A method for secure cross-network data exchange

Abstract

This invention discloses a method for secure cross-network data exchange, relating to the field of network security. The method includes: collecting raw data from an external network database; performing security processing operations on the raw data to obtain data to be transmitted; and transmitting the data to be transmitted to an internal network database based on several exchange nodes. This invention significantly improves the overall reliability and smoothness of cross-network data exchange by dynamically monitoring network and node status and optimizing transmission paths in real time. After transmission failure, it automatically diagnoses the cause and accurately selects a new path for recovery. At the same time, it greatly reduces the risk of interruption caused by network fluctuations, node failures, or data contamination, making the data transmission process more stable, timely, and easier to recover.

Description

Technical Field

[0001] This invention relates to the field of network security, and more specifically, to a method for secure cross-network data exchange. Background Technology

[0002] In information technology infrastructure development, due to the diverse types of business and varying levels of data sensitivity, organizations generally adopt a multi-network approach to protect the security of critical data and application systems. This results in various network zones such as intranets, extranets, private networks, office networks, production networks, the internet, mobile networks, and frequency networks, used to handle different business processes or store data of varying sensitivity. These different network zones are often isolated, hindering data flow and sharing. With the development of computer and network technologies, the demand for cross-industry, cross-departmental, and cross-application data flow and sharing is increasingly strong. However, cross-network data exchange also faces the challenge of ensuring information security during cross-network exchanges.

[0003] Existing cross-network data exchange methods often lack sophisticated real-time monitoring. When node failures or network signal quality deterioration occur in the transmission path, severely impacting data transmission, the system often fails to automatically detect the fault location and its impact range, making rapid and accurate automatic responses difficult. Typically, recovery attempts rely on timeout retransmission mechanisms or manual intervention, which can easily lead to data transmission interruptions, increased latency, or even data loss, severely affecting business continuity and service reliability. Summary of the Invention

[0004] The purpose of this invention is to enable adaptive adjustment of the path based on faults and network conditions during data transmission, so as to ensure high reliability and continuous connectivity in the data exchange process.

[0005] To achieve the above objectives, the present invention provides a method for secure cross-network data exchange, the method comprising:

[0006] Data Acquisition: Collect raw data from an external network database;

[0007] Security processing: Perform security processing operations on the raw data to obtain the data to be transmitted;

[0008] Data exchange: The data to be transmitted is transmitted to the intranet database based on several exchange nodes;

[0009] The step of transmitting the data to be transmitted to the intranet database based on several switching nodes includes:

[0010] Configure node transmission paths based on the original data source, target network area, and / or switching priority, and use the node transmission paths to transmit the data to be transmitted;

[0011] During transmission, the health indicators of the switching nodes on the transmission path of the node are obtained through multi-health dimension calculation, and the network signal indicators of the switching nodes on the transmission path of the node are obtained based on heartbeat signal analysis.

[0012] The node transmission path is dynamically adjusted based on the health indicators or the network signal indicators.

[0013] This invention overcomes the limitations of static path configuration by intelligently generating the optimal or most secure initial transmission path for each data stream during data exchange by analyzing the trust level of the original data source, the security policy requirements of the target network area, and the real-time priority of the exchange task. Simultaneously, this invention employs a dual-dimensional real-time sensing system: on the one hand, it performs multi-dimensional health calculations on key exchange nodes along the transmission path, dynamically generating health indicators reflecting the node's operational status; on the other hand, it continuously collects and analyzes heartbeat signals between nodes to capture network signal indicators of the transmission link. If either indicator becomes abnormal, a dynamic path adjustment strategy is triggered, generating a new node transmission path to avoid the risk of data loss or transmission interruption due to node failure or network deterioration, ensuring the success rate and continuity of data transmission.

[0014] Furthermore, the step of transmitting the data to be transmitted to the intranet database based on several switching nodes also includes:

[0015] Assign a transaction ID to each transmission, and track the status data of this transmission based on the transaction ID;

[0016] If the transmission fails, the cause of the failure will be analyzed using an intelligent fault detection model based on the status data.

[0017] Based on the reason for the failure, the node transmission path is regenerated, and the data to be transmitted is transmitted again based on the newly generated node transmission path.

[0018] This invention introduces a transactional tracking and intelligent path self-healing mechanism. It assigns a unique transaction ID to each transmission, binds and records multi-dimensional status data of path nodes in real time, and constructs a traceable transmission behavior profile. When a transmission fails, a pre-trained intelligent fault detection model performs multi-feature fusion analysis on all status data associated with the transaction ID to accurately identify the cause of the failure. Then, a new transmission path is reconstructed based on the cause of the failure, triggering data retransmission. This solution significantly eliminates the randomness of traditional blind retransmission, effectively improves the accuracy of fault diagnosis, reduces fault investigation time, and ensures smooth data transmission.

[0019] Furthermore, the switching node includes:

[0020] Control layer switching nodes are used to transmit request, response, and control command data;

[0021] Data layer switching nodes are used to transfer file data;

[0022] Streaming media exchange nodes are used to transmit audio and video stream data.

