Data security monitoring method and system based on large model, and storage medium

Abstract

The invention provides a data security monitoring method based on a large model, and the method comprises the following steps: collecting multi-modal data assets, and storing the multi-modal data assets to a file server; collecting database storage monitoring data, file storage monitoring data, data source storage monitoring data and data asset access auditing data; identifying and fusing the acquired data by using a multi-modal large model to generate uniform text natural language information, and performing word segmentation processing; training a vertical domain model based on the annotation data, wherein the vertical domain model is used for identifying a sensitive information label, a sensitive level, an audit information label, an abnormal access scene, a memory, a disk and a CPU utilization rate label and storing a prompt result; performing staged optimization on the model parameters, and calculating an efficiency evaluation score based on the evaluation index; constructing a threat intelligence knowledge base and a rectification suggestion base for carrying out association analysis on risks and providing rectification suggestions; and performing data security risk monitoring on the data asset content, the data asset access audit data and the data asset storage data.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of data security, and particularly relates to a data security monitoring method and system based on a large model and a storage medium. BACKGROUND

[0002] At present, the application scene of a large model is mainly knowledge question and answer. In the knowledge question and answer, a reply is made based on a user question. A data security monitoring product is mainly inclined to security monitoring based on a monitoring rule, such as a black and white list monitoring rule, a regular mode monitoring, and the monitoring object is limited to traffic and log information. There is a lack of multi-modal data monitoring and the associated expansion analysis capability of different monitoring object information. When there is a rule loss or an imperfect rule, a monitoring result cannot be obtained, and an automatically generated rectification suggestion information cannot be obtained. SUMMARY

[0003] The application aims to provide a data security monitoring method and system based on a large model and a storage medium to solve the problems in the prior art.

[0004] In order to achieve the above-mentioned purpose, a data security monitoring method based on a large model comprises the following steps:

[0005] Data collection, collection of multi-modal data assets, including document, video, audio, picture type data and attribute information, storage to a file server; collection of database storage monitoring data, file storage monitoring data, data source storage monitoring data, and data asset access audit data;

[0006] Data processing, using a multi-modal large model to identify and fuse the collected data, generating unified text natural language information, and performing word segmentation processing; storing the generated multi-modal fusion data assets and data asset access audit data in a graph database;

[0007] Model training, training of a vertical domain model based on labeled data, including a multi-modal vertical domain model and a log analysis vertical domain model, for identifying sensitive information labels, sensitive levels, audit information labels, abnormal access scenarios, and memory, disk, CPU usage labels, and storage prompt results;

[0008] Large model parameter optimization and evaluation, stage-by-stage optimization of model parameters, preliminary screening and key optimization to improve model related indicators, and performance evaluation score calculation based on evaluation indicators;

[0009] Knowledge base construction, construction of a threat intelligence knowledge base and a rectification suggestion base for associated analysis of risks and provision of rectification suggestions;

[0010] Security monitoring, data security risk monitoring on data asset content, data asset access audit data and data asset storage data, output risk alarm score and rectification suggestion;

[0011] S7, result output, generate data asset risk three-dimensional portrait and monitoring report.

[0012] Further, the multi-modal large model is Qwen2.5-Omni-7B model.

[0013] Further, the parameter tuning includes:

[0014] Preliminary screening: based on model historical training data, automatically mark importance score, based on multiple training, adjust different parameters each time, system records corresponding different evaluation effect under different parameters, based on evaluation score to determine the relevance of parameters;

[0015] Key optimization: focus on key parameter combination, improve model response speed and accuracy.

[0016] Further, the correlation calculation formula of the parameter is:

[0017]

[0018] Wherein,

[0019] r i : the correlation of parameter x i and index y;

[0020] w j : weight factor, which can be used to emphasize the influence of recent experiments or high confidence experiments;

[0021] X i,j : sample point;

[0022] The mean of parameter x i ; The mean of variable y;

[0023] The mean of variable y;

[0024] y j : each sample point;

[0025] r i The closer to 1, the stronger the correlation between the parameter and the index;

[0026] r i Close to 0, indicating that the relationship is not significant.

[0027] Further, the data security risk is divided into single data asset comprehensive risk and overall data asset comprehensive risk;

[0028] The single data asset comprehensive risk calculation formula is:

[0029] R 单 = A i ×(V i + D i )×((C i × W i ).

