A data storage isolation method for a big data platform under a SaaS mode

Abstract

The application discloses a kind of SaaS mode under big data platform storage data isolation method, it is related to big data technical field, including, input causal diagram neural network to storage situation data set, feature extraction layer captures data time sequence mode and causal correlation feature, multi-hop neighborhood feature aggregation is carried out in feature fusion layer, generates storage anomaly detection vector, input causal reasoning engine to storage anomaly detection vector, utilize improved causal inference tree algorithm to execute risk quantization, obtain causal effect score, and pass through three-level threshold value to carry out risk division, generate abnormal risk grade, utilize Shannon entropy formula to carry out entropy value calculation to abnormal risk grade, obtain abnormal entropy value, and interval classification is carried out to abnormal entropy value, form sensitivity grade;The application is realized to abnormal risk dynamic identification by the causal diagram neural network, improved causal inference tree algorithm and analytic hierarchy process built, also avoid the redundant isolation to low-risk data.

Description

Technical Field

[0001] This invention relates to the field of big data technology, and in particular to a method for isolating stored data in a big data platform under a SaaS model. Background Technology

[0002] With the rapid development of cloud computing and big data technologies, the SaaS (Software as a Service) model has become an important form of enterprise application deployment. Under this model, multiple tenants share the same software system and infrastructure resources, significantly reducing IT operating costs and improving service delivery efficiency. However, the resource-sharing mechanism also brings challenges such as poor data isolation and low security. Especially in multi-tenant big data platforms, ensuring logical isolation and access control of data stored by each tenant has become a key issue in guaranteeing the platform's secure and stable operation.

[0003] Despite the achievements of existing technologies, some shortcomings remain. First, traditional methods rely on fixed thresholds or manually configured access rules, failing to dynamically adjust isolation strength based on temporal behavior patterns, making it difficult to quantify the level of anomalies in storage operations in real time. Second, while existing solutions can achieve physical isolation, they lack a correlation model between anomaly risk and data sensitivity, resulting in insufficient protection for high-value data or excessive isolation of low-risk data, leading to low resource efficiency. Summary of the Invention

[0004] In view of the aforementioned existing problems, the present invention is proposed.

[0005] Therefore, this invention provides a data isolation method for big data platform storage under the SaaS model, which solves the problems of insufficient risk perception capability and lack of correlation between risk and sensitivity in existing technologies.

[0006] To solve the above-mentioned technical problems, the present invention provides the following technical solution:

[0007] In a first aspect, the present invention provides a method for data isolation in a big data platform under a SaaS model, which includes inputting a storage status dataset into a causal graph neural network, a feature extraction layer capturing data temporal patterns and causal correlation features, and a feature fusion layer performing multi-hop neighborhood feature aggregation to generate a storage anomaly detection vector.

[0008] The stored anomaly detection vector is input into the causal inference engine, and the improved causal inference tree algorithm is used to perform risk quantification, obtain causal effect scores, and classify risks through three levels of thresholds to generate anomaly risk levels.

[0009] The Shannon entropy formula is used to calculate the entropy value of the anomaly risk level, obtain the anomaly entropy value, and classify the anomaly entropy value into intervals to form a sensitivity level; the anomaly risk level, anomaly entropy value, and sensitivity level are integrated to generate a storage data isolation scheme.

[0010] The data isolation scheme is converted into control commands to drive the big data platform to perform encrypted partition reconfiguration and data isolation, synchronously collect real-time storage feedback data, and optimize the causal graph neural network.

[0011] As a preferred embodiment of the data isolation method for big data platform storage under the SaaS model described in this invention, the storage status dataset includes tenant identifier, operation type, target partition path, operation timestamp, and data volume.

[0012] As a preferred embodiment of the data isolation method for big data platform storage under the SaaS model described in this invention, the causal graph neural network is specifically constructed as follows:

[0013] The feature extraction layer and feature fusion layer are constructed and initialized. The attention mechanism is used to weight and stack the feature extraction layer and feature fusion layer and perform hierarchical cross-connection to construct a causal graph neural network.

[0014] As a preferred embodiment of the data isolation method for big data platform storage under the SaaS model described in this invention, the generation of the storage anomaly detection vector specifically includes the following steps.

[0015] The storage security situation dataset is input into the causal graph neural network. The feature extraction layer captures the temporal pattern and causal correlation features of the data through the gated recurrent unit, and generates a temporal causal feature matrix.

[0016] The feature fusion layer uses graph convolution to perform multi-hop neighborhood feature aggregation and non-linear activation on the temporal causal feature matrix to generate causal feature vectors.

[0017] The sigmoid activation function is used to perform high-dimensional kernel space projection on the causal feature vector to generate and store anomaly detection vectors.

[0018] As a preferred embodiment of the data isolation method for big data platform storage under the SaaS model described in this invention, the generation of anomaly risk levels specifically includes the following steps:

[0019] The stored anomaly detection vector is input into the causal inference engine, and the causal relationship is verified by Granger causality test to form the causal effect distribution.

