Artificial intelligence-based data security dynamic policy adjustment method, system, device and storage medium

Abstract

The application relates to the technical field of artificial intelligence, and provides a data security dynamic policy adjustment method, system, device and storage medium based on artificial intelligence, which solves the problem of permission redundancy or protection vulnerability. The application captures the state trajectory of each survival stage of target data, forms a time-labeled feature vector, dynamically evaluates data security risks and values according to system environment and operation access features in the vector, and generates a dynamic security level changing with stages; in combination with the level and the trajectory, a state perception policy covering multiple stages is derived through a preset policy network to determine a policy switching condition; a basic access permission is constructed by an AI engine and is decomposed into permission fragments according to stages, matching access rules are configured, and an adaptive security channel adapting to risks in each stage is formed; when an access request is received, context information and the like are comprehensively analyzed to combine and verify in the channel, so that the full-stage data security policy dynamic adjustment and permission accurate control based on artificial intelligence can be realized.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence technology, and in particular to a method, system, device and storage medium for dynamic adjustment of data security strategies based on artificial intelligence. Background Technology

[0002] Against the backdrop of accelerated digital transformation, the application scenarios at different stages of data's lifecycle—from creation, use, and storage to archiving and destruction—exhibit significant differences. This necessitates security strategies that can accurately match the fluctuations in data value and changes in risk at each stage, achieving dynamic protection that adapts to demand. Simultaneously, it avoids resource waste due to over-protection or security risks caused by insufficient protection. This requirement has become a core technological need in the field of data security.

[0003] Currently, the mainstream solution for this requirement is a phased security policy configuration scheme based on preset rules. This scheme pre-divides the entire data lifecycle into fixed phases, sets static security rules and corresponding access permission templates for each phase, and switches policies between different phases by configuring trigger conditions. For example, it enables encrypted storage rules in the storage phase and grants access permissions to specific permission groups in the usage phase.

[0004] The existing solution has obvious shortcomings: the phase division and policy rules are all statically preset, which cannot perceive the dynamic changes in data value, system environment and access behavior in real time, resulting in insufficient policy adaptability; policy switching depends on fixed trigger conditions, lacks comprehensive analysis of data status trajectory, and is difficult to cope with risk fluctuations in cross-phase and complex scenarios; the permission configuration adopts an overall mode and does not perform fine-grained decomposition by phase, which cannot achieve precise permission control based on specific scenarios, and is prone to permission redundancy or protection vulnerabilities. Summary of the Invention

[0005] The purpose of this application is to provide a data security dynamic policy adjustment method, system, device and storage medium based on artificial intelligence, so as to solve the problems of permission redundancy or protection vulnerabilities in the prior art.

[0006] To address the aforementioned technical problems, in a first aspect, this application provides a data security dynamic policy adjustment method based on artificial intelligence, comprising:

[0007] Capture the state trajectory of the target data at each stage of its existence and form a time-stamped feature vector;

[0008] Based on the system environment characteristics and operation access characteristics in the feature vector, the security risk and value level of the target data are dynamically evaluated to generate a dynamic security level that changes with the duration of existence.

[0009] According to the dynamic security level and the state trajectory, a state-aware strategy covering multiple life stages is derived through a preset policy network, and the state-aware strategy defines a security policy switching condition for transition between different life stages.

[0010] Based on the state-aware strategy, a basic access permission is constructed through an artificial intelligence engine, the basic access permission is structurally decomposed according to life stages, a permission shard corresponding to each stage is generated, and an access rule matching the corresponding life stage is configured for each permission shard;

[0011] Based on the state-aware strategy, an adaptive security channel matching the risk level of each life stage is formed; when a data access request is received, an intelligent negotiation mechanism is used to comprehensively analyze the access context, the permission shard state and the access rules of each permission shard, and combined verification is performed in the adaptive security channel to realize dynamic adjustment of access permissions.

[0012] Optionally, according to the dynamic security level and the state trajectory, a state-aware strategy covering multiple life stages is derived through a preset policy network, and the state-aware strategy defines a security policy switching condition for transition between different life stages, including:

[0013] The time-labeled feature vector in the dynamic security level and the state trajectory is input into a preset policy network, and feature propagation calculation is performed through multiple layers of nodes in the preset policy network to obtain a policy weight of each life stage;

[0014] According to the policy weight and the time label in the state trajectory, a transition probability between life stages is calculated, and a trigger threshold for policy switching is determined in combination with the change trend of the dynamic security level;

[0015] Based on the trigger threshold and the policy weight, a state-aware strategy covering multiple life stages is generated, wherein the state-aware strategy includes a policy switching condition, and the policy switching condition defines a security policy transition operation when the dynamic security level crosses the trigger threshold.

[0016] Optionally, according to the policy weight and the time label in the state trajectory, a transition probability between life stages is calculated, and a trigger threshold for policy switching is determined in combination with the change trend of the dynamic security level, including:

[0017] According to the time label in the state trajectory, a start time point and an end time point of adjacent life stages are identified to calculate the duration span of each life stage;

[0018] Based on the duration span, in combination with the distribution density of the policy weight in the corresponding time interval, a conditional probability of transition from a previous survival stage to a next survival stage is calculated as a transition probability;

[0019] The change values of the dynamic security level in multiple continuous survival stages are extracted to form a security level change sequence, and the fluctuation amplitude and change direction of the security level change sequence are analyzed to determine a critical point of security level rise and fall;

[0020] The transition probability is associated with the critical point to establish a mapping table of probability and level, and the security level boundary value corresponding to each transition probability is found according to the mapping table, and the security level boundary value is set as a trigger threshold of policy switching.

[0021] Optionally, based on the state-aware policy, an adaptive security channel matched with the risk level of each survival stage is formed; when receiving a data access request, the access context, the permission slice state and the access rules of each permission slice are comprehensively analyzed through an intelligent negotiation mechanism, and combined verification is performed in the adaptive security channel to realize dynamic adjustment of access permissions, including:

[0022] According to the state-aware policy, an independent security communication path is established for each survival stage, and the encryption strength of the dynamic security level adjustment path of each survival stage is adjusted to form an adaptive security channel;

[0023] When receiving a data access request, the request parameters in the access context are extracted through an intelligent negotiation mechanism, including request time, access identity and operation type, and the permission slice state and access rules are checked;

[0024] In the adaptive security channel, the request parameters, permission slice state and access rules are subjected to multi-condition matching verification to determine a permission slice combination scheme that meets the conditions;

[0025] According to the permission slice combination scheme, the access permissions are dynamically adjusted, and a permission adjustment log is recorded.

