Encryption method and system for big data software

Abstract

The invention provides an encryption method and system of big data software, and relates to the technical field of electric digital data processing, and the encryption method and system of the big data software avoid repeated calculation of irrelevant feature data by dynamically dividing a core part feature set and a non-core part feature set, thereby reducing the calculation burden of the whole system; a dynamic encryption algorithm switching mechanism based on user behavior analysis and risk score driving is provided, and encryption complexity can be flexibly adjusted to balance security and performance requirements; a risk feedback mechanism is introduced, and a screening threshold value for correcting a next monitoring time period is output through risk scores of an isolation warehouse, so that an encryption strategy has a continuous optimization capability.

Description

Technical Field

[0001] The present invention relates to the technical field of electronic digital data processing, and in particular to an encryption method and system for big data software. Background Art

[0002] In the application scenario of comprehensive analysis of user behavior data, business-sensitive data, and environmental parameters, the storage and transmission of sensitive data are exposed to potential security risks and are easily targeted by external attackers and internal abuse. For enterprises, it is not only necessary to ensure the confidentiality and integrity of the data itself, but also to conduct precise risk management of data access to prevent losses caused by data leakage and illegal use.

[0003] In the prior art, the publication number is CN105426771A, and the name is a method for achieving big data security. The method includes: after receiving a piece of data, the DFS client will access the local cache to access whether there is a data encryption key for the data; if so, obtain the security file corresponding to the data with the data encryption key, and transfer the content to the big data security function board for security protection; if not, first request to generate the data encryption key; use GetFileinfo to obtain the security file corresponding to the data with the data encryption key; transfer the content of the security file to the big data security function board for security protection; upgrade the original software and network topology architecture model for big data security protection to direct hardware protection, and increase the protection level from the original software protection level to the hardware protection level, which greatly enhances the big data platform's ability to defend against attacks and can effectively improve big data security.

[0004] Currently, most methods for data security protection in big data scenarios focus on directly using traditional encryption algorithms (such as AES and RSA), or simply increasing key lengths to increase the cracking threshold. However, these methods can easily lead to a sharp increase in computational complexity in high-frequency, multi-source data processing environments, affecting real-time performance and even negatively impacting the end-user experience. In addition, existing encryption technologies lack the ability to dynamically analyze user access behavior risks and adjust corresponding policies, making it impossible to provide targeted encryption policy optimization based on actual security needs.

[0005] The above information disclosed in this Background section is only for enhancement of understanding of the background of the present disclosure and therefore it may contain information that does not form the prior art that is already known to a person of ordinary skill in the art. Summary of the Invention

[0006] The purpose of the present invention is to provide an encryption method and system for big data software to solve the problems raised in the above background technology.

[0007] To achieve the above object, the present invention provides the following technical solutions:

[0008] A method for encrypting big data software, comprising the following steps:

[0009] Step S1: Collect multi-source data of the target user during the current monitoring period multiple times. The multi-source data includes user behavior data, business-sensitive data, and environmental parameters, and input the multi-source data into the big data cloud platform for storage and pre-processing;

[0010] Integrate the multi-source data stored N times in the big data cloud platform into their own multi-dimensional feature vectors;

[0011] Step S2: presetting an initial screening threshold of the multidimensional feature vector, and using the initial screening threshold to screen the core feature set and the non-core feature set of the N-times stored multidimensional feature vectors;

[0012] Step S3: Obtain the filtered core feature set and analyze it to obtain a core risk assessment coefficient. The core risk assessment coefficient is used to assess the access mode operation risk of the target user in the current monitoring period and obtain a risk score.

[0013] Step S4: Obtain the target user's risk score during the current monitoring period, and generate a switching strategy for automatically switching encryption algorithms based on the risk score. The switching strategy includes dynamic adjustment of the sequence length and element complexity of the encryption algorithm, and ultimately generates an encryption element sequence. The encryption algorithm includes symmetric encryption and asymmetric encryption.

[0014] Step S5: Based on the generated encryption element sequence, the multi-source data of the target user at the current monitoring moment is encrypted, and the encrypted multi-source data is transmitted to the isolation warehouse for storage processing. The isolation warehouse provides a correction strategy for the initial screening threshold of the next monitoring time period based on the risk score output value of the current monitoring time period.

[0015] A big data software encryption system, the system is used to execute the big data software encryption method, comprising:

[0016] A big data software encryption system, the system is used to execute the big data software encryption method, comprising:

[0017] The collection and vector generation module is used to collect multi-source data of the target user during the current monitoring period. The multi-source data includes user behavior data, business-sensitive data, and environmental parameters, and then input the multi-source data into the big data cloud platform for storage and pre-processing.

[0018] Integrate the multi-source data stored N times in the big data cloud platform into their own multi-dimensional feature vectors;

[0019] Screening module: used to pre-set the initial screening threshold of the multi-dimensional feature vector, and use the initial screening threshold to screen the core feature set and non-core feature set of the N-times stored multi-dimensional feature vectors;

[0020] Scoring module: used to obtain the core feature set of the screening and analyze it to obtain the core risk assessment coefficient. The core risk assessment coefficient is used to evaluate the access mode operation risk of the target user in the current monitoring period and obtain the risk score.