[0023] This invention addresses the shortcomings of traditional cross-network hybrid data transmission, such as resource contention, protocol conflicts, and optimization failures, by setting up dedicated nodes for different data types, thereby improving the utilization rate of computing resources.

[0024] Furthermore, the method also includes:

[0025] Access control is performed on the data acquisition, the security processing, and the data exchange, and the access control includes:

[0026] Collect and access operation multi-dimensional security parameters;

[0027] Based on the aforementioned multi-dimensional security parameters, a policy engine is used to determine whether the access operation meets the preset permission policy.

[0028] Obtain the permission candidate set corresponding to the access operation that satisfies the preset permission policy;

[0029] Obtain device risk characteristics, and calculate the real-time risk probability value of the access operation based on the device risk characteristics by calling the risk assessment model;

[0030] When the real-time risk probability value exceeds the preset risk threshold, high-risk operation permissions are filtered from the permission candidate set to obtain the final permission set;

[0031] The final set of permissions is output to the access control executor.

[0032] In this invention, when performing access control, the first step is to collect multi-dimensional security parameters of the access operation (such as user role, request time, geographical location, and the accessing user's behavior pattern). Based on these parameters, a policy engine is used to determine whether the preset permission policy is met, completing the initial permission filtering, and then obtaining the permission candidate set corresponding to the operation that meets the policy. Then, based on the device risk characteristics (such as whether the device is rooted / jailbroken, the frequency of device operation, etc.), a risk assessment model is called to calculate the real-time risk probability value and quantify the dynamic threat. When the risk value exceeds the preset threshold, high-risk operations are filtered from the permission candidate set, and the final permission set is generated and output to the executor.

[0033] Furthermore, the multi-dimensional security parameters include: the behavioral patterns of the accessing user.

[0034] In this invention, the user's behavior pattern is used as a key security parameter input into the risk assessment model. By comparing the dynamic deviation between the user's current operation behavior and the historical trusted baseline in real time, the probability of identity abnormality is accurately quantified, preventing internal unauthorized attacks from occurring.

[0035] Furthermore, the security processing operations include SQL statement filtering;

[0036] The SQL statement filtering includes:

[0037] Obtain the multimodal fusion features of the SQL statement, and use a neural network model to detect attacks based on the multimodal fusion features;

[0038] The SQL statements are filtered based on the attack detection results.

[0039] This invention extracts correlation information from SQL statements from multiple perspectives during filtering, forming a multimodal fusion feature. Based on this feature, a neural network model is used for attack detection. This overcomes the shortcomings of traditional rule-based filtering, which relies solely on keyword matching: the multimodal fusion feature simultaneously reflects the semantic nature of the statement and its correlation with other relevant factors, while the neural network can autonomously learn complex attack patterns, thus accurately identifying mutated or disguised SQL injection attacks. Ultimately, this achieves dynamic filtering of malicious statements, significantly improving attack detection accuracy and overall system security.

[0040] Furthermore, the step of obtaining the multimodal fusion features of the SQL statement and performing attack detection using a neural network model based on the multimodal fusion features includes:

[0041] Extract semantic features from the SQL statements in the original data to generate semantic feature vectors. ;

[0042] Perform time-series analysis on user behavior corresponding to SQL statements to generate behavioral time-series feature vectors. ;

[0043] The semantic feature vector of the statement is obtained by using a two-layer attention fusion mechanism. and the behavioral temporal feature vector By fusing the data, key feature vectors can be obtained. ;

[0044] Construct a first multimodal attack detection model, train the first multimodal attack detection model, and obtain a second multimodal attack detection model;

[0045] The key feature vector Input the second multimodal attack detection model and output the attack probability.

[0046] Among them, the multimodal fusion feature is the semantic feature vector of the sentence. With behavioral temporal feature vector Key feature vectors obtained after fusion The semantic feature vector reflects the semantic logic of the SQL statement, while the behavioral temporal feature vector captures the inherent operational patterns of user behavior. This invention, by integrating semantic features and dynamic behavioral features, enables the model to more effectively understand the intent and potential risks of SQL statements, significantly improving the accuracy of identifying covert SQL injection attacks and reducing false negatives and missed detections.

[0047] Furthermore, the SQL statement is subjected to semantic feature extraction to generate a semantic feature vector. ,include:

[0048] Parse the SQL statement to generate an abstract syntax tree;

[0049] The abstract syntax tree is traversed in a depth-first manner to extract node information on the traversal path and generate a linear node sequence.

[0050] Construct an SQL semantic dictionary and perform one-hot encoding on the linear node sequence to obtain a one-hot vector sequence;

[0051] Using the nodes of the abstract syntax tree as vertices and the syntactic logic relations of the abstract syntax tree as directed edges, a directed graph is constructed, and the one-hot vector corresponding to the node of the abstract syntax tree is used as the initial feature of the vertex corresponding to that node.

