An Operation and Maintenance Software Defense System Based on Dynamic Encryption and Intrusion Prevention

Abstract

This invention provides a security system for operation and maintenance software based on dynamic encryption and intrusion prevention, relating to the field of operation and maintenance management technology. It includes: an allocation module, used to receive operation and maintenance connection requests through a dynamic encryption layer, identify the specific type of the current operation and maintenance scenario, and assign corresponding emergency priority identifiers to connection requests belonging to emergency operation and maintenance scenarios; an encryption module, used to prioritize key negotiation requests based on the emergency priority identifiers, and simultaneously obtain session keys and matching encryption algorithms for multiple operation and maintenance connections with emergency priorities through a parallel negotiation mechanism; and a collection module, used to establish secure operation and maintenance connections through session keys and encryption algorithms, collect operation and maintenance behavior data under the connection in real time through an intrusion prevention layer, and load corresponding behavioral feature identification rules according to the operation and maintenance scenario type. This invention improves the security protection capabilities of the operation and maintenance process.

Description

Technical Field

[0001] This invention relates to the field of operation and maintenance management technology, and in particular to an operation and maintenance software defense system based on dynamic encryption and intrusion prevention. Background Technology

[0002] As digital transformation continues to advance, operation and maintenance scenarios are becoming increasingly complex, with emergency operation and maintenance frequently intertwined with routine operation and maintenance scenarios. This places higher demands on the encryption efficiency of operation and maintenance connections and the accuracy of intrusion detection. However, traditional operation and maintenance security solutions generally suffer from problems such as rigid encryption strategies and single anomaly judgment mechanisms, making it difficult to achieve an effective balance between operation and maintenance efficiency and security protection effectiveness.

[0003] During emergency maintenance related to core business operations, multiple high-priority maintenance connections simultaneously initiated key negotiation requests. The existing system's lack of priority scheduling caused delays in critical connection negotiation. Furthermore, the intrusion prevention layer employed fixed behavioral feature rules, which were unsuitable for maintenance environments with multiple sub-scenario integration. This not only led to the misclassification and discarding of normal emergency operations as abnormal traffic, resulting in frequent interruptions of secure connections, but also failed to identify unauthorized access behaviors hidden within routine operations, ultimately causing sensitive data leakage. The case clearly exposes the technical deficiencies of traditional systems, such as the lack of scenario-based dynamic key negotiation scheduling mechanisms, the inability of behavioral feature recognition rules to flexibly adapt to multiple sub-scenarios, and the failure to combine scenario characteristics with dynamic calibration and secondary verification for anomaly judgment. In addition, issues such as the need for system shutdown for key rotation and weak access control audit and traceability capabilities further exacerbated maintenance security risks. Summary of the Invention

[0004] The technical problem to be solved by this invention is to provide an operation and maintenance software defense system based on dynamic encryption and intrusion prevention, so as to improve the security protection capability of the operation and maintenance process.

[0005] To solve the above-mentioned technical problems, the technical solution of the present invention is as follows:

[0006] Firstly, an operation and maintenance software defense system based on dynamic encryption and intrusion prevention includes:

[0007] The allocation module is used to receive operation and maintenance connection requests through a dynamic encryption layer, identify the specific type of the current operation and maintenance scenario, and assign corresponding emergency priority identifiers to connection requests belonging to emergency operation and maintenance scenarios.

[0008] The encryption module is used to prioritize key negotiation requests based on emergency priority identifiers and obtain session keys and matching encryption algorithms for multiple operation and maintenance connections with emergency priorities simultaneously through a parallel negotiation mechanism.

[0009] The data acquisition module is used to establish a secure operation and maintenance connection through session keys and encryption algorithms, collect operation and maintenance behavior data under the connection in real time through the intrusion prevention layer, and load the corresponding behavior feature recognition rules according to the operation and maintenance scenario type.

[0010] The merging module is used to monitor and analyze operation and maintenance behavior data in real time based on behavior feature recognition rules, process it into discrete behavior data samples and construct a behavior feature space; for operation and maintenance scenarios with multi-sub-scenario fusion, a corresponding convex polygon region is defined for the normal behavior features of each sub-scenario, and the benchmark analysis region is obtained by merging all convex polygons.

[0011] The judgment module is used to subdivide the benchmark analysis area into multiple analysis partitions according to the source of sub-scenes, and assign discrete behavior data samples to the corresponding partitions. It generates analysis calibration coefficients based on the sub-scene weights, sample matching degrees, and the proportion of overlapping areas of convex polygons in each partition. The judgment threshold is dynamically adjusted through the calibration coefficients. When a suspected abnormal operation is detected, a secondary judgment is performed to obtain the secondary judgment result.

[0012] The processing module is used to execute defensive actions based on the secondary judgment results.

[0013] Furthermore, by receiving maintenance connection requests through a dynamic encryption layer, the specific type of the current maintenance scenario is identified, and corresponding emergency priority identifiers are assigned to connection requests belonging to emergency maintenance scenarios, including:

[0014] The system receives operation and maintenance connection requests through a dynamic encryption layer and extracts the identity credential information and connection context information from the connection requests.

[0015] Based on the identity credential information and connection context information, and combined with the preset emergency scenario feature library, the system matches and identifies whether the current operation and maintenance scenario belongs to the emergency operation and maintenance scenario.

[0016] When an emergency operation and maintenance scenario is identified, the priority value of the emergency operation and maintenance scenario is calculated based on the urgency level parameter and the impact range parameter in the connection context information.

[0017] Based on the priority value, assign the corresponding emergency priority identifier to the connection request.

[0018] Furthermore, key negotiation requests are prioritized based on emergency priority identifiers, and a parallel negotiation mechanism is used to simultaneously obtain session keys and matching encryption algorithms for multiple operation and maintenance connections with emergency priorities, including:

[0019] Based on the numerical value of the emergency priority identifier, the received multiple key negotiation requests are sorted to form a request sequence arranged from high to low priority value.

[0020] Based on the sorting result of the request sequence, dedicated parallel negotiation resources are allocated to the high-priority requests that are ranked first in the sequence. At the same time, according to the security requirement level corresponding to each request, candidate encryption algorithms that meet the security requirements of each level are selected from the pre-configured set of encryption algorithms.

[0021] Based on the allocated dedicated resources and the selected candidate encryption algorithms, independent key negotiation sessions are established simultaneously for multiple high-priority requests through a parallel negotiation process. In each session, key exchange operations are performed based on the corresponding candidate encryption algorithms to generate corresponding preliminary key data.

[0022] A security strength assessment is performed on the initial key data. Based on the assessment results and the specific performance requirements of each operation and maintenance scenario, the final encryption algorithm is determined from the candidate encryption algorithms for each high-priority operation and maintenance connection.

[0023] Furthermore, a secure operation and maintenance connection is established through session keys and encryption algorithms. Operation and maintenance behavior data under this connection is collected in real time through the intrusion prevention layer, and corresponding behavioral feature recognition rules are loaded according to the type of operation and maintenance scenario, including:

[0024] Receive the session key and the matching encryption algorithm, and establish an end-to-end secure encrypted channel for the corresponding operation and maintenance connection request based on the session key and encryption algorithm to form a secure operation and maintenance connection;

[0025] Deploy an intrusion prevention layer on the established secure operation and maintenance connection. The intrusion prevention layer captures and collects all operation and maintenance behavior data generated under the secure operation and maintenance connection in real time, forming a raw behavior data stream.

[0026] Based on the current operation and maintenance scenario type, retrieve and load the set of behavior feature recognition rules that match the operation and maintenance scenario type from the pre-set behavior rule library.

[0027] Furthermore, based on behavioral feature recognition rules, real-time monitoring and analysis of operation and maintenance behavior data are performed, and the data is processed into discrete behavioral data samples to construct a behavioral feature space. For operation and maintenance scenarios involving the fusion of multiple sub-scenes, a corresponding convex polygon region is defined for the normal behavioral features of each sub-scene. By merging all convex polygons, a baseline analysis region is obtained, including:

[0028] Based on the behavioral feature recognition rule set, the raw behavioral data stream is monitored and its features are extracted and analyzed in real time to obtain a structured sequence of operational and maintenance behavioral features.

[0029] The operation and maintenance behavior feature sequence is discretized. Based on the time window division and feature dimension separation principle, the continuous behavior feature sequence is converted into a discrete behavior data sample set.

[0030] Based on a set of discrete behavioral data samples, a multi-dimensional behavioral feature space is constructed. Each dimension of the behavioral feature space corresponds to a type of behavioral feature. Each discrete behavioral data sample is mapped to a corresponding feature point in the space, forming a feature point distribution cloud data.

[0031] Based on the current operation and maintenance scenario type, determine whether the operation and maintenance scenario is a multi-sub-scenario fusion type. If so, based on the constructed behavior feature space, fit the corresponding convex polygon region in the feature space for the historical normal behavior data of each sub-scenario.