[0021] Encryption algorithm switching module: This module is used to obtain the target user's risk score during the current monitoring period and generate a switching strategy for automatically switching encryption algorithms based on the risk score. The switching strategy includes dynamic adjustment of the sequence length and element complexity of the encryption algorithm, and ultimately generates an encryption element sequence. The encryption algorithm includes symmetric encryption and asymmetric encryption.

[0022] Correction module: used to encrypt the multi-source data of the target user at the current monitoring moment according to the generated encryption element sequence, and transmit the encrypted multi-source data to the isolation warehouse for storage and processing. The isolation warehouse provides a correction strategy for the initial screening threshold of the next monitoring time period based on the risk score output value of the current monitoring time period.

[0023] Compared with the prior art, the present invention has the following beneficial effects:

[0024] 1) By dynamically dividing the feature set into core and non-core parts, we avoid repeated calculations of irrelevant feature data, thereby reducing the computational burden of the entire system;

[0025] 2) A dynamic encryption algorithm switching mechanism driven by user behavior analysis and risk scoring is proposed, which can flexibly adjust encryption complexity to balance security and performance requirements;

[0026] 3) Introduce a risk feedback mechanism to correct the screening threshold for the next monitoring period through the risk score output of the isolated warehouse, so that the encryption strategy has the ability to be continuously optimized. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Figure 1 Schematic diagram of the overall method flow of the present invention;

[0028] Figure 2 This is a block diagram of the overall system module of the present invention. DETAILED DESCRIPTION

[0029] In order to make the objectives, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below with reference to specific embodiments.

[0030] It should be noted that, unless otherwise defined, the technical or scientific terms used in the present invention should have the usual meanings understood by people with ordinary skills in the field to which the present invention belongs. The "first", "second" and similar words used in the present invention do not indicate any order, quantity or importance, but are only used to distinguish different components. "Include" or "comprise" and similar words mean that the elements or objects appearing before the word include the elements or objects listed after the word and their equivalents, without excluding other elements or objects. "Connect" or "connected" and similar words are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect. "Up", "down", "left", "right" and the like are only used to indicate relative position relationships. When the absolute position of the object being described changes, the relative position relationship may also change accordingly.

[0031] Example 1:

[0032] See also Figure 1 , the present invention provides a technical solution:

[0033] A method for encrypting big data software, comprising the following steps:

[0034] Step S1: Collect multi-source data of the target user during the current monitoring period multiple times. The multi-source data includes user behavior data, business-sensitive data, and environmental parameters, and input the multi-source data into the big data cloud platform for storage and pre-processing;

[0035] Integrate the multi-source data stored N times in the big data cloud platform into their own multi-dimensional feature vectors;

[0036] Further explanation: The number of times the target user collects multi-source data in the current monitoring period is represented by a sequence set as {1, 2, ..., i, ..., N}, where i represents the index of the number of times the collection period is collected, and N represents the total number of times the collection period is collected;

[0037] The user behavior data is defined as including the average keyboard key pressure, the mouse track curvature change rate and the window interaction habit index;

[0038] The average keyboard key pressure is the average keyboard pressing force captured by the pressure-sensitive keyboard when the target user types during the current monitoring period;

[0039] Upload the collected multi-source data to the big data cloud platform via secure data transmission protocols HTTPS or TLS to ensure the integrity and security of the data during transmission;

[0040] Use cloud storage services such as Amazon S3, Google Cloud Storage, or Zure Blob Storage to create a storage structure, including different data directories to facilitate classification and management of multi-source data;

[0041] Manage metadata for data stored in the cloud, including information such as data source, data type, and collection time, to facilitate subsequent data retrieval and management;

[0042] Clean the uploaded data, remove duplicate and erroneous data, and fill in missing values. This can be done by writing data cleaning scripts or using data cleaning tools (such as Apache Spark, Apache NiFi, etc.).

[0043] Data conversion operations are performed, including data type conversion and reformatting as needed, to ensure data consistency and compatibility. In this embodiment, the date format is unified into the ISO8601 format, and the numerical values are unified into the corresponding units.

[0044] For the features required for subsequent analysis, dimensionless or normalized processing is performed to convert all feature values to the same range (0,1) to facilitate subsequent analysis and modeling.

[0045] The average value of keyboard key pressure in the collection time period i is defined as ; The calculation formula is as follows:

[0046] ;

[0047] in, is the number of key presses monitored during the collection period i;

[0048] Indicates that within the collection time period i, the The value of the pressing force of the key, in Newtons;

[0049] set up The value range is ,in is the average value of the maximum keyboard key pressure measured during the collection period i;

[0050] The closer it is to 0, the easier it is for the target user to operate without exerting too much effort, reflecting positive emotions. The larger the value, the more it indicates the target user’s stress state, reflecting tension or anxiety;

[0051] The rate of change of the curvature of the mouse track is obtained by recording the rate of change of the curvature of the track when the mouse moves;

[0052] The curvature change rate of the mouse trajectory in the collection time period i is defined as ; The calculation formula is as follows:

[0053] ;

[0054] in, is the number of mouse track points recorded during the collection period i;

[0055] Indicates the arc change of the mouse between two consecutive mouse trajectory points j2+1 and j2;