[0052] The directed graph is input into a graph neural network, and the initial features are updated through multiple iterations.

[0053] The final features obtained after updating each vertex are fused together to generate the semantic feature vector of the statement. .

[0054] The abstract syntax tree (AST) transforms text statements into a computable tree-like logical structure, accurately representing the hierarchical relationships of SQL statements. It generates linear node sequences from node information, preserving the dependency paths of syntactic elements while providing standardized input with a defined order for subsequent feature encoding. An SQL semantic dictionary is constructed and one-hot encoding is performed, mapping the node sequence to a machine-recognizable one-hot vector sequence, solving the problem of strings not being directly computable. Then, a directed graph is constructed based on the syntactic relationships between nodes, using the one-hot vectors as the initial features of corresponding nodes, explicitly transforming syntactic rules into graph structure features. Finally, the input is fed into a graph neural network for multi-layer feature iteration and fusion to generate a semantic feature vector for the statement. This invention achieves syntax-sensitive feature extraction using an interpretable graph structure, significantly improving the ability to identify hidden logic in SQL statements.

[0055] Furthermore, the user behavior corresponding to the SQL statement is subjected to time-series analysis to generate a behavior time-series feature vector. ,include:

[0056] Obtain time series data of various user behaviors and generate a multidimensional time series feature matrix. ;

[0057] Construct a first LSTM network model that includes an attention module, and train the first LSTM network model to obtain a second LSTM network model;

[0058] The multidimensional time series feature matrix Input the second LSTM network model at each time step, and output the hidden state vector at the final time step. ;

[0059] For the hidden state vector Nonlinear transformation and dimensionality compression are performed to generate the behavioral temporal feature vector. .

[0060] This invention collects time series data of various user behaviors to facilitate more comprehensive analysis of user operation patterns. While traditional LSTM can capture long-term dependencies, it processes all time steps uniformly. This invention introduces an attention module into the first LSTM network model to actively focus on high-risk periods by dynamically allocating weights, thus suppressing noise interference from routine operations. Finally, the matrix is ​​input into the model step by step, and the hidden state vector is output at the final time step. The behavior time series feature vector is generated through nonlinear transformation and dimensionality compression, transforming the high-dimensional hidden state vector into a highly discriminative low-dimensional vector.

[0061] Furthermore, the two-layer attention fusion mechanism is used to integrate the semantic feature vector of the statement. and the behavioral temporal feature vector By fusing the data, key feature vectors can be obtained. ,include:

[0062] First-level attention mechanism: Calculate the semantic feature vector of the statement. Fusion weights and the behavioral temporal feature vector Fusion weights ;

[0063] based on and For the semantic feature vector of the statement and the behavioral temporal feature vector Perform weighted summation to obtain the fused feature vector. ;

[0064] Second-layer attention mechanism: [This refers to the fused feature vector...] Attention weights are applied to each feature dimension to filter key feature dimensions and generate the key feature vector. .

[0065] The first-layer attention mechanism generates a fused feature vector by weighting and summing the semantic feature vector and the temporal feature vector of the behavior, thus addressing the limited discriminative power of a single feature (e.g., operations that are semantically normal but exhibit abnormal behavior). The second-layer attention mechanism applies attention weights to each feature dimension of the fused vector, filtering dimensions for strong correlation attack detection (e.g., the intersection of abnormal WHERE clause nodes and high-frequency query behavior), generating a key feature vector. Traditional concatenation and fusion methods easily introduce redundant noise, while the two-layer mechanism effectively reduces the false positive rate through weight allocation and dimension filtering.

[0066] One or more technical solutions provided by this invention have at least the following technical effects or advantages:

[0067] 1. This invention dynamically monitors network and node status and optimizes transmission paths in real time. After a transmission failure, it automatically diagnoses the cause and accurately selects a new path for recovery, which significantly improves the overall reliability and smoothness of cross-network data exchange. At the same time, it greatly reduces the risk of interruption caused by network fluctuations, node failures or data contamination, making the data transmission process more stable, more timely and easier to recover.

[0068] 2. This invention combines multimodal fusion feature extraction with neural network detection mechanisms. At the grammatical level, it transforms SQL statements into abstract syntax trees and utilizes graph neural networks to deeply mine logical anomalies, effectively identifying SQL statement manipulation injection attacks. At the behavioral level, it employs an attention-enhanced LSTM model to capture anomalies in user operation timing, effectively improving the detection model's early warning accuracy against latent attacks. Simultaneously, through a dual-layer attention fusion mechanism, it dynamically focuses on key feature dimensions, significantly reducing the false alarm rate caused by legitimate long queries in complex business scenarios, and overall reducing the risk of data leakage during cross-network exchange. Attached Figure Description

[0069] The accompanying drawings, which are provided to further illustrate embodiments of the invention and constitute a part of this invention, are not intended to limit the scope of the invention.