[0020] An improved causal inference tree algorithm is used to calculate and regularize the causal effect distribution to obtain the average treatment effect value. Then, the risk quantification of the confidence interval is performed on the average treatment effect value to generate a causal effect score.

[0021] The causal effect score is divided into low-risk, medium-risk, and high-risk abnormal risk levels using a three-level threshold.

[0022] As a preferred embodiment of the data isolation method for big data platform storage under the SaaS model described in this invention, the step of obtaining the abnormal entropy value specifically includes the following steps.

[0023] By randomly sampling the abnormal risk level through a sliding window, risk point data is obtained. Then, the distribution fitting method is used to estimate and fit the parameters of the risk point data to form a probability density curve.

[0024] The standard deviation analysis method is used to measure the relative position of the probability density curve and obtain the standard score sequence.

[0025] The Shannon entropy formula is used to calculate the execution information entropy of the standard score sequence to obtain the entropy distribution. The entropy distribution is then conditionally weighted to obtain the abnormal entropy values.

[0026] As a preferred embodiment of the data isolation method for big data platform storage under the SaaS model described in this invention, the generation of the data isolation scheme specifically includes the following steps:

[0027] K-means clustering is used to analyze the distribution pattern and classify the intervals of abnormal entropy values ​​to generate sensitivity intervals. Correlation mapping is then performed on the sensitivity intervals to form sensitivity levels.

[0028] The Analytic Hierarchy Process (AHP) is used to assign multi-factor weights to the anomaly risk level, anomaly entropy value, and sensitivity level. Based on the multi-factor weights, a weighted average method is used to integrate them to generate a storage data isolation scheme.

[0029] As a preferred embodiment of the data isolation method for big data platform storage under the SaaS model described in this invention, the optimization of the causal graph neural network specifically includes the following steps.

[0030] Extract the tenant isolation parameters of the storage data isolation scheme, and use the ACL manager to encapsulate the tenant isolation parameters into control commands;

[0031] Based on control commands, the big data platform is driven to call the HDFS API to create an encrypted partition, and the LUKS encryption tool is triggered to perform encrypted partition reconfiguration and data isolation, while the ELK suite is applied to collect real-time storage feedback data.

[0032] The real-time stored feedback data is input into the causal graph neural network, and gradient backpropagation is performed to obtain the weight gradient. The Adam optimizer is then applied to dynamically adjust the learning rate of the weight gradient to obtain the optimized weight parameters.

[0033] Based on the optimized weight parameters, the graph convolution weights of the causal graph neural network are iteratively updated, and the optimized causal graph neural network is output.

[0034] In a second aspect, the present invention provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the computer program, when executed by the processor, implements any step of the data isolation method for big data platform storage under the SaaS model as described in the first aspect of the present invention.

[0035] Thirdly, the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein: when the computer program is executed by a processor, it implements any step of the data isolation method for big data platform storage in the SaaS mode as described in the first aspect of the present invention.

[0036] The beneficial effects of this invention are as follows: By constructing a causal graph neural network and an improved causal inference tree algorithm, temporal causal features can be extracted from multi-tenant storage status datasets, enabling dynamic identification of anomaly risks. Using the Shannon entropy formula combined with K-means clustering and analytic hierarchy process, a mapping relationship between anomaly risks and data sensitivity is constructed, achieving focused protection of highly sensitive data while avoiding redundant isolation of low-risk data. Attached Figure Description

[0037] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0038] Figure 1 A flowchart illustrating a data isolation method for big data platforms in a SaaS model.

[0039] Figure 2 A flowchart for generating storage anomaly detection vectors.

[0040] Figure 3 This is a flowchart for classifying abnormal risk levels.

[0041] Figure 4 This is a flowchart illustrating the optimization of a causal graph neural network based on a storage data isolation scheme. Detailed Implementation

[0042] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0043] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of the invention. Therefore, the invention is not limited to the specific embodiments disclosed below.

[0044] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The phrase "in one embodiment" appearing in different places in this specification does not necessarily refer to the same embodiment, nor is it a single or selective embodiment that is mutually exclusive with other embodiments.

[0045] Reference Figures 1-4 As one embodiment of the present invention, this embodiment provides a method for isolating data storage in a big data platform under a SaaS model, comprising the following steps:

[0046] S1. Input the storage status dataset into the causal graph neural network. The feature extraction layer captures the temporal pattern and causal relationship features of the data. The feature fusion layer performs multi-hop neighborhood feature aggregation to generate a storage anomaly detection vector.

[0047] Specifically, the operations include the following:

[0048] S1.1 Collect the storage status dataset, which includes tenant identifier, operation type, target partition path, operation timestamp, and data size;

[0049] Tenant identifiers include the primary tenant ID and sub-tenant role labels; the primary tenant ID is collected through an identity authentication service (such as OAuth), and the sub-tenant role labels are obtained using access control lists; the tenant identifier is used to uniquely identify the user identity at different levels in the SaaS platform;

[0050] Operation types include read / write, permission change, and metadata change; read / write operations are obtained using API call logs, permission changes are obtained through the IAM service, and metadata updates are collected using file listeners (such as FsAuditLogger); operation types cover the main interactive behaviors of tenants with storage units;

[0051] The target partition path includes the HDFS namespace path and the object storage logical path; the HDFS namespace path is collected using a file naming monitoring component (such as HDFS Audit Logger), and the object storage logical path is obtained through the API logs of the object storage service; the target partition path is used to locate the specific data area involved in data read and write operations;

[0052] Operation timestamps include initiation and completion times, collected using PTP's clock synchronization service; data size includes requested data size, actual transmitted data size, and storage change size, collected using network traffic monitoring components (such as NetFlow); operation timestamps are used to measure the duration and response latency of data read and storage operations, while data size is used to assess the impact of data read operations on storage resources.