[0030] wherein,

[0031] A i : represents the data asset value, which can be determined according to the importance of the data asset to the business, the commercial value, and the level of the data asset itself;

[0032] V i : represents the data asset access audit risk value, which is evaluated according to the frequency of occurrence of different types of risks and the degree of harm to the data asset;

[0033] D i : represents the data asset storage risk value;

[0034] C i : represents the data asset vulnerability value, which is obtained based on the vulnerability information corresponding to the associated vulnerability risk score carried by the attribute information of the data asset. The vulnerability value is determined according to the severity of the security vulnerabilities existing in the data asset and the repair difficulty, etc.

[0035] W i : represents the weight of the corresponding factor, which reflects the relative importance of each factor in risk assessment;

[0036] The overall data asset comprehensive risk formula is:

[0037]

[0038] wherein,

[0039] k: represents a normalization coefficient, which is used to control the risk value within a reasonable range. The initial k value is N;

[0040] N: represents the number of data assets;

[0041] i: represents the i-th data asset.

[0042] Further, the graph database uses an open-source graph database HugeGraph, and the graph structure thereof includes nodes and relationships. Each node represents a knowledge unit, and the relationship represents the logical association between knowledge units.

[0043] Further, the threat intelligence knowledge base is used to centrally store, classify and manage security threat information from internal and external, including attack features, malicious samples, IP / domain name reputation, attack patterns (TTPs), vulnerability information, etc., to provide data support for security analysis, detection and response, and the threat intelligence provides knowledge services for big model-based audit log analysis, and threat intelligence is generated based on big model correlation audit logs.

[0044] The application further provides a big model-based data security monitoring system, the system comprising:

[0045] A data collection module is configured to acquire multi-modal data assets, data asset storage monitoring data and data asset access audit data, and realize data collection and data storage.

[0046] A data processing module is configured to process the collected multi-modal data to generate unified text natural language information, and store the generated multi-modal fusion data assets, data asset access audit data and storage monitoring data in a graph database.

[0047] A model training module is configured to select a vertical model for training, train a multi-modal vertical model and a log analysis vertical model based on labeled data, and identify labeled information.

[0048] A big model parameter optimization and evaluation module is configured to optimize the model parameters, improve the model effect through preliminary screening and key optimization, and calculate the performance evaluation score based on the evaluation index.

[0049] A knowledge base construction module is configured to construct a threat intelligence library and a rectification suggestion library management function, to perform correlation analysis of risks and provide rectification suggestions for the security monitoring process.

[0050] A security monitoring module is configured to monitor the risks of data asset content, data asset access audit data and data asset storage data, and output the monitored risk results and corresponding solutions.

[0051] A result output module is configured to generate a data asset risk three-dimensional portrait and a downloadable multi-type monitoring report.

[0052] Further, the result output module supports one-key generation of a monitoring report in Word or PDF format.

[0053] The application further provides a computer readable storage medium storing computer program instructions, and the computer program instructions are run by a computer, and the computer executes the steps of the big model-based data security monitoring method.

[0054] By adopting the above technical solution, the application has the following beneficial effects:

[0055] 1、The application introduces data security monitoring based on large models, which can be applied in different vertical fields based on different sub-models in large models, including multi-modal data processing capability and security monitoring capability. Based on the large model capability, the monitoring of data asset content data, data asset storage data and data asset access audit data is realized, and the correlation analysis and calculation of monitoring information are realized to generate data asset monitoring results and three-dimensional portrait information. The problem of single data security monitoring capability and inability to perform data correlation analysis and calculation is solved, and the monitoring efficiency and quality are improved.

[0056] 2、Model parameter optimization in stages, improving parameter optimization efficiency and quality, preliminary screening: based on model historical training data, automatically mark importance score, based on multiple training, adjust different parameters each time, system records different parameters under different evaluation effects, based on evaluation score to determine the relevance of parameters. Key optimization: through screening and calculation, focusing on key parameter combination, improving core index capability. BRIEF DESCRIPTION OF DRAWINGS

[0057] In order to more clearly illustrate the specific embodiments of the present application or the technical solutions in the prior art, the drawings needed in the description of the specific embodiments or the prior art will be briefly introduced. Obviously, the drawings in the following description are some embodiments of the present application, and those skilled in the art can obtain other drawings according to these drawings without creative labor.