[0056] ; ;

[0057] Represents the straight-line distance between two consecutive mouse track points j2+1 and j2, in meters;

[0058] ,in is the maximum curvature change measured during the collection period i;

[0059] when The closer it is to 0, the smoother the user operation is, which is a stable operation for the target user. The closer , it indicates that the target user is attempting fast or complex operations, indicating robot operation or abnormal behavior;

[0060] The window interaction habit indicator collects statistics on user operations on windows in the software interface, including the number of times the window is dragged and the amplitude of window resizing habits;

[0061] The window interaction habit index in the collection time period i is defined as ; The calculation formula is as follows:

[0062] ;

[0063] in, represents the number of window interactions within the collection period i;

[0064] Indicates the distance the window was dragged in the j3rd interaction during the collection period i, in pixels;

[0065] Indicates the window resize amplitude in the j3rd interaction during collection period i, in pixels.

[0066] The value range is ,in It is the maximum window interaction habit indicator that can be achieved in the system;

[0067] when The closer it is to 0, the less the target user operates on the current encryption window, tending to use the default settings or rarely interact;

[0068] And when The closer , indicating that users frequently adjust windows, which can better reflect users' personalized needs and usage habits.

[0069] The business sensitive data is defined as including the target user's modification consistency index of sensitive data, the frequency of dynamic changes in access rights, and the business data usage duration index;

[0070] The modification consistency indicator records the frequency of target users modifying sensitive business data fields;

[0071] The modification consistency index defined in the collection time period i is The calculation formula is as follows:

[0072] ;

[0073] in, is the number of modifications to the sensitive data field during the collection period i;

[0074] It is a parameter that adjusts the mapping amplitude and controls the steepness of the curve;

[0075] It is the balance parameter for zero-point shifting of data and is set to the standard value of the modified frequency of the system;

[0076] The range of is (0,1);

[0077] when The closer it is to 0, the lower the modification frequency is, which means the user operation is more stable;

[0078] when The closer it is to 1, the higher the modification frequency is, which means the user operation is more unstable and the probability of risky operation is higher;

[0079] The frequency of dynamic changes in access rights refers to the frequency of real-time dynamic changes in permissions of monitored target users during normal business operations;

[0080] Define the frequency of dynamic changes in access rights during collection period i as ; The calculation formula is as follows:

[0081] ;

[0082] in, is the number of permission changes identified during the collection period i;

[0083] and is a constant used to adjust the sensitivity of the frequency response; Control the dynamic range of frequency; It is a biased value, ensuring that the output of the calculation formula is not an invalid value.

[0084] The value range of is (0,1);

[0085] when The closer it gets to 0 o'clock, The smaller the value, the fewer times the permission changes occur and the more stable the permission changes are;

[0086] when As it approaches 1 o'clock, The larger the value, the more frequently permissions are changed and the lower the security of the operation.

[0087] The business data usage duration indicator measures the duration of time target users spend accessing sensitive data files or fields.

[0088] The service data usage duration indicator in the collection period i is defined as The calculation formula is as follows:

[0089] ;

[0090] in, is the duration in seconds that the target user spends on business-sensitive data during the collection period i;

[0091] It is the standard value of the normal access duration set by the target user in the collection time period i, in seconds;

[0092] when The closer it is to 0, the shorter the access time is, indicating fast access;

[0093] when A larger value indicates that the target user has been using business-sensitive data for a longer time, indicating that the target user is performing in-depth operations.

[0094] The environmental parameters are defined to include a location consistency index of the operating device, and temperature fluctuations and network jitter rates of the operating device during the execution of encryption operations;

[0095] The position consistency index is used to evaluate the stability and consistency of the positioning data of the operating device within a certain period of time;

[0096] The position consistency index in the collection time period i is defined as The calculation formula is as follows:

[0097] ;

[0098] in, is the frequency of changes in the positioning data of the operating device during collection period i; it is obtained by analyzing the number of position changes of the operating device. In this embodiment, sampling is performed at equal intervals during collection period i. When the position of the operating device changes relative to the last measured position, it is recorded as a position change;

[0099] It is the normal position data change threshold of the operating device, which is derived from the statistical analysis of historical data. The change of positioning data is determined based on the mobile position of the mobile terminal device, specifically the straight-line distance between the reference position and the current position through the GPS navigation route.

[0100] is the steepness parameter, which controls the sensitivity of the output so that it can respond quickly to changes when detecting consistency;

[0101] The value range of is (0,1);

[0102] when The closer When the positioning data of the operating device is more consistent, the operation is more stable.

[0103] when Exceed The larger the value, the more unstable the position of the device.

[0104] Define the temperature fluctuation of the operating device during the encryption operation in the collection period i as The calculation formula is as follows:

[0105] ;

[0106] in, is the maximum temperature of the operating device recorded during the execution of the encryption operation in the collection period i, in degrees Celsius;

[0107] is the lowest temperature of the operating device recorded during the execution of the encryption operation in the collection period i, in degrees Celsius;

[0108] is the average temperature of the operating device recorded during the execution of encryption operations during the collection period i, in degrees Celsius.

