Sensitive data security encryption method and device

Abstract

The invention relates to a sensitive data security encryption method and device, and the method comprises the steps: obtaining historical behavior data of the operation of a software system, and carrying out the preprocessing of the historical behavior data; behavior features are extracted from the historical behavior data, and security feature vectors are constructed based on the behavior features; and training a machine learning algorithm based on the security feature vector to construct an attack model for identifying the attack behavior type. And inputting the current behavior data into an attack model to call the attack model to identify whether the current behavior data is attack behavior data, and determining an attack behavior type when the current behavior data is the attack behavior data. And based on the attack behavior type corresponding to the current behavior data, performing combined encryption of asymmetric encryption and symmetric encryption on target data accessed by the current behavior data. And generating an encryption key by adopting a random number generator, and dividing the encryption key into a plurality of fragments through a secret sharing algorithm so as to carry out distributed storage on the plurality of fragments.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data encryption, and in particular to a sensitive data security encryption method and device, electronic equipment and storage medium. BACKGROUND

[0002] In today's rapidly developing digital age, the importance of performance optimization and resource management of software systems is increasingly prominent. With the continuous increase of software functions, the number of users using software is also growing, and many software systems are facing the problems of performance bottleneck and resource waste, which poses a great challenge to the security of sensitive data.

[0003] At present, most software systems still use traditional resource allocation and scheduling strategies, that is, in terms of resource allocation, the system's resources (CPU, memory, disk I / O, etc.) are mainly allocated to different tasks or processes according to pre-set rules. For example, a certain task is allocated a fixed number of CPU cores and a certain size of memory, but this scheme is difficult to adjust the resource allocation according to the actual needs of the task during the execution of the task. In terms of resource scheduling, the main scheduling algorithm sorts tasks according to their priority, execution time, etc., and then executes the tasks in turn, such as first come first served (FCFS), shortest job first (SJF), etc., which are widely used.

[0004] Therefore, in view of the complex running environment of software systems, multiple tasks may run simultaneously on different nodes, and the traditional resource allocation and scheduling strategy is difficult to effectively coordinate the resource allocation and scheduling of multiple tasks, ultimately leading to the difficulty of more effective protection of the security of sensitive data during the running of software systems. SUMMARY

[0005] The present application aims to provide a sensitive data security encryption method and device, electronic equipment and storage medium to solve the problems existing in the prior art. The technical problems to be solved by the present application are solved by the following technical solutions.

[0006] The embodiment of the application provides a sensitive data security encryption method, the method comprises the following steps: obtaining historical behavior data of a software system, and preprocessing the historical behavior data, the preprocessing comprises data cleaning and normalization; extracting behavior features from the preprocessed historical behavior data, and constructing a security feature vector based on the behavior features; training a machine learning algorithm based on the security feature vector to construct an attack model for identifying attack behavior types; inputting current behavior data into the attack model to call the attack model to identify whether the current behavior data is attack behavior data, and determining an attack behavior type when the current behavior data is attack behavior data; performing combined encryption of asymmetric encryption and symmetric encryption on target data accessed by the current behavior data based on the attack behavior type corresponding to the current behavior data; generating an encryption key by using a random number generator, and dividing the encryption key into multiple fragments by using a secret sharing algorithm to perform distributed storage on the multiple fragments; wherein the historical behavior data is divided into normal behavior data and known attack behavior data, and the behavior features include flow rate and packet quantity.

[0007] In one embodiment, the historical behavior data of the software system is obtained, and the historical behavior data is preprocessed, and the preprocessing includes data cleaning and normalization, which comprises: collecting the historical behavior data of the software system at a fixed time interval, and cleaning the historical behavior data to remove noise and outliers in the historical behavior data; mapping the cleaned historical behavior data to a preset interval to normalize the cleaned historical behavior data, and obtaining the preprocessed historical behavior data.

[0008] In one embodiment, the current behavior data is input into the attack model to call the attack model to identify whether the current behavior data is attack behavior data, and an attack behavior type is determined when the current behavior data is attack behavior data, which comprises: extracting flow rate and packet quantity from the preprocessed current behavior data, and constructing a security feature vector based on the flow rate and packet quantity. The security feature vector is matched with the model output of the attack model to calculate the similarity between the security feature vector and the model output, and it is judged whether there is attack behavior in the security feature vector according to the similarity.

[0009] In one of the embodiments, the inputting the current behavior data into the attack model to invoke the attack model to identify whether the current behavior data is attack behavior data and determine the attack behavior type when the current behavior data is attack behavior data further includes: determining that there is attack behavior in the security feature vector when the similarity between the security feature vector and the model output exceeds a set threshold; triggering an exception handling mechanism and determining the attack type and risk level when there is attack behavior in the security feature vector.

[0010] In one of the embodiments, the inputting the current behavior data into the attack model to invoke the attack model to identify whether the current behavior data is attack behavior data and determine the attack behavior type when the current behavior data is attack behavior data further includes: selecting a corresponding exception handling strategy according to the attack type and risk level corresponding to the current behavior data in response to the exception handling mechanism; executing the exception handling strategy and recording the attack behavior time, attack behavior source and attack behavior type of the current behavior data when executing the exception handling strategy; wherein the risk level is used to represent different risk levels of attack behavior, different risk levels and attack types correspond to different exception handling strategies, and the exception handling strategy includes issuing an alarm, attack behavior monitoring and network disconnection control.

[0011] In one of the embodiments, the combination of asymmetric encryption and symmetric encryption of the target data accessed by the current behavior data based on the attack behavior type corresponding to the current behavior data includes: generating SSL certificates and private keys on the server side and the user side respectively during the transmission of the target data, and loading the SSL certificates and private keys to create an SSL context when the server is started; performing SSL handshake negotiation when the user side and the server side establish a connection, and using the negotiated encryption algorithm and key for encryption during the transmission of the target data; using a symmetric encryption algorithm to encrypt the target data to generate a symmetric encryption key and encrypting the symmetric encryption key through an asymmetric encryption algorithm when the target data is stored.

