Sensitive data security encryption method and device

Abstract

The application relates to a sensitive data security encryption method and device, which comprises the following steps: obtaining historical behavior data of a software system, and preprocessing the historical behavior data; extracting behavior features from the historical behavior data, and constructing a security feature vector based on the behavior features; training a machine learning algorithm based on the security feature vector to construct an attack model for identifying an attack behavior type; inputting current behavior data into the attack model to call the attack model to identify whether the current behavior data is attack behavior data, and determining the attack behavior type when the current behavior data is attack behavior data; performing combined encryption of asymmetric encryption and symmetric encryption on target data accessed by the current behavior data based on the attack behavior type corresponding to the current behavior data; generating an encryption key by using a random number generator, and dividing the encryption key into multiple fragments by using a secret sharing algorithm to perform distributed storage on the multiple fragments.

Description

Technical Field

[0001] This invention relates to the field of data encryption technology, and in particular to a method, apparatus, electronic device, and storage medium for secure encryption of sensitive data. Background Technology

[0002] In today's rapidly developing digital age, the importance of software system performance optimization and resource management is becoming increasingly prominent. As software functions continue to increase and the number of users grows, many software systems face performance bottlenecks and resource waste, posing significant challenges to the security of sensitive data.

[0003] Currently, most software systems still employ traditional resource allocation and scheduling strategies. In terms of resource allocation, they primarily rely on pre-defined rules to distribute system resources (CPU, memory, disk I / O, etc.) to different tasks or processes. For example, a task might be allocated a fixed number of CPU cores and a certain amount of memory. However, this approach makes it difficult to adjust resource allocation according to the actual needs of the task during execution. Regarding resource scheduling, the main scheduling algorithms prioritize tasks based on factors such as priority and execution time, then execute tasks sequentially. Examples include First-Come, First-Served (FCFS) and Shortest Job First (SJF), which are widely used.

[0004] Therefore, given the complex operating environment of software systems, multiple tasks may run simultaneously on different nodes. Traditional resource allocation and scheduling strategies are difficult to effectively coordinate the resource allocation and scheduling of multiple tasks, ultimately making it difficult to effectively protect the security of sensitive data during software system operation. Summary of the Invention

[0005] The present invention aims to provide a method, apparatus, electronic device and storage medium for secure encryption of sensitive data, so as to overcome the shortcomings of the prior art. The technical problem to be solved by the present invention is achieved through the following technical solutions.

[0006] This invention provides a method for secure encryption of sensitive data. The method includes: acquiring historical behavior data of a software system and preprocessing the historical behavior data, including data cleaning and normalization; extracting behavioral features from the preprocessed historical behavior data and constructing a security feature vector based on the behavioral features; training a machine learning algorithm based on the security feature vector to construct an attack model for identifying attack behavior types; inputting current behavior data into the attack model to call the attack model to identify whether the current behavior data is attack behavior data, and determining the attack behavior type when the current behavior data is attack behavior data; performing a combination of asymmetric and symmetric encryption on the target data accessed by the current behavior data based on the attack behavior type corresponding to the current behavior data; generating an encryption key using a random number generator and dividing the encryption key into multiple fragments using a secret sharing algorithm for distributed storage of the multiple fragments; wherein the historical behavior data is divided into normal behavior data and known attack behavior data, and the behavioral features include traffic rate and data packet count.

[0007] In one embodiment, the step of acquiring historical behavior data of the software system and preprocessing the historical behavior data includes data cleaning and normalization, comprising: collecting historical behavior data of the software system at fixed time intervals and cleaning the historical behavior data to remove noise and outliers; mapping the cleaned historical behavior data to a preset interval to normalize the cleaned historical behavior data to obtain preprocessed historical behavior data.

[0008] In one embodiment, the step of inputting the current behavior data into the attack model to call the attack model to identify whether the current behavior data is attack behavior data, and to determine the attack behavior type when the current behavior data is attack behavior data, includes: extracting traffic rate and data packet number from the preprocessed current behavior data, and constructing a security feature vector based on the traffic rate and data packet number;

[0009] The security feature vector is matched with the model output of the attack model to calculate the similarity between the security feature vector and the model output, and the presence of attack behavior in the security feature vector is determined based on the similarity.

[0010] In one embodiment, the step of inputting the current behavior data into the attack model to call the attack model to identify whether the current behavior data is attack behavior data, and determining the attack behavior type when the current behavior data is attack behavior data, further includes: when the similarity between the security feature vector and the model output exceeds a set threshold, determining that there is an attack behavior in the security feature vector; when there is an attack behavior in the security feature vector, triggering an anomaly handling mechanism, and determining the attack type and risk level.

[0011] In one embodiment, the step of inputting current behavior data into the attack model to call the attack model to identify whether the current behavior data is attack behavior data, and determining the attack behavior type when the current behavior data is attack behavior data, further includes: responding to the anomaly handling mechanism, selecting a corresponding anomaly handling strategy based on the attack type and risk level corresponding to the current behavior data; executing the anomaly handling strategy, and recording the attack behavior time, attack behavior source, and attack behavior type of the current behavior data when executing the anomaly handling strategy; wherein, the risk level is used to characterize different risk levels of attack behavior, and different risk levels and attack types correspond to different anomaly handling strategies, and the anomaly handling strategy includes issuing alarms, attack behavior monitoring, and network interruption control.

[0012] In one embodiment, the step of performing a combination of asymmetric and symmetric encryption on the target data accessed by the current behavior data based on the attack behavior type corresponding to the current behavior data includes: generating SSL certificates and private keys on the server and user ends of the target data transmission respectively, and loading the SSL certificate and private key when the server starts to create an SSL context; performing SSL handshake negotiation when the user end and the server establish a connection, and using the negotiated encryption algorithm and key for encryption during the transmission of the target data; and encrypting the target data using a symmetric encryption algorithm to generate a symmetric encryption key during the storage of the target data, and then encrypting the symmetric encryption key using an asymmetric encryption algorithm.

