A large model-based commercial password detection data identification and correlation analysis method

Abstract

The application discloses a kind of based on big model's commercial cipher detection data identification and correlation analysis method, it is related to commercial cipher detection technical field, method steps include: constructing light memory storage module, and setting dynamic memory recycling mechanism;Commercial cipher detection data is handled in real time using big model;Memory index generated by big model is automatically retrieved associated memory;The analysis result output by big model is compared with the memory unit in light memory storage module;Collect false positive case category and analyze, and optimize memory index according to analysis result;Dynamic change of redundant data detection length and redundant data determination period is introduced, and the application sets up redundant data staging module, and reserves a detection recycling length of redundant data determination period, reduces the misjudgment probability of redundant data, reduces the probability that commercial cipher detection result appears false alarm due to misjudgment redundant data.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of commercial password detection, and particularly relates to a commercial password detection data identification and correlation analysis method based on a large model. BACKGROUND

[0002] In the commercial password detection work, a large amount of data related to commercial passwords needs to be identified, analyzed and verified to ensure that the use of commercial passwords complies with relevant standards and specifications. Traditional commercial password detection data processing methods usually rely on fixed rules and templates, and have poor adaptability to complex text data and dynamic scenarios. In the process of processing password detection data, problems such as fabrication of false information, large memory occupation and inaccurate grasp of data context logical relationship may occur, which may result in low accuracy of detection results and high false positive rate, and cannot meet the high-precision requirements of commercial password detection.

[0003] With the development of large model technology, large models have shown strong processing capability in natural language processing and data identification. However, the existing processing method based on large models in the field of commercial password detection does not have further redundant data confirmation mechanism and redundant data detection recovery mechanism when designing a lightweight storage module to judge and process redundant data, and the fixation of the detection duration of redundant data may result in inaccurate data judgment results, which further leads to low accuracy of commercial password detection results and high false positive rate. In addition, there is a lack of special design for the characteristics of password detection data, especially in memory storage, correlation retrieval and error interception, which makes it difficult to efficiently and accurately complete the identification and correlation analysis of commercial password detection data. SUMMARY

[0004] The present application aims to provide a commercial password detection data identification and correlation analysis method based on a large model to solve the problems in the prior art.

[0005] To achieve the above-mentioned purpose, the present application provides the following technical scheme: a commercial password detection data identification and correlation analysis method based on a large model, the method comprising the following steps:

[0006] S1: constructing a lightweight memory storage module, and setting a dynamic memory recovery mechanism for the memory storage module, setting a redundant data confirmation period and a dynamic detection duration adjustment algorithm when designing the dynamic memory recovery mechanism, and setting a redundant data temporary storage module;

[0007] S2: using a large model to process commercial password detection data in real time, extracting key entities and context logical relationships in the data, and dynamically generating a memory index according to the extracted logical relationships;

[0008] S3, in analyzing a new commercial password detection text, the memory index generated by the large model automatically retrieves the associated memory related to the current commercial password detection text in the lightweight memory module;

[0009] S4: compare the analysis results output by the large model with the associated memory in the lightweight memory storage module, if the results are found to be inconsistent with the information in the memory unit, intercept the results, and mark the contradiction points;

[0010] S5: collect false positive cases, analyze the types and causes of false positive cases, and optimize the memory index according to the analysis results.

[0011] Further, in step S1: the constructed lightweight memory storage module includes an entity storage unit, a logical relationship storage unit and an index storage unit; the entity storage unit stores the key entities extracted from the commercial password text through a hash table structure; the logical relationship storage unit stores the context logical relationship between the key entities in the form of triple; the index storage unit stores the information in the memory index table through a B+ tree structure; this module adopts an efficient storage structure, which can significantly reduce the memory occupation while ensuring the integrity of data storage; At the same time, set up dynamic memory recycling mechanism, regularly detect the access frequency of stored data, and clean up the redundant data that has not been accessed for a long time, so as to release the memory space.

[0012] Further, in step S1: the dynamic memory recycling mechanism performs access detection on the lightweight memory storage module regularly, and sets a redundant data confirmation period, in which m times of redundant data detection are performed, and the number set {n1, n2, … n m} of data not accessed in each detection is recorded, the data with access times of 0 in m times of redundant data detection are recorded as set {A1, A2, …, A m}, after m times of redundant data detection, the determined redundant data set A, , where i=1, 2, … m, represents the mark of m times of redundant data detection; A represents the set of redundant data determined in a redundant data determination period;

[0013] The time interval between each redundant data detection in a redundant data determination period is a dynamically changing value, the data access time selected for the first and second redundant data detection is Δt0; from the third redundant data detection, the data access time selected for each redundant data detection is According to the change of the number of data with access times of 0 monitored in the last time, it is calculated according to the following formula:

[0014] ;

[0015] Wherein, j=3, 4, …, m, represents the label of each redundancy data detection from the third redundancy data detection; The dynamic change value of the data access duration selected by each redundancy data detection according to the calculation can calculate the cycle length of the entire redundancy data determination cycle:

[0016] ;

[0017] Wherein, T represents the cycle length of a redundancy data determination cycle; The dynamic memory recycling mechanism is set to delete the redundancy data and release the memory space, and in the design of the dynamic memory recycling mechanism, the dynamically changing redundancy data detection duration and redundancy data determination cycle are introduced, wherein the redundancy data detection duration is adjusted according to the change trend of the number of redundancy data detected in the previous two redundancy data detection processes, which can automatically adjust the redundancy data detection duration according to the change of the number of detected data, so that the number of redundancy data set detected each time is relatively balanced, so that the result of the redundancy data obtained by intersection at the end of the final redundancy data determination cycle is more accurate; And according to the monitored redundancy data quantity, the monitoring duration is adjusted in real time, when the data quantity is detected to decrease, the detection duration is automatically increased, the number of redundancy data detection under the condition of low redundancy data quantity is reduced, and the detection efficiency and detection result accuracy of the redundancy data are improved.