[0012] In one of the embodiments, the combination of asymmetric encryption and symmetric encryption of the target data accessed by the current behavior data based on the attack behavior type corresponding to the current behavior data includes: generating an encryption key of a set length through a random number generator based on a symmetric encryption algorithm and an asymmetric encryption algorithm, and dividing the encryption key into multiple fragments through a secret sharing algorithm; storing the multiple fragments on different storage nodes respectively, and obtaining all key fragments on different storage nodes when invoking the encryption key, and simultaneously invoking the secret sharing algorithm to restore all key fragments.

[0013] The application further provides a sensitive data security encryption device for implementing the sensitive data security encryption method.

[0014] The application further provides an electronic device including a memory and a processor, the memory storing a computer program, and the processor implementing the sensitive data security encryption method when executing the computer program.

[0015] The application further provides a computer storage medium storing a computer program, and the computer program implementing the sensitive data security encryption method when executed by a processor.

[0016] The sensitive data security encryption method, device, electronic equipment and computer storage medium provided by the embodiment of the present application obtain historical behavior data of a software system, and perform data cleaning and normalization on the historical behavior data. Then, behavior features are extracted from the preprocessed historical behavior data, and a security feature vector is constructed based on the behavior features. Next, a machine learning algorithm is trained based on the security feature vector to construct an attack model for identifying attack behavior types. Then, current behavior data is input into the attack model to call the attack model to identify whether the current behavior data is attack behavior data, and determine the attack behavior type when the current behavior data is attack behavior data. Finally, the target data accessed by the current behavior data is combined and encrypted by asymmetric encryption and symmetric encryption based on the attack behavior type corresponding to the current behavior data, an encryption key is generated by using a random number generator, and the encryption key is divided into multiple fragments by using a secret sharing algorithm to perform distributed storage on the multiple fragments. The method identifies attack behavior of system software behavior data through the attack model, and then performs combined encryption of symmetric encryption and asymmetric encryption on sensitive data that may be involved in the attack behavior, and fragments and distributes the encryption key of the combined encryption, so that when sensitive data is possibly leaked or attacked, all key fragments need to be recovered to decrypt the sensitive data, and the security of the sensitive data can be ensured in a complex running environment of a software system. BRIEF DESCRIPTION OF DRAWINGS

[0017] In order to more clearly illustrate the technical solutions in the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or the prior art description. Obviously, the drawings in the following description are some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0018] Figure 1 One of the flowcharts of the sensitive data security encryption method provided by the embodiment of the present application; Figure 2 The attack behavior identification flowchart of the sensitive data security encryption method provided by the embodiment of the present application; Figure 3 The data encryption and key management architecture diagram of the sensitive data security encryption method provided by the embodiment of the present application; Figure 4 The second flowchart of the sensitive data security encryption method provided by the embodiment of the present application; Figure 5 The third flowchart of the sensitive data security encryption method provided by the embodiment of the present application; Figure 6A flowchart of a sensitive data security encryption method provided by an embodiment of the present application is shown in Figure 4. Figure 7 A flowchart of a sensitive data security encryption method provided by an embodiment of the present application is shown in Figure 5. Figure 8 A flowchart of a sensitive data security encryption method provided by an embodiment of the present application is shown in Figure 6. Figure 9 A flowchart of a sensitive data security encryption method provided by an embodiment of the present application is shown in Figure 7. Figure 10 A structural diagram of a sensitive data security encryption device provided by an embodiment of the present application is shown in Figure 8. Figure 11 An internal structure diagram of a sensitive data security encryption electronic device provided by an embodiment of the present application is shown in Figure 9. DETAILED DESCRIPTION

[0019] To make the objectives, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described below in connection with the drawings in the embodiments of the present application. Obviously, the described embodiments are some but not all of the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the protection scope of the present application.

[0020] The embodiments of the present application will be described below in connection with Figures 1 to 11 A sensitive data security encryption method, device, electronic device and storage medium are described.

[0021] Embodiment 1 As shown in Figure 1, in one embodiment, a sensitive data security encryption method includes the following steps: Figure 1 Step S110, obtaining historical behavior data of a software system running, and pre-processing the historical behavior data, the preprocessing including data cleaning and normalization. Step S110, obtaining historical behavior data of a software system running, and pre-processing the historical behavior data, the preprocessing including data cleaning and normalization.

[0022] Among them, the historical behavior data is divided into normal behavior data and known attack behavior data.

[0023] Specifically, the historical behavior data (including normal behavior and known attack behavior data, such as network traffic, CPU usage, etc.) of the software system running is obtained, and pre-processed, including data cleaning to eliminate noise and outliers, and normalization to map feature values to a fixed range.

[0024] Specifically, the historical behavior data determined in the software system is acquired as a data sample, and is divided into normal behavior data and known attack behavior data, and the acquired historical behavior data is subjected to data cleaning and normalization to obtain preprocessed historical behavior data.

[0025] Specifically, in combination with Figure 2 and Figure 3 In a specific embodiment, the sensitive data security encryption method provided by the present application first initializes the system monitoring tool or sensor during the running of the software system to ensure its normal operation. The historical behavior data (including normal behavior data and known attack behavior data) of the system is collected at a certain time interval (every 5 minutes) by using the psutil library of Python through the system monitoring tool, sensor, system log, network traffic monitoring, and performance monitoring, including network traffic, CPU usage, memory occupation, disk I / O, etc. The collected data is stored in a temporary buffer or database for subsequent processing.

[0026] Further, the collected historical behavior data is read from the temporary buffer or database, and the collected behavior data is subjected to cleaning and normalization preprocessing operations. The cleaning operation mainly removes noise and outliers in the behavior data; normalization is to map the characteristic values of the data to a fixed range for processing by the machine learning algorithm.

[0027] Step S120 extracts behavior features from the preprocessed historical behavior data and constructs a security feature vector based on the behavior features.

[0028] The behavior features include traffic rate and packet quantity. The security feature vector is used to describe a set of characteristic values of the behavior of the software system, and each characteristic value in the vector represents a specific behavior or state of the system, such as network traffic, CPU usage, memory occupation, disk I / O, etc. After normalization processing, a fixed-dimension vector is formed for subsequent processing by the machine learning algorithm.

[0029] Specifically, behavior features (such as average traffic rate, CPU usage mean value, etc.) are extracted from the preprocessed historical behavior data, and a fixed-dimension security feature vector is constructed based on the behavior features.