[0109] is a small positive number used to avoid the denominator being zero. ;

[0110] The smaller the value, the more stable the temperature fluctuation of the operating equipment is, indicating that the operating equipment is running more normally;

[0111] The larger the value, the more unstable the temperature fluctuation is, indicating that the equipment is not operating normally.

[0112] Define the network jitter rate of the operating device during the encryption operation in the collection period i as The calculation formula is as follows:

[0113]

[0114] in, It is the time difference between the arrival of two consecutive data packets, in milliseconds;

[0115] P4 is the number of data packets recorded in the collection period i; ;

[0116] It is the maximum allowed delay between two consecutive data packets arriving in the collection period i, in milliseconds;

[0117] when The smaller the value, the more stable the network connection and the higher the transmission quality.

[0118] when The larger the value, the more unstable the network connection and the lower the transmission quality; the greater the efficiency of encryption operation;

[0119] The multidimensional feature vector collected in time period i is represented as ;

[0120] right All eigenvalues in are uniformly dimensionless; the value range is unified to (0,1), and the specific processing is as follows:

[0121] Using the standardized formula:

[0122] ;

[0123] in, Represents the original feature data. and are the minimum and maximum values of the feature, respectively.

[0124] After dimensionless processing, each eigenvalue is uniformly converted to the range of (0,1) to ensure that each eigenvector can be fairly compared and further calculated.

[0125] After dimensionless processing, the multidimensional feature vector that has undergone consistent dimensionless processing is represented as:

[0126] ;

[0127] in, , and They represent the characteristic values of user behavior data, business sensitive data and environmental parameters after consistent dimensionless conversion during the collection period i.

[0128] Step S2: presetting an initial screening threshold of the multidimensional feature vector, and using the initial screening threshold to screen the core feature set and the non-core feature set of the N-times stored multidimensional feature vectors;

[0129] Further explanation: Get the dimensionless multidimensional feature vector ;

[0130] set up The initial screening thresholds for each parameter value are ;

[0131] In this embodiment, The setting principle is: in the multidimensional feature vector stored N times, calculate The average value of each average value is obtained, and a correction value is subtracted from it. The initial setting correction value is 1 to ensure that the average value minus the correction value is below 0.5, and the obtained values are respectively used as ;

[0132] It can also be determined by the fuzzy analytic hierarchy process (FAHP), which will not be described in detail;

[0133] Compute the following scaled values of N stored multidimensional feature vectors:

[0134] ;

[0135] Initially All parameter values in are taken as the core feature set;

[0136] If it meets When the number of multidimensional eigenvectors is less than n1, and n1 is less than N, n1 takes the value Select from and All of them represent rounding up to integers, then As a non-core feature;

[0137] If it meets When the number of multidimensional eigenvectors is less than n1, As a non-core feature;

[0138] If it meets When the number of multidimensional eigenvectors is less than n1, As a non-core feature;

[0139] set up The initial screening thresholds for each parameter value are ;

[0140] Compute the following scaled values of N stored multidimensional feature vectors:

[0141] ;

[0142] Initially All parameter values in are taken as the core feature set;

[0143] If it meets When the number of multidimensional eigenvectors is less than n1, As a non-core feature;

[0144] If it meets When the number of multidimensional eigenvectors is less than n1, As a non-core feature;

[0145] If it meets When the number of multidimensional eigenvectors is less than n1, As a non-core feature;

[0146] set up The initial screening thresholds for each parameter value are ;

[0147] Compute the following scaled values of N stored multidimensional feature vectors:

[0148] ;

[0149] Initially All parameter values in are taken as the core feature set;

[0150] If it meets When the number of multidimensional eigenvectors is less than n1, As a non-core feature;

[0151] If it meets When the number of multidimensional eigenvectors is less than n1, As a non-core feature;

[0152] If it meets When the number of multidimensional eigenvectors is less than n1, As a non-core feature;

[0153] It should be noted that The settings need to ensure At least one of them meets the definition of the core feature set;

[0154] The settings need to ensure At least one of them meets the definition of the core feature set;

[0155] The settings need to ensure At least one of them meets the definition of the core feature set;

[0156] This embodiment sets ; Indicates rounding up to an integer. is a regulating factor; To ensure , and At least one of them meets the definition of the core feature set.

[0157] Step S3: Obtain the filtered core feature set and analyze it to obtain a core risk assessment coefficient. The core risk assessment coefficient is used to assess the access mode operation risk of the target user in the current monitoring period and obtain a risk score.

[0158] Further explanation: , and The parameters in are respectively denoted as , and ;

[0159] If it meets the core characteristics, ; If it is a non-core feature, ;

[0160] Will By combining and analyzing the various parameters in , we can get the following user behavior trend coefficients:

[0161] ;

[0162] in, is the user behavior trend coefficient, Output value and or or For positive correlation, , and are the weight coefficients of the corresponding parameters, and , and The value is in the interval (0,1). ;

[0163] It should be noted that: or or The larger the corresponding ratio, the greater the change trend of the average keyboard key pressure, the mouse track curvature change rate, and the window interaction habit index, and the greater the abnormality of the user behavior.