[0070] Figure 1 This is a flowchart illustrating a cross-network data security exchange method according to the present invention. Detailed Implementation

[0071] To better understand the above-mentioned objectives, features, and advantages of the present invention, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be noted that, where there is no conflict, the embodiments of the present invention and the features thereof can be combined with each other.

[0072] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and therefore the scope of protection of the invention is not limited to the specific embodiments disclosed below.

[0073] Example 1

[0074] Please refer to Figure 1 Embodiment 1 of the present invention provides a method for secure cross-network data exchange, the method comprising:

[0075] Data Acquisition: Collect raw data from an external network database;

[0076] Security processing: Perform security processing operations on the raw data to obtain the data to be transmitted;

[0077] Data exchange: The data to be transmitted is transmitted to the intranet database based on several exchange nodes;

[0078] The step of transmitting the data to be transmitted to the intranet database based on several switching nodes includes:

[0079] Configure node transmission paths based on the original data source, target network area, and / or switching priority, and use the node transmission paths to transmit the data to be transmitted;

[0080] During transmission, the health indicators of the switching nodes on the transmission path of the node are obtained through multi-health dimension calculation, and the network signal indicators of the switching nodes on the transmission path of the node are obtained based on heartbeat signal analysis.

[0081] The node transmission path is dynamically adjusted based on the health indicators or the network signal indicators.

[0082] In data acquisition, the system collects raw data from an external network database, and can read specified data tables or files through standard database query interfaces (such as RESTful API calls). In security processing, the collected raw data undergoes security operations, including but not limited to data anonymization, encryption, and integrity verification. Specific implementation methods are based on existing technologies, and those skilled in the art can choose appropriate methods as needed. In data exchange, the system transmits data to the internal network database based on several exchange nodes. Specifically, firstly, it dynamically generates node transmission paths based on the original data source (e.g., data source label such as "external finance"), the target network area (e.g., internal network security zone code such as "zone-A"), and / or exchange priority (e.g., high-priority tasks are assigned the value "urgent," and low-priority tasks are assigned "normal"). The configuration module uses a path planning algorithm (such as Dijkstra's algorithm) to select the optimal path. For example, if the raw data comes from a high-risk source and has a high priority, the system configures the path to avoid congested nodes and prioritizes high-bandwidth, low-latency paths. Then, during transmission, the node status is assessed through multiple health dimensions, namely, continuous monitoring of CPU utilization, memory usage, and disk space remaining, and weighted calculation of health indicators (e.g., the health indicator calculation formula is: Health Indicator = (1 - CPU Utilization) * Weight 1 + (1 - Memory Usage) * Weight 2 + Disk Space Remaining * Weight 3, where the weighting factors are set based on measured data). Simultaneously, network signal indicators are analyzed based on heartbeat signals; heartbeat signals are sent as probe packets at fixed intervals (e.g., 1-second intervals) to analyze network latency, packet loss rate, and jitter, calculating indicators such as network signal quality values ​​(e.g., Network Signal Indicator = 1 - (Packet Loss Rate + Latency Penalty Factor * Average Latency)). Finally, path adjustment logic is triggered based on health indicators or network signal indicators; for example, if the health indicator of a switching node is below 0.6 (indicating node overload), or the network signal indicator is below 0.7 (indicating network degradation), the system automatically recalculates the node's transmission path and switches to an alternative path to ensure transmission continuity and reliability. The present invention can be implemented as a modular component. For example, in a preferred embodiment, the health monitoring module samples node resource data every second, and the decision engine compares the threshold in real time and selects a new path (such as switching from exchange node A to exchange node B).

[0083] The step of transmitting the data to be transmitted to the intranet database based on several switching nodes further includes:

[0084] Assign a transaction ID to each transmission, and track the status data of this transmission based on the transaction ID;

[0085] If the transmission fails, the cause of the failure will be analyzed using an intelligent fault detection model based on the status data.

[0086] Based on the reason for the failure, the node transmission path is regenerated, and the data to be transmitted is transmitted again based on the newly generated node transmission path.

[0087] Each time data transmission begins, the transaction management module assigns a transaction ID (e.g., a unique identifier such as a UUID or an auto-incrementing numeric ID such as "TX001234") to this transmission and records transmission status data based on this transaction ID. The status data includes: time-series snapshots of health indicators (e.g., snapshots of CPU / memory / disk data collected per second, stored as time-series database entries), network signal fluctuation characteristics (e.g., recording peak and trough values ​​of packet loss rate and latency, and calculating statistical characteristics such as standard deviation), and policy verification logs (e.g., logs recording the verification results of access control policies during each transmission). The status data is stored in a distributed storage system for subsequent analysis. At the end of the transmission, a check is performed to determine if it failed (e.g., the receiving end returns an error code or timeout). If the transmission failed, an intelligent fault detection model is invoked to analyze the cause of the failure. This model is a machine learning model (e.g., a decision tree or neural network), trained on a historical fault dataset. Inputs are status data (such as the aforementioned time-series snapshots of health indicators, network signal fluctuation characteristics, and policy verification logs), and outputs a classification of failure causes (e.g., node resource exhaustion, link quality degradation, or security policy conflict). In practice, if the analysis reveals that the cause is node resource exhaustion (model recognition CPU utilization consistently exceeds 95%), the system initiates a retry mechanism: the fault handling module regenerates the node transmission path based on the cause of failure (e.g., avoiding high-load nodes and increasing timeout tolerance), and then retransmits the data to be transmitted. The retransmission steps include loading the original data packet and applying the new path strategy to ensure complete data transmission.