[0030] Specifically, the traffic rate and packet quantity are extracted from the preprocessed historical behavior data obtained in step S110, and a security feature vector containing characteristic values of network traffic, CPU usage, memory occupation, disk I / O, etc. is constructed based on the traffic rate and packet quantity.

[0031] Specifically, in combination with Figure 2 and Figure 3As shown, in specific embodiments, the sensitive data security encryption method provided by the present application extracts features from preprocessed behavior data according to a pre-defined feature extraction algorithm, extracts representative features, and then combines the extracted features into a security feature vector.

[0032] The algorithm for feature extraction and security feature vector formation is as follows: Extract the flow rate feature: flow_rate = np.mean(network_traffic); Extract the packet count feature: packet_count = len(network_traffic); Form a security feature vector: security_feature_vector = [flow_rate, packet_count].

[0033] Step S130, based on the security feature vector, train the machine learning algorithm to build an attack model for identifying attack behavior types.

[0034] The attack model is a model trained by a machine learning algorithm, which is used to identify different types of attack behaviors. Various machine learning algorithms are used, such as decision trees, support vector machines, and neural networks. In the training process, a large amount of historical behavior data is used to train and optimize the model, including normal behavior data and known attack behavior data.

[0035] Specifically, an improved random forest algorithm (introducing an adaptive feature sampling mechanism and optimizing the decision tree splitting criterion) is used to train the model based on the security feature vector, and an attack model for identifying attack behavior types is built.

[0036] Specifically, based on the security feature vector built in step S120, the machine learning algorithm is trained, and finally an attack model for identifying attack behavior types is built.

[0037] Step S140, input the current behavior data into the attack model to call the attack model to identify whether the current behavior data is attack behavior data, and determine the attack behavior type when the current behavior data is attack behavior data.

[0038] Specifically, the current behavior data to be identified is input into the attack model trained in step S130, and the attack model is called to identify whether the current behavior data has attack behavior, and when the current behavior data has attack behavior, the corresponding attack behavior type is determined.

[0039] Specifically, in combination with Figure 2 and Figure 3As shown, in specific embodiments, the sensitive data security encryption method provided by the present application loads the trained attack model, inputs the security feature vector corresponding to the to-be-identified behavior data into the pre-trained attack model for feature matching, and the feature matching process is performed by similarity calculation and classification prediction, so as to judge whether there is an attack behavior in the vector, that is, whether there is an attack behavior in the corresponding behavior data. If the similarity exceeds the set threshold or the prediction result is an attack behavior, it is considered that there is an attack behavior.

[0040] Among them, the algorithm of the attack model to identify the attack behavior of the behavior event is as follows: Attack model test data: X_train = np.array([[100, 10], [200, 20], [300, 30], [400, 40], [500, 50]]);Y_train = np.array([0, 0, 1, 1, 1]);model = RandomForestClassifier();model.fit(X_train, Y_train); Security feature vector: security_feature_vector = np.array([[350, 35]]); Classification prediction: prediction = model.predict(security_feature_vector).

[0041] In this embodiment, machine learning algorithm is used to classify attack behaviors. According to the purpose, means, characteristics and other factors of attack, including denial of service attack, SQL injection attack, cross-site scripting attack, etc.

[0042] Among them, the algorithm of the attack behavior type identification is as follows: Attack classification model test data: X_train = np.array([[100, 10], [200, 20], [300, 30], [400, 40], [500, 50]]);Y_train = np.array(['normal', 'normal', 'denial of service attack', 'denial of service attack', 'denial of service attack']);model = RandomForestClassifier();model.fit(X_train, Y_train); Extract security feature vector: security_feature_vector = np.array([[350, 35]]); Make attack classification prediction: prediction = model.predict(security_feature_vector).

[0043] In this embodiment, if abnormal behavior is found, the system will immediately issue an alarm and take appropriate measures, such as blocking access, isolating affected parts, etc. According to the type and severity of the attack, different abnormal handling strategies are executed.

[0044] Specifically, when the feature matching unit determines that there is an attack behavior, the abnormal handling mechanism is triggered, and according to the type and severity of the attack, the corresponding abnormal handling strategy is selected, the abnormal handling strategy is executed, the alarm is issued, the access is blocked, the affected part is isolated, etc. Record the relevant information of abnormal handling, including attack time, attack type, handling measures.

[0045] Among them, the abnormal handling algorithm corresponding to the attack behavior of the behavior data is as follows: Configure logging: logging.basicConfig(level=logging.INFO); Detect attack behavior: is_attack = True; if is_attack: Alarm logic branch; Access blocking branch; Isolate the affected part branch.

[0046] Specifically, according to the type and severity of the attack, different coping strategies are taken. For minor attacks, take the form of warning and monitoring; for serious attacks, immediately cut off network connection to prevent data leakage. At the same time, record the relevant information of the attack, including attack time, attack source, attack type, so as to facilitate subsequent analysis and processing.

[0047] Step S150, based on the attack behavior type corresponding to the current behavior data, the target data accessed by the current behavior data is combined encrypted by asymmetric encryption and symmetric encryption.

[0048] Specifically, based on the attack behavior type corresponding to the current behavior data, the target data accessed by the current behavior data is implemented by "symmetric encryption + asymmetric encryption + key fragmentation" combined encryption: first, encrypt the target data with ChaCha20-Poly1305 symmetric algorithm, then encrypt the symmetric key with RSA asymmetric algorithm, and finally determine the number of key fragments according to the attack risk level (high risk 5 pieces need 3 pieces to recover, low risk 3 pieces need 2 pieces to recover) Store the asymmetric encrypted key.

[0049] Specifically, based on the attack type determined by the current behavior data, the target data to be attacked or read by the current behavior data is subjected to combined encryption of asymmetric encryption and symmetric encryption to protect the target data from being read by the attack behavior.

[0050] Specifically, in combination with Figure 2 and Figure 3 As shown in the specific embodiment, the sensitive data security encryption method provided by the application uses SSL / TLS protocol for encryption during data transmission. SSL / TLS protocol is an encryption protocol widely used in network communication, which can ensure that data is not stolen and tampered with during transmission. When establishing a network connection, the user end and the server will negotiate through handshaking, select appropriate encryption algorithms and keys, and transmit data after encryption.