[0032] Spatial merging operations are performed on convex polygon regions. By calculating the union of each convex polygon region, overlapping parts are eliminated, forming a unified benchmark analysis region that covers the normal behavioral characteristics of all sub-scenes.

[0033] Furthermore, the baseline analysis area is subdivided into multiple analysis partitions based on the source of sub-scenes, and discrete behavioral data samples are assigned to the corresponding partitions. Analysis calibration coefficients are generated based on partition characteristics such as sub-scene weights, sample matching degrees, and the proportion of overlapping convex polygon areas, including:

[0034] Receive the baseline analysis area, and according to the source identification information of each sub-scene in the baseline analysis area, spatially divide the baseline analysis area according to the source of the sub-scene to obtain multiple analysis partitions that correspond one-to-one with each sub-scene;

[0035] The discrete behavioral data sample set is assigned to the corresponding analysis partition according to the sub-scene affiliation identifier of each sample, forming the sample distribution dataset within each analysis partition;

[0036] For each analysis partition's sample distribution dataset, calculate the partition's sub-scene weight, the matching degree between the current sample and historical normal samples, and the proportion of overlapping convex polygon regions in the partition's baseline analysis area to obtain a multi-dimensional set of partition feature parameters.

[0037] Based on the partition feature parameter set, an analysis calibration coefficient is generated through a weighted fusion algorithm.

[0038] Furthermore, the judgment threshold is dynamically adjusted through calibration coefficients. When a suspected abnormal operation is detected, a secondary judgment is performed to obtain the secondary judgment result, including:

[0039] Receive and analyze calibration coefficients, and dynamically adjust the preset initial anomaly judgment threshold based on the analysis and calibration coefficients to obtain a dynamic judgment threshold that adapts to the characteristics of the current operation and maintenance scenario.

[0040] The real-time discrete behavioral data samples in the constructed behavioral feature space are compared with the benchmark analysis area in terms of spatial location. Combined with the dynamic judgment threshold, suspected abnormal operation data points located outside the benchmark analysis area and exceeding the range of the dynamic judgment threshold are detected.

[0041] For suspected abnormal operation data points, a pre-built secondary verification rule library is invoked. Combining the sub-scenario features and historical behavior patterns corresponding to the suspected abnormal operation, a multi-dimensional cross-validation analysis is performed on the suspected abnormal operation data points to obtain the multi-dimensional cross-validation analysis results.

[0042] Based on the results of multi-dimensional cross-validation analysis, the confidence level of the secondary judgment is calculated. When the confidence level exceeds the preset secondary judgment threshold, the suspected abnormal operation is confirmed as a real abnormal behavior; otherwise, it is judged as normal behavior, and the final secondary judgment result is obtained.

[0043] Furthermore, based on the secondary judgment result, defensive actions are executed, including:

[0044] Receive the secondary judgment result and parse the abnormal behavior confirmation status and corresponding risk level identifier contained in the secondary judgment result;

[0045] Based on the abnormal behavior confirmation status and risk level identifier, retrieve the matching defense action execution plan from the pre-set defense strategy library;

[0046] According to the defense action execution plan, real-time blocking is implemented for operation and maintenance operations that are confirmed to be abnormal, and bandwidth limitation or session termination is performed on related operation and maintenance connections to form a preliminary defense execution state.

[0047] The initial defense execution status is correlated with the risk level identifier to obtain multi-level alarm notification information, and the alarm information is sent to the operation and maintenance management personnel through the preset notification channels. At the same time, the complete context data of the abnormal operation is recorded to the security audit log library.

[0048] The system aggregates defense execution data from the security audit log library, combines it with feedback information on the effectiveness of the defense actions, generates defense strategy optimization parameters, and dynamically adjusts the emergency priority identifier allocation strategy, behavioral feature recognition rule set, and analysis calibration coefficients.

[0049] In a second aspect, a computing device includes:

[0050] One or more processors;

[0051] A storage device for storing one or more programs that, when executed by one or more processors, cause the one or more processors to execute the system.

[0052] Thirdly, a computer-readable storage medium storing a program that, when executed by a processor, performs the system.

[0053] The above-described solution of the present invention has at least the following beneficial effects:

[0054] Because it employs technologies such as dynamic encryption layer operation and maintenance scenario identification and emergency priority assignment, priority-based parallel key negotiation mechanism, scenario-based behavioral feature rule loading and real-time data acquisition technology for intrusion prevention layer, benchmark analysis region construction technology for merging convex polygon regions in multiple sub-scenarios, analysis calibration coefficient generation and dynamic judgment threshold adjustment and secondary cross-validation mechanism based on partitioned feature weighting, as well as hierarchical execution of defense actions and closed-loop optimization technology, it overcomes the technical problems of rigid traditional operation and maintenance security encryption strategies, emergency connection delays caused by lack of priority scheduling in key negotiation, poor adaptability to multiple sub-scenarios, misjudgments and missed judgments caused by a single anomaly judgment mechanism, and lack of adaptive optimization capabilities. Thus, it achieves dynamic matching between operation and maintenance connection encryption efficiency and security requirements, accurate identification and efficient defense of abnormal behavior in multiple scenarios, and synergistic balance between operation and maintenance efficiency and security protection effect. At the same time, it realizes the self-iterative upgrade of the defense system, comprehensively improving the flexibility, accuracy and reliability of security management in the operation and maintenance process. Attached Figure Description

[0055] Figure 1 This is a schematic diagram of an operation and maintenance software defense system based on dynamic encryption and intrusion prevention, provided by an embodiment of the present invention.

[0056] Figure 2 This is a flowchart illustrating an operation and maintenance software defense system based on dynamic encryption and intrusion prevention, provided by an embodiment of the present invention. The system prioritizes key negotiation requests based on emergency priority identifiers and uses a parallel negotiation mechanism to simultaneously obtain session keys and matching encryption algorithms for multiple operation and maintenance connections with emergency priorities. Detailed Implementation

[0057] Exemplary embodiments of the present disclosure will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the disclosure to those skilled in the art.

[0058] like Figure 1 As shown, an embodiment of the present invention proposes an operation and maintenance software defense system based on dynamic encryption and intrusion prevention, comprising:

[0059] The allocation module is used to receive operation and maintenance connection requests through a dynamic encryption layer, identify the specific type of the current operation and maintenance scenario, and assign corresponding emergency priority identifiers to connection requests belonging to emergency operation and maintenance scenarios.

[0060] The encryption module is used to prioritize key negotiation requests based on emergency priority identifiers and obtain session keys and matching encryption algorithms for multiple operation and maintenance connections with emergency priorities simultaneously through a parallel negotiation mechanism.

[0061] The data acquisition module is used to establish a secure operation and maintenance connection through session keys and encryption algorithms, collect operation and maintenance behavior data under the connection in real time through the intrusion prevention layer, and load the corresponding behavior feature recognition rules according to the operation and maintenance scenario type.

[0062] The merging module is used to monitor and analyze operation and maintenance behavior data in real time based on behavior feature recognition rules, process it into discrete behavior data samples and construct a behavior feature space; for operation and maintenance scenarios with multi-sub-scenario fusion, a corresponding convex polygon region is defined for the normal behavior features of each sub-scenario, and the benchmark analysis region is obtained by merging all convex polygons.

[0063] The judgment module is used to subdivide the benchmark analysis area into multiple analysis partitions according to the source of sub-scenes, and assign discrete behavior data samples to the corresponding partitions. It generates analysis calibration coefficients based on the sub-scene weights, sample matching degrees, and the proportion of overlapping areas of convex polygons in each partition. The judgment threshold is dynamically adjusted through the calibration coefficients. When a suspected abnormal operation is detected, a secondary judgment is performed to obtain the secondary judgment result.

[0064] The processing module is used to execute defensive actions based on the secondary judgment results.

[0065] In this embodiment of the invention, by employing technologies such as dynamic encryption layer for identifying operation and maintenance scenario types and allocating emergency priority identifiers, priority-based key negotiation scheduling and parallel negotiation mechanisms, secure operation and maintenance connection establishment supported by session keys and encryption algorithms, scenario-based behavioral feature rule loading and real-time operation data acquisition technologies for intrusion prevention layers, behavior data discretization processing and benchmark analysis region construction technology for merging convex polygon regions of multiple sub-scenarios, and benchmark region sub-scenario partitioning, analysis calibration coefficient generation driven by partition features, dynamic judgment threshold adjustment, and secondary judgment technologies, the invention effectively overcomes the technical problems of traditional operation and maintenance security encryption strategies, such as lack of scenario adaptability, low efficiency of emergency operation and maintenance connection key negotiation, ambiguous definition of normal behavior boundaries in multi-scenario fusion environments, and misjudgment and missed judgment caused by lack of accurate calibration in anomaly judgment. This achieves precise matching of emergency operation and maintenance needs with encryption resources, clear definition of normal behavior boundaries in multiple scenarios, efficient identification and accurate judgment of anomalies, while ensuring the coordinated unity of operation and maintenance connection security and operation and maintenance efficiency, thus improving the scenario adaptability, judgment accuracy, and execution effectiveness of operation and maintenance security protection.