[0058] Figure 1 Flowchart of the data security monitoring method based on large models of the present application;

[0059] Figure 2 Complete process of data acquisition, processing, monitoring and result output of the present application;

[0060] Figure 3 Flowchart of multi-modal data processing of the present application;

[0061] Figure 4 Model parameter optimization and evaluation flowchart of the present application;

[0062] Figure 5 Data security monitoring flowchart of the present application;

[0063] Figure 6 Data asset sensitive information flowchart of the present application;

[0064] Figure 7 Access audit log monitoring flowchart of the data asset of the present application;

[0065] Figure 8A storage information monitoring flowchart of the data asset of the present application is shown in the figure;

[0066] Figure 9 A large model-based data security monitoring system of the present application is shown in the figure. DETAILED DESCRIPTION

[0067] The technical solutions of the present application will be described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the present application.

[0068] In combination Figure 1 The present application provides a large model-based data security monitoring method, which comprises the following steps:

[0069] S1, data acquisition, acquiring multi-modal data assets including documents, videos, audios, picture type data and attribute information, and storing them in a file server; acquiring database storage monitoring data, file storage monitoring data, data source storage monitoring data, and data asset access audit data;

[0070] S2, data processing, using multi-modal large models to identify and fuse the collected data, generating unified text natural language information, and performing word segmentation processing; storing the generated multi-modal fusion data assets and data asset access audit data in a graph database;

[0071] S3, model training, training vertical models based on labeled data, including multi-modal vertical models and log analysis vertical models, for identifying sensitive information labels, sensitive levels, audit information labels, abnormal access scenarios, and memory, disk, CPU usage labels, and storage prompt results;

[0072] S4, large model parameter optimization and evaluation, optimizing the model parameters in stages, improving the model-related indicators through preliminary screening and key optimization, and calculating the performance evaluation score based on the evaluation indicators;

[0073] S5, knowledge base construction, constructing a threat intelligence knowledge base and a rectification suggestion library for correlated analysis of risks and providing rectification suggestions;

[0074] S6, security monitoring, monitoring the data security risks of data asset content, data asset access audit data, and data asset storage data, outputting risk alarm scores and rectification suggestions;

[0075] S7, result output, generating a data asset risk three-dimensional portrait and a monitoring report.

[0076] It should be noted that the data asset content data collection: offline data assets are collected by manual or automatic means, and the collected multi-modal data assets include documents, videos, audio, picture types, and related attribute information, and are transmitted to an FTP server for storage. Based on the file server, it is divided into four categories of document, video, audio, and picture directories for storage.

[0077] Based on the database collection engine, relational databases and non-relational databases are collected, including attribute information. The collected data assets are transmitted to the data asset management platform through the KAFKA message queue to support subsequent analysis.

[0078] Data asset storage data collection, including database storage monitoring data, file storage monitoring data, and data source storage monitoring data.

[0079] The database storage monitoring data is collected using Prometheus+exporter tools. Different databases are installed and configured with database exporter. Prometheus and database exporter are started. The collected storage performance data is stored in the server in key / value format.

[0080] File storage monitoring data and data source storage monitoring data are collected through Prometheus+Node Exporter. The target storage environment is installed with Node Exporter. After starting Prometheus and Node Exporter, the performance data is stored in the performance data server in key / value format.

[0081] During the collection of data assets, the attribute information of the data assets will also be collected. The attribute information includes but is not limited to data asset category, level, business information, vulnerability information, etc.

[0082] Data asset access audit data collection, data asset access audit logs, including file access audit logs, database access audit logs, etc.

[0083] Through the log collection engine, database audit logs, file access audit logs, and other audit logs are collected through API interfaces, syslog, etc. and stored in the audit log data server in JSON format.

[0084] Specifically, the multi-modal large model is Qwen2.5-Omni-7B model.

[0085] Using Qwen2.5-Omni-7B as an open-source multi-modal large model, compared with multi-modal large models such as OpenGPT-4o, the comprehensive risk shows a slight advantage in multi-modal capabilities (tables, documents, audio, video, etc.), task applicability (excellent performance in tasks that require the combination of visual information and textual information for understanding and reasoning, such as mathematical visual problem solving, chart analysis and interpretation, visual question answering, etc., especially in structured data understanding tasks such as tables, documents, UI, etc.), performance, open source, and customization.