[0053] It should be noted that the above content has been agreed to by the user and is used for legitimate purposes.

[0054] S1.2. Preprocessing of the storage status dataset: Specifically, a Distributed Hash Table (DHT) is used to hash and shard tenant identifiers, eliminating the sparsity of tenant IDs. A Bloom filter is used to detect and deduplicate duplicate tenant identifiers, improving query efficiency. Then, linear interpolation is used to discretely sample operation types to eliminate ordinal bias. TF-IDF weighting is used to reduce the weight of high-frequency operation types, ensuring the saliency of low-frequency operation types. The target partition path is vectorized into a fixed-length vector using a hash algorithm, mapping the target partition path to a fixed-length numerical vector, achieving standardized representation and efficient storage retrieval of the target partition path. Dynamic time warping is used to non-linearly align operation timestamps, eliminating timing phase differences between different operation timestamps. The NTP time synchronization protocol is used to clock-calibrate operation timestamps, unifying the time base. The Interquartile Range (IQR) method is used to identify and correct abnormal data size values. Simultaneously, Z-score normalization is used to normalize continuous variables such as data size, outputting the preprocessed storage status dataset.

[0055] The preprocessed storage status dataset improves the efficiency of analyzing multi-tenant operational behavior and provides accurate data support for achieving efficient big data storage.

[0056] S1.3. Construct and train a causal graph neural network. Specifically, in the PyTorch framework, a gated recurrent network (RNN) is invoked using the `nn.GRU` parameter, and a 256-dimensional hidden layer is embedded within it. The input dimension of the RNN is set to 128, the number of layers to 3, and the bidirectional parameter to False. A `GraphNorm` layer is then applied after the RNN for feature normalization to stabilize the training process, and Dropout with a 0.2 inactivation rate is used for regularization, completing the feature extraction layer. A two-layer graph convolutional architecture is invoked using the `GCNConv` function. The first layer of the two-layer graph convolutional architecture uses spectral graph convolution, and the second layer uses spatial graph convolution. The input and output channels of the two-layer graph convolutional architecture are set to 256. A ReLU activation function is then applied after the two-layer graph convolutional architecture for non-linear transformation to enhance feature representation capabilities, and a `GraphNorm` layer is used for standardization, completing the feature fusion layer.

[0057] Attention mechanisms are used to weight the feature extraction and feature fusion layers to obtain joint features of the temporal-graph structure. Residual connections are then used to enhance and align the joint features of the temporal-graph structure, generating a fused feature vector. The attention weights of the fused feature vector are normalized using the Softmax function to generate causal association weights. Based on the causal association weights, the feature extraction and feature fusion layers are weighted and stacked using a weighted average method, and then layered cross-connections are performed using skip connections to complete the construction of the causal graph neural network.

[0058] Next, the causal graph neural network is trained. Further, the stored situation dataset is divided into a sample set, a training set, and a validation set in a 6:2:2 ratio. On the sample set, a variational autoencoder is used for feature enhancement, and Z-score normalization is applied to normalize the feature distribution, forming enhanced standard samples. On the training set, the Adam optimizer is used to perform gradient backpropagation and gradient descent optimization on the enhanced standard samples to obtain the gradient tensor. Gradient clipping is simultaneously applied to limit the magnitude of the gradient tensor, obtaining updated causal graph neural network parameters. On the validation set, the Focal Loss function is used to calculate the loss on the updated causal graph neural network parameters, obtaining the validation loss value. When the validation loss value exceeds the convergence threshold for 10 consecutive rounds, training terminates, and the trained causal graph neural network is output synchronously.

[0059] It should be noted that the convergence threshold is defined based on the relative rate of change of the validation loss value, and its value ranges from [0.005, 0.02].

[0060] S1.4. Generate storage anomaly detection vectors using causal graph neural networks. In specific operations, the storage situation dataset is divided into temporal continuous slices using a sliding window segmentation method with a fixed time window (e.g., 5 minutes) to form operation sequence segments of equal length. The operation sequence segments of equal length are converted into a temporal feature tensor suitable for input to the causal graph neural network by using PyTorch's DataLoader. The temporal feature tensor is then input into the causal graph neural network through the forward interface.