[0051] In this embodiment, the server end and the client end generate SSL certificates and private keys respectively. When the server end starts, it loads the SSL certificate and the private key to create an SSL context. When the client end connects to the server, it performs SSL handshaking negotiation to determine the encryption algorithm and the key. During data transmission, the data is encrypted using the negotiated encryption algorithm and key. The receiver decrypts the encrypted data using the corresponding key.

[0052] Further, when storing data, a new encryption algorithm is used to encrypt the data. The new encryption algorithm combines symmetric encryption and asymmetric encryption to ensure data security while improving encryption performance. Among them, the symmetric encryption algorithm of AES-GCM and ChaCha20-Poly1305 is used to encrypt the data, and the asymmetric encryption algorithm of RSA and ECC is used to encrypt and manage the symmetric encryption key.

[0053] Specifically, first, a symmetric encryption key is generated, and a symmetric encryption algorithm is used to encrypt the data. Then, the symmetric encryption key is encrypted using an asymmetric encryption algorithm, and the encrypted key is stored in the database or file system. In this way, when reading encrypted data, the symmetric encryption key is first decrypted using the asymmetric encryption key, and then the data is decrypted using the symmetric encryption key.

[0054] Step S160, a random number generator is used to generate an encryption key, and the encryption key is divided into multiple fragments by a secret sharing algorithm to perform distributed storage on the multiple fragments.

[0055] Specifically, a random number generator is used to generate a random encryption key for combined encryption, and the encryption key is divided into multiple fragments by a secret sharing algorithm, and the divided multiple key fragments are distributed and stored in different storage nodes, so that any behavior wants to read the target data needs to obtain all the key fragments, and then the all key fragments are recovered and verified, and the read permission of the target data can be obtained.

[0056] Specifically, in combination with Figure 2 and Figure 3 As shown in the specific embodiment, the sensitive data security encryption method provided by the application selects a software random number generator after encryption, generates a key using a hardware random number generator and a software random number generator, which can ensure the randomness and security of the key. According to the requirements of the foregoing encryption algorithm, a secure random number generator is used to generate an encryption key of a specified length, and the generated key is verified to ensure that it meets the security requirements.

[0057] Further, the generated encryption key is divided into multiple fragments by using a secret sharing algorithm, Shamir's Secret Sharing algorithm, each fragment has a certain independence. In the fragmentation process, first, the number of fragments and the minimum number of fragments required for recovery need to be determined, second, the key is divided into multiple fragments using the secret sharing algorithm, and finally the fragments are stored in different nodes or storage media.

[0058] The algorithm for key fragmentation and distributed storage is as follows: The test key to be fragmented: key = b'1234567890abcdef'; The number of fragments: n = 5; The minimum number of fragments required for recovery: k = 3; Generate fragments: shares = ssss.create_shares(key, n, k); Store the fragments: for i, share in enumerate(shares): with open(f'share_{i}.txt', 'wb') as f: f.write(share) Further, in the process of distributing the key fragments, different storage media such as databases, distributed file systems, cloud storage, etc. are selected, and the key fragments are stored in different storage nodes, and the stored key fragments are backed up to prevent data loss, so as to ensure the security and reliability of the key fragments.

[0059] In this embodiment, when a key is needed, the required key fragments are obtained through a secure communication channel. A secret sharing algorithm is then used to recover the obtained key fragments, and the correctness of the recovered key is verified. Only when the recovered key is correct can the corresponding permissions be granted. Therefore, only when all fragments are correctly obtained can the complete key be restored, ensuring the security of the target data from multiple perspectives. Furthermore, the encryption key needs to be updated regularly to further enhance data security. For example, the key update cycle can be set according to the system's security policy and actual conditions.

[0060] In this embodiment, adaptive adjustments and optimizations to the system are also required. Specifically, new attack data and system operation data are continuously collected during system operation testing. During system operation testing, the scope and frequency of data collection are first determined, including collecting data on system CPU utilization, memory usage, network traffic, etc. Data is collected periodically and stored in a database or file system. Then, data mining algorithms are used to analyze the collected data, including association rule mining, cluster analysis, and anomaly detection. Based on the analysis results, potential patterns and trends in the data are discovered.

[0061] The clustering analysis algorithm used in the system operation test is as follows: System runtime test data: data = {'CPU utilization': [10, 20, 30, 40, 50], 'Memory usage': [20, 30, 40, 50, 60]}; df = pd.DataFrame(data); Cluster analysis using the K-Means algorithm: kmeans = KMeans(n_clusters=2);kmeans.fit(df); To view the clustering results: df['cluster labels'] = kmeans.labels().

[0062] Furthermore, security strategies can be adaptively adjusted based on system operation and attack patterns. For example, if the system is frequently subjected to a certain type of attack, monitoring for that type of attack can be increased; if system performance is affected, the parameters of the encryption algorithm can be adjusted to improve system performance.

[0063] Specifically, based on the results of data analysis, the system's operation and attack status are assessed. Based on the assessment results, it is determined whether the security policy needs to be adjusted. If adjustment is required, an appropriate adjustment policy is selected based on predefined rules or machine learning models, and then the adjustment policy is executed, with the content and time of the adjustment recorded.

[0064] In this embodiment, new attack data and system operation data are also collected periodically, the newly collected data is preprocessed to be consistent with the original training data format, then the new data is added to the original model for training using incremental learning, the performance of the updated model is evaluated, and if the performance is improved, the updated model is used for attack identification.

[0065] The algorithm for model updating is as follows: Initial training data: X_train = np.array([[1, 2], [2, 3], [3, 4]]); y_train = np.array([0, 0, 1]); Initialize the model: model = SGDClassifier(); model.fit(X_train, y_train); Newly collected data: X_new = np.array([[4, 5], [5, 6]]); y_new = np.array([1, 1]); Incremental learning: model.partial_fit(X_new, y_new).

[0066] Specifically, the system is evaluated periodically using security evaluation tools, performance testing tools, etc. to find problems and deficiencies in the system and improve them in a timely manner. For example, determine the evaluation indicators and methods, including system response time, throughput, false positive rate, and false negative rate; periodically evaluate the system, record the evaluation results, analyze the problems and deficiencies of the system according to the evaluation results; finally, propose improvement measures and implement the corresponding improvement measures.

