Big data platform storage data isolation method in SaaS mode

Abstract

The invention discloses a big data platform storage data isolation method in a SaaS mode, and relates to the technical field of big data, and the method comprises the steps: inputting a storage situation data set into a causal graph neural network, capturing a data time sequence mode and causal association features through a feature extraction layer, carrying out the multi-hop neighborhood feature aggregation through a feature fusion layer, and generating a storage anomaly detection vector; inputting the stored anomaly detection vector into a causal inference engine, executing risk quantification by using an improved causal inference tree algorithm, obtaining a causal effect score, carrying out risk division through a three-level threshold, generating an anomaly risk level, carrying out entropy calculation on the anomaly risk level by using a Shannon entropy formula, obtaining an anomaly entropy value, and obtaining an anomaly result. Carrying out interval classification on the abnormal entropy value to form a sensitivity level; according to the invention, through the constructed causal graph neural network, the improved causal inference tree algorithm and the analytic hierarchy process, dynamic identification of abnormal risks is realized, and redundancy isolation of low-risk data is also avoided.

Description

Technical Field

[0001] The present invention relates to the field of big data technology, and in particular to a method for isolating stored data on a big data platform under a SaaS model. Background Art

[0002] With the rapid development of cloud computing and big data technologies, the SaaS (Software as a Service) model has become a key form of enterprise application deployment. In this model, multiple tenants share the same software systems and infrastructure resources, significantly reducing IT operating costs and improving service delivery efficiency. However, this resource sharing mechanism also presents challenges such as poor data isolation and low security. Especially in multi-tenant big data platforms, ensuring logical isolation and access control for each tenant's stored data has become a key issue in ensuring the secure and stable operation of the platform.

[0003] While existing technologies have achieved some success, they still have some shortcomings. First, traditional methods rely on fixed thresholds or manually configured access rules, making it difficult to dynamically adjust isolation strength based on temporal behavior patterns. This makes it difficult to quantify the risk level of abnormalities in storage operations in real time. Second, while existing solutions can achieve physical isolation, they lack a model that correlates abnormal risk with data sensitivity. This results in insufficient protection for high-value data or excessive isolation of low-risk data, resulting in low resource efficiency. Summary of the Invention

[0004] In view of the above existing problems, the present invention is proposed.

[0005] Therefore, the present invention provides a method for isolating data stored on a big data platform under the SaaS model to solve the problems of insufficient risk perception ability and lack of correlation between risk and sensitivity in the existing technology.

[0006] In order to solve the above technical problems, the present invention provides the following technical solutions: In a first aspect, the present invention provides a method for isolating storage data on a big data platform under a SaaS model, comprising: inputting a storage situation dataset into a causal graph neural network; a feature extraction layer capturing data temporal patterns and causal correlation features; and a feature fusion layer performing multi-hop neighborhood feature aggregation to generate a storage anomaly detection vector. The stored anomaly detection vector is input into the causal inference engine, and the improved causal inference tree algorithm is used to perform risk quantification, obtain the causal effect score, and divide the risk using a three-level threshold to generate anomaly risk level; The Shannon entropy formula is used to calculate the entropy value of the abnormal risk level, obtain the abnormal entropy value, and classify the abnormal entropy value into intervals to form a sensitivity level; the abnormal risk level, abnormal entropy value and sensitivity level are integrated to generate a storage data isolation plan; Convert the storage data isolation scheme into control instructions to drive the big data platform to perform encryption partition reconfiguration and data isolation, synchronously collect real-time storage feedback data, and optimize the causal graph neural network.

[0007] As an optimal solution for the data isolation method for storage on a big data platform under the SaaS model described in the present invention, the storage status data set includes tenant identification, operation type, target partition path, operation timestamp and data size.

[0008] As a preferred solution of the data isolation method for big data platform storage under the SaaS model of the present invention, the causal graph neural network is specifically constructed as follows: Build and initialize the feature extraction layer and feature fusion layer, and use the attention mechanism to weightedly stack and hierarchically cross-connect the feature extraction layer and feature fusion layer to construct a causal graph neural network.

[0009] As a preferred solution of the method for isolating storage data on a big data platform under the SaaS model of the present invention, the generating of the storage anomaly detection vector specifically includes the following steps: The stored security situation dataset is input into the causal graph neural network. The feature extraction layer captures the data temporal pattern and causal correlation features through the gated recurrent unit to generate a temporal causal feature matrix. The feature fusion layer uses graph convolution to perform multi-hop neighborhood feature aggregation and nonlinear activation on the temporal causal feature matrix to generate a causal feature vector; The Sigmoid activation function is used to perform high-dimensional kernel space projection on the causal feature vector to generate a stored anomaly detection vector.