[0013] In one embodiment, the step of generating an encryption key using a random number generator and dividing the encryption key into multiple fragments using a secret sharing algorithm for distributed storage includes: generating an encryption key of a set length using a random number generator based on symmetric and asymmetric encryption algorithms, and dividing the encryption key into multiple fragments by calling a secret sharing algorithm; storing the multiple fragments on different storage nodes, and when the encryption key is invoked, retrieving all key fragments on different storage nodes, and simultaneously invoking the secret sharing algorithm to recover all key fragments.

[0014] This invention also provides a sensitive data security encryption device for implementing the sensitive data security encryption method described in any of the above claims. The device includes: a data preprocessing module for acquiring historical behavior data of a software system and preprocessing the historical behavior data, the preprocessing including data cleaning and normalization; a feature extraction module for extracting behavioral features from the preprocessed historical behavior data and constructing a security feature vector based on the behavioral features; a model training module for training a machine learning algorithm based on the security feature vector to construct an attack model for identifying attack behavior types; and an attack identification module for inputting current behavior data into the attack identification module. The system includes a model for identifying whether current behavior data is attack behavior data and determining the attack behavior type when the current behavior data is attack behavior data; a target data encryption module for performing a combination of asymmetric and symmetric encryption on the target data accessed by the current behavior data based on the attack behavior type corresponding to the current behavior data; and a key sharding storage module for generating encryption keys using a random number generator and dividing the encryption keys into multiple shards using a secret sharing algorithm for distributed storage of the multiple shards. The historical behavior data is divided into normal behavior data and known attack behavior data, and the behavior characteristics include traffic rate and number of data packets.

[0015] The present invention also provides an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the sensitive data security encryption method as described above.

[0016] The present invention also provides a computer storage medium storing a computer program, which, when executed by a processor, implements the sensitive data security encryption method as described above.

[0017] This invention discloses a method, apparatus, electronic device, and computer storage medium for secure encryption of sensitive data. The method involves acquiring historical behavioral data of a software system and cleaning and normalizing this data. Behavioral features are then extracted from the preprocessed historical behavioral data, and a security feature vector is constructed based on these features. Subsequently, a machine learning algorithm is trained using this security feature vector to build an attack model for identifying attack behavior types. The current behavioral data is then input into the attack model to identify whether it constitutes an attack, and if so, the attack behavior type is determined. Finally, based on the attack behavior type corresponding to the current behavioral data, the target data accessed by the current behavioral data is encrypted using a combination of asymmetric and symmetric encryption. A random number generator is used to generate the encryption key, and a secret sharing algorithm is used to divide the encryption key into multiple fragments for distributed storage. This method identifies attack behaviors in system software behavior data through an attack model, and then performs a combination of symmetric and asymmetric encryption on sensitive data that may be involved in the attack. At the same time, the encryption keys of the combined encryption are fragmented and distributed for storage. This ensures that if sensitive data is potentially leaked or attacked, reading and accessing it requires the recovery of all key fragments for decryption. Even in the complex operating environment of the software system, the security of sensitive data can be guaranteed. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0019] Figure 1 This is one of the flowcharts illustrating a method for securely encrypting sensitive data according to an embodiment of the present invention;

[0020] Figure 2 This is a schematic diagram of the attack behavior identification process of a sensitive data security encryption method provided in an embodiment of the present invention;

[0021] Figure 3 This invention provides a schematic diagram of the data encryption and key management architecture for a sensitive data security encryption method.

[0022] Figure 4 This is a second schematic flowchart illustrating a method for securely encrypting sensitive data according to an embodiment of the present invention.

[0023] Figure 5The third schematic flowchart of a method for securely encrypting sensitive data provided in an embodiment of the present invention;

[0024] Figure 6 The fourth flowchart illustrates a method for securely encrypting sensitive data according to an embodiment of the present invention.

[0025] Figure 7 The fifth flowchart illustrates a method for securely encrypting sensitive data according to an embodiment of the present invention.

[0026] Figure 8 A schematic flowchart of a method for securely encrypting sensitive data provided in an embodiment of the present invention is shown in Figure 6.

[0027] Figure 9 The seventh flowchart illustrates a method for securely encrypting sensitive data according to an embodiment of the present invention.

[0028] Figure 10 This is a schematic diagram of the structure of a sensitive data security encryption device provided in an embodiment of the present invention;

[0029] Figure 11 This is an internal structural diagram of a sensitive data security encryption electronic device provided in an embodiment of the present invention. Detailed Implementation

[0030] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0031] The following is combined with Figures 1 to 11 This invention describes a method, apparatus, electronic device, and storage medium for secure encryption of sensitive data, according to embodiments of the present invention.

[0032] Example 1

[0033] like Figure 1 As shown, in one embodiment, a method for securely encrypting sensitive data includes the following steps:

[0034] Step S110: Obtain historical behavior data of the software system and preprocess the historical behavior data, including data cleaning and normalization.

[0035] Historical behavior data is divided into normal behavior data and known attack behavior data.

[0036] Specifically, historical behavioral data of the software system (including normal behavior and known attack behavior data, such as network traffic and CPU utilization) is obtained and preprocessed. Preprocessing includes data cleaning to remove noise and outliers, and normalization to map feature values ​​to a fixed range.

[0037] Specifically, historical behavior data identified in the software system is obtained as data samples, which are divided into normal behavior data and known attack behavior data. The obtained historical behavior data is then cleaned and normalized to obtain preprocessed historical behavior data.

[0038] Specifically, in combination Figure 2 and Figure 3 As shown in the specific embodiment, the sensitive data security encryption method provided by the present invention first initializes the system monitoring tools or sensors during the operation of the software system to ensure their normal operation. Using the Python psutil library, historical behavioral data (including normal behavioral data and known attack behavior data) of the system is collected at certain time intervals (every 5 minutes) through system monitoring tools, sensors, system logs, network traffic monitoring, and performance monitoring. This includes network traffic, CPU utilization, memory usage, disk I / O, etc. The collected data is stored in a temporary buffer or database for subsequent processing.

[0039] Furthermore, historical behavioral data collected is read from a temporary buffer or database, and preprocessing operations such as cleaning and normalization are performed on the collected behavioral data. The cleaning operation mainly removes noise and outliers from the behavioral data; normalization maps the feature values ​​of the data to a fixed range so that machine learning algorithms can process them.