[0086] Therefore, based on Qwen2.5-Omni-7B as an open-source large model, multi-modal data assets are identified respectively, and unified text natural language information is generated after identification. The text natural language information generated by the multi-modal is fused, and the text natural language information of the fused multi-modal is supported for word segmentation processing. The process of this model for multi-modal data processing is shown in Figure 3 .

[0087] Finally, based on the multi-modal large model, the multi-modal data assets are fused to generate summary text natural language, and key word segmentation is extracted.

[0088] For model training:

[0089] 1. Apply large models for model training, prepare different types of vertical models, including multi-modal vertical models for different modal data processing, and log analysis vertical models based on collected logs for analysis. Finally, the results generated by the vertical models are uniformly processed.

[0090] 2. Data labeling preparation

[0091] ① Data asset sensitive content data labeling:

[0092] Text natural language labeling: using semantic labeling, also known as semantic tagging, a task that associates words, phrases, or sentences in text or language data with specific meanings or semantic information, providing richer, more structured semantic understanding and expression for text.

[0093] A. Example of labeling text sample data:

[0094]

[0095] B. Example of labeling image sample data, the red box part is labeled:

[0096] Image (shape annotation) Label Sensitive level Annotate the content of the citizen ID number in the ID card with a red box ID card Sensitive Annotate the content of the name in the ID card with a red box Name Sensitive Annotate the content of the address in the ID card with a red box Home address Sensitive Annotate the content of the issuing authority in the ID card with a red box Public Security Bureau Not sensitive

[0097] C. Speech labeling:

[0098] Speech-to-Text (STT) labeling implements the labeling of voice information, and the data is labeled in text, that is, the voice signal is converted into the corresponding text content. Python commonly used SpeechRecognition library can perform voice recognition through Google WebSpeechAP, CMU Sphinx, etc. Usually, SpeechRecognition is used for voice-to-text labeling, and the labeling sample is the same as A.

[0099] ②Data asset access audit data labeling:

[0100]

[0101] ③Data asset storage data labeling:

[0102]

[0103] 3. Initialize the parameters of the question and answer model, including reducing the number of network layers, the number of neurons in each layer, the selection of activation function, learning rate, and regularization parameter to reduce the consumption of computing resources; To improve the evaluation accuracy, set the hyperparameters, including learning rate, regularization parameter, network structure parameter, optimizer parameter, and data enhancement parameter.

[0104] Initial training based on sample data labeling data, including content data labeling training, obtaining the recognition of multi-modal sensitive information label and sensitive level; access audit labeling information training, obtaining audit information label and access abnormal scene; storage information labeling training, obtaining memory, disk, cpu usage label and storage prompt result.

[0105] Model parameter tuning and evaluation, see Figure 4 Model parameter tuning in stages:

[0106] The trained model is tuned in stages, and the construction of large model parameter tuning is a complex task mechanism with multiple objectives and multiple variables. The tuning strategy should be developed according to the actual business requirements and deployment environment.

[0107] Due to the large consumption of computing resources, slow response speed, and inaccurate information output during model training, batch parameter tuning is required. This includes optimizing the number of layers and neurons in the model to improve response speed, adjusting attention mechanism parameters; Simplify the number of network layers and neurons, select appropriate activation function, learning rate and regularization parameter to reduce resource consumption; At the same time, adjust the learning rate, regularization parameter, network structure parameter, optimizer parameter, data enhancement parameter and other hyperparameters to improve the evaluation accuracy.

[0108] Large model performance evaluation is based on different evaluation indicators

[0109] Evaluation index Index description Accuracy One of the basic indicators for measuring the correctness of the model's prediction results. Precision The proportion of actual positive samples in the results predicted as positive. Recall The proportion of correctly identified samples among actual positive samples. ......

[0110] Performance Evaluation Score = w1*E + w2*P + w3*R +... (w1 + w2 + w3 +... = 1)

[0111] where,

[0112] E represents the accuracy evaluation index.

[0113] P represents the precision evaluation index.