[0164] Will By combining and analyzing the various parameters in the above, we can obtain the following business sensitivity trend coefficients:

[0165] in, is the business sensitive trend coefficient, Output value and or or It indicates positive correlation; and Indicates the index of two adjacent collection time periods; , and are the weight coefficients of the corresponding parameters, and , and The value is in the interval (0,1). ;

[0166] It should be noted that: or or The larger the corresponding ratio, the greater the trend of change in the modification consistency index, the frequency of dynamic changes in access rights, and the business data usage duration index, respectively; and the greater the degree of abnormality of business sensitive data;

[0167] Will By combining and analyzing the various parameters in the paper, the following environmental trend coefficients are obtained:

[0168] ;

[0169] in, is the environmental trend coefficient, Output value and or or For positive correlation, , and are the weight coefficients of the corresponding parameters, and , and The value is in the interval (0,1). ;

[0170] It should be noted that: or or The larger the corresponding ratio, the greater the change trend of the position consistency index, temperature fluctuation, and network jitter rate, which reflects the greater impact of environmental parameters on the security of encrypted data.

[0171] The calculation formula for the core risk assessment coefficient is defined as follows:

[0172]

[0173] in, is the core risk assessment coefficient, , and are the weight coefficients of the corresponding parameters, and , and The value is in the interval (0,1). ;

[0174] set up The range of is (0,1); and set The judgment threshold interval is ; are the upper and lower limits of the judgment threshold interval, Contained in (0,1); in this embodiment, Determined by the expert group using the fuzzy analytic hierarchy process (FAHP); the initial setting of this embodiment is for ;

[0175] when When the target user's access mode operation risk in the current monitoring period is assessed as low risk, the risk score is recorded as 0;

[0176] when When the target user's access mode operation risk in the current monitoring period is assessed as medium risk, the risk score is recorded as 1;

[0177] when When the target user's access mode operation risk in the current monitoring period is assessed as high risk, the risk score is recorded as 10;

[0178] It should be noted that the above content , , , , , , , , , , and The corresponding weights are determined by entropy weight method and fuzzy analytic hierarchy process (FAHP).

[0179] Step S4: Obtain the target user's risk score during the current monitoring period and generate a switching strategy for automatically switching encryption algorithms based on the risk score. The switching strategy includes dynamic adjustment of the sequence length and element complexity of the encryption algorithm, ultimately generating an encryption element sequence. The encryption algorithms include symmetric encryption (AES) and asymmetric encryption (RSA).

[0180] Further explanation: The switching strategy for automatically switching encryption algorithms includes:

[0181] When the risk score corresponding to the access mode operation risk is 0, AES symmetric encryption is used to encrypt the data and generate a low-length encryption element sequence;

[0182] The lowest-length encryption element sequence is a 128-bit key, ensuring adequate security while minimizing resource consumption.

[0183] When the risk score corresponding to the access mode operation risk is 1, continue to use AES symmetric encryption for data encryption, but increase the key length or rounds to improve security to generate a medium-length encryption element sequence;

[0184] The medium-length sequence of encryption elements is a 256-bit key and 14 rounds of encryption;

[0185] When the risk score corresponding to the access mode operation risk is 10, switch to RSA asymmetric encryption and generate a high-length encryption element sequence;

[0186] A high-length sequence of encryption elements (e.g., 2048 bits) ensures higher security.

[0187] Step S5: Based on the generated encryption element sequence, the multi-source data of the target user at the current monitoring moment is encrypted, and the encrypted multi-source data is transmitted to the isolation warehouse for storage processing. The isolation warehouse provides a correction strategy for the initial screening threshold of the next monitoring time period based on the risk score output value of the current monitoring time period.

[0188] Further explanation: An isolated warehouse is a secure environment specifically designed to store sensitive data or important information; this environment is isolated from other systems or networks to prevent unauthorized access and data leakage.

[0189] In this embodiment, the isolated warehouse adopts the data lake or AWS's "Isolated Fortress" (AWS Bastion Host) model;

[0190] Provide a corrective strategy for the initial screening threshold for the next monitoring period, including:

[0191] If the risk score output value for the current monitoring period is 0, no correction is made to the initial screening threshold for the next monitoring period;

[0192] If the risk score output value for the current monitoring period is 1, a first-level correction is performed on the initial screening threshold for the next monitoring period;

[0193] Will , and The first-level corrective strategy is comprehensively defined as:

[0194] ;

[0195] in, Characterization , and Each initial screening threshold in;

[0196] Characterize the initial screening threshold after the corresponding parameters are corrected; Characterize the weight coefficients of the corresponding parameters in the user behavior trend coefficient, business sensitivity trend coefficient, and environment trend coefficient;

[0197] The formula is set to obtain Relative to To reduce processing, this setting aims to reduce , and The values of the initial screening thresholds in the , thereby reducing the non-core features of the next monitoring period to increase the core features. The increased core features can enrich the calculation content of the subsequent user behavior trend coefficient, business sensitivity trend coefficient and environmental trend coefficient to improve the calculation accuracy, and ultimately improve the risk assessment accuracy of the core risk assessment coefficient; The introduction of settings can make different degrees of initial screening threshold corrections according to the weights of the corresponding parameters, further improving Adjustment precision;

[0198] Further explanation: Based on the above correction strategy, the following experiments were conducted:

[0199] The goal of the trial is to improve the accuracy of data screening and risk assessment by correcting and optimizing initial screening thresholds. The key steps in implementing this trial are as follows:

[0200] The calculated corrected initial screening threshold Applied to existing data sets to re-screen data features.