[0066] In a preferred embodiment of the present invention, a dynamic encryption layer is used to receive maintenance connection requests, identify the specific type of the current maintenance scenario, and assign corresponding emergency priority identifiers to connection requests belonging to emergency maintenance scenarios, including:

[0067] The system receives maintenance connection requests through a dynamic encryption layer, extracting identity credentials and connection context information from the connection requests. Specifically, the dynamic encryption layer continuously monitors maintenance connection requests initiated by maintenance terminals in the network. When a connection request is detected, the dynamic encryption layer actively receives all the data content contained in the connection request. Subsequently, the received connection request data is parsed and processed to separate and extract two types of key information: one is identity credentials used to verify the identity of the maintenance connection initiator, including the maintenance personnel's identity identifier, corresponding authentication credentials, department information, etc.; the other is connection context information related to the maintenance connection.

[0068] Based on identity credentials and connection context information, and in conjunction with a pre-defined emergency scenario feature library, the system identifies whether the current operation and maintenance scenario belongs to an emergency operation and maintenance scenario. Specifically, this involves: pre-building an emergency scenario feature library containing feature information corresponding to various emergency operation and maintenance scenarios, covering common emergency operation and maintenance initiation time characteristics (e.g., emergency operation and maintenance initiated outside of working hours), accessed resource type characteristics (e.g., critical resources of core business systems), initiating terminal device attribute characteristics (e.g., dedicated emergency operation and maintenance equipment), and network environment characteristics (e.g., specific emergency network channels). The extracted identity credentials and connection context information are then compared and analyzed one by one with the various feature information in the emergency scenario feature library. Through comprehensive matching and verification, the system determines whether the operation and maintenance scenario corresponding to the currently received operation and maintenance connection request matches the emergency operation and maintenance scenario characteristics recorded in the feature library, thereby accurately identifying whether the current operation and maintenance scenario belongs to an emergency operation and maintenance scenario.

[0069] When an emergency maintenance scenario is identified, the priority value of the emergency maintenance scenario is calculated based on the urgency and impact range parameters in the connection context information. Specifically, when the current maintenance scenario is confirmed to be an emergency maintenance scenario through step-by-step matching analysis, two types of core parameters are further extracted from the extracted connection context information: one is the urgency parameter, which characterizes the urgency of the maintenance needs, including the time limit for fault repair, the urgency level of business interruption, and the urgency of the impact of the fault on business operations; the other is the impact range parameter, which characterizes the impact range of the maintenance operation, including the number of business systems involved in the fault, the scale of the user group covered, the scope of business functions affected, and the degree of potential loss. The extracted urgency and impact range parameters are quantitatively evaluated respectively. According to the preset evaluation criteria, different levels of urgency and impact range are converted into corresponding quantitative scores. Then, according to the preset weight allocation rules, corresponding weights are assigned to the urgency quantitative score and the impact range quantitative score. Finally, the priority value corresponding to the emergency maintenance scenario is calculated by weighted summation.

[0070] Based on priority values, corresponding emergency priority identifiers are assigned to connection requests. Specifically, this includes: pre-setting multiple emergency priority identifiers of different levels, each corresponding to a specific priority value range, and the level of the emergency priority identifier is positively correlated with the urgency of the emergency operation and maintenance needs, i.e., the higher the identifier level, the more urgent the corresponding emergency operation and maintenance needs; comparing the calculated priority value of the emergency operation and maintenance scenario with each of the preset priority value ranges one by one to determine the specific value range to which the priority value belongs; and assigning the corresponding emergency priority identifier to the current operation and maintenance connection request according to the determined value range, so that each connection request in an emergency operation and maintenance scenario can obtain a priority identifier that matches its urgency.

[0071] In this embodiment of the invention, because the embodiment adopts the technical means of receiving maintenance connection requests through a dynamic encryption layer and extracting identity credential information and connection context information, matching scenario types by combining a preset emergency scenario feature library, quantifying and calculating emergency priority values ​​based on the urgency and impact range parameters of the connection context, and then allocating corresponding emergency priority identifiers according to the priority values, it effectively overcomes the technical problems of traditional maintenance security systems that are difficult to accurately identify emergency maintenance scenarios and lack quantitative basis and are highly subjective in emergency priority allocation. Thus, it achieves the technical effect of accurate determination of emergency maintenance scenarios and scientific quantitative allocation of emergency priorities, ensuring that emergency maintenance connections are given priority processing.

[0072] like Figure 2 As shown, in another preferred embodiment of the present invention, key negotiation requests are prioritized based on emergency priority identifiers, and a parallel negotiation mechanism is used to simultaneously obtain session keys and matching encryption algorithms for multiple operation and maintenance connections with emergency priorities, including:

[0073] Based on the numerical value of the emergency priority identifier, multiple received key negotiation requests are sorted to form a request sequence arranged from high to low priority. Specifically, this involves: continuously receiving key negotiation requests corresponding to multiple maintenance connection requests, each associated with an emergency priority identifier previously assigned to the corresponding maintenance connection; extracting the numerical value corresponding to the associated emergency priority identifier from each key negotiation request, which directly reflects the urgency of the corresponding emergency maintenance scenario; then comparing all extracted emergency priority identifier values ​​one by one, and sorting the multiple key negotiation requests in descending order of value. During the sorting process, if requests with the same emergency priority identifier value are encountered, a secondary sorting can be performed based on the order in which the requests were initiated to ensure the uniqueness of the sorting result; finally, a key negotiation request sequence arranged from high to low priority is formed.

[0074] Based on the ranking of the request sequence, dedicated parallel negotiation resources are allocated to the high-priority requests at the top of the sequence. Simultaneously, according to the security requirement level of each request, candidate encryption algorithms that meet the security requirements of each level are selected from a pre-configured set of encryption algorithms. Specifically, based on the formed request sequence, the system identifies the high-priority key negotiation requests at the top of the sequence. These requests correspond to the most urgent emergency maintenance needs. To avoid high-priority requests competing for resources with other requests during key negotiation, dedicated parallel negotiation resources are allocated to each of these high-priority requests, including independent computing processing, dedicated network transmission bandwidth, and separate storage cache space, ensuring the security of each high-priority request. All requests receive sufficient resource support and are not interfered with by other requests. Simultaneously, by combining the operational scenario information, identity credential information, and connection context information corresponding to each key negotiation request, the system determines the security requirement level for each request. The security requirement level is divided into different levels based on factors such as the sensitivity of the data involved in the operational operation and the importance of the business. A pre-configured set of encryption algorithms, containing multiple encryption algorithms, is provided, with each algorithm corresponding to a specific security protection level. Based on the security requirement level of each request, the system selects encryption algorithms from the set whose security protection level matches the requirement level, forming a candidate encryption algorithm list specific to each request, ensuring that the candidate algorithms meet the security protection requirements of the corresponding request.

[0075] Based on allocated dedicated resources and selected candidate encryption algorithms, a parallel negotiation process is used to simultaneously establish independent key negotiation sessions for multiple high-priority requests. Within each session, key exchange operations are performed based on the corresponding candidate encryption algorithm, generating corresponding preliminary key data. Specifically, this includes: invoking a parallel processing framework; establishing independent key negotiation sessions for multiple high-priority key negotiation requests based on allocated dedicated parallel negotiation resources; each key negotiation session corresponds to only one high-priority request, and sessions do not interfere with each other, achieving parallel processing of multiple requests; within each independent key negotiation session, one or more algorithms from the candidate encryption algorithm list corresponding to the session are loaded; and key-related parameters are transmitted and interacted with the corresponding operation and maintenance terminal according to the standard key exchange process for encryption algorithms. For example, by exchanging key information such as public keys and random numbers, and combining the operational logic of the selected candidate encryption algorithms, the key generation and negotiation process is completed, ultimately generating corresponding preliminary key data for each key negotiation session.