[0088] The switching nodes include:

[0089] Control layer switching nodes are used to transmit request, response, and control command data;

[0090] Data layer switching nodes are used to transfer file data;

[0091] Streaming media exchange nodes are used to transmit audio and video stream data.

[0092] The control layer exchange nodes use lightweight message queues (such as RabbitMQ or Kafka) to handle metadata and commands. These nodes are suitable for frequent but low-load interactions.

[0093] Data layer exchange nodes support large file transfers (such as binary files or database backups), implemented using FTP protocol or distributed file system (such as HDFS). Data layer nodes are equipped with buffers and breakpoint resume functionality to improve the efficiency of large file exchange.

[0094] Streaming media exchange nodes are implemented as RTSP or WebRTC protocol instances to meet the low-latency requirements of real-time audio and video streams (such as video conferencing data). These three types of nodes can be automatically selected for deployment based on the data type.

[0095] The method further includes:

[0096] Access control is performed on the data acquisition, the security processing, and the data exchange, and the access control includes:

[0097] Collect and access operation multi-dimensional security parameters;

[0098] Based on the aforementioned multi-dimensional security parameters, a policy engine is used to determine whether the access operation meets the preset permission policy.

[0099] Obtain the permission candidate set corresponding to the access operation that satisfies the preset permission policy;

[0100] Obtain device risk characteristics, and calculate the real-time risk probability value of the access operation based on the device risk characteristics by calling the risk assessment model;

[0101] When the real-time risk probability value exceeds the preset risk threshold, high-risk operation permissions are filtered from the permission candidate set to obtain the final permission set;

[0102] The final set of permissions is output to the access control executor.

[0103] Among these, multi-dimensional security parameters include, but are not limited to:

[0104] User roles, such as analyst, regular user;

[0105] The geographical location visited;

[0106] Device parameters, such as the underlying platform of the device (e.g., Android / iOS), the security status of the device (whether it has been rooted / jailbroken), and whether antivirus software is installed on the device;

[0107] Data sensitivity level;

[0108] Access user behavior patterns.

[0109] The `collect_params()` function integrates all collected dimensional parameters into a structured dictionary, which is then input into the policy engine for permission determination. The rule is activated only when all security parameters meet the corresponding conditions, generating a permission candidate set.

[0110] The risk assessment model is pre-trained (the training method is existing in the field and will not be elaborated upon in this invention). The collected parameters are converted into risk feature vectors (the specific conversion method is existing in the field, and those skilled in the art can choose an appropriate conversion method as needed), and input into the model to calculate real-time risk probability values. Based on this probability value, the system performs dynamic permission filtering: if the current permission candidate set is empty and the risk exceeds the limit, the final permission set remains empty; if the candidate permission set is not empty, high-risk permissions will be filtered out according to the magnitude of the risk probability value. For example, in a financial system case: if the risk probability reaches 0.85, the executor only allows basic reads and refuses writes to ensure operational security.

[0111] Finally, the limited set is output to the access control executor, and an audit log (recording the user, risk value, and reason for the block) is generated and an alarm message is pushed to the security center.

[0112] The user behavior patterns include login time distribution and operation sequence. User access behavior pattern data is collected in real time using behavior probes. Specific collection dimensions and quantification methods are as follows:

[0113] Login time distribution: Collect user login time points, session frequency, and duration data. The specific quantification process includes:

[0114] Time Interval Probability Value: The 24 hours of each day are divided into 48 30-minute time intervals. The historical login frequency distribution of users in each interval is statistically analyzed to generate a baseline histogram model. When a user performs a new login, the login frequency probability value for the interval to which the current time point belongs is calculated.

[0115] High-risk state transition probability: An Hidden Markov Model (HMM) state transition matrix is ​​established, modeling login behavior into three states: "normal," "suspicious," and "high-risk." Based on the user's historical login sequence, the probability of transitioning from the normal state to the high-risk state at the current login moment is calculated.

[0116] Frequency deviation coefficient: Calculates the deviation between the current login frequency and the user's 30-day moving average. For example, if the Z-score value of the daily login frequency exceeds 2.58 (p<0.01), it is marked as a significant anomaly.

[0117] Operation sequence: Mapping operation commands to numerical codes (e.g., 1 = open directory, 2 = read file, 3 = delete object). User operation flow is converted into a coded sequence (e.g., "1→2→3→1") for pattern matching. In file system access, the normal sequence should be 1→2→1 (open-read-close), while 1→3 (open-delete) is an irregular sequence.