[0201] Compare the changes in core risk assessment coefficients before and after adjustment to analyze the actual effect of the screening threshold adjustment.

[0202] 1) Dataset preparation:

[0203] Collect access logs from Internet service platforms, including user behavior, business requests, environmental information, etc. This data reflects user behavior trends, business sensitivity, and environmental changes.

[0204] Determine three main trend coefficients: user behavior trend coefficient, business sensitivity trend coefficient and environment trend coefficient.

[0205] 2) Parameter and weight determination:

[0206] Sure The weight coefficients of the corresponding user behavior trend coefficient, business sensitivity trend coefficient, and environmental trend coefficient;

[0207] The following is a table based on experimental data and includes the ratio of the number of core features before and after correction:

[0208]

[0209] Data Analysis:

[0210] The above data show that by applying the screening threshold correction method of the present invention, the proportion of core features after correction is significantly improved compared to before correction; the core feature ratio of the parameter corresponding to the user behavior trend coefficient increases from 20% before correction to 25% after correction; this improvement shows that by reducing the value of non-core features (reduction ratio between 7% and 12%), the feature concentration of the data can be improved, thereby improving the accuracy of the assessment of user behavior, business sensitivity and environmental factors. The increase in the proportion of features after correction means that the system attaches more importance to core features, and therefore the risk assessment and behavior prediction capabilities of the model are also enhanced accordingly. This feature is particularly critical in data-intensive businesses and helps improve decision-making quality and response efficiency.

[0211] The specific instructions are as follows:

[0212] Initial screening threshold corresponding to user behavior data Carry out the following first-level corrective strategies:

[0213] ;

[0214] in, , and are the initial screening thresholds after correction of the corresponding parameters;

[0215] Initial screening threshold for business-sensitive data Carry out the following first-level corrective strategies:

[0216] ;

[0217] in, , and are the initial screening thresholds after correction of the corresponding parameters;

[0218] Initial screening thresholds corresponding to environmental parameters Carry out the following first-level corrective strategies:

[0219] ;

[0220] in, , and are the initial screening thresholds after correction of the corresponding parameters;

[0221] If the risk score output value for the current monitoring period is 10, a secondary correction is performed on the initial screening threshold for the next monitoring period;

[0222] Will , and The comprehensive definition of the secondary corrective strategy is:

[0223] ;

[0224] It should be noted that the detailed description and implementation of the secondary correction strategy are the same as those of the primary correction strategy above, and will not be repeated here.

[0225] The adjustment range of the first-level correction is defined to be smaller than that of the second-level correction.

[0226] Secondary Corrective Strategy Higher than the first level corrective strategy ; thereby making the adjustment range of the secondary correction strategy greater than the adjustment range of the primary correction strategy.

[0227] Example 2:

[0228] See also Figure 2 : An encryption system for big data software, the system is used to execute the encryption method of the big data software, comprising:

[0229] The collection and vector generation module is used to collect multi-source data of the target user during the current monitoring period. The multi-source data includes user behavior data, business-sensitive data, and environmental parameters, and then input the multi-source data into the big data cloud platform for storage and pre-processing.

[0230] Integrate the multi-source data stored N times in the big data cloud platform into their own multi-dimensional feature vectors;

[0231] Screening module: used to pre-set the initial screening threshold of the multi-dimensional feature vector, and use the initial screening threshold to screen the core feature set and non-core feature set of the N-times stored multi-dimensional feature vectors;

[0232] Scoring module: used to obtain the core feature set of the screening and analyze it to obtain the core risk assessment coefficient. The core risk assessment coefficient is used to evaluate the access mode operation risk of the target user in the current monitoring period and obtain the risk score.

[0233] Encryption algorithm switching module: This module is used to obtain the target user's risk score during the current monitoring period and generate a switching strategy for automatically switching encryption algorithms based on the risk score. The switching strategy includes dynamic adjustment of the sequence length and element complexity of the encryption algorithm, and ultimately generates an encryption element sequence. The encryption algorithm includes symmetric encryption and asymmetric encryption.

[0234] Correction module: used to encrypt the multi-source data of the target user at the current monitoring moment according to the generated encryption element sequence, and transmit the encrypted multi-source data to the isolation warehouse for storage and processing. The isolation warehouse provides a correction strategy for the initial screening threshold of the next monitoring time period based on the risk score output value of the current monitoring time period.

[0235] It should be noted that all calculation formulas in this application document utilize, including but not limited to, regression analysis within machine learning algorithms to deeply analyze the collected parameters and identify their natural trends and interrelationships. Professional software, such as Python's Scikit-learn library or the R language, is used to automatically generate mathematical models that match the data. Model performance is then objectively evaluated through methods such as cross-validation, combined with continuous feedback and optimization to ensure that the created formulas truly reflect the inherent laws of the data, thereby guaranteeing their validity and accuracy, and ensuring that the calculation process complies with the constraints of natural laws rather than being based on artificially set rules.