[0026] Optionally, in the adaptive security channel, the request parameters, permission slice state and access rules are subjected to multi-condition matching verification to determine a permission slice combination scheme, including:

[0027] The request time parameter, access identity and request operation type of the request parameters in the access context are extracted to form an access feature set;

[0028] The current state mark of each permission slice is read, and the constraint conditions in the access rules corresponding to each permission slice are parsed;

[0029] In the adaptive security channel, the access feature set is compared with the current state mark and the constraint condition of each permission slice one by one to filter out the permission slice whose request time parameter is within the allowed time range, whose access identity meets the identity requirement, and whose request operation type does not exceed the operation limit, forming a candidate permission slice set;

[0030] The matching degree of each permission slice in the candidate permission slice set and the access feature set is calculated, the candidate permission slices are sorted according to the matching degree, and a number of permission slices with the highest matching degree are selected to form a permission slice combination scheme.

[0031] Optionally, based on the system environment features and operation access features in the feature vector, the security risk and value level of the target data are dynamically evaluated to generate a dynamic security level that changes with the survival stage, including:

[0032] The network connection quantity and system processing load parameters are parsed from the system environment features to calculate an environment fluctuation index of the system environment features;

[0033] Based on the environment fluctuation index, and in combination with historical environment data, the change rate of the environment fluctuation index is calculated as an environment risk factor;

[0034] The access request frequency and access source identity are parsed from the operation access features to calculate a behavior deviation degree of the operation access features;

[0035] Based on the behavior deviation degree, in combination with the normal access mode, the current access sequence is compared with the normal mode item by item to obtain an operation risk factor;

[0036] The environment risk factor and the operation risk factor are weighted and fused to generate a security risk level, and based on the type identification and survival stage time point of the target data, a predefined value mapping table is queried to obtain a basic value coefficient;

[0037] Based on the basic value coefficient and the survival stage time point, a value decay compensation value is calculated as the value level of the target data;

[0038] According to the security risk level and the value level, by comparing predefined level thresholds, a dynamic security level that changes with the survival stage is output.

[0039] Optionally, based on the state-aware strategy, a basic access permission is constructed through an artificial intelligence engine, the basic access permission is structurally decomposed according to the survival stage to generate permission slices corresponding to each stage, and each permission slice is configured with an access rule matched with the corresponding survival stage, including:

[0040] According to the state-aware strategy, the global access requirement of the target data is parsed by an artificial intelligence engine to generate basic access permissions covering all the survival stages;

[0041] According to the time sequence of the survival stages, the basic access permissions are segmented and cut to generate permission fragments corresponding to each survival stage, and each permission fragment contains the access operation type allowed in the corresponding stage;

[0042] Based on the dynamic security level and the policy switching condition of the corresponding survival stage, each permission fragment is configured with a matching access rule, and the access rule includes the time range and operation constraint condition allowed for access.

[0043] In a second aspect, the present application provides an artificial intelligence-based data security dynamic policy adjustment system, comprising:

[0044] A capture module is configured to capture the state trajectory of target data in each survival stage and form a time-labeled feature vector;

[0045] A generation module is configured to dynamically evaluate the security risk and value level of the target data based on the system environment features and operation access features in the feature vector to generate a dynamic security level that changes with the survival stage;

[0046] A derivation module is configured to derive a state-aware strategy covering multiple survival stages from the dynamic security level and the state trajectory through a preset policy network, and the state-aware strategy defines the security policy switching condition for transferring between different survival stages;

[0047] A matching module is configured to construct a basic access permission through an artificial intelligence engine based on the state-aware strategy, structurally decompose the basic access permission according to the survival stage, generate permission fragments corresponding to each stage, and configure each permission fragment with an access rule matching the corresponding survival stage;

[0048] A verification module is configured to form an adaptive security channel matching the risk level of each survival stage based on the state-aware strategy; when a data access request is received, the access context, permission fragment state, and access rules of each permission fragment are comprehensively analyzed through an intelligent negotiation mechanism for combined verification in the adaptive security channel to achieve dynamic adjustment of access permissions.

[0049] In a third aspect, the present application provides an electronic device, comprising:

[0050] A memory is configured to store a computer program;

[0051] The processor is configured to execute the computer program to implement the steps of the method for dynamically adjusting an artificial intelligence-based data security policy according to the first aspect.

[0052] In a fourth aspect, the present application provides a computer readable storage medium, wherein a computer program is stored in the computer readable storage medium, and the computer program is configured to implement the steps of the method for dynamically adjusting an artificial intelligence-based data security policy according to the first aspect when executed by a processor.

[0053] Advantages of the present application:

[0054] The method for dynamically adjusting an artificial intelligence-based data security policy provided by the present application can provide comprehensive and time-sequenced basic data support for subsequent security risk assessment and policy derivation by capturing the state trajectory of the target data in each survival stage and forming a time-labeled feature vector. The dynamic security level that changes with the survival stage can be generated by dynamically evaluating the security risk and value level of the target data based on the system environment features and operation access features in the feature vector, which can accurately reflect the security state fluctuation of the data in the whole life cycle and provide a core basis for security policy adjustment. The state-aware policy covering multiple survival stages can be derived by the preset policy network according to the dynamic security level and the state trajectory, which can clearly define the switching conditions of the security policy between different stages and realize the stage-based adaptation of the policy. The fine and stage-based control of the permissions can be realized by constructing the basic access permissions by the artificial intelligence engine based on the state-aware policy and structurally decomposing them according to the survival stage, and the matching access rules can be generated, which can improve the accuracy of permission allocation. The dynamic adjustment of access permissions can be realized by forming an adaptive security channel based on the state-aware policy, and the access request can be analyzed and verified by the intelligent negotiation mechanism, which can balance the data security protection and access flexibility.

[0055] Further, the multi-stage state-aware policy containing the switching conditions can be generated by inputting the dynamic security level and the time-labeled feature vector into the preset policy network, calculating the policy weights of each survival stage through multi-layer node feature propagation, calculating the stage transition probability and determining the policy switching trigger threshold based on the time label of the state trajectory. The accurate derivation of the policy weights and the switching trigger threshold through multi-layer network calculation can make the state-aware policy not only fit the data security state in each stage but also clearly define the quantitative standard for policy transition between stages, ensuring the scientificity, timeliness and accuracy of the security policy switching and improving the dynamic adaptation ability of the data security policy. BRIEF DESCRIPTION OF DRAWINGS

[0056] To more clearly illustrate the technical solutions of the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0057] Figure 1 A flowchart illustrating a data security dynamic strategy adjustment method based on artificial intelligence, provided for an embodiment of this application;

[0058] Figure 2 A flowchart illustrating a specific implementation of an artificial intelligence-based dynamic data security strategy adjustment method provided in this application embodiment;

[0059] Figure 3 This application provides a specific implementation scenario diagram of an artificial intelligence-based dynamic data security strategy adjustment method.