[0040] Step S120: Extract behavioral features from the preprocessed historical behavioral data and construct a security feature vector based on the behavioral features.

[0041] Among these, behavioral characteristics include traffic rate and data packet count. A security feature vector is a set of feature values ​​used to describe the behavior of a software system. Each feature value in the vector represents a specific behavior or state of the system, such as network traffic, CPU utilization, memory usage, disk I / O, etc. These feature values ​​are normalized to form a fixed-dimensional vector for subsequent processing by machine learning algorithms.

[0042] Specifically, behavioral features (such as average traffic rate, average CPU utilization, etc.) are extracted from preprocessed historical behavioral data, and a fixed-dimensional security feature vector is constructed based on these behavioral features.

[0043] Specifically, traffic rate and data packet count are extracted from the preprocessed historical behavior data obtained in step S110, and a security feature vector containing network traffic, CPU utilization, memory usage, disk I / O and other feature values ​​is constructed based on the traffic rate and data packet count.

[0044] Specifically, in combination Figure 2 and Figure 3 As shown in the specific embodiment, the sensitive data security encryption method provided by the present invention extracts features from preprocessed behavioral data according to a predefined feature extraction algorithm, extracts representative features, and then combines the extracted features into a security feature vector.

[0045] The algorithms for feature extraction and secure feature vector formation are as follows:

[0046] Extracting traffic rate features: flow_rate = np.mean(network_traffic);

[0047] Extracting packet count features: packet_count = len(network_traffic);

[0048] Create a security feature vector: security_feature_vector = [flow_rate, packet_count].

[0049] Step S130: Based on the security feature vector, train the machine learning algorithm to build an attack model for identifying attack behavior types.

[0050] The attack model is a model trained using machine learning algorithms to identify different types of attack behaviors. It employs various machine learning algorithms, such as decision trees, support vector machines, and neural networks. During the training process, a large amount of historical behavior data is used to train and optimize the model, including normal behavior data and known attack behavior data.

[0051] Specifically, an improved random forest algorithm (introducing an adaptive feature sampling mechanism and optimizing the decision tree splitting criterion) is used to train a model based on security feature vectors and construct an attack model for identifying attack behavior types.

[0052] Specifically, based on the security feature vector constructed in step S120, the machine learning algorithm is trained to finally construct an attack model for identifying attack behavior types.

[0053] Step S140: Input the current behavior data into the attack model to call the attack model to identify whether the current behavior data is attack behavior data, and determine the attack behavior type when the current behavior data is attack behavior data.

[0054] Specifically, the current behavior data to be identified is input into the attack model trained in step S130, the attack model is called to identify whether the current behavior data has an attack behavior, and when the current behavior data has an attack behavior, the corresponding attack behavior type is determined.

[0055] Specifically, in combination Figure 2 and Figure 3 As shown in the specific embodiment, the sensitive data security encryption method provided by the present invention loads a pre-trained attack model and inputs the security feature vector corresponding to the behavior data to be identified into the pre-trained attack model for feature matching. The feature matching process uses similarity calculation and classification prediction to determine whether there is an attack behavior in the vector, that is, whether there is an attack behavior in the corresponding behavior data. If the similarity exceeds a set threshold or the prediction result is an attack behavior, then an attack behavior is considered to exist.

[0056] The algorithm for identifying attack behaviors in behavioral events using the attack model is as follows:

[0057] Attack model test data: X_train = np.array([[100, 10], [200, 20], [300, 30],[400, 40], [500, 50]]); Y_train = np.array([0, 0, 1, 1, 1]); model =RandomForestClassifier(); model.fit(X_train, Y_train);

[0058] Security feature vector: security_feature_vector = np.array([[350, 35]]);

[0059] Perform classification prediction: prediction = model.predict(security_feature_vector).

[0060] In this embodiment, machine learning algorithms are used to classify attack behaviors. The classification is based on factors such as the purpose, method, and characteristics of the attack, including denial-of-service attacks, SQL injection attacks, and cross-site scripting attacks.

[0061] The algorithm for identifying attack behavior types is as follows:

[0062] Test data for the attack classification model: X_train = np.array([[100, 10], [200, 20], [300,30], [400, 40], [500, 50]]); Y_train = np.array(['normal', 'normal', 'denial-of-service attack', 'denial-of-service attack', 'denial-of-service attack']); model = RandomForestClassifier(); model.fit(X_train, Y_train);

[0063] Extract the security feature vector: security_feature_vector = np.array([[350, 35]]);

[0064] Perform attack classification prediction: prediction = model.predict(security_feature_vector).

[0065] In this embodiment, if abnormal behavior is detected, the system will immediately issue an alarm and take corresponding measures, such as blocking access or isolating the affected parts. Different anomaly handling strategies will be implemented depending on the type and severity of the attack.

[0066] Specifically, when the feature matching unit determines that there is an attack, it triggers the anomaly handling mechanism. Based on the type and severity of the attack, it selects the appropriate anomaly handling strategy, executes the anomaly handling strategy, issues an alarm, blocks access, isolates the affected parts, etc., and records relevant information on the anomaly handling, including the attack time, attack type, and handling measures.

[0067] The anomaly handling algorithm for when behavioral data contains malicious behavior is as follows:

[0068] Configure logging: logging.basicConfig(level=logging.INFO);

[0069] Attack detected: is_attack = True; if is_attack:;

[0070] Issue an alarm logic branch;

[0071] Prevent access to branches;

[0072] Isolate the affected branches.

[0073] Specifically, different response strategies are adopted based on the type and severity of the attack. For minor attacks, warnings and monitoring are used; for severe attacks, network connections are immediately severed to prevent data leakage. Simultaneously, relevant attack information, including attack time, source, and type, is recorded to facilitate subsequent analysis and processing.

[0074] Step S150: Based on the attack behavior type corresponding to the current behavior data, perform a combination of asymmetric and symmetric encryption on the target data accessed by the current behavior data.