[0236] The technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product. The computer software product can be stored in a computer-readable storage medium, such as a computer floppy disk, read-only memory (ROM), random access memory (RAM), flash memory (FLASH), hard disk or optical disk, etc., and includes a number of instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute the methods of various embodiments of the present invention.

[0237] The logic and / or steps represented in the flowcharts or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing the logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (e.g., a computer-based system, a system including a processor, or other system that can fetch and execute instructions from an instruction execution system, apparatus, or device). For purposes of this specification, a "computer-readable medium" can be any device that can contain, store, communicate, propagate, or transport a program for use by, or in conjunction with, an instruction execution system, apparatus, or device.

[0238] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

[0239] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A method for encrypting big data software, characterized in that: The specific steps include: Step S1: Collect multi-source data of the target user during the current monitoring period multiple times. The multi-source data includes user behavior data, business-sensitive data, and environmental parameters, and input the multi-source data into the big data cloud platform for storage and pre-processing; Integrate the multi-source data stored N times in the big data cloud platform into their own multi-dimensional feature vectors; Step S2: presetting an initial screening threshold of the multidimensional feature vector, and using the initial screening threshold to screen the core feature set and the non-core feature set of the N-times stored multidimensional feature vectors; Step S3: Obtain the filtered core feature set and analyze it to obtain a core risk assessment coefficient. The core risk assessment coefficient is used to assess the access mode operation risk of the target user in the current monitoring period and obtain a risk score. Step S4: Obtain the target user's risk score during the current monitoring period, and generate a switching strategy for automatically switching encryption algorithms based on the risk score. The switching strategy includes dynamic adjustment of the sequence length and element complexity of the encryption algorithm, and ultimately generates an encryption element sequence. The encryption algorithm includes symmetric encryption and asymmetric encryption. Step S5: Based on the generated encryption element sequence, the multi-source data of the target user at the current monitoring moment is encrypted, and the encrypted multi-source data is transmitted to the isolation warehouse for storage processing. The isolation warehouse provides a correction strategy for the initial screening threshold of the next monitoring time period based on the risk score output value of the current monitoring time period.

2. The encryption method for big data software according to claim 1, characterized in that: The number of times the target user collects multi-source data in the current monitoring period is expressed as a sequence set {1, 2, ..., i, ..., N}, where i represents the index of the number of times the data is collected in the period, and N represents the total number of times the data is collected in the period. The user behavior data is defined as including the average keyboard key pressure, the mouse track curvature change rate and the window interaction habit index; The average keyboard key pressure is the average keyboard pressing force captured by the pressure-sensitive keyboard when the target user types during the current monitoring period; The average value of keyboard key pressure in the collection time period i is defined as ; The rate of change of the curvature of the mouse track is obtained by recording the rate of change of the curvature of the track when the mouse moves; The curvature change rate of the mouse trajectory in the collection time period i is defined as ; The window interaction habit indicator collects statistics on user operations on windows in the software interface, including the number of times the window is dragged and the amplitude of window resizing habits; The window interaction habit index in the collection time period i is defined as ; The business sensitive data is defined as including the target user's modification consistency index of sensitive data, the frequency of dynamic changes in access rights, and the business data usage duration index; The modification consistency indicator records the frequency of target users modifying sensitive business data fields; The modification consistency index defined in the collection time period i is ; The frequency of dynamic changes in access rights refers to the frequency of real-time dynamic changes in permissions of monitored target users during normal business operations; Define the frequency of dynamic changes in access rights during collection period i as ; The business data usage duration indicator measures the duration of time target users spend accessing sensitive data files or fields. The service data usage duration indicator in the collection period i is defined as ; The environmental parameters are defined to include a location consistency index of the operating device, and temperature fluctuations and network jitter rates of the operating device during the execution of encryption operations; The position consistency index is used to evaluate the stability and consistency of the positioning data of the operating device within a certain period of time; The position consistency index in the collection time period i is defined as ; Define the temperature fluctuation of the operating device during the encryption operation in the collection period i as ; Define the network jitter rate of the operating device during the encryption operation in the collection period i as ; The multidimensional feature vector collected in time period i is represented as ; right All eigenvalues in are uniformly dimensionless; The multidimensional feature vector that is uniformly dimensionless is represented as: ； in, , and They represent the characteristic values of user behavior data, business sensitive data and environmental parameters after consistent dimensionless conversion during the collection period i.

3. The encryption method for big data software according to claim 2, characterized in that: Get dimensionless multidimensional feature vector ; set up The initial screening thresholds for each parameter value are ; Compute the following scaled values of N stored multidimensional feature vectors: ； Initially All parameter values in are taken as the core feature set; If it meets When the number of multidimensional eigenvectors is less than n1, As a non-core feature; and n1 takes the value Select from and All of them mean rounding up to integers. If it meets When the number of multidimensional eigenvectors is less than n1, As a non-core feature; If it meets When the number of multidimensional eigenvectors is less than n1, As a non-core feature; set up The initial screening thresholds for each parameter value are ; Compute the following scaled values of N stored multidimensional feature vectors: ； Initially All parameter values in are taken as the core feature set; If it meets When the number of multidimensional eigenvectors is less than n1, As a non-core feature; If it meets When the number of multidimensional eigenvectors is less than n1, As a non-core feature; If it meets When the number of multidimensional eigenvectors is less than n1, As a non-core feature; set up The initial screening thresholds for each parameter value are ; Compute the following scaled values of N stored multidimensional feature vectors: ； Initially All parameter values in are taken as the core feature set; If it meets When the number of multidimensional eigenvectors is less than n1, As a non-core feature; If it meets When the number of multidimensional eigenvectors is less than n1, As a non-core feature; If it meets When the number of multidimensional eigenvectors is less than n1, As a non-core feature.