[0118] Sequence risk coefficient: The number of steps of difference between the current operation sequence and the baseline template, measured by Levenshtein distance. For example, if a user suddenly skips the verification step and directly accesses sensitive data, the sequence difference value will increase significantly. The quantification expression is:

[0119] Sequence risk coefficient = min(1, Levenshtein distance / baseline distance threshold);

[0120] Behavioral similarity: A directed graph is constructed based on the access path (nodes = operation steps, edges = transition relationships), and a 128-dimensional feature vector is generated using the Node2Vec algorithm. This vector captures deep behavioral topological features, such as abnormal closed-loop access patterns (e.g., repeatedly executing an infinite loop of A→B→A). The similarity between this vector and the baseline vector is represented by cosine similarity.

[0121] Only when the above-mentioned time interval probability value, high-risk state transition probability, frequency deviation coefficient, sequence risk coefficient and behavior similarity all meet the preset intervals will the user's behavior pattern be determined to be normal.

[0122] Example 2

[0123] Based on Example 1, the security processing operation includes SQL statement filtering;

[0124] The SQL statement filtering includes:

[0125] Obtain the multimodal fusion features of the SQL statement, and use a neural network model to detect attacks based on the multimodal fusion features;

[0126] The SQL statements are filtered based on the attack detection results.

[0127] The step of obtaining the multimodal fusion features of the SQL statement and using a neural network model to detect attacks based on the multimodal fusion features includes:

[0128] Extract semantic features from the SQL statements in the original data to generate semantic feature vectors. ;

[0129] Perform time-series analysis on user behavior corresponding to SQL statements to generate behavioral time-series feature vectors. ;

[0130] The semantic feature vector of the statement is obtained by using a two-layer attention fusion mechanism. and the behavioral temporal feature vector By fusing the data, key feature vectors can be obtained. ;

[0131] Construct a first multimodal attack detection model, train the first multimodal attack detection model, and obtain a second multimodal attack detection model;

[0132] The key feature vector Input the second multimodal attack detection model and output the attack probability.

[0133] The first multimodal attack detection model can be a convolutional neural network (CNN) model, such as the ResNet-18 classification model. This model includes fully connected layers, and a Softmax activation function is added after each fully connected layer to convert the output into a probability distribution. In this embodiment, the first multimodal attack detection model is trained using labeled historical data to obtain the second multimodal attack detection model. The specific training method is existing technology in this field, and this invention does not impose further limitations on it. The cross-entropy loss function is used. The second multimodal attack detection model is optimized, and the Adam optimizer is used to update the model parameters (where, The total number of samples, For the first The true label of each sample For the model to the first The predicted probability of each sample.

[0134] The filtering of SQL statements based on the attack detection results includes:

[0135] If the attack probability exceeds a preset probability threshold, the SQL statement is determined to be an injection attack statement;

[0136] The injected attack statements are filtered out from the original data.

[0137] The preset probability threshold can be set by those skilled in the art based on actual circumstances, and this invention does not limit it. Filtering can be achieved by replacing malicious SQL statements with harmless null operations or by directly removing malicious SQL statements from the transmitted data stream through statement substitution.

[0138] Specifically, the step of extracting semantic features from SQL statements to generate semantic feature vectors is described. ,include:

[0139] Parse the SQL statement to generate an abstract syntax tree;

[0140] The abstract syntax tree is traversed in a depth-first manner to extract node information on the traversal path and generate a linear node sequence.

[0141] Construct an SQL semantic dictionary and perform one-hot encoding on the linear node sequence to obtain a one-hot vector sequence;

[0142] Using the nodes of the abstract syntax tree as vertices and the syntactic logic relations of the abstract syntax tree as directed edges, a directed graph is constructed, and the one-hot vector corresponding to the node of the abstract syntax tree is used as the initial feature of the vertex corresponding to that node.

[0143] The directed graph is input into a graph neural network, and the initial features are updated through multiple iterations.

[0144] The final features obtained after updating each vertex are fused together to generate the semantic feature vector of the statement. .

[0145] For example, a user enters an SQL statement "UPDATE products SET price=price*0.8 WHEREcategory='electronics'", and the ANTLR parsing tool generates its corresponding Abstract Syntax Tree (AST). The root node of this AST is UpdateStatement, which has three child nodes: TableName (products), SetClause (price=price*0.8), and WhereClause (category='electronics'). Then, a depth-first traversal algorithm is used to generate a linear sequence of nodes: ["Update", "products", "Set", "price", "Expression", "Where", "category"].

[0146] Furthermore, each node in the linear node sequence is one-hot encoded using a pre-built SQL semantic dictionary. For example, the "Update" node is encoded as a multi-dimensional vector [1,0,0,...,0], and "price" is encoded as [0,0,1,...,0]. The specific number of dimensions can be between 128 and 512, which can be determined by those skilled in the art according to the actual situation. In this embodiment, it is a 512-dimensional vector.

