Intelligent archive information security protection method and system

Abstract

The invention discloses an intelligent archive information security protection method and system, and belongs to the technical field of information security protection. The method is used for solving the technical problem that the reliability and interpretability of an algorithm for archive information security protection in an existing scheme cannot be actively supervised and optimized. Initial weight distribution of sensitive levels is realized through an analytic hierarchy process, the Bayesian network quantifies the influence degree of real-time risk factors, weights are dynamically adjusted in combination with time attenuation factors, finally, a multi-dimensional archive information security risk assessment model capable of being dynamically optimized is constructed, an explicit logic basis is provided through rule reasoning, and an archive information security risk assessment model is established. A machine learning model quantifies a risk probability and explains key features, multi-source information is fused through a D-S evidence theory, finally, a decision path is tracked through a visual tree diagram, and multi-dimensional improvement of risk identification accuracy-decision transparency-system adaptability is realized through adaptive parameter adjustment and closed-loop optimization of an abnormal response strategy.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information security protection, and particularly relates to an intelligent archive information security protection method and system. BACKGROUND

[0002] Archive information security protection refers to taking a series of measures to ensure the confidentiality, integrity and availability of archive information, and preventing unauthorized access, use, disclosure, destruction or modification of archive information. Archive information security protection includes but is not limited to physical security, network security, data encryption, access control, backup and recovery, privacy protection.

[0003] The existing archive information security protection system is difficult to understand and explain in the decision-making process of complex algorithms such as deep learning when implemented, especially in security audit and responsibility tracing, it is difficult to clearly explain why a certain operation is determined as a risky behavior or a certain archive is sensitive; in addition, the bias of the training data itself may lead to unfair or incorrect judgments by the algorithm in access control, sensitive information identification, etc.; at the same time, the model may lack resistance to carefully designed adversarial attacks, such as tiny perturbation deception image recognition, text classification, and there is a defect that the algorithm reliability and explainability of archive information security protection cannot be actively supervised and optimized. SUMMARY

[0004] The purpose of the present application is to provide an intelligent archive information security protection method and system, which solves the technical problem that the algorithm reliability and explainability of archive information security protection cannot be actively supervised and optimized in the prior art.

[0005] The purpose of the present application can be achieved by the following technical solutions: An intelligent archive information security protection method, comprising: Based on archive type, access behavior, storage environment and historical risk events, an evaluation model containing sensitive level division, real-time risk factor quantification and dynamic weight distribution is established through an evaluation model construction module; A security decision module is used to fuse rule-based reasoning and machine learning algorithms, extract explicit logical rules of the decision-making process, and build a visual decision path tracking mechanism; A dynamic supervision optimization module is used to iteratively optimize system reliability and explainability through adaptive parameter adjustment strategies and abnormal response strategies based on risk data output by the evaluation model and execution feedback of the security decision module.

[0006] Preferably, when constructing the evaluation model, initial sensitive level weights are set for archive type, access behavior and storage environment; Based on the historical risk event database, the occurrence probability and impact of real-time risk factors are quantified; A time decay factor is introduced to dynamically adjust the weight, so as to reduce the influence weight of recent risk events on the evaluation result.

[0007] Preferably, the knowledge graph is constructed based on the archive management specification and the security standard, and a triple rule library containing an access subject-permission-operation object is extracted. The risk prediction model is trained, and a feature importance report is output. The rule reasoning and model prediction results are fused to generate a comprehensive decision report.

[0008] Preferably, the visual decision path tracking mechanism is implemented by constructing a decision tree diagram, wherein the nodes in the diagram include the basic information of the access request, the rule matching result, the key features predicted by the model, and the final decision conclusion.

[0009] Preferably, the dynamic supervision optimization mechanism includes: The risk prediction error of the evaluation model and the execution effect of the decision module are recorded in real time; When the risk prediction error exceeds a threshold or the execution effect is not up to standard, an artificial review process is triggered and optimization requirements are generated; Based on the feedback data, the weight distribution strategy of the evaluation model and the rule priority of the decision module are adjusted to optimize the balance between system reliability and interpretability.