[0076] A security strength assessment is performed on the initial key data. Based on the assessment results and the specific performance requirements of each operation and maintenance scenario, the final encryption algorithm is determined from the candidate encryption algorithms for each high-priority operation and maintenance connection. Specifically, this includes: conducting a security strength assessment on the initial key data generated for each key negotiation session; assessing whether the key length meets security standards, whether the key randomness meets anti-cracking requirements, and whether the corresponding encryption algorithm has the ability to resist common attacks; and classifying the security strength of the initial key data into different levels based on the assessment results. Simultaneously, the specific performance requirements of the operation and maintenance scenario corresponding to each high-priority operation and maintenance connection are retrieved, including key negotiation response speed requirements, real-time operation and maintenance requirements, and terminal device computing resource limitations. Taking into account both the security strength level of the initial key data and the performance requirements of the corresponding scenario, the candidate encryption algorithms for each high-priority operation and maintenance connection are further screened. For example, for scenarios with extremely high security requirements and sufficient terminal device performance, the candidate encryption algorithm with the highest security strength is selected; for emergency scenarios with adequate security requirements but strict response speed requirements, a candidate encryption algorithm that meets the security requirements and has higher computational efficiency is selected. Finally, a unique final encryption algorithm is determined for each high-priority operation and maintenance connection.

[0077] In this embodiment of the invention, because it employs technical means such as sorting key negotiation requests based on emergency priority identifier values, allocating dedicated parallel negotiation resources for high-priority requests, filtering candidate encryption algorithms according to security requirement levels, establishing independent key negotiation sessions through parallel negotiation processes to generate preliminary key data, and determining the final encryption algorithm by combining security strength assessment and scenario performance requirements, it effectively overcomes the technical problems in traditional operation and maintenance security systems, such as the lack of priority scheduling for key negotiation leading to delays in high-priority emergency connection processing, unreasonable resource allocation, inability to balance security requirements and scenario performance in encryption algorithm selection, and insufficient parallel processing capability for multiple emergency connections. This achieves the technical effects of efficiently prioritizing key negotiation for high-priority emergency operation and maintenance connections, accurately adapting encryption algorithms to the security and performance requirements of various scenarios, and enabling multiple emergency connections to simultaneously complete key negotiation and encryption algorithm matching, thereby improving the efficiency and reliability of emergency operation and maintenance connection establishment and ensuring the timely progress of emergency operation and maintenance work.

[0078] In a preferred embodiment of the present invention, a secure operation and maintenance connection is established through a session key and an encryption algorithm. Operation and maintenance behavior data under this connection is collected in real time through an intrusion prevention layer, and corresponding behavior feature recognition rules are loaded according to the operation and maintenance scenario type, including:

[0079] The system receives a session key and a matching encryption algorithm. Based on these, it establishes an end-to-end secure encrypted channel for the corresponding maintenance connection request, forming a secure maintenance connection. Specifically, this involves: receiving the session key and matching encryption algorithm previously generated through a parallel negotiation mechanism; firstly, verifying the validity of the received session key and encryption algorithm to confirm that the session key has not been tampered with and that the encryption algorithm meets the security requirements of the current maintenance scenario; after successful verification, initiating an end-to-end encrypted transmission mechanism, using the session key as the core key for data encryption and decryption, and combining it with the matching encryption algorithm to process all data transmitted between the maintenance terminal and the target maintenance system; at the data sending end, encrypting maintenance operation instructions, data requests, and other information using the session key according to the encryption algorithm's operational logic; at the data receiving end, the system decrypts the received encrypted data using the same session key and encryption algorithm, restoring it to its original state; through end-to-end encrypted transmission, a secure encrypted channel is constructed directly from the maintenance terminal to the target maintenance system. This channel resists network attacks such as data eavesdropping, tampering, and forgery, ensuring the security and integrity of maintenance data during transmission, ultimately forming a stable and reliable secure maintenance connection.

[0080] An intrusion prevention layer is deployed on the established secure operation and maintenance connection. This layer captures and collects all operation and maintenance behavior data generated under the secure connection in real time, forming a raw behavior data stream. Specifically, this includes: deploying an independent intrusion prevention layer along the transmission path of the secure operation and maintenance connection; deeply integrating the intrusion prevention layer with the secure connection to monitor all data transmission behavior within the channel in real time; the intrusion prevention layer activates a real-time capture mechanism to comprehensively collect various operation and maintenance behavior data generated under the secure connection, including the type of operation command initiated by operation and maintenance personnel, execution parameters of the operation command, specific identifiers of accessed operation and maintenance resources, data read / write volume, timestamps of operation execution, interactive response information between the terminal and the system, and connection status changes; during the collection process, all operation behavior data is continuously recorded in chronological order of data generation, ensuring comprehensiveness by not missing any details. Subsequently, the collected scattered data is integrated, sorted, and organized according to a unified data format to form a continuous and uninterrupted raw behavior data stream.

[0081] Based on the current operation and maintenance scenario type, a set of behavioral feature recognition rules matching the scenario type is retrieved and loaded from a pre-built behavioral rule library. Specifically, this involves: first, clarifying the operation and maintenance scenario type corresponding to the current connection, determined through previous scenario identification processes, including emergency operation and maintenance scenarios, regular operation and maintenance scenarios, and complex operation and maintenance scenarios involving multiple sub-scenarios; second, a pre-built behavioral rule library stores behavioral feature recognition rule sets corresponding to various scenarios based on their business characteristics, operational specifications, and security requirements; third, each rule set contains specific rules for allowed normal operational behaviors, prohibited dangerous operational behaviors, and sensitive operational behaviors requiring close monitoring within the scenario; fourth, based on the currently determined operation and maintenance scenario type, a precise search is performed in the behavioral rule library to match a behavioral feature recognition rule set that perfectly corresponds to the scenario type; fifth, after the search, the rule set is extracted from the behavioral rule library and loaded into the current operation and maintenance security analysis, becoming the basis for feature analysis and anomaly judgment of the original behavioral data stream. By loading scenario-adaptive rule sets, the problem of poor adaptability to multiple sub-scenarios caused by using fixed rules is avoided.

[0082] In this embodiment of the invention, because the embodiment adopts the technical means of receiving maintenance connection requests through a dynamic encryption layer and extracting identity credential information and connection context information, matching scenario types by combining a preset emergency scenario feature library, quantitatively calculating emergency priority values ​​based on the urgency and impact range parameters of the connection context, and allocating corresponding emergency priority identifiers according to the priority values, it effectively overcomes the technical problems of traditional maintenance security systems being unable to accurately identify emergency maintenance scenarios, lacking quantitative support for emergency priority allocation, and being highly subjective. Thus, it achieves the technical effects of accurate identification of emergency maintenance scenarios, scientific quantitative allocation of emergency priorities, ensuring that emergency maintenance connections are given priority processing, and guaranteeing the timeliness of emergency maintenance.

[0083] In a preferred embodiment of the present invention, operational behavior data is monitored and analyzed in real time based on behavioral feature recognition rules, and processed into discrete behavioral data samples to construct a behavioral feature space; for operational scenarios involving the fusion of multiple sub-scenes, a corresponding convex polygon region is defined for the normal behavioral features of each sub-scene, and a baseline analysis region is obtained by merging all convex polygons, including:

[0084] Based on a set of behavioral feature recognition rules, the raw behavioral data stream is monitored and its features are extracted and analyzed in real time to obtain a structured sequence of operational and maintenance (O&M) behavioral features. Specifically, this includes: loading a set of behavioral feature recognition rules that matches the current O&M scenario type; the set of rules contains feature descriptions and judgment criteria for normal, sensitive, and dangerous operations in the current scenario; activating a real-time monitoring mechanism; inputting the raw behavioral data stream into the analysis engine segment by segment according to the transmission order; and parsing the data stream frame by frame based on the feature items in the set of rules. The extracted features include key dimensions such as the instruction type, execution object, data read / write volume, operation duration, instruction execution interval, accessed resource path, and changes in terminal information initiating the operation. The extracted scattered features are then structured and arranged according to a unified format of operation time, feature category, and feature value to form an ordered sequence of O&M behavioral features with clear correlations.

[0085] The operational behavior feature sequence is discretized. Based on the principles of time window division and feature dimension separation, the continuous behavioral feature sequence is converted into a discrete behavioral data sample set. Specifically, this involves: pre-setting a reasonable time window length based on the operation frequency and data generation rate of the current operational scenario. The time window must balance data integrity and real-time analysis, avoiding delays due to excessively long windows or feature loss due to excessively short windows. The structured operational behavior feature sequence is segmented according to the set time window, with each time window corresponding to a continuous feature sequence segment. Simultaneously, based on the extracted feature categories, the feature sequence within each time window is separated by feature dimensions, ensuring that the feature data of each dimension is presented independently. The feature data of each dimension within each time window is statistically summarized, including key parameters such as the maximum, minimum, average, and frequency of occurrence of each feature within the window. These statistical parameters are integrated into a complete data unit as a discrete behavioral data sample. After all time windows are processed, all discrete behavioral data samples are collected to form a standardized and unified discrete behavioral data sample set.