[0010] As a preferred solution of the method for isolating data stored on a big data platform under the SaaS model of the present invention, the generating of abnormal risk level specifically includes the following steps: The stored anomaly detection vector is input into the causal inference engine, and the causal relationship is verified through the Granger causality test to form a causal effect distribution; The improved causal inference tree algorithm is used to calculate the average causal effect and regularize the causal effect distribution to obtain the average treatment effect value, and the confidence interval of the average treatment effect value is performed on the risk quantification to generate a causal effect score. A three-level threshold is used to divide the causal effect score into abnormal risk levels of low risk, medium risk and high risk.

[0011] As a preferred solution of the method for isolating data stored on a big data platform under the SaaS model of the present invention, the method of obtaining the abnormal entropy value specifically includes the following steps: Randomly sample the abnormal risk level through the sliding window to obtain risk point data, and use the distribution fitting method to perform parameter estimation and fitting on the risk point data to form a probability density curve; The standard deviation analysis method is used to measure the relative position of the probability density curve and obtain the standard score sequence; The Shannon entropy formula is used to calculate the information entropy of the standard score sequence to obtain the entropy value distribution. The entropy value distribution is conditionally weighted to obtain the abnormal entropy value.

[0012] As a preferred solution of the method for isolating storage data of a big data platform under the SaaS model of the present invention, the generating of the storage data isolation solution specifically includes the following steps: K-means clustering is used to analyze the distribution pattern and classify the abnormal entropy values into intervals to generate sensitivity intervals, and correlation mapping is performed on the sensitivity intervals to form sensitivity levels; The hierarchical analysis method is used to assign multi-factor weights to the abnormal risk level, abnormal entropy value and sensitivity level. According to the multi-factor weights, they are integrated through the weighted average method to generate a storage data isolation plan.

[0013] As a preferred solution of the method for isolating data stored on a big data platform under the SaaS model of the present invention, the optimization of the causal graph neural network specifically includes the following steps: Extract the tenant isolation parameters of the storage data isolation solution and use the ACL manager to encapsulate the tenant isolation parameters into control instructions; Based on control instructions, the big data platform calls the HDFS API to create encrypted partitions, triggers the LUKS encryption tool to reconfigure encrypted partitions and isolate data, and simultaneously applies the ELK suite to collect real-time storage feedback data. Input the real-time stored feedback data into the causal graph neural network and perform gradient backpropagation to obtain the weight gradient. Apply the Adam optimizer to dynamically adjust the learning rate of the weight gradient to obtain the optimized weight parameters. According to the optimized weight parameters, the graph convolution weights of the causal graph neural network are iteratively updated, and the optimized causal graph neural network is output.

[0014] In a second aspect, the present invention provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: when the computer program is executed by the processor, it implements any step of the method for isolating data stored on a big data platform under the SaaS model as described in the first aspect of the present invention.

[0015] In a third aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein: when the computer program is executed by a processor, it implements any step of the method for isolating data stored on a big data platform under the SaaS model as described in the first aspect of the present invention.

[0016] The present invention has the following beneficial effects: By constructing a causal graph neural network and an improved causal inference tree algorithm, it is possible to extract temporal causal features from multi-tenant storage status datasets, enabling dynamic identification of abnormal risks. Using the Shannon entropy formula combined with K-means clustering and the analytic hierarchy process, a mapping relationship between abnormal risk and data sensitivity is constructed, enabling focused protection of highly sensitive data while avoiding redundant isolation of low-risk data. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0018] Figure 1 This is a flowchart of the data isolation method for the big data platform storage in the SaaS model.

[0019] Figure 2 Flowchart generated for storing anomaly detection vectors.

[0020] Figure 3 Flowchart for abnormal risk classification.

[0021] Figure 4 Flowchart for optimizing causal graph neural networks based on storage data isolation scheme. DETAILED DESCRIPTION

[0022] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the specific embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0023] In the following description, many specific details are set forth to facilitate a full understanding of the present invention. However, the present invention may also be implemented in other ways different from those described herein. Those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0024] Secondly, the term "one embodiment" or "embodiment" herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The phrase "in one embodiment" appearing in various places throughout this specification does not necessarily refer to the same embodiment, nor does it refer to a separate or selective embodiment that is mutually exclusive of other embodiments.

[0025] Reference Figures 1 to 4 , is an embodiment of the present invention, which provides a method for isolating stored data on a big data platform under a SaaS model, comprising the following steps: S1. Input the storage situation dataset into the causal graph neural network. The feature extraction layer captures the data temporal pattern and causal correlation features. The feature fusion layer performs multi-hop neighborhood feature aggregation to generate a storage anomaly detection vector.