[0018] Further, a redundancy data temporary storage module is set, after the end of a redundancy data determination cycle, the redundancy data in the redundancy data set A determined is temporarily stored in the redundancy data temporary storage module, and in the next redundancy data determination cycle, the redundancy data stored in the redundancy data temporary storage module can also be used for comparison with new commercial cryptographic text data; And according to the comparison result, the data stored in the redundancy data temporary storage module is processed, and the comparison result is analyzed as follows:

[0019] If the comparison result of the redundancy data stored in the redundancy data temporary storage module is successful, that is, if the same data as the key entity and the logical relationship between entities of the new commercial cryptographic text data is searched in the redundancy data, that is, the associative memory is searched, then the comparison result is successful, and the redundancy data with successful comparison is extracted from the redundancy data temporary storage module and stored in the lightweight memory storage module again, which is no longer used as redundancy data, and the detection and recycling of redundancy data is completed;

[0020] If the comparison result of the redundant data stored in the redundant data temporary storage module is a comparison failure, that is, if the same data as the key entities and the logical relationship between the entities of the new commercial cryptographic text data is not retrieved in the redundant data, that is, no associative memory is retrieved, then the comparison result is a comparison failure, and after the end of the next redundant data determination period, the redundant data that has not been detected for recycling is deleted, thereby releasing the memory space; the redundant data temporary storage unit is set, which gives the data confirmed as redundant data a detection recycling opportunity, and a detection recycling duration of a redundant data determination period is reserved, and after the retrieval of the associative memory by the large model retrieval triggers the timeout mechanism, the retrieval of the redundant data stored in the data temporary storage unit is triggered. This design provides a detection recycling opportunity for redundant data, reduces the misjudgment probability of redundant data, and reduces the probability of false positives in the detection result of commercial cryptography caused by misjudging redundant data.

[0021] Further, in step S2: a special model based on BERT architecture fine-tuning is used to process commercial cryptographic detection data in real time, and key entities and context logical relationships in the data are extracted. This model incorporates a large amount of commercial cryptographic detection related text data in the training process, and has stronger domain adaptability; the key entities include commercial cryptographic algorithm name, cryptographic device model, key length, encryption method, cryptographic application scenario and compliance authentication status; the context logical relationship includes the association relationship between entities, time sequence relationship, cause and effect relationship and constraint relationship; in the process of extracting key entities and context logical relationships in the data, named entity recognition technology and relationship extraction technology are used, combined with professional dictionaries in the field of commercial cryptography, common algorithms, devices, terms, etc. in this field are included, model parameters are optimized through multiple rounds of iterative training, the accuracy of key entity and context logical relationship extraction is improved, ambiguous and ambiguous information is marked, and further confirmation is made in combination with subsequent association analysis; according to the extracted key entities and context logical relationships, a memory index table is dynamically generated; the memory index table takes key entities as the core, records the logical relationship information corresponding to the entities and the position information in the text, and is used for subsequent fast retrieval.

[0022] Further, in step S3: the process of detecting new commercial cryptographic text data includes the following steps:

[0023] S3-1, after preprocessing the new commercial cryptographic text data, the same large model and technology as the key information extraction step are used to extract the key entities in the data, and the extracted key entities include entity name, type and occurrence position;

[0024] S3-2, traversing the B+ tree structure of the memory index table based on the extracted key entities, retrieving the relevant memory in the memory index table through information comparison, and outputting the analysis comparison result between the new commercial password text data and the retrieved relevant memory;

[0025] S3-3, setting a timeout mechanism for the retrieval process, if the retrieval time exceeds the set threshold, terminating the current retrieval and analyzing the retrieval result, and optimizing the retrieval process.

[0026] Further, in step S3-3: a retrieval timeout mechanism is set for the retrieval process, and a retrieval time threshold At is set for the retrieval process max , the real-time retrieval time At' is compared and analyzed with the set threshold, and whether the timeout mechanism is triggered is judged according to the retrieval result and the real-time retrieval time;

[0027] If the real-time retrieval time At' < At max , it is judged that the relevant memory associated with the new commercial password text data has been retrieved from the memory index table, and the timeout mechanism is not triggered, and the analysis of the retrieval result is directly entered;

[0028] If the real-time retrieval time At' ≥ At max , it is judged that the relevant memory associated with the new commercial password text data has not been retrieved from the memory index table, or no relevant memory matching the new commercial password has been retrieved, and the timeout mechanism is triggered; and after triggering the timeout mechanism, the redundant data temporary storage module is started for retrieval of the current commercial password text data, and a timeout mechanism is also set in the retrieval of the redundant data stored in the redundant data temporary storage module; if the relevant memory is retrieved in the redundant data temporary storage module, the commercial password text data corresponding to the retrieved relevant memory is extracted from the redundant data temporary storage module and re-stored in the lightweight memory storage module.