[0067] This invention discloses a method for secure encryption of sensitive data. The method involves acquiring historical behavioral data of a software system and cleaning and normalizing this data. Behavioral features are then extracted from the preprocessed historical behavioral data, and a security feature vector is constructed based on these features. Next, a machine learning algorithm is trained using this security feature vector to build an attack model for identifying attack behavior types. Subsequently, current behavioral data is input into the attack model to identify whether the current behavioral data constitutes an attack, and if so, the attack behavior type is determined. Finally, based on the attack behavior type corresponding to the current behavioral data, the target data accessed by the current behavioral data is encrypted using a combination of asymmetric and symmetric encryption. A random number generator is used to generate the encryption key, and a secret sharing algorithm is used to divide the encryption key into multiple fragments for distributed storage. This method identifies attack behaviors in system software behavior data through an attack model, and then performs a combination of symmetric and asymmetric encryption on sensitive data that may be involved in the attack. At the same time, the encryption keys of the combined encryption are fragmented and distributed for storage. This ensures that if sensitive data is potentially leaked or attacked, reading and accessing it requires the recovery of all key fragments for decryption. Even in the complex operating environment of the software system, the security of sensitive data can be guaranteed.

[0068] Example 2 like Figure 4 As shown, in one embodiment, the sensitive data security encryption method provided by the present invention includes the following steps in step S110: Step S111: Collect historical behavior data of the software system at fixed time intervals, and clean the historical behavior data to remove noise and outliers.

[0069] Step S112: Map the cleaned historical behavior data to a preset interval to normalize the cleaned historical behavior data and obtain preprocessed historical behavior data.

[0070] This invention discloses a method for secure encryption of sensitive data. It collects historical behavioral data from system operation, cleans the data to remove noise and outliers, and normalizes the data by mapping it to a preset interval, resulting in preprocessed historical behavioral data. This method improves data quality and consistency, provides a reliable foundation for subsequent behavioral analysis and model building, and enhances the accuracy of system security monitoring.

[0071] Example 3 like Figure 5 As shown, in one embodiment, the sensitive data security encryption method provided by the present invention includes the following steps in step S140: Step S141: Extract the traffic rate and the number of data packets from the preprocessed current behavior data, and construct a security feature vector based on the traffic rate and the number of data packets.

[0072] Step S142: Perform feature matching between the security feature vector and the model output of the attack model to calculate the similarity between the security feature vector and the model output, and determine whether there is an attack behavior in the security feature vector based on the similarity.

[0073] This invention discloses a method for secure encryption of sensitive data. It extracts traffic rate and data packet count from preprocessed data to construct a security feature vector, and then performs feature matching and similarity calculation between this vector and the output of an attack model to accurately identify whether the data contains malicious activity. This method achieves dynamic perception and real-time determination of abnormal traffic, effectively improving the system's ability to identify potential security threats and its response speed.

[0074] Example 4 like Figure 6 As shown, in one embodiment, the sensitive data security encryption method provided by the present invention further includes the following steps in step S140: Step S143: When the similarity between the security feature vector and the model output exceeds a set threshold, it is determined that there is an attack behavior in the security feature vector.

[0075] Step S144: When an attack is detected in the security feature vector, an anomaly handling mechanism is triggered, and the attack type and risk level are determined.

[0076] This invention discloses a method for secure encryption of sensitive data. It accurately identifies attack behavior by determining whether the similarity between a security feature vector and the output of an attack model exceeds a set threshold. Upon identification, it dynamically triggers an anomaly handling mechanism, simultaneously determining the specific attack type and risk level. This method achieves real-time assessment and tiered response to security threats, effectively improving the system's efficiency in handling attacks and the accuracy of security protection.

[0077] Example 5 like Figure 7 As shown, in one embodiment, the sensitive data security encryption method provided by the present invention further includes the following steps in step S140: Step S145: In response to the exception handling mechanism, select the corresponding exception handling strategy based on the attack type and risk level corresponding to the current behavior data.

[0078] Step S146: Execute the exception handling strategy, and while executing the exception handling strategy, record the attack time, attack source, and attack type of the current behavior data.

[0079] The risk level is used to represent different risk degrees of the attack behavior, different risk levels and attack types correspond to different abnormal processing strategies, and the abnormal processing strategies include issuing an alarm, attack behavior monitoring, and network disconnection control.

[0080] The sensitive data security encryption method provided by the embodiment of the application can dynamically select and execute corresponding abnormal processing strategies according to the identified attack type and risk level, cover measures such as alarms, monitoring, and network control, and record the attack time, source, and type in detail. The method realizes accurate hierarchical response and comprehensive audit tracking of security events, and effectively improves the system emergency response capability and the traceability of security events.

[0081] Embodiment 6 As shown in the figure, in one embodiment, the sensitive data security encryption method provided by the application specifically includes the following steps: Figure 8 Step S151, SSL certificates and private keys are generated on the server side and the user side of the target data transmission, and the SSL certificates and private keys are loaded when the server is started to create an SSL context. Step S152, when the user side and the server side establish a connection, SSL handshake negotiation is performed, and the negotiated encryption algorithm and key are used for encryption when the target data is transmitted.

[0082] Step S153, when the target data is stored, a symmetric encryption algorithm is used to encrypt the target data to generate a symmetric encryption key, and the symmetric encryption key is encrypted by an asymmetric encryption algorithm.

[0083] The sensitive data security encryption method provided by the embodiment of the application can configure SSL certificates and private keys on the server side and the user side to establish a secure transmission channel, and perform SSL handshake negotiation when connected to ensure the confidentiality of data transmission. At the same time, symmetric encryption is used to store data, and the key is protected by asymmetric encryption, which effectively guarantees the security and integrity of data in the transmission and storage process.

[0084] Embodiment 7

[0085] As shown in the figure, in one embodiment, the sensitive data security encryption method provided by the application specifically includes the following steps: Step S161, based on a symmetric encryption algorithm and an asymmetric encryption algorithm, an encryption key of a set length is generated by a random number generator, and a secret sharing algorithm is called to divide the encryption key into multiple fragments. Figure 9 Step S161, based on a symmetric encryption algorithm and an asymmetric encryption algorithm, an encryption key of a set length is generated by a random number generator, and a secret sharing algorithm is called to divide the encryption key into multiple fragments.