[0060] Figure 4 This is a schematic diagram of the structure of a data security dynamic strategy adjustment system based on artificial intelligence, provided in an embodiment of this application. Detailed Implementation

[0061] Existing phased security policy configuration schemes based on preset rules are unable to adapt to dynamic changes in data value, system environment, and access behavior in real time because the phase division and policy rules are statically set. Furthermore, policy switching relies on fixed conditions and lacks comprehensive consideration of data status trajectories. At the same time, permission configuration does not achieve phased and fine-grained decomposition, resulting in insufficient policy adaptability, difficulty in dealing with risk fluctuations in complex scenarios, and easy occurrence of permission redundancy or protection vulnerabilities. It cannot meet the dynamic security protection needs of the entire data lifecycle.

[0062] To address the aforementioned issues, this application proposes a data security dynamic policy adjustment method based on artificial intelligence. The core of this method is to leverage AI technology to achieve dynamic adaptation of security policies throughout the entire process. This method first captures the state trajectory of data at each stage of its existence and forms a time-stamped feature vector. It then dynamically assesses data security risks and value to generate a dynamic security level. Next, it derives a state-aware policy covering multiple stages, further splits permission fragments, configures staged access rules, and constructs an adaptive security channel. Finally, it achieves dynamic verification and adjustment of access permissions through an intelligent negotiation mechanism. This solution replaces static presets with dynamic awareness, replaces holistic configuration with refined permission splitting, and replaces fixed-condition switching with intelligent negotiation verification. It fundamentally solves the problems of insufficient adaptability, weak risk response capabilities, and imprecise permission control in existing solutions. It ensures data security while maintaining access flexibility, avoiding resource waste and security risks.

[0063] For those skilled in the art to better understand the present application, the present application will be further described in detail below in combination with the drawings and specific embodiments. Obviously, the described embodiments are only part of the embodiments of the present application, not all. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0064] The core of the present application is to provide a data security dynamic policy adjustment method based on artificial intelligence, and the flowchart of a specific embodiment thereof is shown in Figure 1 The method comprises:

[0065] S101, capturing the state trajectory of the target data in each survival stage, and forming a time-labeled feature vector.

[0066] Among them, the survival stage refers to the key link of the whole life cycle of the target data from creation, use, transmission, storage, archiving to destruction, covering various core business scenarios and nodes in the data flow process.

[0067] The state trajectory is the dynamic change information sequence of the data in each survival stage, which continuously records the state characteristics in the whole life cycle of the data, and fully reflects the transition path from generation to extinction.

[0068] The time-labeled feature vector is a structured data carrier, which converts the key state characteristics of the data environment, operation, attribute, etc. into calculable quantitative indicators, and also binds the corresponding time stamp for each indicator, forming a vector data with state information and timing properties.

[0069] The state trajectory of the data in each survival stage mainly includes three types of key information: first, the data attribute state, such as format, size, encryption state, association identifier, etc.; second, the system environment state, such as hardware device, software version, network type, security protection level, etc.; third, the operation access state, such as operation type, operation subject, permission range, operation result, etc., which comprehensively covers the core dynamics in the data survival process.

[0070] Specifically, the state trajectory of the target data in each survival stage is captured by using a collaborative mechanism combining multi-source collection and full-link monitoring. First, at the key flow nodes in the whole life cycle of the data, including terminal devices, servers, network devices, business systems, etc. Deploy collection components to obtain discrete data related to the environment information, operation behavior, and self attributes of the data through system log grabbing, business system burying point recording, and special tool state sensing, etc. After cleaning and deduplication of these multi-source data, the data ID, operation subject ID, etc. Key identifiers are used for association and integration to form a complete and continuous state change sequence, that is, the state trajectory of the data.

[0071] Then, forming a time-stamped feature vector requires multiple-step sequential operations. First, from the integrated state trajectory, the environmental class, the operation class, and the data itself class key features with core value for data security evaluation are selected. Then, the unstructured discrete features, such as operation type and encryption state, are converted into numerical form through methods such as one-hot encoding. The continuous features, such as data size and operation frequency, are standardized to ensure that the features are computable and comparable. Subsequently, a precise timestamp is bound to each quantized feature index, corresponding to the specific time node at which the feature was generated. Finally, all time-stamped quantized features are arranged in a predetermined order to form a time-stamped feature vector with uniform structure and fixed dimensions.

[0072] S102, based on the system environment features and operation access features in the feature vector, dynamically evaluating the security risk and value level of the target data to generate a dynamic security level that changes with the survival stage.

[0073] Among them, the system environment feature is a quantized index related to the external environment of the data in the time-stamped feature vector, including network connection quantity, system processing load parameter and other related data reflecting hardware devices, software running and network status. The operation access feature is a quantized index related to data interaction behavior in the time-stamped feature vector, covering access request frequency, access source identity and other related data reflecting operation subject behavior. The security risk level is a quantitative result obtained by combining environmental and operational risk factors. The value level is a quantitative result obtained by combining data inherent attributes and survival stage characteristics. The dynamic security level is a classification identifier based on the security risk level and the value level, which will be adjusted with the change of the data survival stage.

[0074] Optionally, step S102 can specifically include the following steps:

[0075] S1021, according to the system environment features in the feature vector, extracting the network connection quantity and the system processing load parameter, calculating the environmental fluctuation index of the system environment features, combining the historical environment data, and obtaining the environmental risk factor by calculating the index change rate.

[0076] In this step, the environmental fluctuation index is a numerical value calculated by extracting key parameters in the system environment features. The historical environment data refers to the past system environment feature data recorded during the data survival process. The index change rate is the difference between the current environmental fluctuation index and the corresponding index in the historical environment data, divided by the historical index. The environmental risk factor is a quantitative result obtained by combining the environmental fluctuation index and the index change rate.

[0077] S1022, according to the operation access feature in the feature vector, the frequency of the access request and the identity of the access source are parsed, the behavior deviation degree of the operation access feature is calculated, the normal access mode is combined, the operation risk factor is obtained by comparing the current access sequence with the normal mode.

[0078] The behavior deviation degree is a numerical value calculated by parsing the operation access feature. The normal access mode is a behavior model constructed based on historical compliance access data, including common access frequency range, legal access source and other features. The operation risk factor is a quantitative result obtained by comparing the current access sequence with the normal access mode.

[0079] S1023, the environmental risk factor and the operation risk factor are fused, the security risk level of the target data is generated by using a weighted fusion method, the basic value coefficient is obtained by querying the pre-defined value mapping table based on the type identification and the survival stage time point of the target data, the value decay compensation value is calculated combined with the survival stage time point, and the value level of the target data is obtained.

[0080] The survival stage time point refers to the specific time information of the current survival stage of the data, which is used to judge the progress of the data in the life cycle. The value mapping table is a pre-defined corresponding relationship table of data types and basic value coefficients. The basic value coefficient is an initial value quantitative value determined according to the data type. The value decay compensation value is an adjustment value calculated in combination with the survival stage time point.