[0114] R represents the recall evaluation index.

[0115] w i represent the weights corresponding to each index, which need to be adjusted according to the specific application scenario.

[0116] Accuracy:

[0117] Accuracy = (True Positives (TP) + True Negatives (TN)) / Total Predictions

[0118] True Positives (TP): the number of correctly predicted positive classes.

[0119] True Negatives (TN): the number of correctly predicted negative classes.

[0120] Total Predictions: the total number of samples.

[0121] Precision: Precision = TP / (TP + False Positives (FP))

[0122] TP: actual positive class, model prediction is also positive class;

[0123] False Positives (FP): the number of non-positive class samples

[0124] Recall: Recall = TP / (TP + False Negatives (FN))

[0125] TP: actual positive class, model prediction is also positive class sample number;

[0126] False Positives (FP): actual positive class, but model prediction is negative class sample number;

[0127] Specifically, the parameter tuning includes:

[0128] Preliminary screening: Based on the model historical training data, an importance score is automatically assigned. Based on multiple training, different parameters are adjusted each time, and the system records the corresponding different evaluation effects under different parameters. Based on the evaluation score, the relevance of the parameters is determined.

[0129] Key optimization: Focus on key parameter combinations to improve model response speed and accuracy.

[0130] Specifically, the correlation calculation formula of the parameters is:

[0131]

[0132] Wherein,

[0133] r i : the relevance of parameter x i to index y;

[0134] w j : weight factor, which can be used to emphasize the influence of recent experiments or high confidence experiments;

[0135] X i,j : sample point;

[0136] the mean of parameter x i ;

[0137] the mean of variable y;

[0138] y j : each sample point;

[0139] r i closer to 1, the stronger the relevance of the parameter to the index;

[0140] r i close to 0, indicating that the relationship is not significant.

[0141]

[0142] Specifically, the data security risk is divided into single data asset comprehensive risk and overall data asset comprehensive risk.

[0143] The calculation formula of the single data asset comprehensive risk is:

[0144] R 单 = A i ×(V i +D i )×((C i ×W i );

[0145] A irepresents the value of the data asset, which can be determined according to the importance of the data asset to the business, the commercial value, and the level of the data asset itself;

[0146] V i represents the risk value of data asset access audit, which is evaluated according to the frequency of different types of risks and the degree of harm to the data asset;

[0147] D i represents the risk value of data asset storage;

[0148] C i represents the vulnerability value of the data asset, which is obtained based on the vulnerability information carried by the attribute information of the data asset and the corresponding vulnerability risk score associated with the vulnerability information. The vulnerability value is determined according to the severity of the security vulnerabilities existing in the data asset and the difficulty of repair.

[0149] W i represents the weight of the corresponding factor, which reflects the relative importance of each factor in risk assessment;

[0150] i: represents the ith data asset.

[0151] Overall data asset comprehensive risk:

[0152]

[0153] wherein,

[0154] k: represents the normalization coefficient, which is used to control the risk value within a reasonable range. The initial k value is N.

[0155] N: represents the number of data assets;

[0156] Specifically, the graph database uses the open source graph database HugeGraph, and the graph structure thereof includes nodes and relationships. Each node represents a knowledge unit, and the relationship represents the logical association between knowledge units.

[0157] Based on the multi-modal fusion data asset and data asset access audit data generated in the above, they can be stored in the graph database. In order to improve the association effect, the system uses the open source graph database HugeGraph, and the graph structure thereof includes nodes and relationships. Each node represents a knowledge unit, and the relationship represents the logical association between knowledge units.

[0158] Specifically, the threat intelligence knowledge base is used to centrally store, classify and manage security threat information from inside and outside, including attack features, malicious samples, IP / domain name reputation, attack patterns (TTPs), vulnerability information, etc., to provide data support for security analysis, detection and response. Threat intelligence provides knowledge services for audit log analysis based on large models, and generates threat intelligence based on large model correlation of audit logs.

[0159] Information type Explanation IP reputation Internet access IP IOC information IP, domain name, URL Email information Phishing email Vulnerability information Database, host, and other vulnerability information

[0160] The rectification suggestion library is constructed by systematically collecting, classifying and managing repair suggestions for various security problems, helping the large model to respond quickly and accurately, and improving the overall risk governance capability.