[0086] Based on a set of discrete behavioral data samples, a multi-dimensional behavioral feature space is constructed. Each dimension of the behavioral feature space corresponds to a behavioral feature type. Each discrete behavioral data sample is mapped to a corresponding feature point in the space, forming a feature point distribution cloud data. Specifically, this includes: sorting out all extracted behavioral feature types, treating each feature type as an independent dimension, such as operation instruction type dimension, execution duration dimension, data read / write volume dimension, access resource level dimension, etc., constructing a multi-dimensional behavioral feature space, setting a reasonable numerical range for each dimension, the range is determined based on the feature value fluctuation range of historical normal operation and maintenance behavior in the current scenario, ensuring coverage of the feature change range of normal behavior, extracting the value of each sample in the discrete behavioral data sample set on each feature dimension, using the value as the coordinate value of the sample in the behavioral feature space, and marking the corresponding location point in the space, i.e., the feature point. After all samples have completed coordinate mapping, a feature point distribution cloud data composed of a large number of feature points is formed in the multi-dimensional space.

[0087] Based on the current operation and maintenance scenario type, determine whether the operation and maintenance scenario is a multi-sub-scenario fusion type. If so, based on the constructed behavior feature space, fit the corresponding convex polygon region in the feature space for the historical normal behavior data of each sub-scenario. Specifically, this includes: retrieving the previously identified current operation and maintenance scenario type information, and combining the scenario attributes to determine whether the scenario contains multiple sub-scenarios. For example, the core business emergency operation and maintenance scenario may contain multiple sub-scenario fusion types such as fault repair sub-scenarios, data recovery sub-scenarios, and configuration adjustment sub-scenarios. If it is determined to be a multi-sub-scenario fusion type, extract the historical normal behavior data corresponding to each sub-scenario from the historical operation and maintenance behavior database. This data needs to be security verified to ensure that it does not contain abnormal behavior records. Convert the historical normal behavior data of each sub-scenario into corresponding discrete behavior data samples. According to the mapping rules, mark the feature points of the historical normal samples of each sub-scenario in the constructed multi-dimensional behavior feature space. For the feature point distribution of each sub-scenario, use a spatial fitting algorithm to draw a convex polygon region surrounding the majority of normal feature points of the sub-scenario. The vertices of the convex polygon are determined by the edge extrema of the feature point distribution to ensure that the region accurately represents the normal behavior feature boundary of the corresponding sub-scenario.

[0088] Spatial merging operations are performed on convex polygon regions. By calculating the union of each convex polygon region, overlapping parts are eliminated, forming a unified benchmark analysis region covering the normal behavior features of all sub-scenes. Specifically, this involves: collecting convex polygon region data corresponding to each sub-scene, including vertex coordinates and region range of each convex polygon; initiating the spatial merging operation process; firstly, comparing the spatial positions of all convex polygon regions to identify overlapping parts between convex polygons of different sub-scenes; calculating the union of all convex polygon regions according to the principle of retaining all non-overlapping regions and merging overlapping regions, which is the smallest closed region containing the convex polygon regions of all sub-scenes; during the merging process, duplicate boundaries of overlapping parts are eliminated to avoid redundant judgment criteria in subsequent analysis; after merging, a unified closed region is formed, which completely covers the feature points corresponding to the normal behavior features of all sub-scenes, which is the benchmark analysis region. The benchmark analysis region not only retains the unique feature boundaries of normal behavior of each sub-scene, but also achieves unified integration of normal behavior features of multiple sub-scenes.

[0089] In this embodiment of the invention, because it employs the following technical means: extracting structured operation and maintenance behavior feature sequences based on behavior feature recognition rule sets; discretizing the behavior feature sequences according to the principle of separating time windows and feature dimensions; constructing a multi-dimensional behavior feature space based on discrete samples; fitting convex polygon boundary regions to historical normal behavior data of each sub-scenario for multi-sub-scenario fusion type; and eliminating overlapping parts through spatial merging operations to form a unified benchmark analysis region, it effectively overcomes the technical problems of traditional operation and maintenance security systems in multi-sub-scenario fusion environments, such as difficulty in accurately defining the normal behavior boundaries of each sub-scenario, difficulty in conducting accurate analysis of continuous behavior data, and inability to effectively integrate normal behavior features of different sub-scenarios leading to chaotic benchmark judgment criteria. Thus, it achieves clear definition and unified integration of normal behavior features of multiple sub-scenarios, improves the pertinence and reliability of behavior data monitoring and analysis, and adapts to complex multi-sub-scenario operation and maintenance environments.

[0090] In a preferred embodiment of the present invention, the benchmark analysis region is subdivided into multiple analysis partitions according to the source of sub-scenes, and discrete behavioral data samples are assigned to the corresponding partitions. Analysis calibration coefficients are generated based on partition characteristics such as sub-scene weights, sample matching degrees, and the proportion of overlapping convex polygon areas in each partition, including:

[0091] The process involves receiving a baseline analysis region and spatially segmenting it according to the source identifiers of each sub-scene within that region. This results in multiple analysis partitions corresponding to each sub-scene. Specifically, this includes: first, receiving a unified baseline analysis region containing the spatial range data of merged convex polygons corresponding to the normal behavioral characteristics of all sub-scenes; parsing the data in the baseline analysis region to extract the source identifiers of each sub-scene, which are unique identifiers set for each sub-scene during the previous sub-scene segmentation phase to clearly distinguish the spatial regions corresponding to different sub-scenes; initiating a spatial segmentation process based on the source identifiers, precisely segmenting the baseline analysis region according to the original convex polygon boundary range corresponding to each sub-scene, strictly adhering to the original boundaries of the convex polygons of each sub-scene during the segmentation process to ensure that each segmented analysis partition completely retains the spatial range of the normal behavioral characteristics of the corresponding sub-scene, and that the boundaries between partitions are clear and unambiguous; finally, multiple independent analysis partitions corresponding to each sub-scene are obtained, with each partition containing only the spatial data of the normal behavioral characteristics of a single sub-scene.

[0092] The discrete behavioral data sample set is allocated to the corresponding analysis partitions based on the sub-scene attribution identifier of each sample, forming a sample distribution dataset within each analysis partition. Specifically, this involves: retrieving the generated discrete behavioral data sample set, where each sample has been marked with a corresponding sub-scene attribution identifier during the acquisition and processing phases. This identifier is consistent with the source identifier of the sub-scene in the baseline analysis area, used to clarify the specific sub-scene to which the sample belongs; traversing the entire discrete behavioral data sample set, reading the sub-scene attribution identifier of each sample one by one, and comparing and matching the identifier with the generated sub-scene source identifiers of each analysis partition. When the attribution identifier of a sample completely matches the source identifier of a certain analysis partition, the system allocates the sample to the corresponding analysis partition. This matching and allocation process is repeated until all discrete behavioral data samples have been allocated to their corresponding analysis partitions; after each analysis partition receives its samples, the samples within the partition are sorted and categorized according to the time sequence of sample generation and feature dimensions, forming a sample distribution dataset specific to each analysis partition.

[0093] For each analysis partition's sample distribution dataset, the system calculates the partition's sub-scenario weight, the matching degree between the current sample and historical normal samples, and the proportion of overlapping convex polygon regions within the partition in the baseline analysis area, resulting in a multi-dimensional partition feature parameter set. Specifically, for each analysis partition's sample distribution dataset, the system sequentially calculates three core partition feature parameters to form a multi-dimensional partition feature parameter set. Firstly, considering the business architecture and security priorities of the current operation and maintenance scenario, the importance of each sub-scenario is determined. Importance is comprehensively judged based on factors such as the core nature of the business involved, the data sensitivity level, and the scope of impact of the operation and maintenance activities. For example, sub-scenarios involving core business data repair have a higher weight than ordinary configuration adjustment sub-scenarios. According to a preset weight evaluation standard, the importance of each sub-scenario is converted into a corresponding weight value, which is the sub-scenario weight of that analysis partition. Secondly, the system retrieves the historical operation and maintenance behavior data for the corresponding sub-scenario from the historical operation and maintenance behavior database. The analysis involves three steps: First, a set of discrete behavior data is used. Each sample within the current analysis partition is compared with the historical normal sample set. This comparison covers key information such as the sample's numerical values ​​and feature combination patterns across various feature dimensions. The degree of fit between the current sample and historical normal samples across these dimensions is statistically analyzed, and converted into a matching score based on the degree of fit. A higher score indicates stronger consistency between the current sample and historical normal behavior. Second, the analysis extracts the original convex polygon region data corresponding to the analysis partition, as well as the convex polygon region data corresponding to all other sub-scenes in the baseline analysis region. Through spatial location comparison, the overlapping spatial range of the convex polygons in the partition is determined. The ratio of the volume of the overlapping spatial range to the total volume of the convex polygons in the partition is calculated. This ratio represents the percentage of overlapping convex polygon regions, reflecting the degree of overlap between the normal behavior features of this sub-scene and other sub-scenes. After these three parameters are calculated, they are integrated to form a multi-dimensional partition feature parameter set for the analysis partition.