[0147] A directed graph is then constructed based on syntactic and logical relationships: each AST node is a vertex, and the syntactic dependencies between nodes are directed edges (e.g., the WhereClause vertex points to the category column vertex). Finally, the graph structure with feature vectors is input into a graph neural network. The network contains two layers of graph convolution operations, each with an output dimension of 256. The node feature update process follows the neighborhood aggregation principle, meaning that each node's feature is updated by weighting the features of its neighboring nodes. Finally, all node features are fused through a max-pooling layer, outputting a 512-dimensional semantic feature vector.

[0148] The formula for updating the initial features through multi-level iterations is as follows:

[0149] ;

[0150] in, As vertices In the Features of the layer As the first activation function, As vertices The set of neighboring nodes, For the first The weight matrix of the layer is used for feature transformation of neighboring nodes. For the first The layer uses a weight matrix for feature transformation of its own nodes. The weight matrix has a dimension of 256×256. As vertices In the Characteristics of the layer.

[0151] Specifically, the step involves performing time-series analysis on user behavior corresponding to SQL statements to generate behavioral time-series feature vectors. ,include:

[0152] Obtain time series data of various user behaviors and generate a multidimensional time series feature matrix. ;

[0153] Construct a first LSTM network model that includes an attention module, and train the first LSTM network model to obtain a second LSTM network model;

[0154] The multidimensional time series feature matrix Input the second LSTM network model at each time step, and output the hidden state vector at the final time step. ;

[0155] For the hidden state vector Nonlinear transformation and dimensionality compression are performed to generate the behavioral temporal feature vector. .

[0156] In this embodiment, user behavior includes three categories: operation timestamp, sending interval between adjacent SQL statements, and operation frequency per unit time. When a user submits an SQL statement, the system records complete triplet data: operation timestamp, sending interval (timestamps of the current statement and the previous statement; if the statement is the first one, the sending interval is 0), and operation frequency (the total number of operations performed by the user in the previous minute).

[0157] For example, a user executes a query `SELECT * FROM products` at 10:00:00.000, an `UPDATE cart SET qty=3` at 10:00:02.500, and a `DELETE FROM cart WHERE item_id=null` at 10:00:03.100.

[0158] The timestamp sequence is: [1000000, 1000250, 1000310];

[0159] The transmission interval sequence is: [0, 2500, 600];

[0160] The operation frequency sequence is: [0, 30, 120];

[0161] The data are combined into a 3×3 temporal matrix and input into the second LSTM network model. The second LSTM network model adopts a two-layer stacked structure: the first LSTM layer (128 units) processes the raw temporal data and captures instantaneous behavioral patterns; the second LSTM layer (128 units) receives the output of the first layer and learns long-term behavioral dependencies; a temporal attention module is embedded between the two layers; finally, at the output of the second LSTM layer, average pooling is used to generate a 256-dimensional hidden state vector. Then, it is compressed into a 128-dimensional behavioral temporal feature vector through a fully connected layer. .

[0162] The input gate calculation formula for the first LSTM network model is as follows:

[0163] ;

[0164] in, for The output vector of the input gate at any given time. For the second activation function, for The input feature vector at time t, For the current input The weight matrix, for The hidden state vector at time step 1. Hidden in history The weight matrix, This is the input gate bias vector. For Hadama accumulation, Let be the attention distribution function.

[0165] The method of using a two-layer attention fusion mechanism to integrate the semantic feature vector of the statement and the behavioral temporal feature vector By fusing the data, key feature vectors can be obtained. ,include:

[0166] First-level attention mechanism: Calculate the semantic feature vector of the statement. Fusion weights and the behavioral temporal feature vector Fusion weights ;

[0167] based on and For the semantic feature vector of the statement and the behavioral temporal feature vector Perform weighted summation to obtain the fused feature vector. ;

[0168] Second-layer attention mechanism: [This refers to the fused feature vector...] Attention weights are applied to each feature dimension to filter key feature dimensions and generate the key feature vector. .

[0169] in, The calculation formula is:

[0170] ;

[0171] The calculation formula is:

[0172] ;

[0173] in, Learnable weight matrix for The transpose of .

[0174] In this process, the fused feature vector is obtained through the first-layer attention mechanism. Then, calculate each feature dimension. Importance weight The calculation formula can be: ,in The total number of dimensions. Learnable weight matrix.

[0175] reserve For key dimensions exceeding a preset threshold, the key dimensions are reorganized to obtain the key feature vector. .

[0176] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including both the preferred embodiments and all changes and modifications falling within the scope of the invention.

[0177] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.