[0010] Preferably, when quantifying real-time risk factors, a directed acyclic graph is constructed with a risk event R as the root node and real-time risk factors as child nodes. Based on the historical risk event database, the conditional probability P(R|Fi) of the risk event R when each risk factor Fi occurs is calculated. The posterior probability P(R|F) of the risk event R is calculated by Bayes' theorem as the quantification value of the risk factor: ; In the formula, , is all possible states of the risk event; R is the target risk event; Fi is the i-th real-time risk factor; is the joint probability of the risk factor set F when the risk event R occurs; P(R) is the prior probability of the risk event R; P(F) is the total probability of the risk factor set.

[0011] Preferably, when performing dynamic weight distribution, a time decay factor is obtained: ; In the formula, t is the time interval between the current time and the time when the risk event occurs, and a is the decay coefficient, a>0; The initial weight wi and the time decay factor δ(t) are combined to dynamically adjust the real-time weight of each index: ; to ensure that the real-time weight .

[0012] Preferably, when iterative optimization is performed, the risk prediction accuracy ACC of the current system is calculated by the formula The risk prediction accuracy ACC of the current system is calculated by the formula The rule coverage EX in the decision report is obtained, an initial strategy is set, and a state-action value table is initialized. The reward value R is calculated by the formula The reward value R is calculated by the formula The calculated reward value is updated to the Q value by the Q-learning algorithm: ; Wherein, η is the learning rate, which can be 0.1, γ is the discount factor, which can be 0.9, s' is the new state after executing the action, and Q(s,a) is the expected cumulative reward of executing the action a in the state s. The maximum Q value that can be obtained in all possible actions a' for the next state s' is selected. The difference between the current estimated Q value and the actual obtained reward.

[0013] Preferably, when the Q value converges, the optimal action corresponding to the parameter is deployed to the evaluation model and the safety decision module, and the dynamic optimization of system reliability and explainability is completed.

[0014] An intelligent archive information security protection system comprises: An evaluation model construction module is configured to establish an evaluation model comprising sensitive level division, real-time risk factor quantification and dynamic weight distribution based on archive type, access behavior, storage environment and historical risk events. A safety decision module is configured to fuse rule reasoning and machine learning algorithm, extract explicit logical rules in the decision process, and construct a visual decision path tracking mechanism. A dynamic supervision optimization module is configured to iteratively optimize system reliability and explainability through adaptive parameter adjustment strategy and abnormal response strategy based on risk data output by the evaluation model and execution feedback of the safety decision module.

[0015] Compared with the prior art, the present application has the following advantages: The present application realizes initial weight distribution of sensitive level by AHP, quantifies the influence degree of real-time risk factors by Bayesian network, dynamically adjusts the weight by combining time decay factor, and finally constructs a multi-dimensional and dynamically optimized archive information security risk evaluation model, solving the problem that algorithm reliability and explainability cannot be actively supervised and optimized in the prior art.

[0016] This invention provides an explicit logical basis through rule reasoning, uses a machine learning model to quantify risk probabilities and explain key features, fuses multi-source information through DS evidence theory, and finally tracks the decision path through a visual tree diagram, thereby achieving a dual improvement in the explainability and reliability of security decisions, and solving the problems in the existing technology of opaque algorithm decision-making processes and the inability to actively optimize them.

[0017] The present invention achieves a multi-dimensional improvement in risk identification accuracy, decision-making transparency, and system adaptability through closed-loop optimization of adaptive parameter adjustment and abnormal response strategies. It can not only cope with complex scenarios through dynamic parameter adjustment, but also enhance trust through visualization paths, and maintain long-term effectiveness through self-learning mechanisms. It solves the core problems of traditional technologies such as model rigidity, opaque decision-making, and inability to actively optimize, and provides reliable and explainable technical support for the security protection of highly sensitive archives. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The present invention will be further described below with reference to the accompanying drawings.

[0019] Figure 1 This is a flow chart of an intelligent archival information security protection method of the present invention.