[0075] Specifically, based on the attack behavior type corresponding to the current behavior data, the target data accessed by the current behavior data is encrypted using a combination of "symmetric encryption + asymmetric encryption + key fragmentation": first, the target data is encrypted using the ChaCha20-Poly1305 symmetric algorithm, then the symmetric key is encrypted using the RSA asymmetric algorithm, and finally, the number of key fragments is determined according to the attack risk level (high risk requires 5 fragments and 3 fragments to recover, low risk requires 3 fragments and 2 fragments to recover) and the asymmetric encrypted key is stored.

[0076] Specifically, based on the attack type determined by the current behavior data, the target data to be attacked or read by the current behavior data is encrypted using a combination of asymmetric and symmetric encryption to protect the target data from being read by the attack behavior.

[0077] Specifically, in combination Figure 2 and Figure 3 As shown in the specific embodiment, the sensitive data security encryption method provided by the present invention uses the SSL / TLS protocol for encryption during data transmission. SSL / TLS is a widely used encryption protocol in network communication, which can ensure that data is not stolen or tampered with during transmission. When establishing a network connection, the user terminal and the server will perform a handshake negotiation, selecting an appropriate encryption algorithm and key to encrypt and transmit the data.

[0078] In this embodiment, the server and client each generate an SSL certificate and a private key. When the server starts, it loads the SSL certificate and private key and creates an SSL context. When the client connects to the server, an SSL handshake is performed to negotiate the encryption algorithm and key. During data transmission, the negotiated encryption algorithm and key are used for encryption. Upon receiving the encrypted data, the receiver decrypts it using the corresponding key.

[0079] Furthermore, during data storage, a novel encryption algorithm is used to encrypt the data. This algorithm combines symmetric and asymmetric encryption, improving encryption performance while ensuring data security. Specifically, AES-GCM and ChaCha20-Poly1305 symmetric encryption algorithms are used to encrypt the data, while RSA and ECC asymmetric encryption algorithms are used to encrypt and manage the symmetric encryption keys.

[0080] Specifically, first, a symmetric encryption key is generated, and the data is encrypted using a symmetric encryption algorithm. Then, an asymmetric encryption algorithm is used to encrypt the symmetric encryption key, and the encrypted key is stored. The encrypted data is then stored in a database or file system. In this way, when reading encrypted data, the asymmetric encryption key is first used to decrypt the symmetric encryption key, and then the symmetric encryption key is used to decrypt the data.

[0081] Step S160: A random number generator is used to generate an encryption key, and the encryption key is divided into multiple fragments using a secret sharing algorithm for distributed storage of the multiple fragments.

[0082] Specifically, a random number generator is used to generate random encryption keys for combined encryption, and the encryption keys are divided into multiple fragments through a secret sharing algorithm. These fragments are then distributed and stored in different storage nodes. This ensures that any action that wants to read the target data must obtain all the key fragments, and only after all the key fragments are recovered and verified can the read permission for the target data be obtained.

[0083] Specifically, in combination Figure 2 and Figure 3 As shown in the specific embodiment, the sensitive data security encryption method provided by the present invention selects a software random number generator after encryption, and uses a combination of hardware and software random number generators to generate a key, which can ensure the randomness and security of the key. According to the requirements of the aforementioned encryption algorithm, a secure random number generator is used to generate an encryption key of a specified length, and the generated key is verified to ensure that it meets the security requirements.

[0084] Furthermore, Shamir's Secret Sharing algorithm is employed to divide the generated encryption key into multiple fragments, each fragment possessing a degree of independence. During the fragmentation process, the number of fragments and the minimum number of fragments required for recovery are first determined. Then, the secret sharing algorithm is used to divide the key into multiple fragments. Finally, the fragments are stored on different nodes or storage media.

[0085] The algorithms for key fragmentation and distributed storage are as follows:

[0086] The test key for sharding is: key = b'1234567890abcdef';

[0087] Number of fragments: n = 5;

[0088] Minimum number of fragments required for recovery: k = 3;

[0089] Create shards: shares = ssss.create_shares(key, n, k);

[0090] Storage sharding:

[0091] for i, share in enumerate(shares):

[0092] with open(f'share_{i}.txt', 'wb') as f:

[0093] f.write(share)

[0094] Furthermore, in the process of distributed storage key sharding, different storage media, such as databases, distributed file systems, and cloud storage, are selected to store the key shards on different storage nodes. At the same time, the stored key shards are backed up to prevent data loss and ensure the security and reliability of the key shards.

[0095] In this embodiment, when a key is needed, the required key fragments are obtained through a secure communication channel. A secret sharing algorithm is then used to recover the obtained key fragments, and the correctness of the recovered key is verified. Only when the recovered key is correct can the corresponding permissions be granted. Therefore, only when all fragments are correctly obtained can the complete key be restored, ensuring the security of the target data from multiple perspectives. Furthermore, the encryption key needs to be updated regularly to further enhance data security. For example, the key update cycle can be set according to the system's security policy and actual conditions.

[0096] In this embodiment, adaptive adjustments and optimizations to the system are also required. Specifically, new attack data and system operation data are continuously collected during system operation testing. During system operation testing, the scope and frequency of data collection are first determined, including collecting data on system CPU utilization, memory usage, network traffic, etc. Data is collected periodically and stored in a database or file system. Then, data mining algorithms are used to analyze the collected data, including association rule mining, cluster analysis, and anomaly detection. Based on the analysis results, potential patterns and trends in the data are discovered.

[0097] The clustering analysis algorithm used in the system operation test is as follows:

[0098] System runtime test data:

[0099] data = {'CPU utilization': [10, 20, 30, 40, 50], 'Memory usage': [20, 30, 40, 50, 60]}; df = pd.DataFrame(data);

[0100] Cluster analysis using the K-Means algorithm:

[0101] kmeans = KMeans(n_clusters=2);kmeans.fit(df);

[0102] To view the clustering results: df['cluster labels'] = kmeans.labels().

[0103] Furthermore, security strategies can be adaptively adjusted based on system operation and attack patterns. For example, if the system is frequently subjected to a certain type of attack, monitoring for that type of attack can be increased; if system performance is affected, the parameters of the encryption algorithm can be adjusted to improve system performance.