[0026] The specific operations include the following: S1.1. Collect a storage status data set, which includes tenant ID, operation type, target partition path, operation timestamp, and data size; Tenant identification includes the primary tenant ID and subtenant role tags. The primary tenant ID is collected through identity authentication services (such as OAuth), and the subtenant role tags are obtained using access control lists. Tenant identification is used to uniquely identify user identities at different levels in the SaaS platform. Operation types include read and write, permission changes, and metadata changes. Read and write operations are collected using API call logs, permission changes are collected through the IAM service, and metadata updates are collected using file listeners (such as FsAuditLogger). Operation types cover the main interactions of tenants with storage units. The target partition path includes the HDFS namespace path and the object storage logical path. The HDFS namespace path is collected using file naming monitoring components (such as HDFS Audit Logger), and the object storage logical path is obtained through the object storage service API log. The target partition path is used to locate the specific data area involved in data read and write operations. Operation timestamps include initiation and completion times, collected using PTP's clock synchronization service. Data volume includes requested data volume, actual transmitted data volume, and storage change volume, collected using network traffic monitoring components (such as NetFlow). Operation timestamps are used to measure the duration and response latency of data read and storage operations, while data volume is used to assess the impact of data read operations on storage resources. It should be noted that the above content has been obtained with the user's consent and is used for legitimate purposes.

[0027] S1.2. Preprocess the storage status dataset. In the specific operation, a distributed hash table (DHT) is used to hash and shard the tenant ID to eliminate the sparsity of the tenant ID, and a Bloom filter is used to detect and remove duplicate tenant IDs to improve query efficiency. Then, linear interpolation is used to discretely sample the operation type to eliminate ordinal bias, and the high-frequency operation type is downgraded through TF-IDF weighting to ensure the feature significance of the low-frequency operation type. The target partition path is vectorized by a hash algorithm to map the target partition path into a fixed-length numerical vector to achieve standardized representation and efficient storage and retrieval of the target partition path. Dynamic time warping is used to nonlinearly align the operation timestamps to eliminate the timing phase difference between different operation timestamps, and the NTP time synchronization protocol is used to calibrate the operation timestamps to unify the time base. The interquartile range (IQR) method is used to identify and correct abnormal data size values, and the Z-score normalization method is used to normalize continuous variables such as data size, and the preprocessed storage status dataset is output. The preprocessed storage status dataset improves the efficiency of analyzing multi-tenant operation behaviors and provides accurate data support for efficient big data storage.

[0028] S1.3. Construct a causal graph neural network and train it. Specifically, in the PyTorch framework, call the gated recurrent network through the nn.GRU parameter and embed a 256-dimensional hidden layer for the gated recurrent network; set the input dimension of the gated recurrent network to 128, the number of layers to 3, and the bidirectional parameter to False; connect the ayerNorm layer after the gated recurrent network for feature normalization to stabilize the training process, and use Dropout with a 0.2 inactivation rate for regularization to complete the construction of the feature extraction layer; call the double-layer graph convolution architecture through the GCNConv function, and the first layer of the double-layer graph convolution architecture uses spectral graph convolution. The second layer uses spatial graph convolution; set the input channel of the double-layer graph convolution architecture to 256, and the output channel to 256; connect the ReLU activation function after the double-layer graph convolution architecture for nonlinear transformation to enhance feature expression capabilities, and perform standardization through the GraphNorm layer to complete the construction of the feature fusion layer; The attention mechanism is used to perform weighted attention on the feature extraction layer and the feature fusion layer to obtain the joint features of the time series and graph structure. The residual connection is used to enhance the features and align the dimensions of the joint features of the time series and graph structure to generate a fused feature vector. The fused feature vector is normalized by the softmax function to generate causal association weights. Based on the causal association weights, the feature extraction layer and the feature fusion layer are weightedly stacked using the weighted averaging method and cross-connected by skip connections to complete the construction of the causal graph neural network. Next, the causal graph neural network is trained. The stored situation dataset is further divided into a sample set, a training set, and a validation set in a ratio of 6:2:2. On the sample set, a variational autoencoder is used for feature enhancement, and the feature distribution is normalized using Z-score standardization to form an enhanced standard sample. On the training set, the Adam optimizer is used to perform gradient backpropagation and gradient descent optimization on the enhanced standard sample to obtain the gradient tensor. Gradient clipping is simultaneously applied to limit the amplitude of the gradient tensor to obtain the updated causal graph neural network parameters. On the validation set, the Focal Loss loss function is used to calculate the loss of the updated causal graph neural network parameters to obtain the validation loss value. When the validation loss value exceeds the convergence threshold for 10 consecutive rounds, the training is terminated and the trained causal graph neural network is synchronously output. It should be noted that the convergence threshold is defined based on the relative rate of change of the validation loss value, and its value range is [0.005, 0.02].