[0061] The gated recurrent unit (GRU) of the feature extraction layer captures the temporal pattern of the temporal feature tensor through bidirectional gating: the reset gate is responsible for forgetting the historical information of the temporal feature tensor and redistributing the weights through 1×1 convolution to obtain the historical state weights; the update gate performs gated fusion of the historical state weights to form candidate hidden states. The candidate hidden states can dynamically balance the fusion ratio of the current state and the historical state to ensure the long-term preservation of the temporal pattern. Simultaneously, the sigmoid activation function is used to perform nonlinear transformation on the candidate hidden states to output the temporal pattern features of the data.

[0062] Next, a gated recurrent unit is used to perform a nonlinear transformation on the temporal feature tensor, and gradient constraints are applied through gradient pruning to obtain stable gradient features. Residual connections are used to enhance the stable gradient features to alleviate the problems of gradient vanishing or gradient explosion, generating enhanced temporal features. At the same time, Dropout with a 0.2 inactivation rate is used to randomly discard features from the enhanced temporal features to obtain causal correlation features. The temporal pattern features and the temporal pattern features are fused through feature concatenation, and then standardized through a LayerNorm layer to output a temporal causal feature matrix.

[0063] The feature fusion layer extracts time-step features from the temporal causal feature matrix through time-step slicing, and uses the LeakyReLU activation function for non-linear transformation and feature interaction enhancement to obtain a feature similarity vector. The feature similarity vector is used as a graph node, and the temporal causal feature matrix is ​​used as the edge connection between graph nodes to construct an adjacency matrix. A two-layer graph convolution architecture is used to perform multi-hop feature aggregation on the adjacency matrix: the first layer uses spectral graph convolution to perform first-order neighborhood aggregation on the weighted adjacency matrix, and uses degree matrix normalization for feature scaling to obtain first-order aggregated features. Simultaneously, the first-order aggregated features are linearly transformed using the Sigmoid function to generate intermediate graph features. The second layer uses spatial graph convolution to perform second-order neighborhood expansion on the intermediate graph features, and uses the ReLU function for non-linear activation to form higher-order graph features. Graph convolution is used to sparsify the higher-order graph features, outputting sparse graph features, and global average pooling is used to aggregate the sparse graph features into a causal feature vector.

[0064] Min-Max standardization is used to normalize the causal feature vectors, avoiding gradient saturation and generating normalized feature vectors. A Sigmoid activation function is then applied to the normalized feature vectors to perform a non-linear transformation, obtaining non-linear activation values. These non-linear activation values ​​are then projected into a high-dimensional kernel space to obtain a kernel space mapping vector. Cosine similarity is used to measure the similarity of the kernel space mapping vectors, obtaining the cosine distance. This cosine distance is then converted into anomaly probability values ​​using an inverse proportional function. The specific mathematical formula is as follows.

[0065] ;

[0066] in, This represents the probability value of anomalies. This represents the result of high-dimensional kernel space projection. Represents the non-linear activation value. Represents the reference vector. Indicates the activation value of the nonlinearity and reference vector The high-dimensional nuclear space projection value;

[0067] It should be noted that the reference vector refers to the baseline pattern of the kernel space mapping vector, which is based on the definition of the mean of the kernel space mapping vector;

[0068] Dropout with a setting of 0.2 is used to randomly discard anomaly probability values ​​to prevent overfitting. Then, gated convolution is used to project the data into a low-dimensional space to form a dimensionality-reduced feature sequence. Simultaneously, exponential moving average is used to smooth the dimensionality-reduced feature sequence over time to ensure the stability of the results. The output is a stored anomaly detection vector.

[0069] S2. Input the stored anomaly detection vector into the causal inference engine, use the improved causal inference tree algorithm to perform risk quantification, obtain the causal effect score, and classify the risk through a three-level threshold to generate anomaly risk level.

[0070] Specifically, the operations include the following:

[0071] S2.1. Input the storage anomaly detection vector into the causal inference engine, verify the causal relationship through Granger causality test, and form the causal effect distribution. In specific operation, a sliding time window is used to standardize the storage anomaly detection vector for time series to ensure time alignment, and linear interpolation is used to impute missing values ​​to obtain complete time series data; via HTTP... The API protocol inputs complete time-series data into the causal inference engine and uses the Granger causality test to perform first-order differencing and logarithmic transformation on the complete time-series data to eliminate trends and generate stationary sequences. The stationary sequences and stored anomaly detection vectors are aligned by order to construct a lag covariance matrix, and a linear regression relationship of the lag covariance matrix is ​​fitted using the least squares method to obtain the F-statistic. Based on the F-statistic, the causal relationship of the stored anomaly detection vectors is verified. For example, if the F-statistic is greater than the causal threshold, the causal relationship of the stored anomaly detection vectors is considered verified. Furthermore, the verified stored anomaly detection vectors are integrated to form significant causal vectors, and these significant causal vectors are paired to form significant causal pairs. Bootstrap sampling is used to repeatedly and randomly sample from the significant causal pairs to generate a causal effect distribution.

[0072] It should be noted that the causal threshold is defined based on the 90th percentile of the F statistic, and its value ranges from 2.5 to 6.0.