[0161]

[0162]

[0163] For security monitoring, see Figure 5 The data security monitoring process is shown in the schematic diagram,

[0164] 1. User three types of data collection and storage

[0165] ① Data asset content: video, audio, file, picture data asset collection and server storage, relational database, non-relational database collection and storage.

[0166] ② Data asset storage data: including database storage monitoring data, file storage monitoring data, data source storage monitoring data.

[0167] ③ Data asset access audit data: database asset access audit log, including file asset access audit log.

[0168] 2. Large model for data security risk monitoring

[0169] See Figure 6 The data asset sensitive information monitoring

[0170] For monitoring of data asset sensitive information, if the large model learns the sample data, match based on the learned sample data, when matching the learned sample data, output the label and sensitive level of the monitored data, and find the rectification suggestion in the rectification suggestion library based on the label, when finding the corresponding rectification suggestion, output the rectification suggestion.

[0171] When facing new samples, the large model mode matches and infers the sensitive data level and rectification suggestions through the ability of probability prediction. When the rectification suggestion library information is missing, the large model starts the query solution mechanism, and the data source of multi-modal search solution includes connecting the Internet and local knowledge base for network search and deep thinking to obtain summary suggestions.

[0172] The data asset value formula is as follows:

[0173] A i =S i *L i +D i *M i

[0174] Wherein,

[0175] A i : data asset value, which can be determined according to the importance of data asset to business, business value, and data asset level, etc.;

[0176] S i : sensitive information coefficient, which is determined according to whether the data asset contains sensitive information. If the data asset contains sensitive information such as personal privacy information (name, ID number, phone number, etc.), business secrets (company financial data assets, core business strategies, etc.), the coefficient is higher, and the general sensitive information coefficient can be taken between 0-1. For example, the data asset contains highly sensitive personal medical records, and the coefficient can be taken as 0.9; if it is ordinary product introduction information, the coefficient is 0.1.

[0177] L i： Data asset level weight, usually data asset level is divided into different levels, such as top secret, secret, secret, public, etc. The weight of top secret data asset is the highest, assuming that the weight of top secret is 0.6, the weight of secret is 0.4, the weight of secret is 0.2, and the weight of public is 0. According to the level of data asset, the corresponding weight is given.

[0178] D i： Data asset business value weight, which involves the criticality of data asset to business. According to the important level corresponding to the data asset, the corresponding weight coefficient is generated.

[0179] Business importance Weight coefficient Core system 1 Key system 0.98 Important system 0.8 General system 0.6 Simple system 0.3

[0180] M i Data asset usage frequency weight, calculate the usage frequency of data asset in a certain period (such as the number of times of use per month). Data assets with high usage frequency are often more important. For example, a database of inventory data assets is queried many times a day, and the usage frequency weight is 0.7, while a historical file rarely accessed, the weight is 0.1.

[0181] Referring to Figure 7 The access audit log of the data asset is monitored

[0182] The access audit data of the data asset is monitored, the model learns threat intelligence information, if the large model learns and trains sample data, matching is performed based on the learned sample data, when the learned sample data is matched, a label and an abnormal result of the monitored data are output, and a rectification suggestion is searched in a rectification suggestion library based on the label, when the corresponding rectification suggestion is searched, the rectification suggestion is output.

[0183] The large model matches the purpose IP address of the access audit log with the IOC threat intelligence, and matches the source IP address with the IP reputation threat intelligence, based on the risk level and the confidence parameter of the threat intelligence, the risk value of the matched access audit log is calculated.

[0184] The confidence and risk score are the lowest score in the initial threat intelligence of different levels, based on the risk occurrence frequency and manual research and judgment, the confidence score and risk level score are gradually increased by 1 point each time, and the highest score is 100 points.

[0185] Threat intelligence risk level Threat intelligence confidence Threat intelligence impact interval High 0.8-1 0.80～1 Medium 0.61～0.79 0.61～0.79 Low 0.1～0.60 0.61～0.79

[0186] The access audit risk formula is as follows:

[0187] R 访问审计 = 100(β·(I×C) γ +(1-β)(X) / max(X))

[0188] Wherein,

[0189] β: control the balance weight between hazard and anomaly (0≤β≤1).