[0081] S1024, according to the security risk level and the value level, the dynamic security level changing with the survival stage is output by comparing the pre-defined level threshold.

[0082] In this step, the pre-defined level threshold is a pre-defined security level division standard, including the interval range of the security risk level and the value level corresponding to different levels.

[0083] In the embodiments of the application, first, the network connection quantity and the system processing load parameter contained in the system environment feature are extracted by step S1021, the standard deviation algorithm is used to calculate these parameters to obtain the environmental fluctuation index of the system environment feature, the historical environment data recorded in the data survival process is called, the current environmental fluctuation index is compared with the corresponding index in the historical environment data, the index change rate of the two is calculated, and finally, the environmental risk factor is obtained by weighted summation algorithm combined with the environmental fluctuation index and the index change rate.

[0084] For example, in the system environment feature of a certain data in the storage stage, the network connection quantity is 80, the system processing load parameter is The environmental fluctuation index, calculated using the standard deviation algorithm, is 0.6. Historical environmental data from the past 30 days of this data storage period was retrieved, showing an average of 50 network connections and an average system processing load parameter of [missing information]. The corresponding historical environmental fluctuation index is 0.3, the calculated index change rate is 1.0, and then it is weighted according to the preset weights. and The environmental risk factor is obtained by weighted summation of environmental fluctuation indicators and their change rates. .

[0085] Secondly, step S1022 parses the access request frequency and access source identity identifier contained in the operation access features. A cosine similarity algorithm is used to calculate the deviation between the current operation access features and a preset benchmark. Simultaneously, a normal access pattern constructed based on historical compliant access data is retrieved. This pattern includes common access frequency ranges and a set of legitimate access source identity identifiers for this type of data. Then, the current access sequence is broken down into individual access behaviors in chronological order and compared item by item with the corresponding features in the normal access pattern. Based on the comparison results, the operation risk factor is calculated using a ratio. The formula for calculating the operation risk factor is:

[0086] ;

[0087] in, Represents operational risk factors. The number of behavioral dimensions representing the comparison. This represents the single-dimensional behavioral difference degree under the i-th dimension, which is the proportion of the difference between the current behavior and the normal pattern under each dimension.

[0088] For example, in the operation access characteristics of certain data, the access request frequency is 60 times per hour and the access source identity is C. The behavior deviation degree calculated by the cosine similarity algorithm is 0.7. A behavior deviation degree of 0.7 indicates that the current operation access characteristics have a significant deviation from the preset compliance benchmark (such as a benchmark value of 0.5), which has reached the "high deviation" level.

[0089] Assuming that under normal access conditions, the legitimate access frequency for this type of data ranges from 10 to 30 times per hour, and the set of legitimate access source identifiers includes... It involves two behavioral dimensions, namely In terms of access frequency, the current access frequency of 60 times per hour is compared with the normal range. If it exceeds the upper limit of the normal range by 30 times per hour, the single-dimensional behavioral difference is considered. The excess portion represents 1.0% of the normal upper limit. Under the access source identity dimension, the access source identity identifier... If not within the valid set, assign a single-dimensional behavioral difference according to preset rules. According to the operation risk factor calculation formula Substituting the data, the operation risk factor 1.0 can be calculated as The operation risk factor 1.0 quantifies the actual risk impact of the deviation in the key behavior dimension, reflecting that both the access frequency exceeding the standard and the illegal identity have reached the highest risk level. The behavior deviation degree reveals the overall deviation trend of the risk, and the operation risk factor clearly indicates the specific severity of the risk. Both of them reflect the security risk at the operation level.

[0090] Then, the safety risk level is calculated by summing the environment risk factor and the operation risk factor after assigning corresponding weights to them through the pre-set weighted fusion method. The calculation formula of the safety risk level is as follows:

[0091] ;

[0092] Wherein, represents the safety risk level, represents the weight of the environment risk factor, represents the environment risk factor, represents the weight of the operation risk factor, represents the operation risk factor, and satisfies .

[0093] At the same time, the type identifier of the target data is extracted to determine its business category, and the specific time information of the current existence stage of the data, i.e. the existence stage time point, is obtained. According to the type identifier, the corresponding basic value coefficient is obtained by querying the pre-defined value mapping table, and then the value decay compensation value is calculated by linear interpolation algorithm combined with the existence stage time point. The calculation formula of the value decay compensation value is as follows:

[0094] ;

[0095] Wherein, represents the value decay compensation value, represents the pre-set decay coefficient, represents the current existence stage time point, represents the starting time point of the stage.

[0096] Finally, the basic value coefficient and the value decay compensation value are added to obtain the value level.

[0097] For example, the environment risk factor is 0.84, the operation risk factor is 1.0, and the safety risk level is calculated according to the pre-set weights and is ; the data type is identified as core business data, the basic value coefficient is 0.9 obtained by querying the value mapping table, the data is currently in the 15th day of the storage stage, the stage starting time point is the 1st day, and the preset decay coefficient , the value decay compensation value is calculated by a linear interpolation algorithm , the approximate value is 0.05 in the example, and the value level is calculated as .

[0098] Finally, the pre-defined level threshold value is called through step S1024, the threshold value includes the interval range of the security risk level and the value level corresponding to the high, medium and low three security levels, the calculated security risk level and value level are substituted into the pre-defined level threshold value for comparison, the interval range of the two is judged, and the dynamic security level changing with the survival stage is output. For example, in the pre-defined level threshold value, the security risk level corresponding to the high security level is greater than or equal to 0.8 and the value level is greater than or equal to 0.8, the currently calculated security risk level is 0.952 and the value level is 0.95, both of which satisfy the interval requirement of the high security level, so the output dynamic security level is high.

[0099] In the overall scheme of the above step S102, the comprehensive evaluation of security risk and data value is realized, both the real-time changes of external environment and operation behavior are considered, and the data itself attributes and life cycle characteristics are also taken into account, so that the evaluation result is more comprehensive and accurate, and the generated dynamic security level can truly reflect the security demand of the data in the current survival stage, effectively avoiding the problem of insufficient strategy adaptability caused by single evaluation dimension.

[0100] S103, according to the dynamic security level and the state trajectory, a state-aware strategy covering multiple survival stages is derived through a preset strategy network, and the state-aware strategy defines the security strategy switching condition between different survival stages.