[0020] Figure 2 This is a module block diagram of an intelligent archive information security protection system of the present invention. DETAILED DESCRIPTION

[0021] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0022] Example 1, as Figure 1 As shown, the present invention is an intelligent archival information security protection method, comprising: Based on file type, access behavior, storage environment, and historical risk events, an assessment model is established through the assessment model building module, which includes sensitivity level classification, real-time risk factor quantification, and dynamic weight allocation. The specific steps include: Divide the factors affecting archival information security risks into target layer, criterion layer and indicator layer; Among them, the target layer includes the archival information security risk level; The criteria layer includes file types, access behaviors, and storage environments; The indicator layer contains the detailed indicators of each criterion layer; For example: file type (C1): refined into "personnel files (C11)" "financial files (C12)" "technical files (C13)"; Access behavior (C2): refined into "high-frequency access (C21)" "cross-privilege access (C22)" "non-working time access (C23)"; Storage environment (C3): refined into "local physical storage (C31)" "cloud storage (C32)" "hybrid storage (C33)"; The importance of the criterion layer and the index layer is compared by expert scoring method, and a judgment matrix A=(aij)n×n is constructed, where aij represents the importance ratio of the ith index relative to the jth index, taking values from 1 to 9, 1 for equal importance, and 9 for extreme importance; n is the dimension; The maximum eigenvalue λmax and its corresponding eigenvector W of the judgment matrix are calculated by the eigenvector method, and the initial weight wi of each index is obtained after normalization; the initial weight wi satisfies ; The consistency index is calculated , and the random consistency index RI is introduced. If the consistency ratio , the judgment matrix passes the consistency test and the weight is effective; Where the random consistency index is obtained by looking up the table, for example, RI=0.58 when n=3; When quantifying real-time risk factors, take risk event R as the root node, risk events such as unauthorized access and data leakage, and real-time risk factors as child nodes to construct a directed acyclic graph representing the causal relationship between risk factors and risk events; where the real-time risk factors are, for example, access frequency anomaly F1, cross-department access F2, and transmission delay exceeding threshold F3. Based on the historical risk event database, the conditional probability P(R|Fi) of risk event R when each risk factor Fi occurs is calculated; for example, if "access frequency anomaly F1" occurs in the history, the probability of "unauthorized access R" is 80%, then P(R|F1)=0.8.

[0023] The posterior probability P(R|F) of risk event R is calculated by Bayes' theorem as the quantification value of the risk factor: ; where , is the risk event of all possible states, such as occurrence or non-occurrence; R is the target risk event; Fi is the ith real-time risk factor; is the joint probability of risk factor set F when risk event R occurs; P(R) is the prior probability of risk event R; P(F) is the total probability of the risk factor set; When performing dynamic weight allocation, in order to reduce the excessive influence of early risk events on the current evaluation, a time decay factor δ(t) is introduced, which is in the form of: ; wherein t is the time interval between the current time and the time of the risk event, the unit is day, and a is a decay coefficient, a>0, and the specific value is defined and adjusted according to the file security requirements, for example, when a=0.05, it means that the weight decays about 78% after 30 days; The initial weight wi of each index is combined with the time decay factor δ(t) to dynamically adjust the real-time weight of each index : ; and ensure that the real-time weight .

[0024] In the embodiment of the application, the initial weight distribution of the sensitivity level is realized by the analytic hierarchy process, the influence degree of the real-time risk factor is quantified by the Bayesian network, the weight is dynamically adjusted in combination with the time decay factor, and finally a multi-dimensional and dynamically optimized file information security risk evaluation model is constructed, thereby solving the problem that the algorithm reliability and interpretability cannot be actively supervised and optimized in the prior art.

[0025] The security decision module is used to fuse rule reasoning and machine learning algorithm, extract explicit logical rules in the decision process, and construct a visual decision path tracking mechanism; the specific steps include: When constructing the knowledge graph and extracting the rule base, the ontology structure of the knowledge graph is defined according to the file information security specification, including concept class, attribute relationship and instance data; specifically: Concept class: access subject, operation object, permission type, security rule; Among them, the access subject is, for example, employee A and external visitor B; The operation object is, for example, personnel files and financial statements; The permission type is, for example, reading, modifying and deleting; The security rule is, for example, prohibition of cross-department access during non-working hours; Attribute relationship: define the relationships of “having permission”, “operation object” and “violating rules”; Instance data: extract specific instances from historical access logs and file management specifications; for example, employee A has the reading permission of personnel files; Based on the ontology structure, the access subject-permission-operation object triple rule is extracted, and the rule form is: rule={subject, permission, object, trigger condition}; When training the risk prediction model, historical access data such as access time, access frequency, user department and operation type are collected, a feature set X={x1,x2,…,xk} is extracted, for example, x1: number of non-working time access, x2: number of cross-permission operation, and the label y is “safe access (0)” or “risk access (1)”; The contribution degree Φi of the feature xi to the model output is obtained by calculation, and the calculation formula is: ; In the formula, S is a feature subset that does not contain xi; f(S) is the predicted value of the model under the feature subset S; k is the total number of features; |S| is the size of the subset S; For each prediction result, a feature importance report containing the top 3 high-contribution features and their contribution degrees is output; When multi-dimensional result fusion is performed, the rule reasoning result E1 and the model prediction result E2 are taken as two independent evidence sources, and the focal element is defined as Θ={allow access, deny access}; When defining the basic probability assignment m1 of rule reasoning, the rule matching degree and the rule priority need to be combined: for example: The rule R1 (high-risk rule) matching degree=0.9, priority weight=0.6; The rule R2 (medium-risk rule) matching degree=0.7, priority weight=0.3; The rule R3 (low-risk rule) is not triggered, matching degree=0, priority weight=0.1.