[0073] S2.2 An improved causal inference tree algorithm is used to calculate the average causal effect and perform regularization optimization on the causal effect distribution to obtain the average treatment effect value. Specifically, the improved causal inference tree algorithm is used to map the causal effect distribution into a high-dimensional space to obtain the initial causal structure. Dynamic feature selection is performed on the initial causal structure to construct the causal inference tree. The causal inference tree is recursively partitioned using the variance minimization criterion to prevent overfitting and improve generalization ability, obtaining a homogeneous subgroup. Post-pruning optimization is then performed within each leaf node of the homogeneous subgroup to merge statistically insignificant nodes, forming a simplified causal tree structure. Simultaneously, a weighted bootstrap method is used to assign significance weights to the simplified causal tree structure, and the average causal effect is calculated. L2 regularization is used concurrently during the calculation to optimize the average treatment effect value. The specific mathematical formula is as follows.

[0074] ;

[0075] in, This represents the average treatment effect value. This represents the total number of leaf nodes in the causal inference tree. Indicates the leaf node index. Indicates the first Local causal effect estimation of leaf nodes, Indicates the first The significance weight of each leaf node;

[0076] It should be noted that the significance threshold is defined based on the statistical significance level of the average treatment effect value, and its value range is [0, 0.1].

[0077] It should be noted that the improved causal inference tree algorithm makes the following improvements based on the existing causal inference tree algorithm: on the one hand, it uses high-dimensional space mapping and dynamic feature selection mechanism to solve the limitations of traditional methods in modeling nonlinear causal relationships; on the other hand, it integrates L2 regularization and significance weighting to significantly improve the statistical significance and estimation stability of the average treatment effect value.

[0078] S2.3. Perform risk quantification of the average treatment effect value using confidence intervals to generate a causal effect score. In practice, the average treatment effect value is repeatedly sampled, and probability density is fitted using kernel density estimation to obtain the effect value distribution. Percentile interval constraints are applied to the effect value distribution to generate effect value confidence intervals. Based on the effect value confidence intervals, the average treatment effect value is truncated using quantile regression to correct for downside risk, generating a risk-quantified adjusted effect value. Linear normalization is applied to the risk-quantified adjusted effect value to perform standardized mapping, resulting in a causal effect score.

[0079] S2.4. A three-tiered threshold system is used to classify causal effect scores into low-risk, medium-risk, and high-risk anomaly analysis levels. In practice, the three-tiered thresholds are defined according to specific business needs. For example, the first-tier threshold can be set to [0, 0.3), the second-tier threshold to [0.3, 0.7), and the third-tier threshold to [0.7, 1]. When the causal effect score falls within the first-tier threshold range, it is defined as low-risk, requiring regular monitoring of the stored data. When the causal effect score falls within the second-tier threshold range, it is defined as medium-risk, requiring specific analysis of the stored data. When the causal effect score falls within the third-tier threshold range, it is defined as high-risk, requiring immediate data isolation and business intervention.

[0080] S3. Calculate the entropy value of the anomaly risk level using the Shannon entropy formula, obtain the anomaly entropy value, and classify the anomaly entropy value into intervals to form a sensitivity level; integrate the anomaly risk level, anomaly entropy value, and sensitivity level to generate a storage data isolation scheme.

[0081] S3.1. The entropy value of the abnormal risk level is calculated using the Shannon entropy formula to obtain the abnormal entropy value. Specifically, a fixed size and step size parameter is set for the sliding window (e.g., window size = 24 hours, step size = 12 hours), and the window slides across the abnormal risk level while simultaneously extracting sample data for each risk level within the window in real time. Stratified random sampling is used to maintain the proportion of the risk level sample data, ensuring that the proportion of the risk level sample data is consistent with the overall distribution of abnormal risk levels. Kernel density estimation is used to smooth the risk level sample data, forming risk point data. The distribution fitting method is applied to derive the parameters of the risk point data, obtain the distribution parameters, and perform kernel smoothing fitting on the distribution parameters to form an initial density distribution curve. Finally, bandwidth optimization is performed on the initial density distribution curve through the sliding window to generate a probability density curve.

[0082] The probability density curve is uniformly sampled using an equal-interval sampling method, with 1000 discrete sampling points evenly collected within the defined domain to ensure coverage of the main features of the probability density curve. Next, standard deviation analysis is used to numerically integrate the discrete sampling points to obtain the first moment of the curve. A weighted average is then performed on the first moment to generate the mean. The mean is then squared using the second central moment formula to obtain the second moment. The standard deviation is obtained by taking the square root of the second moment and the mean. Based on the mean and standard deviation, Z-score standardization is used to measure the relative position of each discrete sampling point, generating original standard values. These original standard values ​​are then normalized to obtain the Z-score. A linear transformation is performed on the Z-score to generate standard scores. Finally, the 3σ principle is used to sort the standard scores of all discrete sampling points and remove outliers, outputting a continuous sequence of standard scores.

[0083] It should be noted that the domain range is based on the confidence interval definition of the probability density curve.