[0101] Among them, the preset strategy network is an artificial intelligence network model pre-trained and constructed for deducing security strategy, which has a multi-layer node structure and a feature propagation calculation capability, and can output corresponding strategy related parameters based on the input dynamic security level and time marked feature vector, providing algorithm support for the generation of state-aware strategy. The dynamic security level is a hierarchical identifier based on data security risk and value level, which will be adjusted with the change of data survival stage. The state trajectory is a sequence of dynamic change information of data in each survival stage, which contains key data such as time marked feature vector. The state-aware strategy is a security strategy scheme covering multiple survival stages of data, which clearly defines the switching condition of security strategy between different survival stages, and can be adjusted adaptively according to the change of data state. The security strategy switching condition is a trigger rule defined in the state-aware strategy, which is used to judge when to execute the security strategy transfer operation between different survival stages.

[0102] Optionally, as shown in Figure 2 S1031, inputting the dynamic security level and the time-labeled feature vector in the state trajectory into the preset policy network, performing feature propagation calculation through multiple layers of nodes in the preset policy network to obtain a policy weight of each survival stage.

[0103] S1031, inputting the dynamic security level and the time-labeled feature vector in the state trajectory into the preset policy network, performing feature propagation calculation through multiple layers of nodes in the preset policy network to obtain a policy weight of each survival stage.

[0104] In this step, the policy weight is a quantitative value obtained by feature propagation calculation of the preset policy network, corresponding to the importance or adaptation priority of the security policy of each survival stage.

[0105] S1032, calculating a transition probability between survival stages according to the policy weight and the time label in the state trajectory, and determining a trigger threshold of policy switching in combination with a change trend of the dynamic security level.

[0106] In this step, the policy weight is a quantitative value obtained by feature propagation calculation of the preset policy network, corresponding to the importance or adaptation priority of the security policy of each survival stage.

[0107] The time mark is the time information bound in the time-marked feature vector, used to identify the specific time node at which the data state feature is generated. The transition probability is a value calculated based on the policy weight and the time mark, reflecting the possibility of data transition from one survival stage to the next. The start time point and the end time point are the specific time information at which each survival stage starts and ends. The duration span is the length of time from the start to the end of a single survival stage. The distribution density is a quantitative indicator of the distribution of the policy weight within the corresponding survival stage time interval. The conditional probability is the probability of data transition to the next survival stage given the state of the previous survival stage. The security level change sequence is a sequence data formed by arranging the change values of the dynamic security level in multiple consecutive survival stages in chronological order. The fluctuation amplitude is the degree of fluctuation of the values in the security level change sequence. The change direction is the trend of the values in the security level change sequence, which can be rising or falling. The critical point is the key value point at which the security level starts to rise or fall or changes significantly in the security level change sequence. The mapping table is a data table that establishes the correspondence between the transition probability and the security level boundary value. The security level boundary value is a critical value that divides different security level ranges.

[0108] S1033, based on the trigger threshold and the policy weight, generating a state-aware policy covering multiple survival stages, wherein the state-aware policy contains a policy switching condition, and the policy switching condition defines a transition operation of a security policy when the dynamic security level crosses the trigger threshold.

[0109] In this step, the change trend of the dynamic security level refers to the fluctuation amplitude and change direction of the dynamic security level in multiple consecutive survival stages, which is used to judge the development trend of the data security state. The trigger threshold is a determined security level boundary value, which triggers the security policy transition when the dynamic security level crosses the value.

[0110] In the embodiments of the present application, first, the dynamic security level and the time-marked feature vector in the state trajectory are input into the preset policy network as input data in step S1031. The preset policy network adopts a multi-layer perceptron architecture in deep learning, and performs feature propagation calculation through multiple nodes such as input layer, hidden layer and output layer inside the network. Each layer of nodes performs linear transformation and non-linear activation processing on the input features, gradually extracts high-order features and performs weight distribution, and finally outputs the policy weight corresponding to each survival stage.

[0111] For example, the survival stages of a certain core business data include the creation stage, the use stage, the storage stage and the archiving stage, and the dynamic security level in each stage is quantified as 0.6 medium, 0.9 high, 0.85 high, and 0.7 medium, respectively. The time-marked feature vector contains quantified indicators such as the number of network connections, the access request frequency, and the system load rate in each stage. Specifically:

[0112] Create phase network connection number 20, access frequency 5 times / hour, system load rate , time mark T1;

[0113] Use phase network connection number 80, access frequency 60 times / hour, system load rate , time mark T2;

[0114] Storage phase network connection number 40, access frequency 15 times / hour, system load rate , time mark T3;

[0115] Archive phase network connection number 10, access frequency 3 times / hour, system load rate , time mark T4.

[0116] The dynamic security level vector is spliced with the time-marked feature vector of each phase and input into the preset policy network, and the network input layer receives 16-dimensional feature data, i.e., 4 phases Class features, are nonlinearly transformed by the ReLU activation function through 32 neurons in the first hidden layer, and the calculation formula is:

[0117] ;

[0118] Wherein, is a dimensional weight matrix, is a 32-dimensional bias vector, and a 32-dimensional intermediate feature is finally extracted. This formula is used to linearly weight and bias adjust the 16-dimensional input feature, filter negative feature values to retain effective feature information.

[0119] Further processed by 16 neurons in the second hidden layer through the Sigmoid activation function, and the calculation formula is:

[0120] ;

[0121] Wherein, is a dimensional weight matrix, is a 16-dimensional bias vector, and a 16-dimensional high-order feature is extracted. This formula maps the 32-dimensional intermediate feature to the interval 0-1, realizes the normalization and nonlinear optimization of the feature.

[0122] Finally, 4 neurons in the output layer adopt linear activation function:

[0123] ;

[0124] Wherein, is a The weight matrix, is a 4-dimensional bias vector. The formula integrates the 16-dimensional high-order features to output the strategy weight values corresponding to the number of survival stages for weight distribution. Finally, the strategy weights corresponding to each survival stage are output: 0.6 for the creation stage, 0.9 for the use stage, 0.85 for the storage stage, and 0.5 for the archiving stage.

[0125] It should be noted that the above output of the strategy weight corresponding to each survival stage is only an example, and those skilled in the art can also set other calculation methods according to requirements, and the present application does not limit this.

[0126] Secondly, by step S1032, the starting time point and the ending time point of the adjacent survival stage are identified according to the time mark in the state trajectory, and the duration span of each survival stage is obtained by subtracting the starting time point from the ending time point; then, based on the duration span of each survival stage, the distribution density of the strategy weight in the time interval is combined, and the conditional probability of transferring from the previous survival stage to the next survival stage is calculated as the transition probability by using the Bayesian probability algorithm, and the calculation formula is:

[0127]

[0128] wherein, represents the transition probability from the i-th survival stage to the j-th survival stage, represents the strategy weight of the i-th survival stage, represents the duration span of the i-th survival stage, represents the strategy weight of the j-th survival stage, represents the duration span of the j-th survival stage.