[0029] Further, in step S4: the analysis comparison result output by the large model between the new commercial password data and the retrieved relevant memory includes the difference of the core attributes of the key entities, i.e. the deviation length between the key lengths corresponding to the algorithms, and the logical relationship between the entities; the analysis result output by the large model is compared with the specific content of the relevant memory in the lightweight memory storage module, and the comparison content includes the deviation length between the key lengths corresponding to the algorithms and the logical relationship between the entities; the comparison method adopts a hierarchical comparison strategy, first comparing the core attributes of the key entities, i.e. the key lengths corresponding to the algorithms, and then comparing the key logical relationship between the entities;

[0030] For the detection of the core attributes of key entities, a contradiction judgment threshold is set. For the key length data, the key length contradiction threshold corresponding to the algorithm is set as L0. The deviation length between the key length in the new commercial cryptographic text extracted by the large model in real time and the key length retrieved from the associated memory is recorded as L. Whether there is a contradiction is determined by analyzing and comparing the relationship between L and L0. For logical relationship analysis, if there is a direct conflict between the logical relationships between entities, it is directly determined that there is a contradiction. For example, the logical relationship between the AES algorithm and the SM4 algorithm stored in the memory unit is: first use the AES algorithm and then upgrade to the SM4 algorithm. However, the logical relationship between the two entities in the detection result of the large model is: first use the SM4 algorithm and then upgrade to the AES algorithm. It is determined that there is a direct conflict in the logical relationship and that there is a contradiction.

[0031] If L≤L0and there is no direct conflict in the logical relationship, it is determined that the real-time commercial cryptography and the retrieved associated memory are not contradictory, and the analysis result is then output to the subsequent process.

[0032] If L>L0or there is a direct conflict in the logical relationship, it is determined that there is a contradiction between the real-time commercial cryptography and the retrieved associated memory.

[0033] For analysis results that are determined to have a contradiction, the analysis result is intercepted, the output to the subsequent process is suspended, and the contradiction point is marked through a structured form. The contradiction information is temporarily stored in the to-be-processed queue and waits for the review of the management personnel. When the management personnel reviews, all the information in the structured form is viewed to determine whether the intercepted result is a false positive. After review, if it is determined to be a false positive, the system automatically includes the case in the training set of the memory index optimization step and removes the interception to allow the result to enter the subsequent process. If it is determined to be an effective contradiction, the management personnel's instructions are processed, such as correcting the large model output result and supplementing the memory unit information. The corrected large model output result needs to be compared with the memory unit again and then entered into the subsequent process after confirming that there is no contradiction. The supplemented memory unit information is updated to the lightweight memory storage module for subsequent comparison and analysis.

[0034] Further, in step S5: collect false positive cases, including correct results that are incorrectly intercepted, incorrect results that are not intercepted, and cases of associated memory retrieval errors. The weights of the memory index are automatically adjusted using the collected false positive cases. The weight calculation is calculated using a dynamic adjustment formula:

[0035] ;

[0036] wherein, represents the adjusted new memory index weight; q represents the memory index weight before adjustment; s represents the set adjustment coefficient, and the adjustment coefficient is associated with the influence degree of false positives on the detection result; represents the false positive frequency of each memory index entry; represents the total use frequency of each memory index entry;

[0037] The adjustment coefficient s is a system default setting, the influence degree of false positives on the detection result is different according to different false positive case types, the influence degree of the two false positive case types of the correct result being wrongly intercepted and the error result not being intercepted on the detection result is high, the adjustment coefficient with a high value is set when the memory index weight adjustment is carried out for the two false positive case types, for example, s=0.3; the influence degree of the association memory retrieval error on the monitoring result is low, the adjustment coefficient with a low value is set for the false positive case of the association memory retrieval error, for example, s=0.1; the weight adjustment process is periodically executed, in the adjustment process, the false positive frequency and the total use frequency of each memory index entry are counted, the new memory index weight is calculated according to the dynamic adjustment formula, the memory index weight in the memory index table is updated, and the updated memory index weight is fed back to the large model.

[0038] Compared with the prior art, the beneficial effects of the present application are:

[0039] The application constructs a lightweight memory storage module, which adopts an efficient storage structure and can significantly reduce memory occupancy while ensuring data storage integrity. The application also sets up a dynamic memory recycling mechanism to delete redundant data and release memory space. When designing the dynamic memory recycling mechanism, a dynamically changing redundant data detection duration and a redundant data determination period are introduced. The redundant data detection duration is adjusted according to the change trend of the number of redundant data detected in the previous two redundant data detection processes, so that the redundant data detection duration can be automatically adjusted dynamically according to the change in the number of detected data, making the number of redundant data sets detected each time relatively balanced, and thus the result of redundant data obtained by intersection at the end of the final redundant data determination period is more accurate. The monitoring duration is adjusted in real time according to the monitored number of redundant data. When the number of data decreases, the detection duration is automatically increased to reduce the number of redundant data detections in the case of low redundant data quantity, improving the detection efficiency and accuracy of the detection result. The application sets up a redundant data temporary storage unit to give the data confirmed as redundant data a detection and recycling opportunity, and reserves a detection and recycling duration of a redundant data determination period. After the retrieval of associated memory triggered by the timeout mechanism of the large model retrieval, the retrieval of redundant data stored in the data temporary storage unit is triggered. This design provides a detection and recycling opportunity for redundant data, reduces the probability of misjudgment of redundant data, and reduces the probability of false positives in the detection result of commercial passwords. The application sets up a timeout mechanism for the retrieval process to optimize the retrieval process. The application uses a special model based on BERT architecture fine-tuning to process commercial password detection data in real time, extracts key entities and context logical relationships in the data, and integrates a large amount of commercial password detection related text data in the training process, which has stronger domain adaptability. The application calculates new weights according to a dynamic adjustment formula and updates the weight values in the memory index table. In this way, the triggering accuracy of the memory index is optimized, and the rate of fictitious errors is reduced. BRIEF DESCRIPTION OF DRAWINGS