[0094] Based on the partition feature parameter set, an analysis calibration coefficient is generated through a weighted fusion algorithm. Specifically, this involves: first, assigning a corresponding fusion weight to each parameter in the obtained multi-dimensional partition feature parameter set. The fusion weight is determined based on the degree of influence of each parameter on anomaly analysis and judgment. For example, sub-scene weights have a significant impact on judgment priority, so a higher fusion weight is assigned; the proportion of overlapping areas of convex polygons affects boundary judgment accuracy, so a reasonable weight is also assigned. Then, the weighted fusion algorithm process is initiated, multiplying the value of each feature parameter of each analysis partition by its corresponding fusion weight to obtain a weighted score for each parameter. Next, all weighted scores are summed to obtain a comprehensive score for the analysis partition. The comprehensive score is then standardized and converted into a coefficient value within a reasonable range; this coefficient value is the analysis calibration coefficient for that analysis partition. Each analysis partition generates its corresponding analysis calibration coefficient according to this process, ensuring that the generated calibration coefficients comprehensively reflect the differences in business importance, sample fit, and feature overlap of each sub-scene.

[0095] In this embodiment of the invention, because the embodiment adopts the technical means of dividing the benchmark analysis area into corresponding analysis partitions according to the sub-scene source identification information, allocating discrete behavioral data samples to corresponding partitions according to the sample sub-scene belonging identification, calculating the sub-scene weight, sample matching degree and the proportion of overlapping areas of convex polygons in each partition to obtain a multi-dimensional partition feature parameter set, and generating analysis calibration coefficients through a weighted fusion algorithm, it overcomes the technical problems of insufficient targeting and incomplete consideration of partition features in traditional operation and maintenance security analysis, which leads to insufficient accuracy in generating calibration coefficients. Thus, it achieves accurate partition analysis of behavioral data samples under multiple sub-scenes and comprehensive integration of multi-dimensional partition features, so that the generated analysis calibration coefficients truly reflect the differences in analysis needs of each sub-scene, and improve the targeting and accuracy of anomaly analysis judgment.

[0096] In a preferred embodiment of the present invention, the judgment threshold is dynamically adjusted by a calibration coefficient. When a suspected abnormal operation is detected, a secondary judgment is performed to obtain a secondary judgment result, including:

[0097] The system receives analysis calibration coefficients and dynamically adjusts the preset initial anomaly detection threshold based on these coefficients to obtain a dynamic detection threshold adapted to the characteristics of the current operation and maintenance scenario. Specifically, this involves: first, receiving the analysis calibration coefficients corresponding to each analysis partition, which comprehensively reflect the differences in business importance, sample matching degree, feature overlap, and other dimensions of different sub-scenarios; second, establishing a correlation adjustment mechanism between the analysis calibration coefficients and the initial anomaly detection threshold, based on a pre-set unified initial anomaly detection threshold. This threshold is a basic judgment standard formulated based on the security requirements of general operation and maintenance scenarios, but it does not consider the personalized characteristics of specific scenarios, and a fixed threshold cannot adapt to scenario differences. For each analysis partition, the analysis calibration coefficient of the partition is used as the adjustment basis. If the calibration coefficient is high, it indicates that the business importance of the sub-scenarios is high and the sample matching requirements are strict, so the initial threshold is appropriately lowered to improve the sensitivity of anomaly detection; if the calibration coefficient is low, it indicates that the feature overlap of the sub-scenarios is high and the fault tolerance margin is large, so the initial threshold is appropriately increased to reduce false judgments. Through targeted adjustments, the unified initial threshold is transformed into a dynamic detection threshold that accurately matches the characteristics of each sub-scenarios.

[0098] The real-time discrete behavioral data samples in the constructed behavioral feature space are spatially compared with the benchmark analysis area. Combined with a dynamic judgment threshold, suspected abnormal operation data points located outside the benchmark analysis area and exceeding the dynamic judgment threshold range are detected. Specifically, this includes: real-time collection of operation and maintenance behavior data, converting it into real-time discrete behavioral data samples according to a discretization processing standard, and accurately projecting the samples into the constructed multi-dimensional behavioral feature space according to mapping rules; subsequently, initiating a spatial position comparison process to determine whether the coordinate position of each real-time discrete behavioral data sample in the feature space is within the generated benchmark analysis area; if the sample coordinates are within the benchmark analysis area... If a sample is within the baseline analysis area, it is initially identified as a normal behavior sample. If the sample coordinates are outside the baseline analysis area, a second judgment is made based on the dynamic judgment threshold of the corresponding analysis partition. The dynamic judgment threshold sets a reasonable tolerance range outside the baseline analysis area. The spatial distance between the sample and the boundary of the baseline analysis area is calculated. If the distance does not exceed the dynamic judgment threshold range, it is still identified as normal behavior. If the distance exceeds the dynamic judgment threshold range, the sample is marked as a suspected abnormal operation data point. The whole process uses the dual logic of intra-area judgment and extra-area threshold verification, which avoids the limitations of the single judgment standard of the traditional system and accurately screens out sample points that are truly suspected of being abnormal.

[0099] For suspected anomalous operation data points, a pre-built secondary verification rule library is invoked. Combining the sub-scenario characteristics and historical behavior patterns corresponding to the suspected anomalous operation, a multi-dimensional cross-validation analysis is performed on the suspected anomalous operation data points to obtain the results. Specifically, this includes: retrieving the sub-scenario attribution information corresponding to the data points marked as suspected anomalous operations to clarify the specific sub-scenario to which they belong; then, invoking the pre-built secondary verification rule library, which stores specific verification rules for different sub-scenarios, including the operation permission boundaries, sensitive operation triggering conditions, normal behavior logic chains, and typical characteristics of anomalous behavior for each sub-scenario; and finally, combining the sub-scenario to which the suspected anomalous data point belongs... Features such as the business process specifications of the sub-scenario, the range of allowed operation types, and the level of data access permissions are identified. Historical behavioral pattern data corresponding to the sub-scenario is also retrieved, including characteristic combinations of historical normal operations, operation frequency distribution, and data interaction patterns. Cross-validation analysis is performed on suspected abnormal data points from multiple dimensions, specifically including whether the operation initiation permission is compliant, whether the operation process conforms to the business logic of the sub-scenario, the degree of deviation between the operation characteristics and historical normal patterns, and whether the data access scope exceeds the allowed boundaries of the sub-scenario. Through multi-dimensional and comprehensive cross-validation, comprehensive compliance evidence for the suspected abnormal data points is collected, forming detailed multi-dimensional cross-validation analysis results.

[0100] Based on the results of multi-dimensional cross-validation analysis, a secondary judgment confidence level is calculated. When the confidence level exceeds a preset secondary judgment threshold, the suspected abnormal operation is confirmed as a real abnormal behavior; otherwise, it is judged as normal behavior, resulting in the final secondary judgment result. Specifically, this includes: quantifying and evaluating the validation conclusion of each dimension based on the obtained multi-dimensional cross-validation analysis results. For example, in the operation permission compliance dimension, a positive score is assigned if the validation passes, and a negative score is assigned if it does not comply with the rules; the alignment between the operation process and business logic is assigned different scores according to the degree of alignment, with lower scores for more severe deviations; then, the quantified scores of all dimensions are summarized, and a weighted calculation is performed according to the importance of each dimension in the validation to obtain the secondary judgment confidence level of the suspected abnormal operation data point. The higher the confidence level, the greater the probability that the sample is a real abnormal behavior. The system presets a secondary judgment threshold, which is a confidence threshold set based on a large amount of historical operation and maintenance data and security incident cases. It is used to distinguish between real anomalies and false positives. The calculated secondary judgment confidence is compared with the preset secondary judgment threshold. If the confidence exceeds the threshold, it indicates that multi-dimensional verification supports that the sample is an abnormal behavior and confirms that it is a real abnormal behavior. If the confidence does not reach the threshold, it indicates that the abnormal characteristics of the sample are insufficient and may be a special fluctuation of normal behavior, and it is judged as normal behavior. Finally, a clear secondary judgment result is formed.

[0101] In this embodiment of the invention, because it employs technical means such as dynamically adjusting the initial anomaly judgment threshold based on the analysis calibration coefficient to adapt to the current operation and maintenance scenario, comparing the spatial location of real-time discrete behavior data samples with the benchmark analysis area and combining dynamic thresholds to detect suspected abnormal operation data points, calling the pre-set secondary verification rule base and combining sub-scenario features and historical behavior patterns to perform multi-dimensional cross-verification of suspected anomaly points, and determining the final judgment result by calculating the secondary judgment confidence, it effectively overcomes the technical problems of fixed thresholds in traditional operation and maintenance anomaly judgment that cannot adapt to scenario differences, single judgment that is prone to misjudgment and missed judgment, and lack of targeted verification basis. Thus, it achieves accurate adaptation of the judgment threshold to the operation and maintenance scenario features, multi-dimensional in-depth verification of suspected abnormal operations, reduces the misjudgment rate and missed judgment rate of anomaly judgment, and improves the accuracy and reliability of abnormal behavior identification.