[0029] S1.4. Generate storage anomaly detection vectors using a causal graph neural network. Specifically, use a sliding window segmentation method to slice the storage status dataset into time-series continuous slices in fixed time windows (e.g., 5-minute units) to form equal-length operation sequence segments. These equal-length operation sequence segments are converted into time-series feature tensors suitable for causal graph neural network input using PyTorch's DataLoader. These time-series feature tensors are then simultaneously input into the causal graph neural network through the forward interface. The gated recurrent unit (GRU) of the feature extraction layer captures the data timing pattern of the timing feature tensor through bidirectional gating: the reset gate is responsible for forgetting historical information of the timing feature tensor and redistributing weights through 1×1 convolution to obtain historical state weights; the update gate performs gated fusion on the historical state weights to form candidate hidden states. The candidate hidden states can dynamically balance the fusion ratio of the current state and the historical state to ensure the long-term preservation of the timing pattern. The Sigmoid activation function is simultaneously used to perform nonlinear transformation on the candidate hidden states to output the data timing pattern features; Next, a gated recurrent unit is used to perform nonlinear transformation on the temporal feature tensor, and gradient clipping is used to constrain the gradient to obtain stable gradient features. Residual connections are used to enhance the stable gradient features to alleviate the problem of gradient vanishing or gradient exploding, generating enhanced temporal features. At the same time, Dropout with a deactivation rate of 0.2 is used to randomly discard the enhanced temporal features to obtain causal correlation features. The data temporal pattern features and data temporal pattern features are fused through feature splicing and normalized through the LayerNorm layer to output the temporal causal feature matrix. The feature fusion layer extracts the time step features in the temporal causal feature matrix through time step slicing, and uses the LeakyReLU activation function for nonlinear transformation and feature interaction enhancement to obtain the feature similarity vector; the feature similarity vector is used as the graph node, and the temporal causal feature matrix is used as the edge connection between the graph nodes to construct the adjacency matrix; a two-layer graph convolution architecture is used to perform multi-hop feature aggregation on the adjacency matrix: the first layer uses spectral graph convolution to perform first-order neighborhood aggregation on the weighted adjacency matrix, and uses degree matrix normalization for feature scaling to obtain first-order aggregated features, and simultaneously performs linear transformation on the first-order aggregated features through the Sigmoid function to generate intermediate graph features; the second layer uses spatial graph convolution to perform second-order neighborhood expansion on the intermediate graph features, and performs nonlinear activation through the ReLU function to form high-order graph features; the high-order graph features are sparsely processed through graph convolution, sparse graph features are output, and the sparse graph features are aggregated into causal feature vectors through global average pooling; The causal feature vector is normalized using Min-Max normalization to avoid gradient saturation and generate a normalized feature vector. The Sigmoid activation function is used to perform nonlinear changes on the normalized feature vector to obtain a nonlinear activation value. The nonlinear activation value is projected into a high-dimensional kernel space to obtain a kernel space mapping vector. The cosine similarity calculation is used to measure the similarity of the kernel space mapping vector to obtain the cosine distance, and the cosine distance is converted into an abnormal probability value through an inverse proportional function. The specific mathematical formula is as follows: ; in, is the abnormal probability value, represents the projection result of high-dimensional kernel space, represents the nonlinear activation value, represents the reference vector, Represents the nonlinear activation value and the reference vector The projection value of the kernel high-dimensional kernel space; It should be noted that the reference vector refers to the benchmark mode of the kernel space mapping vector, which is defined based on the mean value of the kernel space mapping vector; A Dropout of 0.2 is set to randomly discard abnormal probability values to prevent overfitting, and low-dimensional space projection is performed through gated convolution to form a reduced-dimensional feature sequence. The exponential moving average is used to smooth the reduced-dimensional feature sequence in time series to ensure the stability of the results, and the anomaly detection vector is output and stored.

[0030] S2. Input the stored anomaly detection vector into the causal inference engine, use the improved causal inference tree algorithm to perform risk quantification, obtain the causal effect score, and divide the risk through the three-level threshold to generate the anomaly risk level.

[0031] The specific operations include the following: S2.1. Input the stored anomaly detection vector into the causal inference engine, verify the causal relationship through the Granger causality test, and form the causal effect distribution. In the specific operation, the stored anomaly detection vector is normalized by the sliding time window to ensure time alignment, and linear interpolation is used to fill the missing values to obtain the complete time series data; through HTTP The API protocol inputs the complete time series data into the causal inference engine, and uses the Granger causality test to perform first-order difference and logarithmic transformation on the complete time series data to eliminate trends and generate a stationary sequence; the stationary sequence and the storage anomaly detection vector are aligned in order to construct a lag covariance matrix, and the least squares method is used to fit the linear regression relationship of the lag covariance matrix to obtain the F statistic; based on the F statistic, the causal relationship of the storage anomaly detection vector is verified. For example, when the F statistic is greater than the causal threshold, the causal relationship of the storage anomaly detection vector is considered to have been verified. Furthermore, the verified storage anomaly detection vectors are integrated to form a significant causal vector, and the significant causal vectors are paired to form a significant causal pair; Bootstrap sampling is used to repeatedly randomly sample the significant causal pairs to generate a causal effect distribution; It should be noted that the causal threshold is defined based on the 90% quantile of the F statistic, and its value range is [2.5~6.0].