[0040] Figure 1 A method flowchart of a commercial password detection data identification and association analysis method based on a large model according to the application;

[0041] Figure 2 A lightweight memory storage module structure diagram of a commercial password detection data identification and association analysis method based on a large model according to the application;

[0042] Figure 3 A dynamic memory recycling mechanism flowchart of a commercial password detection data identification and association analysis method based on a large model according to the application. DETAILED DESCRIPTION

[0043] The technical solutions in the embodiments of the present application will be described clearly and completely below in combination with the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work fall within the scope of protection of the present application.

[0044] As shown in Figures 1-3 The present application provides a technical solution, a commercial password detection data identification and correlation analysis method based on a large model, as shown in Figure 1 The method comprises the following steps:

[0045] S1: Construct a lightweight memory storage module, and set a dynamic memory recycling mechanism for the memory storage module. When designing the dynamic memory recycling mechanism, set a redundant data confirmation period and a dynamic detection duration adjustment algorithm, and set a redundant data temporary storage module;

[0046] S2: Use the large model to perform real-time processing on the commercial password detection data, extract key entities and context logical relationships in the data, and dynamically generate a memory index according to the extracted logical relationships;

[0047] S3: When analyzing new commercial password detection text, automatically retrieve relevant associated memories in the lightweight memory module with the current commercial password detection text through the memory index generated by the large model;

[0048] S4: Compare the analysis result output by the large model with the associated memories in the lightweight memory storage module. If it is found that the result is contradictory to the information in the memory unit, intercept the result and mark the contradiction point;

[0049] S5: Collect false positive cases, analyze the types of false positive cases and the causes of false positive cases, and optimize the memory index according to the analysis result.

[0050] In step S1: The constructed lightweight memory storage module comprises an entity storage unit, a logical relationship storage unit and an index storage unit; the entity storage unit stores key entities extracted from commercial password text through a hash table structure; the logical relationship storage unit stores context logical relationships between key entities in the form of triples; the index storage unit stores information in the memory index table through a B+ tree structure; and a dynamic memory recycling mechanism is set to periodically detect the access frequency of stored data, and clean up redundant data that has not been accessed for a long time, thereby releasing memory space.

[0051] In step S1: the dynamic memory recycling mechanism accesses the lightweight memory storage module to detect access timing and sets a redundant data confirmation period. In one redundant data confirmation period, m times of redundant data detection are performed, and the number of data not accessed each time is recorded as a set {n1, n2,... n m} and the data with 0 access times detected in m times of redundant data detection is recorded as a set {A1, A2,... A m} and after m times of redundant data detection, the determined redundant data set A is obtained, where i = 1, 2,... m, represents the label of m times of redundant data detection; A represents the set of data judged as redundant data in one redundant data confirmation period;

[0052] In one redundant data confirmation period, the time interval between each redundant data detection is a dynamically changing value, and the data access time selected for the first and second redundant data detection is Δt0; from the third redundant data detection, the data access time selected for each redundant data detection changes according to the change in the number of data with 0 access times monitored in the previous time, and is calculated according to the following formula:

[0053] ;

[0054] where j = 3, 4,... m, represents the label of each redundant data detection starting from the third redundant data detection; represents the data access time selected for each redundant data detection starting from the third redundant data detection; according to the dynamically changing value of the data access time selected for each redundant data detection calculated, the period length of the entire redundant data confirmation period can be calculated as:

[0055] ;

[0056] where T represents the period length of one redundant data confirmation period.

[0057] A redundant data temporary storage module is set, and after one redundant data confirmation period ends, the redundant data in the determined redundant data set A is temporarily stored in the redundant data temporary storage module, and in the next redundant data confirmation period, the redundant data stored in the redundant data temporary storage module can still be used for comparison with new commercial cipher text data; and the data stored in the redundant data temporary storage module is processed according to the comparison result, and the comparison result is analyzed as follows:

[0058] If the comparison result of the redundant data stored in the redundant data temporary storage module is a comparison success, the redundant data that has been compared successfully is extracted from the redundant data temporary storage module and re-stored in the lightweight memory storage module, and is no longer used as redundant data, thereby completing the detection and recovery of the redundant data.

[0059] If the comparison result of the redundant data stored in the redundant data temporary storage module is a comparison failure, and after the end of the next redundant data determination period, the redundant data that has not been detected and recovered is deleted, thereby releasing the memory space.

