Data security vectorization method based on time sequence
Through data preprocessing and feature extraction, a time series-enhanced vector database is constructed, and the distance formula for dynamic adjustment of weights is used to identify events with close time first. Combined with the LLM big model to generate security strategies, the problem of inability to effectively process time series data in the existing technology is solved, and efficient and accurate security event analysis and real-time response are achieved.
Patent Information
- Application Number
- CN202510627674.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-05-15
- Publication Date
- 2025-08-01
AI Technical Summary
The existing vectorized calculation methods based on large language models cannot effectively capture the changes in the time dimension when processing time series data, resulting in the inability to accurately identify time-sensitive security events and lack the ability to effectively model time series data.
Security feature vectors are extracted through data preprocessing, combined with user behavior patterns, and constructed a vector database, used distance formulas for dynamically adjusting weights to calculate similarity, prioritize the identification of events with close time, and combine with LLM big model to generate security policies.
It significantly improves the sensitivity and accuracy of security analysis, realizes real-time monitoring and analysis, enhances data privacy protection, improves the speed and efficiency of responding to threats, and complies with the requirements of laws and regulations.
Smart Images
Figure CN120408682A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of data security analysis, and particularly to a time-series-based data security vectorization method. Background Art
[0002] In the field of data security, especially in the processing of security events involving time series analysis, existing technical solutions mainly rely on the Embedding vectorization calculation and retrieval method of large language models (LLMs). These methods usually first preprocess the original log data, including cleaning irrelevant information and extracting key fields such as timestamps, operation types, etc. Then, text information is transformed into feature vectors using word embedding techniques. Next, the Euclidean distance or cost distance between these feature vectors is calculated to evaluate their similarity and identify potential security threats. However, the core of this method is that it only considers the similarity in the spatial dimension, that is, the matching degree of the text content itself, while ignoring the important variable of time.
[0003] Traditional vectorization calculation methods cannot reflect the close relationship between two events in terms of time and logic. However, due to the large differences in their content features, when calculating similarity based on simple spatial distance, this association may not be accurately identified, thus missing important time-series-related security clues. In addition, existing technologies lack the ability to effectively model time series data, which means that when facing a dataset containing time information, they cannot effectively capture the changing patterns in the time dimension. Summary of the Invention
[0004] The purpose of the present invention is to provide a time-series-based data security vectorization method, which optimizes the existing LLM Embedding vectorization calculation and retrieval technology and is particularly suitable for vector enhanced retrieval analysis of security events containing time information.
[0005] The technical solution adopted by the present invention is as follows: A time-series-based data security vectorization method, comprising the following steps: Step 1, data preprocessing: Collect the original log data, clean it and extract keywords, and at the same time transform the text information into feature vectors and then extract the security feature vectors; Further, in step 1, regular expressions are used for cleaning to extract keywords; on the basis of the feature vectors, security feature vectors are extracted in combination with user behavior patterns.
[0006] Specifically, in step 1, the original log data is collected, and technologies such as regular expressions are used for cleaning to extract key fields. The text information is transformed into feature vectors using word embedding techniques, and security feature vectors are extracted in combination with user behavior patterns.
[0007] Step 2, construct a vector database: Obtain the timestamps corresponding to the security feature vectors and store them in the vector database together with the security feature vectors; Specifically, store the extracted security feature vectors together with their occurrence timestamps in the vector database. Design an efficient indexing mechanism to ensure fast retrieval of relevant vectors.
[0008] Step 3, time series enhanced retrieval: Convert the newly added log data into security feature vectors, and use an improved distance formula with dynamically adjusted weights to calculate the similarity, so as to preferentially identify events with close time to obtain the corresponding security feature vectors; Furthermore, dynamically adjust the distance calculation formula according to the time difference.
[0009] Specifically, when new log data enters the system, first convert it into a security feature vector. Use the improved distance formula Distance = sqrt(Σ((v1_i - v2_i)^2)+α*(t1 - t2)^2) to calculate the similarity, where v1_i represents the vector coordinate of data 1, v2_i represents the vector coordinate of data 2, a represents the time weight, t1 represents the event occurrence time of data 1, and t2 represents the event occurrence time of data 2. Dynamically adjust the weight value in the distance calculation formula according to the time difference, and give priority to events that are close in time.