[0032] S2.2. Use the improved causal inference tree algorithm to calculate the average causal effect and perform regularization optimization on the causal effect distribution to obtain the average treatment effect value. In the specific operation, the causal effect distribution is mapped into a high-dimensional space by the improved causal inference tree algorithm to obtain the initial causal structure; dynamic feature selection is performed on the initial causal structure to construct a causal inference tree; the causal inference tree is recursively partitioned using the variance minimization criterion to prevent overfitting and improve generalization ability, obtain homogeneous subgroups, and perform post-pruning optimization within each leaf node of the homogeneous subgroup to merge statistically insignificant nodes to form a streamlined causal tree structure; at the same time, the weighted bootstrap method is used to assign significance weights to the streamlined causal tree structure and calculate the average causal effect. L2 regularization is used for optimization during the calculation process to output the average treatment effect value. The specific mathematical formula is as follows: ; in, represents the average treatment effect value, represents the total number of leaf nodes in the causal inference tree, represents the leaf node index, Indicates the The local causal effect estimation of leaf nodes, Indicates the The significance weight of each leaf node; It should be noted that the significance threshold is defined based on the statistical significance level of the average treatment effect value, and the value range is [0, 0.1]; It should be noted that the improved causal inference tree algorithm has made the following improvements based on the existing causal inference tree algorithm: on the one hand, the use of high-dimensional space mapping and dynamic feature selection mechanism solves the modeling limitations of traditional methods on nonlinear causal relationships; on the other hand, the integration of L2 regularization and significance weighting significantly improves the statistical significance and estimation stability of the average treatment effect value.

[0033] S2.3. Perform risk quantification with confidence intervals on the average treatment effect value to generate a causal effect score. Specifically, perform repeated sampling on the average treatment effect value, and perform probability density fitting through kernel density estimation to obtain the effect value distribution. Apply percentile interval constraints to the effect value distribution to generate an effect value confidence interval. Based on the effect value confidence interval, perform quantile truncation on the average treatment effect value through the quantile regression method to correct the downside risk and generate a risk quantification-adjusted effect value. Apply linear normalization to perform standardized mapping on the risk quantification-adjusted effect value to obtain a causal effect score.

[0034] S2.4. Use the three-level threshold to divide the causal effect score into low-risk, medium-risk, and high-risk anomaly analysis levels. In specific operations, define the three-level threshold according to specific business needs. For example, set the first-level threshold to [0, 0.3), the second-level threshold to [0.3, 0.7), and the third-level threshold to [0.7, 1]. When the causal effect score is within the range of the first-level threshold, it is defined as low risk, and the stored data needs to be monitored regularly; when the causal effect score is within the range of the second-level threshold, it is defined as medium risk, and special analysis of the stored data needs to be performed; when the causal effect score is within the range of the third-level threshold, it is defined as high risk, and immediate data isolation and business intervention are required.

[0035] S3. Use the Shannon entropy formula to calculate the entropy value of the abnormal risk level, obtain the abnormal entropy value, and classify the abnormal entropy value into intervals to form a sensitivity level; integrate the abnormal risk level, abnormal entropy value and sensitivity level to generate a storage data isolation plan.

[0036] S3.1. Use the Shannon entropy formula to calculate the entropy value of the abnormal risk level and obtain the abnormal entropy value. In the specific operation, set a fixed size and step length parameters for the sliding window (e.g., window size = 24 hours, step length = 12 hours), slide the window for the abnormal risk level, and extract sample data of each risk level within the window in real time; use stratified random sampling to maintain the proportion of the risk level sample data to ensure that the proportion of the risk level sample data is consistent with the distribution of the overall abnormal risk level; use kernel density estimation to smooth the risk level sample data to form risk point data; apply the distribution fitting method to derive parameters of the risk point data to obtain distribution parameters, perform kernel smoothing fitting on the distribution parameters to form an initial density distribution curve, and perform bandwidth optimization on the initial density distribution curve through the sliding window to generate a probability density curve; The probability density curve is uniformly sampled using the equal-interval sampling method, and 1000 discrete sampling points are uniformly collected within the definition domain to ensure that the main features of the probability density curve are covered. The standard deviation analysis method is then used to numerically integrate the discrete sampling points to obtain the first-order moment of the curve, and the first-order moment of the curve is weighted averaged to generate the mean. The second-order central moment formula is used to square the deviation of the mean to obtain the second-order moment of the curve. The arithmetic square root of the second-order moment of the curve and the mean is taken to obtain the standard deviation. Based on the mean and standard deviation, the relative position of each discrete sampling point is measured through Z-score standardization to generate the original standard value, which is normalized to obtain the Z score. The Z score is linearly transformed to generate the standard score. Finally, the 3σ principle is used to sort the standard scores of all discrete sampling points and eliminate outliers, outputting a continuous standard score sequence. It should be noted that the domain range is defined based on the confidence interval of the probability density curve.