[0190] γ: exponential amplification factor (γ≥1), used to amplify the influence of high Impact×Confidence.

[0191] max(X): used to normalize the anomaly score to [0,1].

[0192] I: Impact, threat intelligence impact.

[0193] C: Confidence, threat intelligence confidence.

[0194] X: access anomaly score.

[0195] When facing new samples, the large model performs inference through pattern matching and probability prediction ability to obtain abnormal results and rectification suggestions. When the rectification suggestion library information is missing, the large model starts the query solution mechanism, and the data sources for searching for solutions in multiple modes include connecting the Internet and searching the local knowledge base to obtain summary suggestions through networking search and deep thinking.

[0196] Referring to Figure 8 The storage information of the data asset is monitored

[0197] The storage information is monitored. If the large model learns the sample data, matching is performed based on the learned sample data. When the learned sample data is matched, the label and prompt result of the monitored data are output, and the rectification suggestion is searched in the rectification suggestion library based on the label. When the corresponding rectification suggestion is found, the rectification suggestion is output.

[0198] When facing new samples, the large model performs inference through pattern matching and probability prediction ability to obtain prompt results and rectification suggestions. When the rectification suggestion library information is missing, the large model starts the query solution mechanism, and the data sources for searching for solutions in multiple modes include connecting the Internet and searching the local knowledge base to obtain summary suggestions through networking search and deep thinking.

[0199] D 存储 = large model output data asset storage risk score

[0200] The data asset comprehensive risk calculation is described above.

[0201] Referring to Figure 9 The application also provides a data security monitoring system based on a large model, as shown in the accompanying drawings, the system comprises:

[0202] A data acquisition module is configured to acquire multi-modal data assets, data asset storage monitoring data, and data asset access audit data, and realize data collection and storage.

[0203] A data processing module is configured to process the collected multi-modal data to generate unified text natural language information, and store the generated multi-modal fusion data assets, data asset access audit data, and storage monitoring data in a graph database.

[0204] A model training module is configured to select a vertical model for training, train a multi-modal vertical model and a log analysis vertical model based on labeled data, and identify labeled information.

[0205] A large model parameter optimization and evaluation module is configured to optimize the model parameters, improve the model effect through preliminary screening and key optimization, and calculate the performance evaluation score based on the evaluation index.

[0206] A knowledge base construction module is configured to construct a threat intelligence base and a rectification suggestion base management function, to perform correlation analysis risk for a security monitoring process and provide rectification suggestions;

[0207] A security monitoring module is configured to monitor risk of data asset content, data asset access audit data and data asset storage data, and output monitored risk results and corresponding solutions;

[0208] A result output module is configured to generate a data asset risk three-dimensional portrait and a downloadable multi-type monitoring report.

[0209] Specifically, the result output module supports one-key generation of a monitoring report in a Word or PDF format

[0210] The application further provides a computer readable storage medium, which stores computer program instructions, and when the computer program instructions are run by a computer, the computer executes the steps of the data security monitoring method based on a large model.

[0211] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present application, and not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that: it can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacement for part or all of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A data security monitoring method based on a large model, characterized in that: The method comprises the following steps: S1, data collection, collects multimodal data assets, including documents, videos, audio, and images, and their attribute information, and stores them in file servers; collects database storage monitoring data, file storage monitoring data, data source storage monitoring data, and data asset access audit data; S2, data processing, uses a multimodal large model to identify and fuse the collected data, generate unified text natural language information, and perform word segmentation processing; the generated multimodal fusion data assets and data asset access audit data are stored in the graph database; S3, model training, trains vertical domain models based on labeled data, including multimodal vertical domain models and log analysis vertical domain models, used to identify sensitive information labels, sensitivity levels, audit information labels, abnormal access scenarios, and memory, disk, and CPU usage labels, as well as storage prompt results; S4, large model parameter tuning and evaluation, which involves tuning model parameters in stages, improving model-related indicators through preliminary screening and key optimization, and calculating performance evaluation scores based on evaluation indicators; S5, knowledge base construction, builds a threat intelligence knowledge base and rectification suggestion library to correlate and analyze risks and provide rectification suggestions; S6, security monitoring, monitors data security risks of data asset content, data asset access audit data, and data asset storage data, and outputs risk warning scores and rectification suggestions; S7, output the results and generate a three-dimensional portrait and monitoring report of data asset risks.