[0026] The support degree of the rule to each focal element is calculated by weighted summation: m1(high risk)=0.9×0.6=0.54; m1(medium risk)=0.7×0.3=0.21; m1(low risk)=0×0.1=0; m1(Θ)=1−(0.54+0.21)=0.25; When defining the basic probability assignment m2 of model prediction, the risk probability P is assigned based on: if the model predicts the risk probability as 85%, then m2(deny access)=0.85, m2(Θ)=0.15; The fused basic probability assignment m=m1⊕m2 is calculated by the Dempster combination rule: ; ; Where m(A) is the basic probability assignment of the evidence to the proposition A, and the value range is [0, 1]; K is the conflict coefficient, which indicates that the evidence conflict is acceptable when K<0.8; B and C are the focal elements of m1 and m2, respectively, for example, B=deny access, C=deny access; According to the fused basic probability assignment, the maximum probability proposition is selected as the final decision, for example, m(deny access)=0.92, then deny access, and the rule matching degree and the model key features are noted in the report; When visualizing the decision path tracking, the access request is taken as the root node, and the hierarchical nodes are expanded downward, including the basic information layer, the rule matching layer, the model explanation layer, and the decision conclusion layer; specifically: The basic information layer includes user ID, operation time, and operation object; for example, "user 123, 2025-07-01 22:30, access financial records"; The rule matching layer displays the triggered security rules; for example, "triggered rule 1: non-working time cross-department access"; The model explanation layer shows the high-contribution features and their SHAP values; for example, "cross-privilege access (SHAP=0.7)" and "non-working time access (SHAP=0.5)"; The decision conclusion layer shows the final decision result and the fusion probability; for example, "access denied" and "fusion BPA=0.92"; It needs to be explained that the node hierarchy is: from root to leaf, basic information, rule matching, model explanation, and decision conclusion; Edge labels: label information association, for example, "trigger" and "based on"; Node attributes: include specific numerical values, such as time and SHAP values, or text descriptions, such as rule names.

[0027] In the embodiments of the present application, explicit logical basis is provided through rule reasoning, machine learning model quantifies risk probability and explains key features, multiple source information is fused through D-S evidence theory, and finally the decision path is tracked through visual tree diagram, realizing the dual improvement of explainability and reliability of security decision, and solving the problems of opaque algorithm decision process and inability to actively optimize in the prior art.