[0060] In step S2: a special model based on BERT architecture fine-tuning is used to process commercial password detection data in real time, and key entities and context logical relationships in the data are extracted; the key entities include commercial password algorithm names, password device models, key lengths, encryption methods, password application scenarios, and compliance authentication states; the context logical relationships include the association between entities, the time sequence relationship, the cause and effect relationship, and the constraint relationship; according to the extracted key entities and context logical relationships, a memory index table is dynamically generated; the memory index table takes key entities as the core, records the logical relationship information corresponding to the entities and the position information in the text, and is used for subsequent fast retrieval.

[0061] In step S3: the process of detecting new commercial password text data includes the following steps:

[0062] S3-1, after preprocessing the new commercial password text data, the same large model and technology as the key information extraction step are used to extract key entities in the data, and the extracted key entities include entity names, types, and occurrence positions;

[0063] S3-2, based on the extracted key entities, traverse the B+ tree structure of the memory index table, retrieve the associated memories in the memory index table related to the new commercial password text data through information comparison, and output the analysis comparison result between the new commercial password data and the retrieved associated memories;

[0064] S3-3, a timeout mechanism is set for the retrieval process, if the retrieval time exceeds the set threshold, the current retrieval is terminated and the retrieval result is analyzed and processed, and the retrieval process is optimized.

[0065] In step S3-3: a retrieval timeout mechanism is set for the retrieval process, and a retrieval duration threshold Δt is set for the retrieval process max The real-time retrieval duration Δt' is compared and analyzed with the set threshold, and whether the timeout mechanism is triggered is judged according to the retrieval result and the real-time retrieval duration;

[0066] If the real-time retrieval duration Δt' < Δt maxIf it is determined that the associated memory related to the new commercial cipher text data has been retrieved from the memory index table, the timeout mechanism is not triggered, and the analysis of the retrieval result is directly entered.

[0067] If the real-time retrieval time Δt' ≥ Δt max If it is determined that the associated memory related to the new commercial cipher text data has not been retrieved from the memory index table, or no associated memory matching the new commercial cipher is retrieved, the timeout mechanism is triggered. After the timeout mechanism is triggered, the redundant data temporary storage module is started for retrieval of the current commercial cipher text data. In the process of retrieving the redundant data stored in the redundant data temporary storage module, the timeout mechanism is also set. If the associated memory is retrieved in the redundant data temporary storage module, the commercial cipher text data corresponding to the retrieved associated memory is extracted from the redundant data temporary storage module and stored in the lightweight memory storage module.

[0068] In step S4, the analysis and comparison result between the new commercial cipher data output by the large model and the retrieved associated memory includes the difference of the core attributes of the key entities, the deviation length between the key lengths corresponding to the algorithms, and the logical relationship between the entities. The analysis result output by the large model is compared with the specific content of the associated memory in the lightweight memory storage module. The comparison content includes the deviation length between the key lengths corresponding to the algorithms and the logical relationship between the entities. The comparison method adopts a hierarchical comparison strategy, which first compares the core attributes of the key entities, i.e., the key lengths corresponding to the algorithms, and then compares the key logical relationship between the entities.

[0069] For the detection of the core attributes of the key entities, a contradiction judgment threshold is set. For the key length data, the contradiction threshold of the key length corresponding to the algorithm is set as L0. The deviation length between the key length in the new commercial cipher text extracted by the large model in real time and the key length of the retrieved associated memory is denoted as L. Whether there is a contradiction is determined by analyzing and comparing the relationship between L and L0. For the logical relationship analysis, if there is a direct conflict between the logical relationships between the entities, it is directly determined that there is a contradiction. The analysis result is as follows:

[0070] If L ≤ L0 and there is no direct conflict in the logical relationship, it is determined that the real-time commercial cipher and the retrieved associated memory are not contradictory, and the process is continued to the subsequent flow output.

[0071] If L > L0 or there is a direct conflict in the logical relationship, it is determined that there is a contradiction between the real-time commercial cipher and the retrieved associated memory.

[0072] For the analysis result judged to have contradictions, the analysis result is intercepted, output to the subsequent process is suspended, and the contradiction point is marked through the structured form, and the contradiction information is temporarily stored in the to-be-processed queue, waiting for the management personnel to review; when the management personnel reviews, all information in the structured form is viewed, and whether the intercepted result is a false alarm is judged in combination with professional knowledge and related information; after review, if it is determined that it is a false alarm, the system automatically includes the case in the training set of the memory index optimization step, removes the interception, and allows the result to enter the subsequent process; if it is determined to be an effective contradiction, processing is performed according to the instructions of the management personnel; for the output result of the revised large model, it needs to be compared with the memory unit again, and after confirming that there is no contradiction, it enters the subsequent process again; the supplementary memory unit information is updated to the lightweight memory storage module for subsequent comparison and analysis.

[0073] In step S5: collect false positive cases, false positive case types include correct results that are wrongly intercepted, incorrect results that are not intercepted, and cases of associated memory retrieval errors, automatically adjust the weights of the memory index using the collected false positive cases, and the weight calculation is calculated using a dynamic adjustment formula:

[0074] ;

[0075] wherein, represents the new memory index weight after adjustment; q represents the memory index weight before adjustment; s represents the set adjustment coefficient, which is associated with the influence degree of false positives on detection results; represents the false positive frequency of each memory index item; represents the total use frequency of each memory index item;

[0076] The influence degree of false positives on detection results is different according to different false positive case types. The influence degree of the two false positive case types of correct results that are wrongly intercepted and incorrect results that are not intercepted on detection results is high, so a high numerical value adjustment coefficient is set for memory index weight adjustment for these two false positive cases. The influence degree of associated memory retrieval errors on detection results is low, so a low numerical value adjustment coefficient is set for the false positive case of associated memory retrieval errors. The weight adjustment process is performed regularly. In the adjustment process, the false positive frequency and the total use frequency of each memory index item are first counted, then the new memory index weight is calculated according to the dynamic adjustment formula, and finally the memory index weight in the memory index table is updated, and the updated memory index weight is fed back to the large model.