[0084] The standard score sequence is divided into equally wide intervals, and the frequency distribution of discrete sampling points within each interval is statistically analyzed using frequency statistics. The Shannon entropy formula is used to measure the information content of the frequency distribution to obtain initial entropy values. Interval smoothing is then performed on these initial entropy values ​​to generate an entropy distribution. Subsequently, a piecewise linear function is used to conditionally weight the entropy distribution interval by interval to form abnormal entropy values. The specific mathematical formula is as follows.

[0085] ;

[0086] in, Indicates the abnormal entropy value. Indicates the segmented weight coefficient. Represents the smoothing probability. Represents the sensitivity parameter. Indicates standard deviation, This represents the mean. Represents standard scores;

[0087] It should be noted that the segmented weight coefficient is based on the risk interval division definition of the standard score sequence, and the value range is [1,3]; the smoothing probability is based on the Laplace smoothing definition of the frequency distribution, and the value range is (0,1); the sensitivity parameter is based on the detection sensitivity requirement of the anomaly entropy value, and the value range is (0,+∞).

[0088] S3.2. The abnormal entropy values ​​are categorized into intervals to form sensitivity levels. Specifically, the abnormal entropy values ​​are initialized with centroids using the silhouette coefficient to determine initial cluster centers. Based on these initial cluster centers, K-means is used to minimize the distance between the abnormal entropy values, obtaining temporary clustering results. These temporary clustering results are then weighted, integrated, and their variance normalized to generate a distribution pattern matrix. Next, clustering iterations are performed on the distribution pattern matrix. In each iteration, the relative distance from each abnormal entropy value to the initial cluster center is recorded. Based on this relative distance, the initial cluster centers are categorized into intervals to obtain updated cluster centers. Change statistics are performed on the updated cluster centers to obtain center offset values. When the center offset value is less than the clustering threshold, clustering stops, forming the final cluster partitions. The final cluster partitions are then sorted by median to generate sensitivity intervals.

[0089] It should be noted that the silhouette coefficient is defined based on the cluster density of the abnormal entropy value, and the value range is [-1, 1]; the clustering threshold is defined based on the convergence stability of the cluster centers through the iterative offset, and the value range is (0, 1e-4].

[0090] The sensitivity intervals are correlated and matched using the Pearson correlation coefficient to obtain the interval correlation vector. The interval correlation vector is then weighted and nonlinearly transformed to obtain the effective mapping relationship. Based on the effective mapping relationship, the softmax function is used to perform correlation mapping on the sensitivity intervals to form the sensitivity level.

[0091] It should be noted that the Pearson correlation coefficient is based on the definition of linear correlation within the sensitivity interval, and its value ranges from [-1, 1].

[0092] S3.3. Integrate the anomaly risk level, anomaly entropy value, and sensitivity level to generate a storage data isolation scheme. In specific operations, the anomaly risk level, anomaly entropy value, and sensitivity level are structured using the analytic hierarchy process (AHP) to obtain a three-layer hierarchical analysis structure. Lagrange interpolation is then used to perform uniform density sampling on the three-layer hierarchical analysis structure to obtain hierarchical elements. Pairwise comparisons are performed on the hierarchical elements to obtain the relative importance relationship between elements. The relative importance relationship between elements is then quantified and assigned to generate a relative importance score. The NumPy library's array function is used to perform matrix filling on the relative importance score to generate a judgment matrix. The judgment matrix is ​​orthogonally decomposed using the power iteration method to extract the largest eigenvector. The largest eigenvector is then numerically normalized to form multi-factor weights.

[0093] The Min-Max standardization is applied to normalize the anomaly risk level, anomaly entropy value, and sensitivity level to generate standardized index values. Based on the multi-factor weights, the standardized index values ​​are weighted and integrated to form a comprehensive isolation score. The comprehensive isolation score is boundary-divided by ternary segmentation to obtain the optimal isolation value. The optimal isolation value is structured and encapsulated by the strategy rule engine to generate a storage data isolation scheme.

[0094] S4. Convert the storage data isolation scheme into control commands to drive the big data platform to perform encrypted partition reconfiguration and data isolation, synchronously collect real-time storage feedback data, and optimize the causal graph neural network.

[0095] Specifically, the operations include the following:

[0096] S4.1 Extract tenant isolation parameters from the storage data isolation scheme and encapsulate them into control commands using the ACL manager. The specific steps are as follows: In the parameter parsing stage, firstly, use the ACL manager's parameter scanning function to extract tenant isolation parameters from the storage data isolation scheme, including tenant ID, storage path, and access permissions. Next, use a parameter parser (such as Python's json.loads) to convert the JSON string of the tenant isolation parameters into a structured dictionary. Then, call the ACL manager's Policy API to perform permission logic transformation on the structured dictionary, obtain the basic permission rule set, perform permission mapping on the basic permission rule set, and generate standardized permission identifiers. Use the PV control unit in the ACL manager to bind the standardized permission identifiers to paths, obtaining permission rules with paths. In the command encapsulation stage, use the ACL manager's Envoy configuration generation function to logically encapsulate the permission rules with paths, forming raw control parameters. Apply a message serialization tool to binary encapsulate the raw control parameters to generate control commands.