[0010] Step 4, generate and execute security policies: Generate corresponding security policies based on the retrieved security feature vectors. That is, submit the security-related feature data retrieved from the previous vector search to a large model, and let the large model automatically generate security-related policies according to the feature data.
[0011] Furthermore, in Step 4, input the retrieved security feature vectors into the LLM large model and use the LLM large model to generate security policies.
[0012] Specifically, submit the retrieved relevant vectors and their metadata to the large model to generate corresponding security policies. Automatically generate response measures to improve the speed and efficiency of dealing with threats. The large model can be an existing basic large language model. I provide security feature data and let the large model generate security-related policies according to the feature data.
[0013] The present invention adopts the above technical solutions, enhances security feature retrieval by introducing time series, dynamically adjusts time weights, and preferentially identifies security events with closer time proximity, significantly improving the sensitivity and accuracy of analysis. At the same time, the present invention constructs an efficient time series enhanced vector database, combines advanced indexing and storage optimization technologies to ensure fast query and data management, and realizes real-time monitoring and analysis. In addition, using large models to process vector data instead of raw logs enhances data privacy protection, and encryption technology is used during data transmission and storage to further improve security, meeting strict laws and regulations requirements. In summary, compared with the prior art, the present invention not only improves the accuracy, efficiency, and flexibility of data security analysis, but also shows significant advantages in data privacy protection, provides stronger security guarantees for enterprises, has important application value and broad market prospects. These improvements enable enterprises to respond to potential security threats more quickly and accurately.
[0014] The present invention solves the deficiencies of existing traditional vectorization techniques in processing time series data. The vectorization method of the present invention is of great significance for analyzing security events strongly related to time series and enhancing network security protection capabilities. Brief Description of the Drawings
[0015] The following further describes the present invention in detail with reference to the drawings and specific embodiments; Figure 1 It is a schematic flowchart of a data security vectorization method based on time series of the present invention. Specific Embodiments
[0016] To make the objectives, technical solutions, and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application.
[0017] As Figure 1 shown, the present invention discloses a data security vectorization method based on time series, which realizes the data security vectorization of time series for data related to security events when processing security events containing time information. The present invention specifically includes the following steps: Step 1, data preprocessing: Collect raw log data, clean it and extract keywords, and at the same time convert text information into feature vectors and then extract security feature vectors; Furthermore, in step 1, regular expressions are used for cleaning to extract keywords; security feature vectors are extracted based on user behavior patterns on the basis of feature vectors.
[0018] Specifically, in step 1, the original log data is collected and cleaned using techniques such as regular expressions to extract key fields. The word embedding technique is used to convert the text information into feature vectors, and the security feature vectors are extracted in combination with the user behavior patterns.
[0019] Step 2, construct a vector database: Obtain the timestamps corresponding to the security feature vectors and store them in the vector database together with the security feature vectors; Specifically, the extracted security feature vectors are stored in the vector database together with their occurrence timestamps. An efficient indexing mechanism is designed to ensure fast retrieval of relevant vectors.
[0020] Step 3, time series enhanced retrieval: Convert the new log data into security feature vectors, and calculate the similarity using an improved distance formula with dynamically adjusted weights to preferentially identify events close in time to obtain the corresponding security feature vectors; Furthermore, the distance calculation formula is dynamically adjusted according to the time difference.
[0021] Specifically, when new log data enters the system, it is first converted into security feature vectors. The similarity is calculated using the improved distance formula Distance = sqrt(Σ((v1_i - v2_i)^2) + α * (t1 - t2)^2), where v1_i represents the vector coordinates of data 1, v2_i represents the vector coordinates of data 2, a represents the time weight, t1 represents the event occurrence time of data 1, and t2 represents the event occurrence time of data 2. The weight value in the distance calculation formula is dynamically adjusted according to the time difference, and events close in time are preferentially considered.