[0086] ​Step S162: Store multiple fragments on different storage nodes, and when calling the encryption key, obtain all key fragments on different storage nodes, and simultaneously call the secret sharing algorithm to recover all key fragments.

[0087] This invention discloses a method for securely encrypting sensitive data. A high-strength encryption key is generated using a random number generator, and then divided into multiple fragments using a secret-sharing algorithm, each fragment being stored on a different node. When needed, all fragments must be collected to recover the complete key, effectively avoiding the risk of single-point storage and significantly improving the security and reliability of key management.

[0088] The following describes a sensitive data security encryption device provided by the present invention. The sensitive data security encryption device described below can be referred to in correspondence with the sensitive data security encryption method described above.

[0089] Example 8 like Figure 10 As shown, in one embodiment, a sensitive data security encryption device includes a data preprocessing module 1010, a feature extraction module 1020, a model training module 1030, an attack identification module 1040, a target data encryption module 1050, and a key fragment storage module 1060.

[0090] The data preprocessing module 1010 is used to acquire historical behavior data of the software system and preprocess the historical behavior data, including data cleaning and normalization.

[0091] The feature extraction module 1020 is used to extract behavioral features from preprocessed historical behavioral data and construct a security feature vector based on the behavioral features.

[0092] The model training module 1030 is used to train machine learning algorithms based on security feature vectors to build attack models for identifying attack behavior types.

[0093] The attack identification module 1040 is used to input the current behavior data into the attack model, so as to call the attack model to identify whether the current behavior data is attack behavior data, and determine the attack behavior type when the current behavior data is attack behavior data.

[0094] The target data encryption module 1050 is used to perform a combination of asymmetric and symmetric encryption on the target data accessed by the current behavior data based on the attack behavior type corresponding to the current behavior data.

[0095] The key sharding storage module 1060 is used to generate an encryption key using a random number generator and divide the encryption key into multiple shards using a secret sharing algorithm for distributed storage of the multiple shards.

[0096] The historical behavior data is divided into normal behavior data and known attack behavior data, and the behavior features include a flow rate and a packet quantity.

[0097] In this embodiment, the sensitive data security encryption device provided by the application is provided with a data preprocessing module 1010, which is specifically used for: The historical behavior data of the software system running at a fixed time interval is collected, and the historical behavior data is cleaned to remove noise and outliers in the historical behavior data.

[0098] The cleaned historical behavior data is mapped to a preset interval to normalize the cleaned historical behavior data, and the preprocessed historical behavior data is obtained.

[0099] In this embodiment, the sensitive data security encryption device provided by the application is provided with an attack identification module 1040, which is specifically used for: The flow rate and the packet quantity are extracted from the preprocessed current behavior data, and a security feature vector is constructed based on the flow rate and the packet quantity.

[0100] The security feature vector is matched with the model output of the attack model to calculate the similarity between the security feature vector and the model output, and whether there is an attack behavior in the security feature vector is determined according to the similarity.

[0101] In this embodiment, the sensitive data security encryption device provided by the application is provided with an attack identification module 1040, which is specifically used for: When the similarity between the security feature vector and the model output exceeds a set threshold, it is determined that there is an attack behavior in the security feature vector.

[0102] When there is an attack behavior in the security feature vector, an abnormal processing mechanism is triggered, and the attack type and the risk level are determined.

[0103] In this embodiment, the sensitive data security encryption device provided by the application is provided with an attack identification module 1040, which is specifically used for: In response to the abnormal processing mechanism, the corresponding abnormal processing strategy is selected according to the attack type and the risk level corresponding to the current behavior data.

[0104] The abnormal processing strategy is executed, and when the abnormal processing strategy is executed, the attack behavior time, the attack behavior source and the attack behavior type of the current behavior data are recorded.

[0105] The risk level is used to represent different risk levels of attack behaviors, different risk levels and attack types correspond to different abnormal processing strategies, and the abnormal processing strategy includes issuing an alarm, attack behavior monitoring and network interruption control.

[0106] In this embodiment, the sensitive data security encryption device provided by the application is characterized in that the target data encryption module 1050 is specifically used for: The SSL certificate and the private key are generated on the server side and the user side of the target data transmission, and the SSL certificate and the private key are loaded when the server starts to create the SSL context.

[0107] When the user side and the server side establish a connection, SSL handshake negotiation is performed, and the negotiated encryption algorithm and key are used for encryption when the target data is transmitted.

[0108] When the target data is stored, the symmetric encryption algorithm is used to encrypt the target data to generate a symmetric encryption key, and the asymmetric encryption algorithm is used to encrypt the symmetric encryption key.

[0109] In this embodiment, the sensitive data security encryption device provided by the application is characterized in that the key fragment storage module 1060 is specifically used for: Based on the symmetric encryption algorithm and the asymmetric encryption algorithm, the encryption key of a set length is generated by the random number generator, and the encryption key is divided into multiple fragments by calling the secret sharing algorithm.

[0110] The multiple fragments are respectively stored on different storage nodes, and when the encryption key is called, all the key fragments on the different storage nodes are obtained, and the secret sharing algorithm is called to recover all the key fragments.

[0111] The sensitive data security encryption device provided by the embodiment of the application is characterized in that the system behavior data is cleaned and normalized by the data preprocessing module, the security feature vector is constructed by the feature extraction module, the attack model is constructed by the model training module using the vector to train the machine learning algorithm. The attack recognition module identifies and classifies the attack behavior in real time with the help of the model, the target data encryption module performs asymmetric and symmetric combined encryption on the associated sensitive data, and the key fragment storage module distributes and stores the encryption key fragments by the secret sharing algorithm. The device realizes full-link security protection from attack behavior identification to data active encryption protection, effectively improves the anti-leakage and anti-attack capability of sensitive data in a complex software environment.