[0104] Specifically, based on the results of data analysis, the system's operation and attack status are assessed. Based on the assessment results, it is determined whether the security policy needs to be adjusted. If adjustment is required, an appropriate adjustment policy is selected based on predefined rules or machine learning models, and then the adjustment policy is executed, with the content and time of the adjustment recorded.

[0105] In this embodiment, new attack data and system operation data need to be collected periodically. The newly collected data is preprocessed to ensure it is consistent with the original training data format. Subsequently, incremental learning is used to add the new data to the original model for training. The performance of the updated model is evaluated. If the performance is improved, the updated model is used for attack identification.

[0106] The algorithm for model updating is as follows:

[0107] Initial training data: X_train = np.array([[1, 2], [2, 3], [3, 4]]); y_train = np.array([0, 0, 1]);

[0108] Initialize the model: model = SGDClassifier(); model.fit(X_train, y_train);

[0109] Newly collected data: X_new = np.array([[4, 5], [5, 6]]); y_new = np.array([1,1]);

[0110] Incremental learning: model.partial_fit(X_new, y_new).

[0111] Specifically, the system is regularly evaluated using security assessment tools and performance testing tools to identify problems and deficiencies and make timely improvements. For example, the evaluation indicators and methods are determined, including the system's response time, throughput, false alarm rate, and false negative rate. The system is evaluated regularly, and the evaluation results are recorded. Based on the evaluation results, the problems and deficiencies of the system are analyzed. Finally, improvement measures are proposed for the problems and deficiencies, and the corresponding improvement measures are implemented.

[0112] This invention discloses a method for secure encryption of sensitive data. The method involves acquiring historical behavioral data of a software system and cleaning and normalizing this data. Behavioral features are then extracted from the preprocessed historical behavioral data, and a security feature vector is constructed based on these features. Next, a machine learning algorithm is trained using this security feature vector to build an attack model for identifying attack behavior types. Subsequently, current behavioral data is input into the attack model to identify whether the current behavioral data constitutes an attack, and if so, the attack behavior type is determined. Finally, based on the attack behavior type corresponding to the current behavioral data, the target data accessed by the current behavioral data is encrypted using a combination of asymmetric and symmetric encryption. A random number generator is used to generate the encryption key, and a secret sharing algorithm is used to divide the encryption key into multiple fragments for distributed storage. This method identifies attack behaviors in system software behavior data through an attack model, and then performs a combination of symmetric and asymmetric encryption on sensitive data that may be involved in the attack. At the same time, the encryption keys of the combined encryption are fragmented and distributed for storage. This ensures that if sensitive data is potentially leaked or attacked, reading and accessing it requires the recovery of all key fragments for decryption. Even in the complex operating environment of the software system, the security of sensitive data can be guaranteed.

[0113] Example 2

[0114] like Figure 4 As shown, in one embodiment, the sensitive data security encryption method provided by the present invention includes the following steps in step S110:

[0115] Step S111: Collect historical behavior data of the software system at fixed time intervals, and clean the historical behavior data to remove noise and outliers.

[0116] Step S112: Map the cleaned historical behavior data to a preset interval to normalize the cleaned historical behavior data and obtain preprocessed historical behavior data.

[0117] This invention discloses a method for secure encryption of sensitive data. It collects historical behavioral data from system operation, cleans the data to remove noise and outliers, and normalizes the data by mapping it to a preset interval, resulting in preprocessed historical behavioral data. This method improves data quality and consistency, provides a reliable foundation for subsequent behavioral analysis and model building, and enhances the accuracy of system security monitoring.

[0118] Example 3

[0119] like Figure 5 As shown, in one embodiment, the sensitive data security encryption method provided by the present invention includes the following steps in step S140:

[0120] Step S141: Extract the traffic rate and the number of data packets from the preprocessed current behavior data, and construct a security feature vector based on the traffic rate and the number of data packets.

[0121] Step S142: Perform feature matching between the security feature vector and the model output of the attack model to calculate the similarity between the security feature vector and the model output, and determine whether there is an attack behavior in the security feature vector based on the similarity.

[0122] This invention discloses a method for secure encryption of sensitive data. It extracts traffic rate and data packet count from preprocessed data to construct a security feature vector, and then performs feature matching and similarity calculation between this vector and the output of an attack model to accurately identify whether the data contains malicious activity. This method achieves dynamic perception and real-time determination of abnormal traffic, effectively improving the system's ability to identify potential security threats and its response speed.

[0123] Example 4

[0124] like Figure 6 As shown, in one embodiment, the sensitive data security encryption method provided by the present invention further includes the following steps in step S140:

[0125] Step S143: When the similarity between the security feature vector and the model output exceeds a set threshold, it is determined that there is an attack behavior in the security feature vector.

[0126] Step S144: When an attack is detected in the security feature vector, an anomaly handling mechanism is triggered, and the attack type and risk level are determined.

[0127] This invention discloses a method for secure encryption of sensitive data. It accurately identifies attack behavior by determining whether the similarity between a security feature vector and the output of an attack model exceeds a set threshold. Upon identification, it dynamically triggers an anomaly handling mechanism, simultaneously determining the specific attack type and risk level. This method achieves real-time assessment and tiered response to security threats, effectively improving the system's efficiency in handling attacks and the accuracy of security protection.

[0128] Example 5

[0129] like Figure 7 As shown, in one embodiment, the sensitive data security encryption method provided by the present invention further includes the following steps in step S140:

[0130] Step S145: In response to the exception handling mechanism, select the corresponding exception handling strategy based on the attack type and risk level corresponding to the current behavior data.

[0131] Step S146: Execute the exception handling strategy, and while executing the exception handling strategy, record the attack time, attack source, and attack type of the current behavior data.

[0132] The risk level is used to characterize the different levels of risk of attack behavior. Different risk levels and attack types correspond to different anomaly handling strategies, which include issuing alarms, monitoring attack behavior, and controlling network access.

[0133] This invention discloses a method for secure encryption of sensitive data. This method dynamically selects and executes corresponding anomaly handling strategies based on the identified attack type and risk level, encompassing measures such as alarms, monitoring, and network control. It also records the attack time, source, and type in detail. This method achieves precise hierarchical response and comprehensive audit tracing of security incidents, effectively improving the system's emergency response capabilities and the traceability of security incidents.