2. The method according to claim 1, characterized in that The multimodal large model is the Qwen2.5-Omni-7B model.

3. The method according to claim 1, characterized in that The parameter tuning includes: Initial screening: Automatically assign importance scores based on historical model training data. Through multiple training sessions, different parameters are adjusted each time. The system records the corresponding evaluation results under different parameters and determines the relevance of the parameters based on the evaluation scores. Key optimization: Focus on key parameter combinations to improve model response speed and accuracy.

4. The method according to claim 3, characterized in that The correlation calculation formula of the parameters is: in, r i : parameter x i Correlation with indicator y; w j : Weight factor, which can be used to emphasize the impact of recent experiments or high-confidence experiments; X i,j : sample point; Parameter x i The mean of The mean of variable y; y j : Each sample point; r i The closer it is to 1, the stronger the correlation between the parameter and the indicator; r i Close to 0, indicating that the relationship between the two is not significant.

5. The method according to claim 1, wherein The data security risks are divided into comprehensive risks of individual data assets and comprehensive risks of overall data assets; The formula for calculating the comprehensive risk of a single data asset is: R 单 =A i ×(V i +D i )×((C i ×W i ); in, A i : Indicates the value of data assets. The value of data assets can be determined based on the importance of data assets to the business, commercial value, and the level of the data assets themselves; V i : Represents the data asset access audit risk value, which is determined based on the frequency of occurrence of different types of risks and the degree of harm they cause to data assets; D i : Indicates the data asset storage risk value; C i : Indicates the vulnerability value of data assets. The vulnerability information carried in the data asset attribute information is collected, and the vulnerability risk score associated with the vulnerability information is calculated to obtain the vulnerability value of the data asset. The vulnerability value is determined based on the severity of the security vulnerabilities in the data asset and the difficulty of repairing them. W i : Indicates the weight of the corresponding factor, which reflects the relative importance of each factor in risk assessment; The formula for calculating the comprehensive risk of overall data assets is: in, k: represents the normalization coefficient, which is used to control the risk value within a reasonable range. The initial k value is N; N: represents the number of data assets; i: represents the i-th data asset.

6. The method according to claim 1, characterized in that The graph database described in S2 uses the open source graph database HugeGraph, whose graph structure includes nodes and relationships. Each node represents a knowledge unit, and the relationship represents the logical association between knowledge units.

7. The method according to claim 1, characterized in that The threat intelligence knowledge base described in S5 is used to centrally store, classify and manage security threat information from internal and external sources, including attack characteristics, malicious samples, IP / domain name reputation, attack patterns (TTPs), vulnerability information, etc., to provide data support for security analysis, detection and response. Threat intelligence provides knowledge services for audit log analysis based on large models, and generates threat intelligence based on the association of audit logs with large models.

8. A data security monitoring system based on a large model, characterized in that: The system comprises: The data collection module is used to obtain multimodal data assets, as well as data asset storage monitoring data and data asset access audit data, so as to realize the storage of collected data; The data processing module is used to process the collected multimodal data and generate unified text natural language information; and store the generated multimodal fusion data assets, data asset access audit data and storage monitoring data in the graph database; The model training module is used to select vertical domain models for training, train multimodal vertical domain models and log analysis vertical domain models based on labeled data, and identify labeled information; Large model parameter tuning and evaluation module, used to tune model parameters, improve model performance through preliminary screening and key optimization, and calculate performance evaluation scores based on evaluation indicators; The knowledge base construction module is used to build a threat intelligence library and a rectification suggestion library management function, and to analyze risks and provide rectification suggestions for the security monitoring process; The security monitoring module is used to monitor the risks of data asset content, data asset access audit data, and data asset storage data, and output the monitored risk results and corresponding solutions; The result output module is used to generate a three-dimensional portrait of data asset risks and download multiple types of monitoring reports.

9. The system according to claim 8, characterized in that The result output module supports one-click generation of monitoring reports in Word or PDF format.

10. A computer-readable storage medium storing computer program instructions, wherein when the computer program instructions are executed by a computer, the computer executes the steps of the large model-based data security monitoring method according to any one of claims 1 to 7.

Images