[0022] Step 4, generate and execute security policies: Generate corresponding security policies based on the retrieved security feature vectors.
[0023] Furthermore, in step 4, the retrieved security feature vectors are input into the LLM large model, and the security policies are generated using the LLM large model.
[0024] Specifically, the retrieved relevant vectors and their metadata are submitted to the large model to generate corresponding security policies. Response measures are automatically generated to improve the speed and efficiency of dealing with threats.
[0025] In summary, the present invention first collects and cleans log data through data preprocessing and feature extraction, and extracts key features. Then, a time series enhanced vector database is constructed to vectorize and store the features to ensure efficient retrieval. Subsequently, a time series enhanced security feature vector retrieval is performed, and the weight is dynamically adjusted using an improved distance formula to prioritize the identification of events with close time proximity. Finally, security policies are generated through a large language model (LLM), and response measures are automatically generated based on the retrieval results to improve the speed and efficiency of threat response. This process significantly improves the accuracy and real-time performance of security analysis.
[0026] The present invention adopts the above technical solutions, extracts key features using word embedding technology and user behavior patterns and stores them in vector form. This method specially designs an efficient vector database and indexing mechanism to ensure fast retrieval capabilities. During the retrieval process, an improved distance formula is used to consider the time factor, dynamically adjusting the weights in the similarity calculation to prioritize the processing of events with close time proximity, improving the detection accuracy and timeliness. Finally, the retrieval results are combined with a large model to generate security policies and implement automated response measures. The method of the present invention not only improves the speed and accuracy of identifying potential threats, but also significantly enhances the efficiency of threat response, providing strong support for real-time data analysis and security management. It innovatively integrates time series to vectorize security events in the time series, and provides event correlation through vectorized retrieval and intelligent decision-making of the large model.
[0027] Obviously, the described embodiments are some, but not all, of the embodiments of the present application. Without conflict, the embodiments and features in the present application can be combined with each other. Generally, the components of the embodiments of the present application described and illustrated in the drawings here can be arranged and designed in various different configurations. Therefore, the detailed description of the embodiments of the present application is not intended to limit the scope of the present application claimed, but merely represents selected embodiments of the present application. All other embodiments obtained by those of ordinary skill in the art based on the embodiments in the present application without creative efforts fall within the scope of protection of the present application.
Claims
1. A time - series - based data security vectorization method, characterized in that: It includes the following steps: Step 1, data preprocessing: Collect the original log data, clean it, extract keywords, and at the same time convert the text information into feature vectors and then extract the security feature vectors; Step 2, construct a vector database: Obtain the timestamps corresponding to the security feature vectors and store them in the vector database together with the security feature vectors; Step 3, time series enhanced retrieval: Convert the newly added log data into security feature vectors, calculate the similarity using an improved distance formula with dynamically adjusted weights, so as to preferentially identify events with close times to obtain the corresponding security feature vectors; Step 4, generate and execute security policies: Generate corresponding security policies based on the retrieved security feature vectors.
2. The data security vectorization method based on time series according to claim 1, characterized in that: In step 1, regular expressions are used for cleaning to extract keywords.
3. A data security vectorization method based on time series according to claim 1, characterized in that: In step 1, security feature vectors are extracted based on the feature vectors in combination with the user behavior patterns.
4. A time-series-based data security vectorization method according to claim 1, characterized in that : In step 3, the distance calculation formula is dynamically adjusted according to the time difference.
5. A time-series-based data security vectorization method according to claim 1, wherein : The improved distance formula in step 3 is as follows: Distance=sqrt(Σ((v1_i-v2_i)^2)+α*(t1-t2)^2); Among them, v1_i represents the vector coordinate of data 1, v2_i represents the vector coordinate of data 2, α represents the time weight, t1 represents the event occurrence time of data 1, and t2 represents the event occurrence time of data 2.
6. A time - series - based data security vectorization method according to claim 1, characterized in that : In step 4, the retrieved security feature vectors are input into the LLM large model, and the LLM large model is used to generate security policies.