[0134] Example 6

[0135] like Figure 8 As shown, in one embodiment, the sensitive data security encryption method provided by the present invention includes the following steps in step S150:

[0136] Step S151: Generate SSL certificates and private keys on the server and user ends of the target data transmission respectively, and load the SSL certificates and private keys when the server starts to create an SSL context.

[0137] Step S152: When the user terminal and the server establish a connection, an SSL handshake negotiation is performed, and the negotiated encryption algorithm and key are used to encrypt the target data transmission.

[0138] Step S153: When storing the target data, a symmetric encryption algorithm is used to encrypt the target data to generate a symmetric encryption key, and an asymmetric encryption algorithm is used to encrypt the symmetric encryption key.

[0139] This invention provides a method for securely encrypting sensitive data. By configuring SSL certificates and private keys on both the server and client sides to establish a secure transmission channel and performing an SSL handshake negotiation during connection, the confidentiality of data transmission is ensured. Simultaneously, symmetric encryption is used to store the data, and asymmetric encryption is used to protect the key, effectively guaranteeing the security and integrity of the data during transmission and storage.

[0140] Example 7

[0141] like Figure 9 As shown, in one embodiment, the sensitive data security encryption method provided by the present invention includes the following steps in step S160:

[0142] Step S161: Based on symmetric and asymmetric encryption algorithms, an encryption key of a set length is generated by a random number generator, and a secret sharing algorithm is called to divide the encryption key into multiple fragments.

[0143] Step S162: Store multiple fragments on different storage nodes, and when calling the encryption key, obtain all key fragments on different storage nodes, and simultaneously call the secret sharing algorithm to recover all key fragments.

[0144] This invention discloses a method for securely encrypting sensitive data. A high-strength encryption key is generated using a random number generator, and then divided into multiple fragments using a secret-sharing algorithm, each fragment being stored on a different node. When needed, all fragments must be collected to recover the complete key, effectively avoiding the risk of single-point storage and significantly improving the security and reliability of key management.

[0145] The following describes a sensitive data security encryption device provided by the present invention. The sensitive data security encryption device described below can be referred to in correspondence with the sensitive data security encryption method described above.

[0146] Example 8

[0147] like Figure 10As shown, in one embodiment, a sensitive data security encryption device includes a data preprocessing module 1010, a feature extraction module 1020, a model training module 1030, an attack identification module 1040, a target data encryption module 1050, and a key fragment storage module 1060.

[0148] The data preprocessing module 1010 is used to acquire historical behavior data of the software system and preprocess the historical behavior data, including data cleaning and normalization.

[0149] The feature extraction module 1020 is used to extract behavioral features from preprocessed historical behavioral data and construct a security feature vector based on the behavioral features.

[0150] The model training module 1030 is used to train machine learning algorithms based on security feature vectors to build attack models for identifying attack behavior types.

[0151] The attack identification module 1040 is used to input the current behavior data into the attack model, so as to call the attack model to identify whether the current behavior data is attack behavior data, and determine the attack behavior type when the current behavior data is attack behavior data.

[0152] The target data encryption module 1050 is used to perform a combination of asymmetric and symmetric encryption on the target data accessed by the current behavior data based on the attack behavior type corresponding to the current behavior data.

[0153] The key sharding storage module 1060 is used to generate an encryption key using a random number generator and divide the encryption key into multiple shards using a secret sharing algorithm for distributed storage of the multiple shards.

[0154] Historical behavior data is divided into normal behavior data and known attack behavior data. Behavioral characteristics include traffic rate and number of data packets.

[0155] In this embodiment, the sensitive data security encryption device provided by the present invention includes a data preprocessing module 1010 specifically used for:

[0156] Historical behavior data of the software system is collected at fixed time intervals, and the historical behavior data is cleaned to remove noise and outliers.

[0157] The cleaned historical behavior data is mapped to a preset range to normalize the cleaned historical behavior data, resulting in preprocessed historical behavior data.

[0158] In this embodiment, the attack identification module 1040 of the sensitive data security encryption device provided by the present invention is specifically used for:

[0159] Traffic rate and packet count are extracted from the preprocessed current behavior data, and a security feature vector is constructed based on the traffic rate and packet count.

[0160] The security feature vector is matched with the model output of the attack model to calculate the similarity between the security feature vector and the model output, and the presence of attack behavior in the security feature vector is determined based on the similarity.

[0161] In this embodiment, the attack identification module 1040 of the sensitive data security encryption device provided by the present invention is further used for:

[0162] When the similarity between the security feature vector and the model output exceeds a set threshold, it is determined that there is an attack behavior in the security feature vector.

[0163] When an attack is detected in the security feature vector, an anomaly handling mechanism is triggered to determine the attack type and risk level.

[0164] In this embodiment, the attack identification module 1040 of the sensitive data security encryption device provided by the present invention is further used for:

[0165] In response to the anomaly handling mechanism, the corresponding anomaly handling strategy is selected based on the attack type and risk level corresponding to the current behavior data.

[0166] Execute the exception handling strategy, and while executing the exception handling strategy, record the attack time, attack source, and attack type of the current behavior data.

[0167] Among them, the risk level is used to characterize the different levels of risk of attack behavior. Different risk levels and attack types correspond to different anomaly handling strategies, which include issuing alarms, monitoring attack behavior, and controlling network access.

[0168] In this embodiment, the sensitive data security encryption device provided by the present invention includes a target data encryption module 1050 specifically used for:

[0169] SSL certificates and private keys are generated on both the server and client sides for the target data transmission. When the server starts, the SSL certificate and private key are loaded to create an SSL context.

[0170] When a connection is established between the user and the server, an SSL handshake negotiation is performed, and the negotiated encryption algorithm and key are used to encrypt the target data during transmission.

[0171] When storing the target data, a symmetric encryption algorithm is used to encrypt the target data to generate a symmetric encryption key, and then an asymmetric encryption algorithm is used to encrypt the symmetric encryption key.