[0077] Embodiment 1: In step S1: The dynamic memory recycling mechanism accesses the lightweight memory storage module for detection at regular intervals, and sets a redundant data determination period. In one redundant data determination period, m = 3 times of redundant data detection are performed, and the number of data not accessed each time is recorded as a set {n1=12, n2=10, n3=8}. The data with 0 access times detected in the m = 3 times of redundant data detection are recorded as a set {A1, A2, A3}. After the 3 times of redundant data detection, the determined redundant data set A is obtained, ; A represents the set of data determined as redundant data in one redundant data determination period;

[0078] The time interval between each redundant data detection in one redundant data determination period is a dynamically changing value. The data access time selected for the first and second redundant data detection is set as Δt0. Starting from the third redundant data detection, the data access time selected for each redundant data detection is changed according to the change in the number of data with 0 access times monitored in the previous time. The calculation is based on the following formula:

[0079] ;

[0080] Where j represents the label of each redundant data detection starting from the third redundant data detection. The data access time selected for each redundant data detection starting from the third redundant data detection is Δtj. According to the dynamically changing value of the data access time selected for each redundant data detection calculated, the period length of the entire redundant data determination period can be calculated as: = 1.07h;

[0081] ;

[0082] Where T represents the period length of one redundant data determination period; T = 3.07h.

[0083] A redundant data temporary storage module is set. After the end of one redundant data determination period, the redundant data in the determined redundant data set A is temporarily stored in the redundant data temporary storage module. In the next redundant data determination period, the redundant data stored in the redundant data temporary storage module can still be used for comparison with new commercial cipher text data. And according to the comparison result, the data stored in the redundant data temporary storage module is processed. The comparison result is analyzed as follows:

[0084] If the comparison result of the redundant data stored in the redundant data temporary storage module is a comparison success, the redundant data that has been compared successfully is extracted from the redundant data temporary storage module and re-stored in the lightweight memory storage module, and is no longer used as redundant data, thereby completing the detection and recovery of the redundant data.

[0085] If the comparison result of the redundant data stored in the redundant data temporary storage module is a comparison failure, and after the end of the next redundant data determination period, the redundant data that has not been detected and recovered is deleted, thereby releasing the memory space.

[0086] In step S3-3: a retrieval timeout mechanism is set for the retrieval process, and a retrieval duration threshold At is set for the retrieval process max = 60s, the real-time retrieval duration At' is compared and analyzed with the set threshold, and whether the timeout mechanism is triggered is determined according to the retrieval result and the real-time retrieval duration;

[0087] If the real-time retrieval duration At' < At max , it is determined that the associated memory related to the new commercial cryptographic text data has been retrieved from the memory index table, and the timeout mechanism is not triggered, and the analysis of the retrieval result is directly entered;

[0088] If the real-time retrieval duration At' ≥ At max , it is determined that the associated memory related to the new commercial cryptographic text data has not been retrieved from the memory index table, or no associated memory that completely matches the new commercial cryptographic text data has been retrieved, and the timeout mechanism is triggered; and after the timeout mechanism is triggered, the redundant data temporary storage module retrieval is started for the current commercial cryptographic text data, and a timeout mechanism is also set during the retrieval of the redundant data stored in the redundant data temporary storage module; if the associated memory is retrieved in the redundant data temporary storage module, the commercial cryptographic text data corresponding to the retrieved associated memory is extracted from the redundant data temporary storage module and re-stored in the lightweight memory storage module.

[0089] In step S4: the analysis and comparison result between the new commercial cryptographic data output by the large model and the retrieved associated memory includes the difference of the core attributes of the key entities, i.e., the deviation length between the key lengths corresponding to the algorithms, and the logical relationship between the entities; the analysis result output by the large model is compared with the specific content of the associated memory in the lightweight memory storage module, and the comparison content includes the deviation length between the key lengths corresponding to the algorithms and the logical relationship between the entities; the comparison method adopts a hierarchical comparison strategy, which first compares the core attributes of the key entities, i.e., the key lengths corresponding to the algorithms, and then compares the key logical relationship between the entities;

[0090] For the detection of the core attributes of the key entity, a contradiction judgment threshold is set, and for the key length data, the key length contradiction threshold corresponding to the algorithm is set as L0=32 bytes. The deviation length between the key length in the new commercial cryptographic text extracted by the large model in real time and the key length retrieved by the associative memory is recorded as L. Whether there is a contradiction is judged by analyzing the relationship between L and L0. For logical relationship analysis, if there is a direct conflict between the logical relationships between entities, it is directly judged that there is a contradiction. The analysis results are as follows:

[0091] If L≤L0and there is no direct conflict in the logical relationship, it is judged that the real-time commercial cryptography and the retrieved associative memory are not contradictory, and then the output is continued to the subsequent process.