[0102] In a preferred embodiment of the present invention, the method for performing defensive actions based on the secondary determination result includes:

[0103] The system receives the secondary judgment results and analyzes the abnormal behavior confirmation status and corresponding risk level identifiers contained within them. Specifically, it receives the generated final secondary judgment results, which clearly indicate the judgment conclusion for each real-time discrete behavior data sample. To address the lack of tiered criteria in traditional defenses, a result analysis process is initiated, focusing on extracting two core types of information: one is the abnormal behavior confirmation status, which clearly indicates whether the judgment result is a genuine abnormal behavior or a normal behavior, ensuring accurate definition of the behavior's nature; the other is the corresponding risk level identifier, which is a tiered information generated synchronously during the secondary judgment process based on factors such as the core business involved in the abnormal behavior, the data sensitivity level, and the scope of losses caused. Risk levels are typically divided into different levels, such as emergency, high risk, and general warning, providing a clear basis for subsequent tiered defenses. By fully analyzing these two types of information, the security status and risk level of the current operation and maintenance can be clearly understood.

[0104] Based on the confirmed status of abnormal behavior and the risk level identifier, matching defense action execution plans are retrieved from a pre-configured defense strategy library. Specifically, this involves: combining the parsed confirmed status of abnormal behavior with the risk level identifier to form defense requirement retrieval conditions. A dedicated defense strategy library stores standardized defense action execution plans for different abnormal states and risk levels. These plans cover specific details such as operation blocking methods, connection handling strategies, alarm level settings, and log recording requirements. For example, for emergency high-risk abnormal behavior, the defense strategy library stores a plan to forcibly block the operation, terminate the session, and immediately issue an alarm; for general risk-level abnormal behavior, it stores a plan to limit bandwidth and trigger a regular alarm. Based on the combined retrieval conditions, a precise matching query is performed in the defense strategy library to select defense action execution plans that perfectly match the current abnormal state and risk level.

[0105] According to the defense action execution plan, real-time blocking is implemented for operations and maintenance (O&M) operations confirmed as abnormal behavior. Simultaneously, bandwidth limiting or session termination operations are performed on related O&M connections, establishing a preliminary defense execution state. Specifically, this includes: retrieving the matched defense action execution plan and initiating the defense execution process according to the plan's explicit requirements; for O&M operations confirmed as genuine abnormal behavior, real-time blocking is prioritized, preventing the abnormal operation from continuing by intercepting operation command transmissions and terminating data interaction processes, thus avoiding further impact on core business data; simultaneously, based on the corresponding connection handling strategy in the plan, the relevant O&M connections initiating the abnormal operation are handled specifically. If the risk level is high, session termination is performed directly to completely sever the insecure connection; if the risk level is relatively low, bandwidth limiting is performed to restrict the data transmission rate of the connection, reducing the speed of potential risk propagation. After completing the blocking and connection handling, the execution status of each operation is recorded, including blocking time, handling method, and changes in connection status, establishing a preliminary defense execution state.

[0106] The initial defense execution status is correlated with risk level identifiers to generate multi-level alarm notifications. These alarms are then sent to operations and maintenance personnel through pre-defined notification channels. Simultaneously, the complete context data of abnormal operations is recorded in the security audit log library. Specifically, to address the shortcomings of traditional alarms in terms of targeting and audit traceability, a deep correlation analysis is performed between the generated initial defense execution status and the parsed risk level identifiers. Based on the risk level and the actual effectiveness of the defense execution, corresponding multi-level alarm notifications are generated. Emergency high-risk situations correspond to the highest level alarm, general risks correspond to regular alarms, and alert-level risks... The system provides alerts for corresponding risks, with different handling suggestions and response time limits for different alert levels. Alert information is sent simultaneously through multiple preset notification channels, including pop-ups on the operations and maintenance management platform, administrators' office emails, SMS messages, and messages from dedicated communication software, ensuring that operations and maintenance personnel receive the information in a timely manner. At the same time, it comprehensively collects complete contextual data of abnormal operations, including terminal information initiating the operation, details of the operation instructions, data access paths, execution time nodes, abnormal characteristics, and defense and handling processes. After being organized according to a unified log format, the data is fully recorded in the security audit log library, enabling full traceability of abnormal operations.

[0107] This process involves aggregating defense execution data from the security audit log database, combining it with feedback on the effectiveness of the current defense actions, generating optimization parameters for the defense strategy, and dynamically adjusting the emergency priority assignment strategy, behavioral feature identification rule set, and analysis calibration coefficients. Specifically, this includes: initiating a closed-loop optimization process to address the inability to dynamically optimize the defense strategy; firstly, aggregating relevant data from the security audit log database, including abnormal behavior characteristics, risk levels, defense action content, execution effects, and alarm feedback; secondly, collecting feedback on the effectiveness of the current defense actions, including the response speed of operations and maintenance personnel to alarms, whether the defense actions effectively prevented the spread of anomalies, whether there were any misjudgments that blocked normal operations, and whether there were any residual effects from the abnormal behavior; and thirdly, collecting feedback on these actions. The system comprehensively analyzes aggregated data and feedback to identify shortcomings in the current defense strategy, such as the rationality of emergency priority identifier allocation, whether there are omissions in behavioral feature recognition rules, and whether the analysis calibration coefficients need adjustment. Based on the analysis results, it generates defense strategy optimization parameters, which clearly define the adjustment direction and specific values ​​for each part of the strategy. Finally, it dynamically adjusts the emergency priority identifier allocation strategy according to the optimization parameters to make priority determination more aligned with actual business needs; it adjusts the behavioral feature recognition rule set, adding newly discovered abnormal feature rules and deleting outdated or high-false-rate rules; it adjusts the analysis calibration coefficients to improve the accuracy of anomaly detection; and through dynamic adjustments, it achieves self-iterative upgrades of the defense system, continuously improving the adaptability and effectiveness of operational security defense.

[0108] In this embodiment of the invention, because it employs the following technical means: parsing the abnormal behavior confirmation status and risk level identifier in the secondary judgment result; retrieving matching defense execution schemes from the defense strategy library based on the status and identifier; implementing real-time blocking of abnormal operations and limiting bandwidth or terminating related connections; associating defense execution status and risk level to generate multi-level alarms and recording the complete context of abnormal operations to the security audit log library; summarizing audit data and effect feedback to generate optimization parameters and dynamically adjusting emergency priority allocation strategies; and using behavioral feature identification rule sets and analysis calibration coefficients, it effectively overcomes the technical problems of traditional operation and maintenance defense actions lacking hierarchical adaptability, alarm information lacking specificity, audit traceability being incomplete, and defense strategies being unable to be dynamically optimized. This achieves hierarchical and precise defense of abnormal behavior, timely and accurate alarm notifications for operation and maintenance personnel, and full traceability of abnormal operations. Simultaneously, it realizes closed-loop self-optimization of defense strategies, improving the specificity, timeliness, and adaptability of operation and maintenance security defense.

[0109] Embodiments of the present invention also provide a computing device, including: a processor and a memory storing a computer program, wherein the computer program, when executed by the processor, performs the system as described above. All implementations in the above system embodiments are applicable to this embodiment and can achieve the same technical effects.

[0110] Embodiments of the present invention also provide a computer-readable storage medium storing instructions that, when executed on a computer, cause the computer to perform the system as described above. All implementations in the above system embodiments are applicable to this embodiment and can achieve the same technical effects.

[0111] The above description represents the preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. An operation and maintenance software defense system based on dynamic encryption and intrusion prevention, characterized in that, The method comprises the following steps: a distribution module is used to receive an operation and maintenance connection request through a dynamic encryption layer, identify the specific type of the current operation and maintenance scene, and assign a corresponding emergency priority identifier to the connection request belonging to the emergency operation and maintenance scene; an encryption module is used to prioritize the key negotiation request based on the emergency priority identifier, and obtain the session key and the matching encryption algorithm for multiple operation and maintenance connections with emergency priority through a parallel negotiation mechanism; a collection module is used to establish a secure operation and maintenance connection through the session key and the encryption algorithm, collect operation and maintenance operation behavior data in real time through an intrusion prevention layer, and load corresponding behavior feature recognition rules according to the operation and maintenance scene type; a merging module is used to monitor and analyze the operation and maintenance operation behavior data in real time based on the behavior feature recognition rules, process discrete behavior data samples, and construct a behavior feature space; for a multi-sub-scene fusion operation and maintenance scene, a corresponding convex polygon region is defined for the normal behavior features of each sub-scene, and a baseline analysis region is obtained by merging all convex polygons; a judgment module is used to subdivide the baseline analysis region into multiple analysis partitions according to the sub-scene source, and distribute the discrete behavior data samples to the corresponding partitions, generate an analysis calibration coefficient according to the sub-scene weight, sample matching degree, and convex polygon overlap area proportion of each partition; the calibration coefficient is used to dynamically adjust the judgment threshold, and when a suspected abnormal operation is detected, a secondary judgment is performed to obtain a secondary judgment result; a processing module is used to execute a defense action according to the secondary judgment result.