[0028] The dynamic supervision optimization module iteratively optimizes the system reliability and explainability based on the risk data output by the evaluation model and the execution feedback of the security decision module through adaptive parameter adjustment strategies and abnormal response strategies; specifically including: Define risk assessment error indicators and decision execution effect indicators and build a feedback index system; Among them, the risk assessment error indicators are used to quantify the prediction reliability of the evaluation model, including: False positive rate FPR: the proportion of normal access incorrectly marked as "risk access" by the evaluation model, calculated by the formula FPR=(false positive times / total number of normal access) x 100%; Among them, the false positive times are the number of times that the evaluation model marks as risk access but is actually normal access; False Negative Rate (FNR): the proportion of risk accesses that are incorrectly labeled as normal accesses by the evaluation model, calculated by the formula FNR=(false negative times / risk access total times) x 100%; wherein, the false negative times are the number of times that the evaluation model labels as normal accesses but are actually risk accesses; Decision execution effect indicators, for quantifying the actual effectiveness of the safety decision module, including: Interception rate (IR): the proportion of risk accesses that are rejected by the system among all risk accesses, calculated by the formula IR=(successfully intercepted risk access times / risk access total times) x 100%; User complaint (AR) rate: the proportion of users who make complaints among all users who are rejected, calculated by the formula AR=(user complaint times / rejected access total times) x 100%; According to the pre-set corresponding threshold value of the file security level, the calculated risk assessment error indicators are compared with the corresponding threshold value for judgment; If there is a risk assessment error indicator greater than the corresponding threshold value, an abnormal report is automatically generated and pushed to the security administrator for processing; When iterative optimization is performed, the risk prediction accuracy ACC of the current system is calculated by the formula The rule coverage EX displayed in the decision report is obtained, for example, the proportion of decisions with a rule matching degree greater than 70%; an initial strategy is set, and a state-action value table is initialized; The reward value R is calculated by the formula ; wherein, c is a balance coefficient of accuracy and explainability, and the value range is (0, 1); The calculated reward value is updated by the Q-learning algorithm to update the Q value: ; ; wherein, η is the learning rate, which can be 0.1, γ is the discount factor, which can be 0.9, and s' is the new state after executing the action; Q(s, a) is the expected cumulative reward of executing action a in state s; is the maximum Q value that can be obtained from all possible actions a' in the next state s'; is the difference between the current estimated Q value and the actual obtained reward; When the Q value converges, that is, the strategy is stable, the parameters corresponding to the optimal action, such as the adjusted weights or rule priorities, are deployed to the evaluation model and the safety decision module, completing the dynamic optimization of system reliability and explainability; ​It should be noted that through the Q-value update formula of Q-learning, the archival information security protection system can dynamically adjust the evaluation model weights or decision rule priorities based on real-time feedback, gradually optimize the reliability and interpretability of the system, and ultimately achieve a closed-loop iteration of active supervision-problem identification-parameter optimization.

[0029] In the embodiment of the present invention, through closed-loop optimization of adaptive parameter adjustment and abnormal response strategy, a multi-dimensional improvement of risk identification accuracy, decision transparency and system adaptability is achieved. It can not only cope with complex scenarios through dynamic parameter adjustment, but also enhance trust through visualization path, and maintain long-term effectiveness through self-learning mechanism. It solves the core problems of model rigidity, opaque decision-making and inability to actively optimize in traditional technologies, and provides reliable and explainable technical support for the security protection of highly sensitive archives.

[0030] Example 2, as Figure 2 As shown, an intelligent archive information security protection system includes: An assessment model building module is used to establish an assessment model that includes sensitivity level classification, real-time risk factor quantification, and dynamic weight allocation based on file type, access behavior, storage environment, and historical risk events; The security decision module is used to integrate rule-based reasoning and machine learning algorithms, extract explicit logical rules of the decision-making process, and build a visual decision path tracking mechanism; The dynamic supervision optimization module is used to iteratively optimize system reliability and explainability through adaptive parameter adjustment strategies and abnormal response strategies based on the risk data output by the assessment model and the execution feedback of the security decision-making module.

[0031] In the several embodiments provided by the present invention, it should be understood that the disclosed system can be implemented in other ways. For example, the embodiments of the invention described above are merely illustrative. For example, the division of modules is only a logical function division, and other division methods may be used in actual implementation.

[0032] Modules described as separate components may or may not be physically separate, and components shown as modules may or may not be physical modules, and may be located in one place or distributed across multiple network modules. Some or all of these modules may be selected to achieve the objectives of this embodiment based on actual needs.

[0033] In addition, the functional modules in various embodiments of the present invention may be integrated into a single processing module, each module may exist physically separately, or two or more modules may be integrated into a single module. The aforementioned integrated modules may be implemented in the form of hardware or hardware plus software functional modules.

[0034] It is apparent for a person skilled in the art that the application is not limited to the details of the exemplary embodiments described above, but that the application can be implemented in other concrete forms without departing from the essential characteristics of the application.

[0035] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application but not to limit the present application, and although the present application has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present application can be modified or equivalently replaced without departing from the spirit and scope of the technical solutions of the present application.

Claims

1. An intelligent archival information security protection method, characterized in that: include: Based on file type, access behavior, storage environment, and historical risk events, an assessment model is established through the assessment model building module, which includes sensitivity level classification, real-time risk factor quantification, and dynamic weight allocation; The security decision module integrates rule-based reasoning and machine learning algorithms to extract explicit logical rules of the decision-making process and build a visual decision path tracking mechanism. The dynamic supervision optimization module is used to iteratively optimize the system reliability and explainability through adaptive parameter adjustment strategy and abnormal response strategy based on the risk data output by the evaluation model and the execution feedback of the security decision module.