[0172] In this embodiment, the sensitive data security encryption device provided by the present invention includes a key fragmentation storage module 1060 specifically used for:

[0173] Based on symmetric and asymmetric encryption algorithms, a random number generator generates an encryption key of a set length, and a secret sharing algorithm is called to divide the encryption key into multiple fragments.

[0174] Multiple key fragments are stored on different storage nodes. When the encryption key is invoked, all key fragments on different storage nodes are retrieved, and the secret sharing algorithm is invoked to recover all key fragments.

[0175] This invention provides a sensitive data security encryption device. A data preprocessing module cleans and normalizes system behavior data, a feature extraction module constructs a security feature vector based on this vector, and a model training module uses the vector to train a machine learning algorithm to build an attack model. An attack identification module uses the model to identify and classify attack behaviors in real time. A target data encryption module then performs asymmetric and symmetric combination encryption on the associated sensitive data. A key fragmentation and storage module uses a secret sharing algorithm to fragment and distribute the encryption key. This device achieves end-to-end security protection from attack behavior identification to proactive data encryption, effectively improving the anti-leakage and anti-attack capabilities of sensitive data in complex software environments.

[0176] Example 9

[0177] Figure 11 This example illustrates a schematic diagram of the physical structure of an electronic device, which can be a smart terminal. Its internal structure diagram can be as follows: Figure 11 As shown. The electronic device includes a processor, internal memory, and a network interface connected via a system bus. The processor provides computing and control capabilities. The memory includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores an operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The network interface is used to communicate with external terminals via a network connection. When the computer program is executed by the processor, it implements a method for securely encrypting sensitive data, the method including:

[0178] Acquire historical behavior data of the software system and preprocess the historical behavior data, including data cleaning and normalization;

[0179] Behavioral features are extracted from preprocessed historical behavioral data, and a security feature vector is constructed based on these behavioral features.

[0180] Based on security feature vectors, machine learning algorithms are trained to build attack models for identifying attack behavior types;

[0181] The current behavior data is input into the attack model, which then identifies whether the current behavior data is attack behavior data and determines the attack behavior type when the current behavior data is attack behavior data.

[0182] Based on the attack behavior type corresponding to the current behavior data, the target data accessed by the current behavior data is encrypted using a combination of asymmetric and symmetric encryption.

[0183] A random number generator is used to generate the encryption key, and the encryption key is divided into multiple fragments through a secret sharing algorithm for distributed storage.

[0184] Historical behavior data is divided into normal behavior data and known attack behavior data. Behavioral characteristics include traffic rate and number of data packets.

[0185] This invention provides a sensitive data security encryption electronic device that uses a processor to execute a computer program stored in memory to achieve sensitive proactive security encryption protection. The device first preprocesses and extracts features from historical behavioral data of the software system, constructs a security feature vector, and trains a machine learning model that can identify attack types. Subsequently, this model is used to monitor and classify real-time behavioral data. Once an attack is identified, asymmetric and symmetric combination encryption is immediately initiated on the relevant target data, and the generated encryption key is fragmented and stored in distributed nodes through a secret sharing mechanism. This integrated solution achieves fully automated protection from attack identification to data encryption at the hardware level, significantly improving the security and anti-attack capability of sensitive data in complex operating environments.

[0186] Those skilled in the art will understand that Figure 11 The structure shown is merely a block diagram of a portion of the structure related to the present invention and does not constitute a limitation on the electronic device to which the present invention is applied. A specific electronic device may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0187] Example 10

[0188] On the other hand, embodiments of the present invention also provide a computer storage medium storing a computer program, which, when executed by a processor, implements a method for securely encrypting sensitive data, the method comprising:

[0189] Acquire historical behavior data of the software system and preprocess the historical behavior data, including data cleaning and normalization;

[0190] Behavioral features are extracted from preprocessed historical behavioral data, and a security feature vector is constructed based on these behavioral features.

[0191] Based on security feature vectors, machine learning algorithms are trained to build attack models for identifying attack behavior types;

[0192] The current behavior data is input into the attack model, which then identifies whether the current behavior data is attack behavior data and determines the attack behavior type when the current behavior data is attack behavior data.

[0193] Based on the attack behavior type corresponding to the current behavior data, the target data accessed by the current behavior data is encrypted using a combination of asymmetric and symmetric encryption.

[0194] A random number generator is used to generate the encryption key, and the encryption key is divided into multiple fragments through a secret sharing algorithm for distributed storage.

[0195] Historical behavior data is divided into normal behavior data and known attack behavior data. Behavioral characteristics include traffic rate and number of data packets.

[0196] This invention provides a computer storage medium for securely encrypting sensitive data. When the computer program stored on this medium is executed by a processor, it enables proactive encryption protection for sensitive data. By preprocessing system behavior data and constructing feature vectors to train an attack identification model, it performs asymmetric and symmetric combination encryption on the target data associated with identified attack behaviors. Simultaneously, it utilizes a secret-sharing algorithm to fragment and distribute the encryption key. This medium allows for convenient deployment and stable operation of the security method, forming an automated protection chain from attack detection to data encryption, significantly enhancing the resistance to attacks and leakage prevention of sensitive data in complex software environments.

[0197] Example 11

[0198] In another aspect, a computer program product or computer program is provided, comprising computer instructions stored in a computer-readable storage medium. A processor of an electronic device reads the computer instructions from the computer-readable storage medium, and when the processor executes the computer instructions, it implements a method for securely encrypting sensitive data, the method comprising:

[0199] Acquire historical behavior data of the software system and preprocess the historical behavior data, including data cleaning and normalization;

[0200] Behavioral features are extracted from preprocessed historical behavioral data, and a security feature vector is constructed based on these behavioral features.

[0201] Based on security feature vectors, machine learning algorithms are trained to build attack models for identifying attack behavior types;

[0202] The current behavior data is input into the attack model, which then identifies whether the current behavior data is attack behavior data and determines the attack behavior type when the current behavior data is attack behavior data.

[0203] Based on the attack behavior type corresponding to the current behavior data, the target data accessed by the current behavior data is encrypted using a combination of asymmetric and symmetric encryption.

[0204] A random number generator is used to generate the encryption key, and the encryption key is divided into multiple fragments through a secret sharing algorithm for distributed storage.