[0097] S4.2. Based on control commands, the big data platform is driven to call the HDFS API to create an encrypted partition, and the LUKS encryption tool is triggered to perform encrypted partition reconfiguration and data isolation. Simultaneously, the ELK suite is used to collect real-time storage feedback data. The specific operations are as follows: During the command execution phase, control commands are sent to the job scheduler of the big data platform. The job scheduler drives the HDFS API (Distributed File Interface) of the big data platform to create an encrypted partition at the specified path, while setting strict access permissions for the encrypted partition. Then, the LUKS (Disk Encryption) tool is used to perform partition formatting on the encrypted partition to obtain encrypted storage blocks. A key is injected into the encrypted storage blocks through the KMS key management service to generate a dynamic key. Based on the dynamic key, encrypted files are created using a file system formatting tool (such as mkfs.ext4), completing the encrypted partition reconfiguration.

[0098] During the data isolation phase, the reconfigured encrypted partitions are marked through the HDFS storage interface to obtain cold storage partition identifiers, and storage capacity limits are set for the cold storage partition identifiers to avoid storage resource abuse and obtain controlled storage resources; the HDFS quota manager is used to isolate the controlled storage resources, thereby achieving tenant-level storage space isolation;

[0099] Simultaneously configure the ELK suite on the edge nodes of the big data platform to monitor access records, operation types, and tenant tags of encrypted partitions, and integrate them to generate real-time storage feedback data.

[0100] S4.3. Input the real-time stored feedback data into the causal graph neural network and perform gradient backpropagation to obtain the weight gradients. Apply the Adam optimizer to dynamically adjust the learning rate of the weight gradients to obtain optimized weight parameters. The specific operations are as follows: Input the real-time stored feedback data into the causal graph neural network through the GraphLoader interface. The graph convolution of the causal graph neural network aggregates neighborhood information from the real-time stored feedback data to obtain node representation vectors. Perform gradient backpropagation on the node representation vectors to obtain the parameter gradient tensor. Perform amplitude limitation on the parameter gradient tensor through gradient clipping to generate the weight gradients. Then, apply the Adam optimizer to perform momentum accumulation on the weight gradients to obtain gradient history information. Perform exponential weighted averaging on the gradient history information to generate the first and second gradient moments. Perform weighted integration on the first and second gradient moments to obtain the parameter update amount. Based on the parameter update amount, use the learning rate scheduler to dynamically adjust the learning rate of the weight gradients to obtain the optimized parameter increments. Apply the LayerNorm layer to the optimized parameter increments for normalization processing and output the optimized weight parameters.

[0101] S4.4. Based on the optimized weight parameters, iteratively update the graph convolution weights of the causal graph neural network to output the optimized causal graph neural network. The specific operations are as follows: Dimensional analysis of the optimized weight parameters is performed using tensor slicing, separating the node feature transformation matrix and the adjacency matrix weights. Based on the node feature transformation matrix and the adjacency matrix weights, the PyTorch reshape function is used to reshape the weights according to the structural dimensions of the graph convolution, generating updatable weight blocks. Then, PyTorch's data.copy is called to replace the parameters of the updatable weight blocks to obtain the validation weights. The validation weights are sparsified using a causal attention mask to maintain the sparsity of causal relationships, generating sparse weights. Based on the sparse weights, the graph convolution weights are updated in-situ. During the update process, gradient clipping is used to constrain the norm of the sparse weights to ensure the stability of the iterative update. Simultaneously, principal component analysis is used to perform low-dimensional projection on the graph convolution weights to obtain the causal effect strength value. When the causal effect strength value reaches the optimization threshold, the update stops, and the optimized causal graph neural network is output.

[0102] It should be noted that the optimization threshold is defined based on the statistical significance level of the causal effect strength value, and the value range is [0.7, 0.9].

[0103] This embodiment also provides a computer device applicable to the data isolation method for big data platform storage under SaaS mode, including: a memory and a processor; the memory is used to store computer-executable instructions, and the processor is used to execute computer-executable instructions to implement the data isolation method for big data platform storage under SaaS mode as proposed in the above embodiment.

[0104] The computer device can be a terminal, comprising a processor, memory, communication interface, display screen, and input devices connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, carrier networks, NFC (Near Field Communication), or other technologies. The display screen can be an LCD screen or an e-ink screen. The input devices can be a touch layer covering the display screen, buttons, a trackball, or a touchpad on the computer device's casing, or an external keyboard, touchpad, or mouse.

[0105] This embodiment also provides a storage medium on which a computer program is stored. When executed by a processor, the program implements the data isolation method for big data platform storage under the SaaS model proposed in the above embodiments. The storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as Static Random Access Memory (SRAM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Erasable Programmable Read Only Memory (EPROM), Programmable Red-Only Memory (PROM), Read-Only Memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk.

[0106] In summary, this invention, through the construction of a causal graph neural network and an improved causal inference tree algorithm, can extract temporal causal features from multi-tenant storage status datasets, enabling dynamic identification of anomaly risks. By using the Shannon entropy formula combined with K-means clustering and analytic hierarchy process, a mapping relationship between anomaly risks and data sensitivity is constructed, achieving focused protection of highly sensitive data while avoiding redundant isolation of low-risk data.