2. An intelligent archival information security protection method according to claim 1, characterized in that: When building the assessment model, set initial sensitivity level weights for file type, access behavior, and storage environment; Quantify the probability and impact of real-time risk factors based on the historical risk event database; Introduce a time decay factor to dynamically adjust the weight and reduce the impact of recent risk events on the assessment results.

3. An intelligent archival information security protection method according to claim 2, characterized in that: Build a knowledge graph based on archive management specifications and security standards, and extract a triple rule base containing access subject-authority-operation object; Train the risk prediction model and output feature importance report; Integrate rule reasoning and model prediction results to generate comprehensive decision reports.

4. An intelligent archival information security protection method according to claim 3, characterized in that: The visual decision path tracing mechanism is implemented by constructing a decision tree diagram, in which the nodes contain the basic information of the access request, the rule matching results, the key features predicted by the model, and the final decision conclusion.

5. An intelligent archival information security protection method according to claim 4, characterized in that: The dynamic supervision optimization mechanism includes: Real-time recording of risk prediction errors of the assessment model and the execution effect of the decision-making module; When the risk prediction error exceeds the threshold or the execution effect does not meet the standard, the manual review process is triggered and optimization requirements are generated; Based on feedback data, the weight distribution strategy of the evaluation model and the rule priority of the decision module are adjusted to optimize the balance between system reliability and explainability.

6. An intelligent archival information security protection method according to claim 2, characterized in that: When quantifying real-time risk factors, the risk event R is used as the root node and the real-time risk factor For the child nodes, build a directed acyclic graph; Based on the historical risk event database, calculate the conditional probability P(R|Fi) of risk event R when each risk factor Fi occurs; The posterior probability P(R|F) of the risk event R is calculated by Bayes’ theorem as the quantitative value of the risk factor: Where, , are all possible states of risk events; R is the target risk event; Fi is the i-th real-time risk factor; is the joint probability of the risk factor set F when the risk event R occurs; P(R) is the prior probability of the risk event R; P(F) is the total probability of the risk factor set.

7. An intelligent archival information security protection method according to claim 2, characterized in that: When performing dynamic weight allocation, obtain the time decay factor: ; In the formula, t is the time interval between the current time and the time when the risk event occurs, α is the attenuation coefficient, α>0; Combine the initial weight wi with the time decay factor δ(t) to dynamically adjust the real-time weight of each indicator : ; Ensure real-time weight .

8. An intelligent archival information security protection method according to claim 7, characterized in that: When performing iterative optimization, the formula Calculate the risk prediction accuracy ACC of the current system; where FPR is the false positive rate and FNR is the false negative rate; Obtain the rule coverage EX displayed in the decision report, set the initial strategy, and initialize the state-action value table; By formula Calculate the reward value R; where c is the balance coefficient between accuracy and interpretability, and its value range is (0, 1); The reward value obtained by calculation is updated through the Q-learning algorithm: ； Where η is the learning rate, which can be set to 0.1; γ is the discount factor, which can be set to 0.9; s′ is the new state after the action is executed; Q(s,a) is the expected cumulative reward for executing action a in state s; For the next state s′, select the maximum Q value that can be obtained from all possible actions a′; is the difference between the current estimated Q value and the actual reward obtained.

9. An intelligent archival information security protection method according to claim 8, characterized in that: When the Q value converges, the parameters corresponding to the optimal action are deployed to the evaluation model and safety decision module to complete the dynamic optimization of system reliability and explainability.

10. An intelligent archive information security protection system, characterized in that: include: An assessment model building module is used to establish an assessment model that includes sensitivity level classification, real-time risk factor quantification, and dynamic weight allocation based on file type, access behavior, storage environment, and historical risk events; The security decision module is used to integrate rule-based reasoning and machine learning algorithms, extract explicit logical rules of the decision-making process, and build a visual decision path tracking mechanism; The dynamic supervision optimization module is used to iteratively optimize system reliability and explainability through adaptive parameter adjustment strategies and abnormal response strategies based on the risk data output by the assessment model and the execution feedback of the security decision-making module.

Images