4. The encryption method for big data software according to claim 3, characterized in that: Will , and The parameters in are respectively denoted as , and ; If it meets the core characteristics, ; If it is a non-core feature, ; Will By combining and analyzing the various parameters in , we can get the following user behavior trend coefficients: ； in, is the user behavior trend coefficient, Output value and or or For positive correlation, , and are the weight coefficients of the corresponding parameters, and , and The value is in the interval (0,1). ; Will By combining and analyzing the various parameters in the above, we can obtain the following business sensitivity trend coefficients: in, is the business sensitive trend coefficient, Output value and or or It indicates positive correlation; and Indicates the index of two adjacent collection time periods; , and are the weight coefficients of the corresponding parameters, and , and The value is in the interval (0,1). ; Will By combining and analyzing the various parameters in the paper, the following environmental trend coefficients are obtained: ； in, is the environmental trend coefficient, Output value and or or For positive correlation, , and are the weight coefficients of the corresponding parameters, and , and The value is in the interval (0,1). .

5. The encryption method for big data software according to claim 4, characterized in that: The calculation formula for the core risk assessment coefficient is defined as follows: in, is the core risk assessment coefficient, , and are the weight coefficients of the corresponding parameters, and , and The value is in the interval (0,1). ; set up The range of is (0,1); and set The judgment threshold interval is ; are the upper and lower limits of the judgment threshold interval, Contained in (0,1); when When the target user's access mode operation risk in the current monitoring period is assessed as low risk, the risk score is recorded as 0; when When the target user's access mode operation risk in the current monitoring period is assessed as medium risk, the risk score is recorded as 1; when , the target user's access mode operation risk during the current monitoring period is assessed as high risk, and the risk score is recorded as 10.

6. The encryption method for big data software according to claim 5, characterized in that: Automatic switching of encryption algorithms, including: When the risk score corresponding to the access mode operation risk is 0, AES symmetric encryption is used to encrypt the data and generate a low-length encryption element sequence; When the risk score corresponding to the access mode operation risk is 1, continue to use AES symmetric encryption for data encryption, but increase the key length or rounds to improve security to generate a medium-length encryption element sequence; When the risk score corresponding to the access mode operation risk is 10, switch to RSA asymmetric encryption; and generate a high-length encryption element sequence.

7. The encryption method for big data software according to claim 6, characterized in that: Provide a corrective strategy for the initial screening threshold for the next monitoring period, including: If the risk score output value for the current monitoring period is 0, no correction is made to the initial screening threshold for the next monitoring period; If the risk score output value for the current monitoring period is 1, a first-level correction is performed on the initial screening threshold for the next monitoring period; Will , and The first-level corrective strategy is comprehensively defined as: ； in, Characterization , and Each initial screening threshold in; Characterize the initial screening threshold after the corresponding parameters are corrected; Characterize the weight coefficients of the corresponding parameters in the user behavior trend coefficient, business sensitivity trend coefficient, and environment trend coefficient; If the risk score output value for the current monitoring period is 10, a secondary correction is performed on the initial screening threshold for the next monitoring period; Will , and The comprehensive definition of the secondary corrective strategy is: ； The adjustment range of the first-level correction is defined to be smaller than that of the second-level correction.

8. An encryption system for big data software, characterized by: The system is used to execute the encryption method of big data software according to any one of claims 1 to 7, comprising: The collection and vector generation module is used to collect multi-source data of the target user during the current monitoring period. The multi-source data includes user behavior data, business-sensitive data, and environmental parameters, and then input the multi-source data into the big data cloud platform for storage and pre-processing. Integrate the multi-source data stored N times in the big data cloud platform into their own multi-dimensional feature vectors; Screening module: used to pre-set the initial screening threshold of the multi-dimensional feature vector, and use the initial screening threshold to screen the core feature set and non-core feature set of the N-times stored multi-dimensional feature vectors; Scoring module: used to obtain the core feature set of the screening and analyze it to obtain the core risk assessment coefficient. The core risk assessment coefficient is used to evaluate the access mode operation risk of the target user in the current monitoring period and obtain the risk score. Encryption algorithm switching module: This module is used to obtain the target user's risk score during the current monitoring period and generate a switching strategy for automatically switching encryption algorithms based on the risk score. The switching strategy includes dynamic adjustment of the sequence length and element complexity of the encryption algorithm, and ultimately generates an encryption element sequence. The encryption algorithm includes symmetric encryption and asymmetric encryption. Correction module: used to encrypt the multi-source data of the target user at the current monitoring moment according to the generated encryption element sequence, and transmit the encrypted multi-source data to the isolation warehouse for storage and processing. The isolation warehouse provides a correction strategy for the initial screening threshold of the next monitoring time period based on the risk score output value of the current monitoring time period.

Images