[0092] If L>L0or there is a direct conflict in the logical relationship, it is judged that there is a contradiction between the real-time commercial cryptography and the retrieved associative memory.

[0093] It is obvious to those skilled in the art that the present application is not limited to the details of the above exemplary embodiments, and can be implemented in other specific forms without departing from the spirit or essential characteristics of the present application. Therefore, the embodiments should be regarded as exemplary and non-limiting, and the scope of the present application is defined by the appended claims rather than the above description, and therefore all changes falling within the meaning and scope of the equivalent elements of the claims are intended to be included in the present application. Any reference signs in the claims should not be regarded as limiting the claims involved.

Claims

1. A method for identifying and correlating commercial cryptographic detection data based on a large model, characterized in that: The method includes the following steps: S1: Construct a lightweight memory storage module and set up a dynamic memory reclamation mechanism for the memory storage module. When designing the dynamic memory reclamation mechanism, set up a redundant data confirmation cycle and a dynamic detection duration adjustment algorithm, and set up a redundant data temporary storage module. S2: Utilize a large model to process commercial cryptography detection data in real time, extract key entities and contextual logical relationships from the data, and dynamically generate a memory index based on the extracted logical relationships; S3. When analyzing new commercial cryptography detection text, the associated memories related to the current commercial cryptography detection text are automatically retrieved from the lightweight memory module through the memory index generated by the large model. S4: Compare the analysis results output by the large model with the associated memory in the lightweight memory storage module. If a contradiction is found between the result and the information in the memory unit, the result is intercepted and the contradiction is marked. S5: Collect false alarm cases, analyze the types and causes of false alarm cases, and optimize the memory index based on the analysis results.

2. The method for identifying and correlating commercial cryptographic detection data based on a large model according to claim 1, characterized in that: In step S1: the constructed lightweight memory storage module includes an entity storage unit, a logical relation storage unit, and an index storage unit; the entity storage unit stores key entities extracted from commercial cryptographic text using a hash table structure; the logical relation storage unit stores the contextual logical relationships between key entities using triples. The index storage unit stores information from the memory index table using a B+ tree structure; it also sets up a dynamic memory reclamation mechanism to periodically detect the access frequency of the stored data and clean up redundant data that has not been accessed for a long time, thereby freeing up memory space.

3. The method for identifying and correlating commercial cryptographic detection data based on a large model according to claim 2, characterized in that: In step S1: The dynamic memory reclamation mechanism periodically checks the access to the lightweight memory storage module and sets a redundancy data confirmation period. Within one redundancy data confirmation period, a total of m redundancy data checks are performed, and the set of the number of unaccessed data detected each time {n1, n2, ... n} is recorded. m Let {A1, A2, ..., A} be the set of data that has been accessed 0 times in m redundant data detections. m After m redundant data checks are completed, the determined redundant data set A is obtained. , where i=1,2,...m, represents the label of m redundant data detections; A represents the set of data identified as redundant within a redundant data determination period; Within a redundancy data determination period, the data access duration selected for the first and second redundancy data checks is set to Δt0; starting from the third redundancy data check, the data access duration selected for each subsequent redundancy data check is... Calculated according to the following formula: ； Where j=3,4,...,m, represents the index of each redundant data detection starting from the third redundant data detection; This indicates the data access duration selected for each redundant data detection starting from the third redundant data detection; based on the dynamically changing value of the selected data access duration for each redundant data detection, the length of the entire redundant data determination period can be calculated. ； Where T represents the period length of a redundant data period.

4. The method for identifying and correlating commercial cryptographic detection data based on a large model according to claim 3, characterized in that: A redundant data temporary storage module is set up. After a redundant data determination cycle ends, the redundant data in the determined redundant data set A is temporarily stored in the redundant data temporary storage module. In the next redundant data determination cycle, the redundant data stored in the redundant data temporary storage module can also be used to compare with new commercial cryptographic text data. And based on the comparison results, the data stored in the redundant data temporary storage module is processed. The comparison results are analyzed as follows: If the comparison result of the redundant data stored in the redundant data temporary storage module is successful, the successfully compared redundant data will be extracted from the redundant data temporary storage module and re-stored into the lightweight memory storage module, and will no longer be regarded as redundant data, thereby completing the detection and recycling of redundant data. If the comparison result of the redundant data stored in the redundant data temporary storage module is a failure, and the redundant data that has not been detected and recycled is deleted after the next redundant data determination cycle ends, the memory space will be freed up.

5. The method for identifying and correlating commercial cryptographic detection data based on a large model according to claim 1, characterized in that: In step S2: A dedicated model based on BERT architecture fine-tuning is used to process commercial cryptography detection data in real time, extracting key entities and contextual logical relationships from the data; the key entities include the name of the commercial cryptography algorithm, the model of the cryptographic device, the key length, the encryption method, the cryptographic application scenario, and the compliance certification status; the contextual logical relationships include the association, chronological order, causal relationship, and constraint relationship between entities; based on the extracted key entities and contextual logical relationships, a memory index table is dynamically generated; The memory index table is centered around key entities, recording the logical relationship information of the entities and their position information in the text, for subsequent fast retrieval.