Claims

1. A method for secure cross-network data exchange, characterized in that, The method includes: Data Acquisition: Collect raw data from an external network database; Security processing: Perform security processing operations on the raw data to obtain the data to be transmitted; Data exchange: The data to be transmitted is transmitted to the intranet database based on several exchange nodes; The step of transmitting the data to be transmitted to the intranet database based on several switching nodes includes: Configure node transmission paths based on the original data source, target network area, and / or switching priority, and use the node transmission paths to transmit the data to be transmitted; During transmission, the health indicators of the switching nodes on the transmission path of the node are obtained through multi-health dimension calculation, and the network signal indicators of the switching nodes on the transmission path of the node are obtained based on heartbeat signal analysis. The node transmission path is dynamically adjusted based on the health indicators or the network signal indicators. The security processing operations include SQL statement filtering; The SQL statement filtering includes: Obtain the multimodal fusion features of the SQL statement, and use a neural network model to detect attacks based on the multimodal fusion features; The SQL statements are filtered based on the attack detection results. The process of obtaining the multimodal fusion features of the SQL statement and using a neural network model to detect attacks based on these features includes: Extract semantic features from the SQL statements in the original data to generate semantic feature vectors. ; Perform time-series analysis on user behavior corresponding to SQL statements to generate behavioral time-series feature vectors. ; The semantic feature vector of the statement is obtained by using a two-layer attention fusion mechanism. and the behavioral temporal feature vector By fusing the data, key feature vectors can be obtained. ; Construct a first multimodal attack detection model, train the first multimodal attack detection model, and obtain a second multimodal attack detection model; The key feature vector Input the second multimodal attack detection model and output the attack probability; The SQL statement is subjected to semantic feature extraction to generate a semantic feature vector. ,include: Parse the SQL statement to generate an abstract syntax tree; The abstract syntax tree is traversed in a depth-first manner to extract node information on the traversal path and generate a linear node sequence. Construct an SQL semantic dictionary and perform one-hot encoding on the linear node sequence to obtain a one-hot vector sequence; Using the nodes of the abstract syntax tree as vertices and the syntactic logic relations of the abstract syntax tree as directed edges, a directed graph is constructed, and the one-hot vector corresponding to the node of the abstract syntax tree is used as the initial feature of the vertex corresponding to that node. The directed graph is input into a graph neural network, and the initial features are updated through multiple iterations. The final features obtained after updating each vertex are fused together to generate the semantic feature vector of the statement. .

2. The cross-network secure data exchange method according to claim 1, characterized in that, The step of transmitting the data to be transmitted to the intranet database based on several switching nodes also includes: Assign a transaction ID to each transmission, and track the status data of this transmission based on the transaction ID; If the transmission fails, the cause of the failure will be analyzed using an intelligent fault detection model based on the status data. Based on the reason for the failure, the node transmission path is regenerated, and the data to be transmitted is transmitted again based on the newly generated node transmission path.

3. The cross-network secure data exchange method according to claim 1, characterized in that, The switching nodes include: Control layer switching nodes are used to transmit request, response, and control command data; Data layer switching nodes are used to transfer file data; Streaming media exchange nodes are used to transmit audio and video stream data.

4. The cross-network secure data exchange method according to claim 1, characterized in that, The method further includes: Access control is performed on the data acquisition, the security processing, and the data exchange, and the access control includes: Collect and access operation multi-dimensional security parameters; Based on the aforementioned multi-dimensional security parameters, a policy engine is used to determine whether the access operation meets the preset permission policy. Obtain the permission candidate set corresponding to the access operation that satisfies the preset permission policy; Obtain device risk characteristics, and calculate the real-time risk probability value of the access operation based on the device risk characteristics by calling the risk assessment model; When the real-time risk probability value exceeds the preset risk threshold, high-risk operation permissions are filtered from the permission candidate set to obtain the final permission set; The final set of permissions is output to the access control executor.

5. A cross-network secure data exchange method according to claim 4, characterized in that, The multi-dimensional security parameters include: the behavioral patterns of the accessing user.

6. The cross-network secure data exchange method according to claim 1, characterized in that, The process involves performing time-series analysis on user behavior corresponding to SQL statements to generate behavior time-series feature vectors. ,include: Obtain time series data of various user behaviors and generate a multidimensional time series feature matrix. ; Construct a first LSTM network model that includes an attention module, and train the first LSTM network model to obtain a second LSTM network model; The multidimensional time series feature matrix Input the second LSTM network model at each time step, and output the hidden state vector at the final time step. ; For the hidden state vector Nonlinear transformation and dimensionality compression are performed to generate the behavioral temporal feature vector. .

7. A cross-network secure data exchange method according to claim 1, characterized in that, The semantic feature vector of the statement is obtained by using a two-layer attention fusion mechanism. and the behavioral temporal feature vector By fusing the data, key feature vectors can be obtained. ,include: First-level attention mechanism: Calculate the semantic feature vector of the statement. Fusion weights and the behavioral temporal feature vector Fusion weights ; based on and For the semantic feature vector of the statement and the behavioral temporal feature vector Perform weighted summation to obtain the fused feature vector. ; Second-layer attention mechanism: [This refers to the fused feature vector...] Attention weights are applied to each feature dimension to filter key feature dimensions and generate the key feature vector. .

Images