[0129] Then, the change values of the dynamic security level in multiple continuous survival stages are extracted to form a security level change sequence, the fluctuation amplitude and change direction of the sequence are analyzed by using the sliding window algorithm, and the critical point of the security level rise and fall is determined; finally, the transition probability calculated and the critical point are associated and mapped, a mapping table containing different transition probabilities and corresponding security level boundary values is established, the security level boundary values corresponding to each transition probability are found according to the mapping table and set as the trigger threshold of the policy switching.

[0130] For example, continuing the above scenario, the time mark of each survival stage shows that the starting time of the creation stage is the first day and the ending time is the second day, the duration span is 1 day; the starting time of the use stage is the second day and the ending time is the tenth day, the duration span is 8 days; the starting time of the storage stage is the tenth day and the ending time is the thirtieth day, the duration span is 20 days; the starting time of the archiving stage is the thirtieth day and the ending time is the ninetieth day, the duration span is 60 days. ​

[0131] The policy weight distribution density is uniformly distributed in the creation phase, concentrated in the use phase, relatively concentrated in the storage phase, and sparse in the archiving phase.

[0132] The transition probability from the creation phase to the use phase is calculated as .

[0133] The transition probability from the use phase to the storage phase is .

[0134] The transition probability from the storage phase to the archiving phase is .

[0135] The dynamic security level change sequence is medium, high, high, and medium. The fluctuation amplitude is two levels, the change direction is first rising and then falling, and the critical point of security level rise and fall is the boundary value 0.8 between high and medium. A mapping table of transition probability and security level boundary value is established, where the boundary value 0.85 corresponds to the transition probability 0.92, the boundary value 0.8 corresponds to the transition probability 0.70, and the boundary value 0.75 corresponds to the transition probability 0.64. Finally, the trigger threshold of policy switching is determined as .

[0136] Finally, the trigger threshold determined in step S1032 is associated and matched with the policy weight of each survival phase obtained in step S1031 through step S1033. For each survival phase and its corresponding transition direction, the policy adjustment rule when the dynamic security level crosses the corresponding trigger threshold is determined, and a state-aware policy covering multiple survival phases is integrated. The policy contains specific policy switching conditions, that is, when the dynamic security level rises or falls and crosses the trigger threshold, the operation of transitioning from the security policy corresponding to the current survival phase to the security policy corresponding to the next survival phase or the previous survival phase is automatically executed.

[0137] In the overall scheme of the above step S103, the security policy is accurately adapted to the data survival phase and the dynamic security state, the policy switching condition is clear and has strong dynamic response ability, and the policy transition can be automatically triggered according to the data state change, effectively solving the problem of insufficient adaptability of traditional static policy, ensuring that the data can obtain matched security protection in different survival phases, and balancing the stability and flexibility of policy adjustment.

[0138] S104, based on the state-aware policy, constructing a basic access permission through an artificial intelligence engine, structurally decomposing the basic access permission according to the survival phase, generating permission fragments corresponding to each phase, and configuring access rules matched with the corresponding survival phase for each permission fragment.

[0139] The artificial intelligence engine is an intelligent processing module with data analysis, permission construction, and rule configuration capabilities, and can parse data access requirements and generate adaptive permissions and rules based on state-aware strategies. The state-aware strategy is a security strategy scheme covering multiple existence stages, including strategy switching conditions between different stages, and provides a basis for the construction and splitting of basic access permissions. The basic access permission is a global access permission set covering all existence stages of data, including various access operation permissions that may be involved in the entire life cycle of data. The existence stage is a key link in the entire life cycle of data from creation to destruction, and advances in time sequence. The permission slice is a phased access permission unit formed by splitting the basic access permission according to the existence stage, and only contains the access operation types allowed in the corresponding stage. The access rule is a constraint condition configured for each permission slice, which matches the security requirements of the corresponding existence stage, and is used to regulate the data access behavior in the stage.

[0140] Optionally, step S104 can specifically include the following steps:

[0141] S1041, according to the state-aware strategy, parsing the global access requirements of the target data through an artificial intelligence engine, and generating a basic access permission covering all existence stages.

[0142] In this step, the global access requirement is parsed based on the state-aware strategy, covering the legal access operation types and ranges of data in all existence stages, and is the core basis for constructing the basic access permission.

[0143] S1042, according to the time sequence of the existence stage, performing a segmented cutting operation on the basic access permission, generating a permission slice corresponding to each existence stage, and each permission slice contains the access operation types allowed in the corresponding stage.

[0144] The time sequence refers to the natural flow sequence of the data existence stage from creation to destruction, which is used to guide the segmented cutting of the basic access permission. The segmented cutting operation is a processing process of splitting the global basic access permission according to the existence stage, which ensures that only adaptive access permissions are retained in each stage. The allowed access operation type is an executable access behavior in the permission slice, such as reading, modifying, and transmitting, which is adapted to the business requirements and security level of the corresponding stage.

[0145] S1043, configuring a matching access rule for each permission slice, the access rule is set based on the dynamic security level and strategy switching condition of the corresponding existence stage, including the time range and operation constraint condition allowed to access.

[0146] In the above steps, the dynamic security level is a hierarchical identifier based on the data security risk and value level division, which is adjusted with the change of the survival stage. The policy switching condition is a trigger rule defined in the state-aware policy, which is used to judge the timing of policy transfer. The allowed access time range is the legal access period defined in the access rule, which matches the stage business development time. The operation constraint condition is the specific restriction of access behavior in the access rule, such as access frequency restriction, operation result retention requirement, etc., which is used to further improve the stage access security.

[0147] In the embodiments of the present application, first, the state-aware policy is input into the artificial intelligence engine through step S1041. The artificial intelligence engine extracts the legal access operation type and range covering all survival stages, i.e. global access demand, by analyzing the security requirements, policy switching conditions and data life cycle business scenarios of each survival stage in the state-aware policy, and then generates the basic access permission containing all legal access operations based on the global access demand.

[0148] Secondly, the basic access permission is segmented and cut according to the time sequence of the data survival stage, i.e. the natural flow sequence of the creation stage, the use stage, the storage stage and the archive stage, through step S1042:

[0149] Taking the dynamic security level and business scenario demand of each stage as the core screening basis, first, the association strength of each type of operation in the basic access permission with different survival stages is analyzed through the permission dependency graph, and the exclusive operation suitable for a single stage and the universal operation that can be reused across stages are marked; then, in combination with the principle of least privilege, the exclusive operation is directly assigned to the corresponding stage, and the universal operation is differentiated and split according to the stage use frequency and risk level threshold, and the use range and permission boundary of the universal operation in each stage are clarified; finally, the access operation type necessary for each stage is screened out, and the permission fragments corresponding to each survival stage are formed, ensuring that each permission fragment only contains the access operation necessary for the corresponding stage business development and adapted to the security level.