[0107] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A data isolation method for big data platform storage under a SaaS model, characterized in that: include, The storage status dataset is input into the causal graph neural network. The feature extraction layer captures the temporal patterns and causal correlation features of the data, and the feature fusion layer performs multi-hop neighborhood feature aggregation to generate a storage anomaly detection vector. The storage status dataset includes tenant identifier, operation type, target partition path, operation timestamp, and data size. The stored anomaly detection vector is input into the causal inference engine, and the improved causal inference tree algorithm is used to perform risk quantification, obtain causal effect scores, and classify risks through three levels of thresholds to generate anomaly risk levels. The Shannon entropy formula is used to calculate the entropy value of the abnormal risk level, obtain the abnormal entropy value, and classify the abnormal entropy value into intervals to form a sensitivity level. By integrating the anomaly risk level, anomaly entropy value, and sensitivity level, a storage data isolation scheme is generated; The storage data isolation scheme is converted into control commands. Specifically, this includes extracting the tenant isolation parameters of the storage data isolation scheme, encapsulating the tenant isolation parameters into control commands using an ACL manager, driving the big data platform to perform encrypted partition reconfiguration and data isolation according to the control commands, synchronously collecting real-time storage feedback data, and optimizing the causal graph neural network.

2. The data isolation method for big data platform storage under the SaaS model as described in claim 1, characterized in that: The specific construction process of the causal graph neural network is as follows. The feature extraction layer and feature fusion layer are constructed and initialized. The attention mechanism is used to weight and stack the feature extraction layer and feature fusion layer and perform hierarchical cross-connection to construct a causal graph neural network.

3. The data isolation method for big data platform storage under the SaaS model as described in claim 2, characterized in that: The generation of the storage anomaly detection vector specifically includes the following steps. The storage security situation dataset is input into the causal graph neural network. The feature extraction layer captures the temporal pattern and causal correlation features of the data through the gated recurrent unit, and generates a temporal causal feature matrix. The feature fusion layer uses graph convolution to perform multi-hop neighborhood feature aggregation and non-linear activation on the temporal causal feature matrix to generate causal feature vectors. The sigmoid activation function is used to perform high-dimensional kernel space projection on the causal feature vector to generate and store anomaly detection vectors.

4. The data isolation method for big data platform storage under the SaaS model as described in claim 1, characterized in that: The process of generating an anomaly risk level specifically includes the following steps. The stored anomaly detection vector is input into the causal inference engine, and the causal relationship is verified by Granger causality test to form the causal effect distribution. An improved causal inference tree algorithm is used to calculate and regularize the causal effect distribution to obtain the average treatment effect value. Then, the risk quantification of the confidence interval is performed on the average treatment effect value to generate a causal effect score. The causal effect score is divided into low-risk, medium-risk, and high-risk abnormal risk levels using a three-level threshold.

5. The data isolation method for big data platform storage under the SaaS model as described in claim 1, characterized in that: The process of obtaining the abnormal entropy value specifically includes the following steps. By randomly sampling the abnormal risk level through a sliding window, risk point data is obtained. Then, the distribution fitting method is used to estimate and fit the parameters of the risk point data to form a probability density curve. The standard deviation analysis method is used to measure the relative position of the probability density curve and obtain the standard score sequence. The Shannon entropy formula is used to calculate the execution information entropy of the standard score sequence to obtain the entropy distribution. The entropy distribution is then conditionally weighted to obtain the abnormal entropy values.

6. The data isolation method for big data platform storage under the SaaS model as described in claim 5, characterized in that: The generated storage data isolation scheme specifically includes the following steps. K-means clustering is used to analyze the distribution pattern and classify the intervals of abnormal entropy values ​​to generate sensitivity intervals. Correlation mapping is then performed on the sensitivity intervals to form sensitivity levels. The Analytic Hierarchy Process (AHP) is used to assign multi-factor weights to the anomaly risk level, anomaly entropy value, and sensitivity level. Based on the multi-factor weights, a weighted average method is used to integrate them to generate a storage data isolation scheme.

7. The data isolation method for big data platform storage under the SaaS model as described in claim 1, characterized in that: The optimization of the causal graph neural network specifically includes the following steps. Based on control commands, the big data platform is driven to call the HDFS API to create an encrypted partition, and the LUKS encryption tool is triggered to perform encrypted partition reconfiguration and data isolation, while the ELK suite is applied to collect real-time storage feedback data. The real-time stored feedback data is input into the causal graph neural network, and gradient backpropagation is performed to obtain the weight gradient. The Adam optimizer is then applied to dynamically adjust the learning rate of the weight gradient to obtain the optimized weight parameters. Based on the optimized weight parameters, the graph convolution weights of the causal graph neural network are iteratively updated, and the optimized causal graph neural network is output.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that: When the processor executes the computer program, it implements the steps of the data isolation method for big data platform storage under the SaaS model as described in any one of claims 1 to 7.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by the processor, it implements the steps of the data isolation method for big data platform storage under the SaaS model as described in any one of claims 1 to 7.

Images