6. The method for identifying and correlating commercial cryptographic detection data based on a large model according to claim 1, characterized in that: In step S3: The process of detecting new commercial cryptographic text data includes the following steps: S3-1. After preprocessing the new commercial cryptographic text data, use the same large model and techniques as the key information extraction step to extract the key entities in the data. The extracted key entities include entity name, type and location of occurrence. S3-2. Based on the extracted key entities, traverse the B+ tree structure of the memory index table, retrieve the associated memories in the memory index table that are related to the new commercial cryptographic text data through information comparison, and output the analysis and comparison results between the new commercial cryptographic data and the retrieved associations and memories. S3-3. Set a timeout mechanism for the retrieval process. If the retrieval time exceeds the set threshold, terminate the current retrieval and analyze and process the retrieval results to optimize the retrieval process.

7. The method for identifying and correlating commercial cryptographic detection data based on a large model according to claim 6, characterized in that: In step S3-3: a search timeout mechanism is set for the search process, and a search duration threshold Δt is set for the search process. max The real-time retrieval duration Δt′ is compared and analyzed with the set threshold, and the timeout mechanism is determined based on the retrieval results and the real-time retrieval duration. If the real-time retrieval duration Δt′ < Δt max If it is determined that an associated memory related to the new commercial cryptographic text data has been retrieved from the memory index table, the timeout mechanism will not be triggered, and the process will directly proceed to the analysis of the retrieval results. If the real-time retrieval duration Δt′≥Δt max If no associated memory related to the new commercial cryptographic text data is found in the memory index table, or no associated memory that completely matches the new commercial cryptography is found, a timeout mechanism is triggered. After the timeout mechanism is triggered, the redundant data temporary storage module is started to search for the current commercial cryptographic text data. A timeout mechanism is also set during the process of searching the redundant data stored in the redundant data temporary storage module. If an associated memory is retrieved in the redundant data temporary storage module, the commercial cryptographic text data corresponding to the retrieved associated memory will be extracted from the redundant data temporary storage module and re-stored into the lightweight memory storage module.

8. The method for identifying and correlating commercial cryptographic detection data based on a large model according to claim 1, characterized in that: In step S4: The analysis and comparison results output by the large model for the new commercial cryptographic data and the retrieved associations and memories include the differences in the core attributes of key entities, namely the deviation length between the key lengths corresponding to the algorithms, and the logical relationships between entities; the analysis results output by the large model are compared with the specific content of the association memories in the lightweight memory storage module. The comparison content includes the deviation length between the key lengths corresponding to the algorithms and the logical relationships between entities; the comparison method adopts a hierarchical comparison strategy, first comparing the core attributes of key entities, namely the key lengths corresponding to the algorithms, and then comparing the key logical relationships between entities; For the detection of core attributes of key entities, a contradiction judgment threshold is set. For key length data, the corresponding key length contradiction threshold for the algorithm is set to L0. The deviation length between the key length in the new commercial cryptographic text extracted in real time by the large model and the key length in the retrieved associated memory is recorded as L. The relationship between L and L0 is analyzed and compared to determine whether a contradiction exists. For logical relationship analysis, if there is a direct conflict in the logical relationship between entities, it is directly judged as a contradiction. The analysis results are as follows: If L≤L0 and there is no direct conflict in the logical relationship, it is determined that the real-time commercial password and the associated memory of the retrieval do not contradict each other, and then the output continues to the subsequent process; If L>L0 or there is a direct conflict in the logical relationship, it is determined that there is a contradiction between the real-time commercial cryptography and the associated memory of retrieval; For analysis results deemed contradictory, the results are intercepted, output to subsequent processes is paused, and contradictory points are marked using a structured form. The contradictory information is temporarily stored in a processing queue, awaiting review by administrators. During review, administrators examine all information in the structured form to determine if the intercepted result is a false alarm. If a false alarm is determined, the system automatically includes the case in the training set for the memory index optimization step, removes the interception, and allows the result to proceed to subsequent processes. If a valid contradiction is determined, it is processed according to the administrator's instructions. The corrected output of the large model needs to be compared with the memory unit again to confirm the absence of contradictions before proceeding to subsequent processes. The supplemented memory unit information is updated in the lightweight memory storage module for subsequent comparisons and analyses.

9. The method for identifying and correlating commercial cryptographic detection data based on a large model according to claim 1, characterized in that: In step S5: False positive cases are collected. False positive cases include correctly detected results that were incorrectly blocked, incorrect results that were not blocked, and cases of incorrect association memory retrieval. The collected false positive cases are used to automatically adjust the memory index weights. The weights are calculated using a dynamic adjustment formula. ； in, q represents the new memory index weights after adjustment; s represents the memory index weights before adjustment; and s represents the adjustment coefficient, which is related to the degree of impact of false alarms on the detection results. Indicates the false alarm frequency of each memory index entry; This indicates the total frequency of use for each memory index entry; The impact of false alarms on detection results varies depending on the type of false alarm case. For the two types of false alarm cases—correct results that are incorrectly blocked and incorrect results that are not blocked—the impact on detection results is high, so a high adjustment coefficient is set when adjusting the memory index weights for these two types of false alarm cases. For the false alarm case of associated memory retrieval errors, the impact on monitoring results is low, so a low adjustment coefficient is set for this type of false alarm case. The weight adjustment process is executed periodically. During the adjustment process, the false alarm frequency and total usage frequency of each memory index entry are first counted, then the new memory index weights are calculated according to the dynamic adjustment formula, and finally the memory index weights in the memory index table are updated, and the updated memory index weights are fed back to the large model.

Images