[0150] Finally, for each permission fragment, the dynamic security level and policy switching condition of the corresponding survival stage are retrieved through step S1043, and the access rule matching each permission fragment is configured in combination with the stage business development characteristics. The allowed access time range in the access rule is set according to the regular development period of the stage business, and the operation constraint condition is set to the appropriate strictness according to the level of the dynamic security level.

[0151] For example, the dynamic security level of the creation stage is intermediate, and the policy switching condition is the completion of data attribute configuration, therefore, the configured access rule is that the allowed access time range is 9:00-18:00 on weekdays, and the operation constraint condition is that data entry needs to retain entry log, and attribute configuration cannot modify the core identifier.

[0152] The dynamic security level in the use stage is high, the policy switching condition is the end of the business process, the configured access rule is to allow access within the time range of 8:30-20:00 on weekdays, and the operation constraint condition is that the modification operation needs double-checking and the collaborative editing needs real-time synchronization of operation records.

[0153] The dynamic security level in the storage stage is high, the policy switching condition is the submission of the archiving application, the configured access rule is to allow access within the time range of 24 hours a day, and the operation constraint condition is that the backup operation is performed every 6 hours and the permission query only supports administrator operation.

[0154] The dynamic security level in the archiving stage is medium, the policy switching condition is the approval of the destruction, the configured access rule is to allow access within the time range of 10:00-16:00 on weekdays, and the operation constraint condition is that the restricted reading can only view but cannot download and the destruction application needs to submit a written explanation.

[0155] In the overall scheme of the above step S104, the fine and phased control of access permissions is achieved, avoiding the security risks caused by global permissions, while ensuring that the access operations in each stage are highly matched with business needs and security levels. The individualized configuration of access rules further improves the security and compliance of data access, which not only meets the flexibility of business development, but also provides a solid support for the security protection of the whole life cycle of data.

[0156] S105, based on the state-aware policy, form an adaptive security channel matched with the risk level of each survival stage; when receiving a data access request, the access context, permission slice state and the access rules of each permission slice are comprehensively analyzed through an intelligent negotiation mechanism, and combined verification is performed in the adaptive security channel to realize dynamic adjustment of access permissions.

[0157] The adaptive security channel is a set of secure communication paths constructed based on a state-aware strategy and adapted to the risk level of each survival stage. The state-aware strategy is a security strategy scheme covering multiple survival stages, including policy switching conditions and risk adaptation requirements for each stage. The survival stage risk level is the severity of the security threat faced by the data in each survival stage, which is directly related to the dynamic security level. The data access request is an access application to the target data initiated by the operation subject, including request time, access identity, operation type, and other key information. The intelligent negotiation mechanism is a processing module with multi-dimensional information comprehensive analysis and matching verification capability. The access context is the environment and behavior information related to the data access request, including request time, access identity, operation type, and other request parameters. The permission slice state is the current available state identifier of each permission slice, reflecting whether the permission slice is in an effective state. The access rule is a constraint condition configured for each permission slice, including the time range, identity requirement, and operation restriction allowed for access. The dynamic adjustment is an operation that changes the access permission in real time according to the access request verification result, ensuring that the permission is adapted to the current access scenario.

[0158] Optionally, step S105 can specifically include the following steps:

[0159] S1051, according to the state-aware strategy, establish independent secure communication paths for each survival stage, adjust the path encryption strength in combination with the dynamic security level of each survival stage, and form an adaptive security channel.

[0160] The secure communication path is a dedicated data transmission channel established for each survival stage, which guarantees the transmission security of data access within the stage. The dynamic security level is a hierarchical identifier divided based on the data security risk and value level, which is adjusted with the change of the survival stage. The path encryption strength is the encryption protection level of the secure communication path, which will be adjusted according to the dynamic security level to match the stage risk level.

[0161] S1052, when receiving a data access request, extract the request parameters in the access context through the intelligent negotiation mechanism, including request time, access identity and operation type, and check the current state and access rule of each permission slice.

[0162] In this step, the request parameters are the core information extracted from the access context, including request time, access identity, and operation type, which are used for the legality verification of the access request. The current state of the permission slice is the identification information indicating whether the permission slice is available and whether it is in an effective state.

[0163] S1053, in the adaptive security channel, multi-condition matching verification is performed on the access context, the permission slice state and the access rule, to determine the permission slice combination scheme that meets the conditions.

[0164] In step S1053, the request time parameter, the access identity, and the request operation type in the access context are extracted to form an access feature set; the current state mark of each permission slice is read, and the constraint condition in the access rule corresponding to each permission slice is parsed; in the adaptive security channel, the access feature set is compared with the current state mark and the constraint condition of each permission slice to filter out the permission slices in which the request time parameter is within the allowed time range, the access identity meets the identity requirement, and the request operation type does not exceed the operation limit, to form a candidate permission slice set; the matching degree of each permission slice in the candidate permission slice set and the access feature set is calculated, the candidate permission slices are sorted according to the matching degree, and a number of permission slices with the highest matching degree are selected to form a permission slice combination scheme.

[0165] In the above steps, the constraint condition is a specific limitation requirement contained in the access rule, covering the allowed access time range, the identity requirement, the operation limit, and the like. The access feature set is a set data composed of the request time parameter, the access identity, and the request operation type in the access context, used for comparison with the state and the rule of the permission slice. The candidate permission slice set is a combination of permission slices that meet the basic matching requirement of the access feature set after preliminary filtering. The matching degree is a quantitative index for measuring the degree of agreement between each slice in the candidate permission slice set and the access feature set, used for filtering the optimal permission combination.

[0166] In step S1054, the access permission is dynamically adjusted according to the permission slice combination scheme, and a permission adjustment log is recorded.

[0167] In this step, the permission slice combination scheme is a combination of a number of permission slices that are most suitable for the access request, selected according to the matching degree. The permission adjustment log is log data recording the process and result of dynamic adjustment of the access permission, used for tracing and auditing.

[0168] In the embodiments of the present application, first, the risk adaptation requirements of each survival stage are determined through step S1051 according to the state perception strategy, an independent secure communication path is established for each survival stage, and the encryption strength of the path is adjusted by using a symmetric encryption algorithm combined with a dynamic security level. The symmetric encryption algorithm refers to an encryption technology using the same key for encryption and decryption, which has the characteristics of high encryption efficiency and low resource consumption, and is suitable for real-time protection in the data transmission process. The higher the dynamic security level is, the longer the encryption key length is, and the higher the encryption algorithm complexity is, and finally an adaptive security channel covering all survival stages and matching the risk level of each stage is formed.

[0169] For example, the life cycle of a certain core business data includes the creation stage, the use stage, the storage stage, and the archiving stage. The state-aware strategy specifies that the dynamic security levels of the respective stages are medium, high, high, and medium. The security communication path established for the creation stage uses the 128-bit AES encryption algorithm, the use stage and the storage stage use the 256-bit AES encryption algorithm, and the archiving stage uses the 128-bit AES encryption algorithm, forming an adaptive security channel that is adapted to the risk level of each stage.