[0037] The standard score sequence is divided into equal-width intervals, and the frequency distribution of the discretized sampling points in each interval is calculated by frequency statistics. The Shannon entropy formula is used to measure the information content of the frequency distribution, obtain the initial entropy value, perform interval smoothing on the initial entropy value, and generate the entropy value distribution. Then, a piecewise linear function is used to conditionally weight the entropy value distribution interval by interval to form the abnormal entropy value. The specific mathematical formula is as follows: ; in, represents the abnormal entropy value, represents the segment weight coefficient, represents the smoothed probability, represents the sensitivity parameter, represents the standard deviation, represents the mean, Indicates standard score; It should be noted that the segmented weight coefficient is defined based on the risk interval division of the standard score sequence, and its value range is [1,3]; the smoothing probability is defined based on the Laplace smoothing of the frequency distribution, and its value range is (0,1); the sensitivity parameter is defined based on the detection sensitivity requirement of the abnormal entropy value, and its value range is (0,+∞).

[0038] S3.2. Classify the abnormal entropy values into intervals to form sensitivity levels. In the specific operation, the center point of the abnormal entropy value is initialized by the silhouette coefficient to determine the initial cluster center; the abnormal entropy value is classified by minimizing the distance based on the initial cluster center using K-means to obtain a temporary clustering result, and the temporary clustering result is weighted integrated and variance normalized to generate a distribution law matrix; then cluster iteration is performed on the distribution law matrix. In each iteration, the relative distance from each abnormal entropy value to the initial cluster center is recorded, and the initial cluster center is classified into intervals based on the relative distance to obtain an updated cluster center; the updated cluster center is statistically changed to obtain the center offset value. When the center offset value is less than the clustering threshold, clustering is stopped to form the final cluster partition; the final cluster partition is sorted by median to generate a sensitivity interval; It should be noted that the silhouette coefficient is defined based on the clustering tightness of the abnormal entropy value, and its value range is [-1, 1]. The clustering threshold is defined by the iterative offset based on the convergence stability of the cluster center, and its value range is (0, 1e-4]. The sensitivity intervals are correlated and matched using the Pearson correlation coefficient to obtain interval correlation vectors, which are then weighted and nonlinearly transformed to obtain effective mapping relationships. Based on the effective mapping relationships, the softmax function is used to perform correlation mapping on the sensitivity intervals to form sensitivity levels. It should be noted that the Pearson correlation coefficient is defined based on the linear correlation of the sensitivity interval, and its value range is [-1,1].

[0039] S3.3. Integrate the abnormal risk level, abnormal entropy value, and sensitivity level to generate a storage data isolation plan. In the specific operation, the abnormal risk level, abnormal entropy value, and sensitivity level are structured and organized through the hierarchical analysis method to obtain a three-layer hierarchical analysis structure. The three-layer hierarchical analysis structure is uniformly density sampled using Lagrange interpolation to obtain hierarchical elements; the hierarchical elements are compared pairwise to obtain the relative importance relationship between the elements, and the relative importance relationship between the elements is quantified and assigned to generate a relative importance score; the relative importance score is matrix-filled using the array function of the NumPy library to generate a judgment matrix; the judgment matrix is orthogonally decomposed using the power iteration method to extract the maximum eigenvector, and the maximum eigenvector is numerically normalized to form a multi-factor weight; Min-Max standardization is applied to normalize the abnormal risk level, abnormal entropy value, and sensitivity level to generate standardized index values; based on the multi-factor weights, the standardized index values are weighted and integrated to form a comprehensive isolation score; the comprehensive isolation score is divided into boundaries through tertile segmentation to obtain the optimal isolation value; the optimal isolation value is structured and encapsulated through the policy rule engine to generate a storage data isolation solution.

[0040] S4. Convert the storage data isolation scheme into control instructions to drive the big data platform to perform encryption partition reconfiguration and data isolation, synchronously collect real-time storage feedback data, and optimize the causal graph neural network.

[0041] The specific operations include the following: S4.1. Extract the tenant isolation parameters of the storage data isolation solution and use the ACL manager to encapsulate the tenant isolation parameters into control instructions. The specific operations are as follows: in the parameter parsing stage, first use the parameter scanning function of the ACL manager to extract the tenant isolation parameters in the storage data isolation solution, including the tenant ID, storage path, and access rights; next, use the parameter parser (such as Python's json.loads) to convert the JSON string of the tenant isolation parameters into a structured dictionary; then call the ACL manager's Policy API to perform permission logic conversion on the structured dictionary, obtain the basic permission rule set, perform permission mapping on the basic permission rule set, and generate a standardized permission identifier; use the PV control unit in the ACL manager to bind the standardized permission identifier to a path and obtain the permission rules with a path; in the instruction encapsulation stage, use the Envoy configuration generation function of the ACL manager to logically encapsulate the permission rules with a path to form the original control parameters, apply the message serialization tool to the original control parameters for binary encoding, and generate control instructions.