[0205] Historical behavior data is divided into normal behavior data and known attack behavior data. Behavioral characteristics include traffic rate and number of data packets.

[0206] This invention provides a computer program product for secure encryption of sensitive data. The computer instructions contained therein, when executed by a processor, enable a complete proactive protection process for sensitive data. By preprocessing behavioral data, constructing feature vectors, and training an attack identification model, it initiates asymmetric and symmetric combination encryption on identified threat-related data. Simultaneously, it utilizes a secret-sharing algorithm to fragment and distribute the encryption key. This product integrates attack detection, data encryption, and key management into a unified solution, significantly enhancing the resilience and overall security of sensitive data in complex environments.

[0207] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. This computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided by this invention can include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory may include random access memory (RAM) or external cache memory.

[0208] By way of illustration and not limitation, RAM is available in a variety of forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), RAMbus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0209] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0210] The embodiments described above are merely illustrative of several implementations of the present invention, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of the present invention. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the present invention, and these modifications and improvements all fall within the scope of protection of the present invention. Therefore, the scope of protection of this patent should be determined by the appended claims.

[0211] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0212] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this invention, "a plurality of" means at least two, such as two, three, etc., unless otherwise explicitly specified.

Claims

1. A method for secure encryption of sensitive data, characterized by, The method includes: Step S110: Obtain historical behavior data of the software system operation, and preprocess the historical behavior data, including data cleaning and normalization. Step S120: Extract behavioral features from the preprocessed historical behavioral data and construct a security feature vector based on the behavioral features; Step S130: Based on the security feature vector, train the machine learning algorithm to build an attack model for identifying attack behavior types; Step S140: Input the current behavior data into the attack model to call the attack model to identify whether the current behavior data is attack behavior data, and determine the attack behavior type when the current behavior data is attack behavior data; Step S150: Based on the attack behavior type corresponding to the current behavior data, perform a combination of asymmetric and symmetric encryption on the target data accessed by the current behavior data. Step S160: A random number generator is used to generate an encryption key, and the encryption key is divided into multiple fragments using a secret sharing algorithm for distributed storage of the multiple fragments. The historical behavior data is divided into normal behavior data and known attack behavior data, and the behavior characteristics include traffic rate and number of data packets.

2. The method of claim 1, wherein, Step S110 includes: Historical behavior data of the software system during operation is collected at fixed time intervals, and the historical behavior data is cleaned to remove noise and outliers. The cleaned historical behavior data is mapped to a preset range to normalize the cleaned historical behavior data, resulting in preprocessed historical behavior data.

3. The method of claim 1, wherein the sensitive data is encrypted by using a symmetric key encryption algorithm. Step S140 includes: Extract traffic rate and packet count from the preprocessed current behavior data, and construct a security feature vector based on traffic rate and packet count; The security feature vector is matched with the model output of the attack model to calculate the similarity between the security feature vector and the model output, and the presence of attack behavior in the security feature vector is determined based on the similarity.

4. The sensitive data security encryption method of claim 3, wherein, Step S140 further includes: When the similarity between the security feature vector and the model output exceeds a set threshold, it is determined that there is an attack behavior in the security feature vector; When an attack is detected in the security feature vector, an anomaly handling mechanism is triggered to determine the attack type and risk level.

5. The sensitive data secure encryption method of claim 4, wherein, Step S140 further includes: In response to the anomaly handling mechanism, the corresponding anomaly handling strategy is selected based on the attack type and risk level corresponding to the current behavior data; The exception handling strategy is executed, and while executing the exception handling strategy, the attack time, attack source, and attack type of the current behavior data are recorded; The risk level is used to characterize the different levels of risk of attack behavior. Different risk levels and attack types correspond to different anomaly handling strategies, which include issuing alarms, monitoring attack behavior, and controlling network access.

6. The method of claim 1, wherein, Step S150 includes: An SSL certificate and a private key are generated on the server and client sides of the target data transmission, respectively. When the server starts, the SSL certificate and private key are loaded to create an SSL context. When the user terminal and the server establish a connection, an SSL handshake negotiation is performed, and the negotiated encryption algorithm and key are used to encrypt the target data during transmission. When storing the target data, a symmetric encryption algorithm is used to encrypt the target data to generate a symmetric encryption key, and then an asymmetric encryption algorithm is used to encrypt the symmetric encryption key.

7. The sensitive data secure encryption method of claim 6, wherein, Step S160 includes: Based on symmetric and asymmetric encryption algorithms, a random number generator generates an encryption key of a set length, and a secret sharing algorithm is called to divide the encryption key into multiple fragments. Multiple key fragments are stored on different storage nodes. When the encryption key is invoked, all key fragments on different storage nodes are retrieved, and the secret sharing algorithm is invoked to recover all key fragments.

8. A sensitive data security encryption apparatus, characterized by, The apparatus for implementing the sensitive data secure encryption method according to any one of claims 1 to 7, the apparatus comprising: The data preprocessing module is used to acquire historical behavior data of the software system and preprocess the historical behavior data, including data cleaning and normalization. The feature extraction module is used to extract behavioral features from preprocessed historical behavioral data and construct a security feature vector based on the behavioral features. The model training module is used to train machine learning algorithms based on security feature vectors to build attack models for identifying attack behavior types. An attack identification module is used to input current behavior data into the attack model, so as to call the attack model to identify whether the current behavior data is attack behavior data, and determine the attack behavior type when the current behavior data is attack behavior data; The target data encryption module is used to perform a combination of asymmetric and symmetric encryption on the target data accessed by the current action data, based on the attack behavior type corresponding to the current action data. The key sharding storage module is used to generate encryption keys using a random number generator and divide the encryption keys into multiple shards using a secret sharing algorithm for distributed storage of the multiple shards. The historical behavior data is divided into normal behavior data and known attack behavior data, and the behavior characteristics include traffic rate and number of data packets.

9. An electronic device comprising a memory and a processor, the memory storing a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the sensitive data security encryption method according to any one of claims 1 to 7.

10. A computer storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the sensitive data security encryption method according to any one of claims 1 to 7.

Images