2. The operation and maintenance software defense system based on dynamic encryption and intrusion prevention according to claim 1, characterized in that, The method comprises the following steps: The operation and maintenance connection request is received through the dynamic encryption layer, and the identity credential information and the connection context information in the connection request are extracted; According to the identity credential information and the connection context information, and in combination with the pre-set emergency scene feature library, it is determined whether the current operation and maintenance scene belongs to the emergency operation and maintenance scene; When it is determined that the current operation and maintenance scene belongs to the emergency operation and maintenance scene, the priority value of the emergency operation and maintenance scene is calculated according to the emergency degree parameter and the influence range parameter in the connection context information; Based on the priority value, the corresponding emergency priority identifier is assigned to the connection request.

3. The operation and maintenance software defense system based on dynamic encryption and intrusion prevention according to claim 2, characterized in that, The key negotiation request is prioritized based on the emergency priority identifier, and the session key and the matching encryption algorithm are obtained for multiple operation and maintenance connections with emergency priority through a parallel negotiation mechanism, which comprises the following steps: Based on the value of the emergency priority identifier, the multiple received key negotiation requests are sorted to form a request sequence arranged from high to low according to the priority value; Based on the sorting result of the request sequence, the high-priority request arranged in the front of the sequence is assigned a dedicated parallel negotiation resource, and candidate encryption algorithms that meet the security requirements of each level are selected from a pre-configured encryption algorithm set according to the security requirement level corresponding to each request. Based on the allocated dedicated resources and the screened candidate encryption algorithms, independent key negotiation sessions are simultaneously established for multiple high-priority requests through a parallel negotiation process, and key exchange operations are performed in each session based on the corresponding candidate encryption algorithm to generate corresponding preliminary key data; The preliminary key data is subjected to security strength evaluation, and based on the evaluation results and the specific performance requirements of each operation and maintenance scene, the encryption algorithm finally adopted is determined from the candidate encryption algorithms for each high-priority operation and maintenance connection.

4. The operation and maintenance software defense system based on dynamic encryption and intrusion prevention according to claim 3, characterized in that, A secure operation and maintenance connection is established through the session key and the encryption algorithm, and operation and maintenance operation behavior data under the connection is collected in real time through the intrusion prevention layer, and the corresponding behavior feature recognition rules are loaded according to the operation and maintenance scene type, including: Receiving the session key and the matching encryption algorithm, an end-to-end secure encryption channel is established for the corresponding operation and maintenance connection request based on the session key and the encryption algorithm, forming a secure operation and maintenance connection; An intrusion prevention layer is deployed on the established secure operation and maintenance connection, and all operation and maintenance operation behavior data generated under the secure operation and maintenance connection are captured and collected in real time through the intrusion prevention layer, forming an original behavior data stream; According to the current operation and maintenance scene type, the behavior feature recognition rule set matching the operation and maintenance scene type is retrieved and loaded from the preloaded behavior rule library.

5. The operation and maintenance software defense system based on dynamic encryption and intrusion prevention according to claim 4, characterized in that, Based on the behavior feature recognition rules, operation and maintenance operation behavior data is monitored and analyzed in real time, and is processed into discrete behavior data samples and a behavior feature space is constructed; for a multi-sub-scene fusion operation and maintenance scene, a convex polygon area is defined for the normal behavior features of each sub-scene, and a baseline analysis area is obtained by merging all convex polygons, including: Based on the behavior feature recognition rule set, the original behavior data stream is monitored and feature extraction analyzed in real time to obtain a structured operation and maintenance behavior feature sequence; The operation and maintenance behavior feature sequence is subjected to discretization processing, and according to the time window division and feature dimension separation principle, the continuous behavior feature sequence is converted into a discrete behavior data sample set; Based on the discrete behavior data sample set, a multi-dimensional behavior feature space is constructed, each dimension of the behavior feature space corresponds to a behavior feature type, and each discrete behavior data sample is mapped to a corresponding feature point in the space, forming a feature point distribution cloud data; According to the current operation and maintenance scene type, it is judged whether the operation and maintenance scene is of the multi-sub-scene fusion type, and if so, based on the constructed behavior feature space, a corresponding convex polygon area is fitted for the historical normal behavior data of each sub-scene in the feature space; The convex polygon areas are subjected to spatial merging operation, and the union set of each convex polygon area is calculated to eliminate the overlapping parts and form a unified baseline analysis area covering the normal behavior features of all sub-scenes.

6. The operation and maintenance software defense system based on dynamic encryption and intrusion prevention according to claim 5, characterized in that, The baseline analysis area is subdivided into multiple analysis partitions according to the sub-scene sources, and the discrete behavior data samples are allocated to the corresponding partitions, and analysis calibration coefficients are generated according to the sub-scene weights, sample matching degrees, and convex polygon overlapping area proportions of each partition, including: Receiving the baseline analysis area, the baseline analysis area is spatially segmented according to the sub-scene sources based on the source identification information of each sub-scene in the baseline analysis area, and multiple analysis partitions corresponding to each sub-scene are obtained; The discrete behavior data sample set is distributed into corresponding analysis partitions according to the sub-scene attribution identification of each sample, forming a sample distribution data set in each analysis partition; For the sample distribution data set in each analysis partition, the sub-scene weight of the partition, the matching degree between the current sample and the historical normal sample, and the proportion of the convex polygon overlap area of the partition in the benchmark analysis area are calculated to obtain a multi-dimensional partition feature parameter set; Based on the partition feature parameter set, an analysis calibration coefficient is generated through a weighted fusion algorithm.

7. The operation and maintenance software defense system based on dynamic encryption and intrusion prevention according to claim 6, characterized in that, The calibration coefficient is used to dynamically adjust the determination threshold. When a suspected abnormal operation is detected, a secondary determination is performed to obtain a secondary determination result, including: Receiving the analysis calibration coefficient, dynamically adjusting the preset initial abnormal determination threshold based on the analysis calibration coefficient, and obtaining a dynamic determination threshold that adapts to the current operation and maintenance scene characteristics; Comparing the real-time discrete behavior data sample in the constructed behavior feature space with the benchmark analysis area in terms of spatial position, and detecting suspected abnormal operation data points located outside the benchmark analysis area and exceeding the dynamic determination threshold range, in combination with the dynamic determination threshold; For the suspected abnormal operation data points, a pre-set secondary verification rule library is called, and multi-dimensional cross-verification analysis is performed on the suspected abnormal operation data points in combination with the sub-scene characteristics and historical behavior patterns corresponding to the suspected abnormal operation, to obtain a multi-dimensional cross-verification analysis result; Based on the multi-dimensional cross-verification analysis result, a secondary determination confidence is calculated. When the confidence exceeds a preset secondary determination threshold, the suspected abnormal operation is confirmed as a real abnormal behavior, otherwise it is determined as a normal behavior, to obtain the final secondary determination result.

8. The operation and maintenance software defense system based on dynamic encryption and intrusion prevention of claim 7, wherein, For performing a defense action according to the secondary determination result, including: Receiving the secondary determination result, analyzing the abnormal behavior confirmation state and the corresponding risk level identification contained in the secondary determination result; Based on the abnormal behavior confirmation state and the risk level identification, a matching defense action execution scheme is retrieved from a pre-set defense strategy library; According to the defense action execution scheme, real-time blocking processing is implemented for the operation and maintenance operation confirmed as an abnormal behavior, and bandwidth limitation or session termination operation is performed on the related operation and maintenance connection, to form a preliminary defense execution state; Associating and analyzing the preliminary defense execution state with the risk level identification, obtaining multi-level alarm notification information, and sending the alarm information to the operation and maintenance management personnel through a pre-set notification channel, while recording the complete context data of the abnormal operation to a security audit log library; Summarizing the defense execution data in the security audit log library, combining the effect feedback information of this defense action, generating defense strategy optimization parameters, and dynamically adjusting the emergency priority level identification allocation strategy, the behavior feature recognition rule set, and the analysis calibration coefficient.

9. A computing device, comprising: It includes: One or more processors; A storage device for storing one or more programs, when the one or more programs are executed by the one or more processors, so that the one or more processors execute the system as claimed in any one of claims 1 to 8.

10. A computer-readable storage medium, characterized in that, The computer readable storage medium stores a program which is executed by the processor to execute the system as claimed in any one of claims 1 to 8.

Images