[0042] S4.2. Based on control instructions, the big data platform is driven to call the HDFS API to create an encrypted partition, and the LUKS encryption tool is triggered to perform encrypted partition reconfiguration and data isolation. The ELK suite is simultaneously applied to collect real-time storage feedback data. The specific operations are as follows: During the instruction execution phase, the control instructions are sent to the big data platform's job scheduler, which drives the big data platform's HDFS API (distributed file interface) to create an encrypted partition with a specified path and set strict access permissions for the encrypted partition. The LUKS (disk encryption) tool is then used to format the encrypted partition and obtain encrypted storage blocks. The KMS key management service is used to inject keys into the encrypted storage blocks and generate dynamic keys. Based on the dynamic keys, encrypted files are created using file system formatting tools (such as mkfs.ext4) to complete the encrypted partition reconfiguration. During the data isolation phase, the reconfigured encrypted partition is marked through the HDFS storage interface to obtain the cold storage partition identifier. Storage capacity limits are set for the cold storage partition identifier to prevent storage resource abuse and obtain controlled storage resources. The HDFS quota manager is used to isolate data on controlled storage resources to achieve tenant-level storage space isolation. Synchronously configure the ELK suite on the edge nodes of the big data platform to monitor access records, operation types, and tenant tags of encrypted partitions, integrate them, and generate real-time storage feedback data.

[0043] S4.3. Input the real-time stored feedback data into the causal graph neural network, and perform gradient backpropagation to obtain the weight gradient. Apply the Adam optimizer to dynamically adjust the learning rate of the weight gradient to obtain the optimized weight parameter. The specific operations are as follows: input the real-time stored feedback data into the causal graph neural network through the GraphLoader interface. The graph convolution of the causal graph neural network aggregates the neighborhood information of the real-time stored feedback data to obtain the node representation vector. Perform gradient backpropagation on the node representation vector to obtain the parameter gradient tensor, and perform amplitude limitation on the parameter gradient tensor through gradient clipping to generate the weight gradient; then apply the Adam optimizer to perform momentum accumulation on the weight gradient to obtain the gradient history information, perform exponential weighted averaging on the gradient history information to generate the gradient first-order moment and gradient second-order moment, and perform weighted integration on the gradient first-order moment and gradient second-order moment to obtain the parameter update amount; according to the parameter update amount, use the learning rate scheduler to dynamically adjust the learning rate of the weight gradient to obtain the optimized parameter increment, apply the LayerNorm layer to perform normalization on the optimized parameter increment, and output the optimized weight parameter.

[0044] S4.4. According to the optimized weight parameters, the graph convolution weights of the causal graph neural network are iteratively updated, and the optimized causal graph neural network is output. The specific operations are as follows: the optimized weight parameters are dimensionally parsed by tensor slicing to separate the node feature transformation matrix and the adjacency matrix weights; according to the node feature transformation matrix and the adjacency matrix weights, the PyTorch reshape function is used to reshape them according to the structural dimension of the graph convolution to generate an updateable weight block; then PyTorch's data.copy is called to replace the parameters of the updateable weight block to obtain the verification weight; the verification weight is sparsified by the causal attention mask to maintain the sparsity of the causal relationship and generate sparse weights; according to the sparse weights, the graph convolution weights are updated in place, and gradient clipping is used to constrain the norm of the sparse weights during the update process to ensure the stability of the iterative update; the principal component analysis is used to perform low-dimensional projection on the graph convolution weights to obtain the causal effect strength value. When the causal effect strength value reaches the optimization threshold, the update is stopped and the optimized causal graph neural network is output; It should be noted that the optimization threshold is defined based on the statistical significance level of the causal effect strength value, and its value range is [0.7, 0.9].

[0045] This embodiment also provides a computer device, which is suitable for the method of isolating data stored on a big data platform under the SaaS model, including: a memory and a processor; the memory is used to store computer-executable instructions, and the processor is used to execute computer-executable instructions, thereby implementing the method of isolating data stored on a big data platform under the SaaS model proposed in the above embodiment.

[0046] The computer device may be a terminal, comprising a processor, memory, a communication interface, a display, and an input device connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores an operating system and computer programs. The internal memory provides an environment for the operating system and computer programs stored in the non-volatile storage media. The communication interface of the computer device is used to communicate with external terminals via wired or wireless communication. Wireless communication may be achieved via Wi-Fi, a carrier network, NFC (near-field communication), or other technologies. The display of the computer device may be a liquid crystal display or an electronic ink display. The input device may be a touchscreen overlay on the display, buttons, a trackball, or a touchpad on the computer device housing, or an external keyboard, touchpad, or mouse.

[0047] This embodiment also provides a storage medium having a computer program stored thereon, which, when executed by a processor, implements the method for isolating stored data on a big data platform under the SaaS model as proposed in the above embodiment; the storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk or optical disk.

[0048] In summary, this invention extracts temporal causal features from multi-tenant storage status datasets by constructing a causal graph neural network and an improved causal inference tree algorithm, enabling dynamic identification of abnormal risks. Using the Shannon entropy formula combined with K-means clustering and the analytic hierarchy process, a mapping relationship between abnormal risk and data sensitivity is constructed, enabling focused protection of highly sensitive data while avoiding redundant isolation of low-risk data.