[0112] Embodiment 9 Figure 11 An example of an entity structure diagram of an electronic device, which can be a smart terminal, is shown in FIG. 1, and the internal structure diagram can be as shown in FIG. 2. Figure 11As shown. The electronic device includes a processor, a memory and a network interface connected by a system bus. Among them, the processor of the electronic device is used to provide computing and control capability. The memory of the electronic device includes non-volatile storage medium, memory. The non-volatile storage medium stores operating system and computer program. The memory provides an environment for the running of the operating system and the computer program in the non-volatile storage medium. The network interface of the electronic device is used to communicate with the external terminal through the network connection. The computer program is executed by the processor to implement the sensitive data security encryption method, which comprises: Obtain the historical behavior data of the software system running, and preprocess the historical behavior data, the preprocessing including data cleaning and normalization; Extract behavior features from the preprocessed historical behavior data, and construct a security feature vector based on the behavior features; Based on the security feature vector, the machine learning algorithm is trained to construct an attack model for identifying attack behavior types; Input the current behavior data into the attack model to call the attack model to identify whether the current behavior data is attack behavior data, and determine the attack behavior type when the current behavior data is attack behavior data; Based on the attack behavior type corresponding to the current behavior data, the target data accessed by the current behavior data is combined encrypted by asymmetric encryption and symmetric encryption; A random number generator is used to generate an encryption key, and the encryption key is divided into multiple fragments by a secret sharing algorithm for distributed storage of the multiple fragments. Among them, the historical behavior data is divided into normal behavior data and known attack behavior data, and the behavior features include flow rate and packet quantity.

[0113] The embodiment of the application provides a sensitive data security encryption electronic device, which executes the computer program stored in the memory by the processor to realize the sensitive active security encryption protection. The device first preprocesses the historical behavior data of the software system and extracts features, constructs a security feature vector and trains a machine learning model that can identify attack types. Then, the model is used to monitor and classify real-time behavior data. Once attack behavior is identified, asymmetric and symmetric combined encryption is started on the related target data, and the generated encryption key fragments are stored in distributed nodes through the secret sharing mechanism. This integrated solution realizes the whole process of automatic protection from attack identification to data encryption at the hardware level, significantly improving the security and attack resistance of sensitive data in complex running environment.

[0114] Those skilled in the art can understand that, Figure 11The structure shown in the figure is only a block diagram of part of the structure related to the scheme of the present application, and does not constitute a limitation on the electronic device to which the scheme of the present application is applied; a specific electronic device can include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0115] Embodiment 10 In another aspect, the embodiment of the present application also provides a computer storage medium storing a computer program, the computer program being executed by a processor to implement a sensitive data security encryption method, the method comprising: obtaining historical behavior data of a software system running, and pre-processing the historical behavior data, the pre-processing including data cleaning and normalization; extracting behavior features from the pre-processed historical behavior data, and constructing a security feature vector based on the behavior features; training a machine learning algorithm based on the security feature vector to construct an attack model for identifying an attack behavior type; inputting current behavior data into the attack model to call the attack model to identify whether the current behavior data is attack behavior data, and determining an attack behavior type when the current behavior data is attack behavior data; performing combined encryption of asymmetric encryption and symmetric encryption on target data accessed by the current behavior data based on the attack behavior type corresponding to the current behavior data; generating an encryption key using a random number generator, and dividing the encryption key into multiple fragments by a secret sharing algorithm to perform distributed storage on the multiple fragments; The historical behavior data is divided into normal behavior data and known attack behavior data, and the behavior features include flow rate and packet quantity.

[0116] The embodiment of the present application provides a sensitive data security encryption computer storage medium, the computer program stored in the computer storage medium being executed by a processor to implement active sensitive data security encryption protection. By pre-processing system behavior data and constructing a feature vector to train an attack recognition model, and then performing asymmetric and symmetric combined encryption on target data associated with the identified attack behavior, and simultaneously using a secret sharing algorithm to fragment and distribute the encryption key. The medium enables the security method to be conveniently deployed and stably operated, forming an automatic protection chain from attack perception to data encryption, and significantly enhancing the anti-attack and anti-leakage capabilities of sensitive data in a complex software environment.

[0117] Embodiment 11 In yet another aspect, a computer program product or computer program is provided, which includes computer instructions stored in a computer-readable storage medium. A processor of an electronic device reads the computer instructions from the computer-readable storage medium, and the processor implements a sensitive data security encryption method when executing the computer instructions, the method comprising: obtaining historical behavior data of a software system running, and preprocessing the historical behavior data, the preprocessing including data cleaning and normalization; extracting behavior features from the preprocessed historical behavior data, and constructing a security feature vector based on the behavior features; training a machine learning algorithm based on the security feature vector to construct an attack model for identifying attack behavior types; inputting current behavior data into the attack model to call the attack model to identify whether the current behavior data is attack behavior data, and determining an attack behavior type when the current behavior data is attack behavior data; performing combined encryption of asymmetric encryption and symmetric encryption on target data accessed by the current behavior data based on the attack behavior type corresponding to the current behavior data; generating an encryption key using a random number generator, and dividing the encryption key into multiple fragments using a secret sharing algorithm to perform distributed storage of the multiple fragments; wherein the historical behavior data is divided into normal behavior data and known attack behavior data, and the behavior features include flow rate and packet quantity.

[0118] The embodiment of the application provides a sensitive data security encryption computer program product, which contains computer instructions that can implement a complete sensitive data active protection process when executed by a processor. By preprocessing behavior data, constructing a feature vector, and training an attack recognition model, asymmetric and symmetric combined encryption is started on the identified threat-related data, and the secret sharing algorithm is used to fragment and distribute the encryption key. This product integrates attack awareness, data encryption, and key management into an integrated solution, significantly enhancing the anti-attack ability and overall security of sensitive data in complex environments.

[0119] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer readable storage medium. When the computer program is executed, it can include the processes of the above-mentioned embodiment methods. Any reference to memory, storage, database or other medium used in each embodiment of the present application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory.

[0120] By way of illustration and not limitation, RAM is available in a variety of forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0121] The technical features of the above embodiments can be combined in any way. In order to make the description concise, not all possible combinations of the technical features in the above embodiments are described, but as long as the combinations of the technical features do not exist, they should be considered as the scope of the present application.

