backed up; Mount the kernel debugging interface of the device to capture the call chain topology of the process associated with the data to be backed up; Traverse the dynamic link library loading records in the process call chain and identify abnormal dynamic link libraries; Extracting the abnormal dynamic link library, determining isolated data blocks and the API call sequence of each isolated data block; Compare the API call sequence with the malicious code fingerprints in the known virus behavior feature library; then calculate the cosine similarity between the API call sequence and the known virus behavior feature library. If the similarity is high, it is determined to be a potential threat; output the matching results and mark abnormal data blocks with abnormal characteristics; Transferring the abnormal data block to an isolated storage pool for virus feature comparison, and determining whether the abnormal data block carries a virus based on the virus comparison results; The determining of a differential backup scheme for the fragmented data according to the network topology information and the data characteristics includes: If the abnormal data block carries a virus, then the abnormal data block is rolled back in time to determine the data before the infection; Determining the infection level of the abnormal data block according to the virus comparison result; determining a data sensitivity level of each abnormal data block based on the infection degree; A differential backup scheme for the fragmented data is determined according to the data sensitivity level, the network topology information, and the data characteristics.

2. The method according to claim 1, characterized in that The analyzing the current newly added data to obtain data features includes: Using binary mode, extract the file header bytes of the newly added data to determine the file type; Match the extracted bytes with a predefined signature database and determine the file format signature based on the matching results; Obtaining a data storage path for the currently newly added data, and determining a data extension based on the data storage path; Calculate the frequency of occurrence of each byte in the current newly added data; determine the content entropy value based on the frequency of occurrence; Obtaining a database transaction log; determining the access frequency of the current newly added data based on the database transaction log; The file type, the file format signature, the data extension, the content entropy value and the access frequency are determined as data features of the current newly added data.

3. The method according to claim 2, characterized in that The multi-dimensional decomposition of the current newly added data according to the data characteristics to obtain fragmented data includes: Determine structured data, unstructured data, and time series data based on the data characteristics; Analyze the structured data, the unstructured data, and the time series data to determine a corresponding block segmentation algorithm; Analyze the database transaction log to determine the log writing frequency and written data; Determining a disassembly granularity according to the log writing frequency and the written data; According to the block algorithm and the decomposition granularity, the current newly added data is decomposed in multiple dimensions to obtain fragmented data.

4. The method according to claim 3, characterized in that The determining of the disassembly granularity according to the log writing frequency and the written data includes: Parsing the written data to determine the written data block size and the written data type; Determining high-frequency write data and low-frequency write data according to the write data type; Determining a high-frequency update frequency of the high-frequency write data and a low-frequency update frequency of the low-frequency write data according to the log write frequency; The disassembly granularity is determined according to the write data block size, the high-frequency update frequency, and the low-frequency update frequency.

5. The method according to claim 1, wherein The determining of a differential backup scheme for the fragmented data according to the network topology information and the data characteristics includes: Analyzing the network topology information to determine real-time delay, packet loss rate, and remaining bandwidth; Analyze the newly added data to determine the data sensitivity; Determining a bandwidth preemption priority based on the data sensitivity and the data characteristics; determining an optimal transmission protocol based on the bandwidth preemption priority, the data sensitivity, and the real-time delay; A differential backup solution for the fragment data is determined according to the bandwidth preemption priority and the optimal transmission protocol.

6. The method according to claim 1, characterized in that The obtaining of the emergency backup request, parsing the emergency backup request, and determining the triggering time point include: Obtain environmental monitoring data and intrusion monitoring data in real time; Analyzing the environmental monitoring data and the intrusion monitoring data to determine environmental changes and port access conditions; Analyze the port access situation to determine whether there is abnormal access; If it is determined that there is abnormal access, the number of abnormal accesses is determined based on the port access situation; Comparing the number of abnormal accesses with an abnormal access frequency threshold; Analyzing the environmental changes to determine whether any two environmental parameters exceed corresponding critical values; If the number of abnormal accesses exceeds the abnormal access frequency threshold, or if any two environmental parameters exceed corresponding critical values, an emergency backup request is generated; The time when the number of abnormal accesses exceeds the abnormal access frequency threshold, or when any two environmental parameters exceed corresponding critical values, is determined as the trigger time point.

7. The method according to claim 5, characterized in that The analyzing the newly added data to determine the data sensitivity includes: Determining metadata attributes of the newly added data based on the data characteristics; Obtain historical operation data, extract the historical operation data, determine the data creator identity, data access control list and data encryption status; Based on the data creator's identity, query the preset organizational structure database to determine the security level of the business department to which the data belongs; Analyze the data access control list to identify authorized user roles and permission operation scopes; The data sensitivity is calculated using a weighted decision tree model according to the security level, the permission operation range, and the encryption status.

8. A data security application system for a server, characterized in that: The method as claimed in any one of claims 1 to 7 comprises: A request parsing module is used to obtain an emergency backup request, parse the emergency backup request, and determine a triggering time point; A data determination module is used to retrieve historical backup data according to the trigger time point, and determine the current newly added data based on the historical backup data; A data decomposition module is used to analyze the newly added data to obtain data features; and based on the data features, perform multi-dimensional decomposition on the newly added data to obtain fragmented data; The solution determination module is used to obtain the network topology information at the current moment, and determine the differential backup solution of the fragmented data according to the network topology information and the data characteristics to perform data preservation operations.

Images