[0049] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A method for isolating stored data on a big data platform under the SaaS model, characterized by: include, The storage situation dataset is input into the causal graph neural network. The feature extraction layer captures the data temporal pattern and causal correlation features. The feature fusion layer aggregates multi-hop neighborhood features to generate a storage anomaly detection vector. The stored anomaly detection vector is input into the causal inference engine, and the improved causal inference tree algorithm is used to perform risk quantification, obtain the causal effect score, and divide the risk using a three-level threshold to generate anomaly risk level; The Shannon entropy formula is used to calculate the entropy value of the abnormal risk level, obtain the abnormal entropy value, and classify the abnormal entropy value into intervals to form a sensitivity level; Integrate the abnormal risk level, abnormal entropy value, and sensitivity level to generate a storage data isolation plan; Convert the storage data isolation scheme into control instructions to drive the big data platform to perform encryption partition reconfiguration and data isolation, synchronously collect real-time storage feedback data, and optimize the causal graph neural network.

2. The method for isolating stored data on a big data platform under the SaaS model according to claim 1, characterized in that: The storage status data set includes tenant identification, operation type, target partition path, operation timestamp and data size.

3. The method for isolating stored data on a big data platform under the SaaS model as claimed in claim 1, characterized in that: The specific construction process of the causal graph neural network is as follows: Build and initialize the feature extraction layer and feature fusion layer, and use the attention mechanism to weightedly stack and hierarchically cross-connect the feature extraction layer and feature fusion layer to construct a causal graph neural network.

4. The method for isolating stored data on a big data platform under the SaaS model as claimed in claim 3, characterized in that: The generation and storage of anomaly detection vectors specifically includes the following steps: The stored security situation dataset is input into the causal graph neural network. The feature extraction layer captures the data temporal pattern and causal correlation features through the gated recurrent unit to generate a temporal causal feature matrix. The feature fusion layer uses graph convolution to perform multi-hop neighborhood feature aggregation and nonlinear activation on the temporal causal feature matrix to generate a causal feature vector; The Sigmoid activation function is used to perform high-dimensional kernel space projection on the causal feature vector to generate a stored anomaly detection vector.

5. The method for isolating stored data on a big data platform under the SaaS model according to claim 1, wherein: The generation of abnormal risk level specifically includes the following steps: The stored anomaly detection vector is input into the causal inference engine, and the causal relationship is verified through the Granger causality test to form a causal effect distribution; The improved causal inference tree algorithm is used to calculate the average causal effect and regularize the causal effect distribution to obtain the average treatment effect value, and the confidence interval of the average treatment effect value is performed on the risk quantification to generate a causal effect score. A three-level threshold is used to divide the causal effect score into abnormal risk levels of low risk, medium risk and high risk.

6. The method for isolating stored data on a big data platform under the SaaS model according to claim 1, characterized in that: The obtaining of abnormal entropy value specifically includes the following steps: Randomly sample the abnormal risk level through the sliding window to obtain risk point data, and use the distribution fitting method to perform parameter estimation and fitting on the risk point data to form a probability density curve; The standard deviation analysis method is used to measure the relative position of the probability density curve and obtain the standard score sequence; The Shannon entropy formula is used to calculate the information entropy of the standard score sequence to obtain the entropy value distribution. The entropy value distribution is conditionally weighted to obtain the abnormal entropy value.

7. The method for isolating stored data on a big data platform under the SaaS model according to claim 6, characterized in that: The generation of the storage data isolation solution specifically includes the following steps: K-means clustering is used to analyze the distribution pattern and classify the abnormal entropy values into intervals to generate sensitivity intervals, and correlation mapping is performed on the sensitivity intervals to form sensitivity levels; The hierarchical analysis method is used to assign multi-factor weights to the abnormal risk level, abnormal entropy value and sensitivity level. According to the multi-factor weights, they are integrated through the weighted average method to generate a storage data isolation plan.

8. The method for isolating stored data on a big data platform under the SaaS model according to claim 1, wherein: The optimization of the causal graph neural network specifically includes the following steps: Extract the tenant isolation parameters of the storage data isolation solution and use the ACL manager to encapsulate the tenant isolation parameters into control instructions; Based on control instructions, the big data platform calls the HDFS API to create encrypted partitions, triggers the LUKS encryption tool to reconfigure encrypted partitions and isolate data, and simultaneously applies the ELK suite to collect real-time storage feedback data. Input the real-time stored feedback data into the causal graph neural network and perform gradient backpropagation to obtain the weight gradient. Apply the Adam optimizer to dynamically adjust the learning rate of the weight gradient to obtain the optimized weight parameters. According to the optimized weight parameters, the graph convolution weights of the causal graph neural network are iteratively updated, and the optimized causal graph neural network is output.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method for isolating stored data on a big data platform under the SaaS model described in any one of claims 1 to 8 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method for isolating stored data on a big data platform under the SaaS model described in any one of claims 1 to 8 are implemented.

Images