[0122] The above embodiments only express several embodiments of the present application, and the description is more specific and detailed, but it should not be understood as a limitation on the scope of the patent of the present application. It should be pointed out that for ordinary skilled in the art, without departing from the concept of the present application, a number of modifications and improvements can be made, which are within the scope of protection of the present application. Therefore, the scope of protection of the patent of the present application should be subject to the appended claims.

[0123] In the description of the specification, the description of the terms "one embodiment", "some embodiments", "an example", "a specific example", or "some examples" and the like means that the specific features, structures, materials or characteristics described in connection with the embodiment or example are included in at least one embodiment or example of the present application. In the specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Also, the specific features, structures, materials or characteristics described can be combined in any appropriate manner in any one or more embodiments or examples. Furthermore, the person skilled in the art can combine and combine the different embodiments or examples described in the specification and the features of the different embodiments or examples, without contradiction.

[0124] In addition, the terms "first", "second", are used only for descriptive purposes and cannot be understood as indicating or implying relative importance or implicitly indicating the number of the technical features indicated. Thus, the features defined with "first", "second" can include at least one of the features, explicitly or implicitly. In the description of the present application, the meaning of "a plurality of" is at least two, for example, two, three, etc., unless otherwise explicitly specified.

Claims

1. A method for secure encryption of sensitive data, characterized by, The method comprises: Step S110, obtaining historical behavior data of software system running, and preprocessing the historical behavior data, the preprocessing including data cleaning and normalization; Step S120, extracting behavior features from the preprocessed historical behavior data, and constructing a security feature vector based on the behavior features; Step S130, training a machine learning algorithm based on the security feature vector to construct an attack model for identifying attack behavior types; Step S140, inputting current behavior data into the attack model to call the attack model to identify whether the current behavior data is attack behavior data, and determining an attack behavior type when the current behavior data is attack behavior data; Step S150, performing combined encryption of asymmetric encryption and symmetric encryption on target data accessed by the current behavior data based on the attack behavior type corresponding to the current behavior data; Step S160, generating an encryption key using a random number generator, and dividing the encryption key into multiple fragments by a secret sharing algorithm to perform distributed storage on the multiple fragments; Wherein, the historical behavior data is divided into normal behavior data and known attack behavior data, and the behavior features include flow rate and packet quantity.

2. The method of claim 1, wherein, The step S110 comprises: Collecting historical behavior data of software system running at fixed time intervals, and cleaning the historical behavior data to remove noise and outliers in the historical behavior data; Mapping the cleaned historical behavior data to a preset interval to normalize the cleaned historical behavior data, and obtaining preprocessed historical behavior data.

3. The method of claim 1, wherein the sensitive data is encrypted by using a symmetric key encryption algorithm. The step S140 comprises: Extracting flow rate and packet quantity from the preprocessed current behavior data, and constructing a security feature vector based on the flow rate and packet quantity; Performing feature matching between the security feature vector and the model output of the attack model to calculate the similarity between the security feature vector and the model output, and determining whether there is attack behavior in the security feature vector according to the similarity.

4. The sensitive data security encryption method of claim 3, wherein, The step S140 further comprises: When the similarity between the security feature vector and the model output exceeds a set threshold, it is determined that there is attack behavior in the security feature vector; When there is attack behavior in the security feature vector, triggering an exception handling mechanism, and determining an attack type and a risk level.

5. The sensitive data secure encryption method of claim 4, wherein, The step S140 further comprises: In response to the exception handling mechanism, selecting a corresponding exception handling strategy according to the attack type and the risk level corresponding to the current behavior data; Executing the exception handling strategy, and recording the attack behavior time, attack behavior source and attack behavior type of the current behavior data when executing the exception handling strategy; Wherein, the risk level is used to represent different risk levels of attack behavior, different risk levels and attack types correspond to different exception handling strategies, and the exception handling strategy includes issuing an alarm, attack behavior monitoring and network interruption control.

6. The method of claim 1, wherein, The step S150 comprises: The SSL certificate and the private key are generated at the server side and the user side of the target data transmission, and the SSL certificate and the private key are loaded when the server starts to create an SSL context; When the user side and the server side establish a connection, SSL handshake negotiation is performed, and the negotiated encryption algorithm and key are used for encryption during the target data transmission; When the target data is stored, a symmetric encryption algorithm is used to encrypt the target data to generate a symmetric encryption key, and the symmetric encryption key is encrypted by an asymmetric encryption algorithm.

7. The sensitive data secure encryption method of claim 6, wherein, The step S160 comprises: Based on the symmetric encryption algorithm and the asymmetric encryption algorithm, an encryption key of a set length is generated by a random number generator, and the encryption key is divided into multiple fragments by calling a secret sharing algorithm; The multiple fragments are stored on different storage nodes, and when the encryption key is called, all key fragments on different storage nodes are obtained, and the secret sharing algorithm is called to restore all key fragments.

8. A sensitive data security encryption apparatus, characterized by, The device for implementing the sensitive data security encryption method of any one of claims 1 to 7 comprises: A data preprocessing module for obtaining historical behavior data of software system running and preprocessing the historical behavior data, the preprocessing including data cleaning and normalization; A feature extraction module for extracting behavior features from the preprocessed historical behavior data and constructing a security feature vector based on the behavior features; A model training module for training a machine learning algorithm based on the security feature vector to construct an attack model for identifying attack behavior types; An attack identification module for inputting current behavior data into the attack model to call the attack model to identify whether the current behavior data is attack behavior data, and determining the attack behavior type when the current behavior data is attack behavior data; A target data encryption module for asymmetric encryption and symmetric encryption combined encryption of target data accessed by the current behavior data based on the attack behavior type corresponding to the current behavior data; A key fragment storage module for generating an encryption key using a random number generator and dividing the encryption key into multiple fragments by a secret sharing algorithm to distribute the multiple fragments; The historical behavior data is divided into normal behavior data and known attack behavior data, and the behavior features include traffic rate and packet quantity.

9. An electronic device comprising a memory and a processor, the memory storing a computer program, characterized in that, The processor executes the computer program to implement the steps of the sensitive data security encryption method of any one of claims 1 to 7.

10. A computer storage medium storing a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the sensitive data security encryption method of any one of claims 1 to 7.

Images