[0170] Secondly, when receiving a data access request initiated by an operation subject, the intelligent negotiation mechanism is started through step S1052 to extract the request parameters such as the request time, the access identity, and the operation type in the access context, check the current state marks of the respective permission shards through the system state monitoring tool to confirm whether the permission shards are in an available state, and then call and parse the access rules corresponding to each permission shard to extract the constraint conditions therein.

[0171] For example, continuing the above scenario, an access request is received from the operation subject C, the intelligent negotiation mechanism extracts the request time as 10:30 on weekdays, the access identity as a department business personnel, and the operation type as reading, and checks that the creation stage, the use stage, and the storage stage permission shards are in the effective state, and the archiving stage permission shard is in the ineffective state. By parsing the access rules of the respective effective permission shards, it is obtained that the creation stage allows the access time to be 9:00-18:00, the identity requirement to be a data entry personnel, and the operation limitation to be only allowed to enter and configure, the use stage allows the access time to be 8:30-20:00, the identity requirement to be a department business personnel, and the operation limitation to be allowed to read and modify, and the storage stage allows the access time to be 24 hours a day, the identity requirement to be an administrator, and the operation limitation to be allowed to backup and query.

[0172] Next, through step S1053, in the adaptive security channel, the extracted request time, access identity, and request operation type are first integrated to form an access feature set, and then the current state marks of the respective permission shards are read and the corresponding constraint conditions are parsed. Then, the access feature set is compared with the current state marks and the constraint conditions of each effective permission shard one by one to filter out the permission shards whose request time is within the allowed time range, whose access identity meets the requirements, and whose operation type does not exceed the limitations, forming a candidate permission shard set.

[0173] After that, the cosine similarity algorithm is used to calculate the matching degree of each shard in the candidate permission shard set and the access feature set, and the matching degree calculation formula is:

[0174] ;

[0175] wherein, S represents the matching degree, and the value range is 0-1. The closer S is to 1, the higher the matching degree is. quantized value representing the i-th feature in the access feature set; quantized value representing the i-th corresponding feature in the permission slice constraint condition; representing the number of feature dimensions. The formula quantifies the matching degree by calculating the vector cosine value of the access feature set and the permission slice constraint condition. The smaller the vector angle, the closer the cosine value to 1, representing the stronger adaptability of the two.

[0176] Finally, according to the matching degree, the candidate permission slices are sorted, and the several slices with the highest matching degree are selected to form the permission slice combination scheme.

[0177] For example, continuing the above scenario, the access feature set is quantized to request time 10:30 (quantized value 0.8), access identity department business personnel (quantized value 0.9), and operation type read (quantized value 0.7). The candidate permission slices are usage stage slice (constraint condition quantized value: time 0.9, identity 1.0, operation 0.8) and creation stage slice (constraint condition quantized value: time 0.8, identity 0.6, operation 0.3). The usage stage slice matching degree is calculated as:

[0178] ;

[0179] The creation stage slice matching degree is After sorting by matching degree, the usage stage slice is selected as the permission slice combination scheme.

[0180] Finally, according to the filtered permission slice combination scheme, the access permission of the operation subject is dynamically adjusted to the permission range corresponding to the scheme, i.e. only the read and modify operation permissions contained in the usage stage permission slice are opened, and the time of permission adjustment, the permission range before and after adjustment, the access request parameters, the matching verification results, etc. are recorded in detail through the log recording module to form the permission adjustment log for traceability audit.

[0181] In the overall scheme of the above step S105, both the security and compliance of data access are taken into account, and the flexibility of business development is guaranteed, effectively solving the problem that fixed permissions are difficult to adapt to dynamic access scenarios, and providing closed-loop protection for data access security throughout the life cycle.

[0182] The following is a complete embodiment for steps S101 to S105:

[0183] For example, Figure 3As shown, the user transaction data of a large e-commerce enterprise covers the creation, use, storage, and archiving of the entire life cycle, and needs to deal with security risks such as user information leakage and transaction data tampering. The enterprise applies the data security dynamic policy adjustment method based on artificial intelligence. First, through the collection components deployed in the terminal, server and business system, the state trajectory of the data in each stage is captured, and features such as network connection quantity and access frequency are extracted to form a feature vector with a time marker. Based on this vector, the system dynamically assesses the data security risk and value level, and generates a dynamic security level - the creation and use stages are high, the storage stage is medium-high, and the archiving stage is medium. Combined with the dynamic security level and the state trajectory, the state-aware policy is derived through the preset policy network, and the policy switching conditions for each stage are determined. Subsequently, the AI engine builds the basic access permissions and splits them into permission shards corresponding to each stage, configures a two-person verification modification rule for the use stage, and sets up an off-site backup rule for the storage stage. At the same time, an adaptive security channel is built, and high-strength encryption is used in the transaction stage. When receiving a request from a merchant to access transaction data, the intelligent negotiation mechanism analyzes the request time, access identity and other information, combines the permission shards and access rules for verification in the channel, and dynamically grants adaptive permissions.

[0184] The data security dynamic policy adjustment method based on artificial intelligence provided by the present application accurately captures the data state trajectory and dynamically assesses the risk value, so that the security policy always matches the security needs of the data life cycle, effectively reducing the risk of data leakage and tampering. The fine configuration of permission shards and access rules, combined with the combined verification of the adaptive security channel, ensures data security while avoiding the impact of excessive protection on business efficiency, achieving a balance between security and efficiency. The dynamic adjustment of permissions driven by the intelligent negotiation mechanism greatly improves the flexibility and compliance of permission management, providing reliable data security support for the continuous and stable operation of enterprise business.

[0185] Figure 4 A specific implementation structure diagram of a data security dynamic policy adjustment system based on artificial intelligence provided by an embodiment of the present application is shown in Figure 4 The system can include:

[0186] The capture module 41 is configured to capture the state trajectory of the target data in each life cycle stage and form a feature vector with a time marker;

[0187] The generation module 42 is configured to dynamically assess the security risk and value level of the target data based on the system environment features and operation access features in the feature vector, to generate a dynamic security level that changes with the life cycle stage;

[0188] The derivation module 43 is configured to derive, according to the dynamic security level and the state trajectory, a state-aware strategy covering multiple life stages by a preset strategy network, the state-aware strategy defining a security strategy switching condition for transition between different life stages.

[0189] The matching module 44 is configured to construct, based on the state-aware strategy, a basic access right by an artificial intelligence engine, structurally decompose the basic access right according to life stages, generate a right fragment corresponding to each stage, and configure an access rule matched with the corresponding life stage for each right fragment.

[0190] The verification module 45 is configured to form, based on the state-aware strategy, an adaptive security channel matched with a risk level of each life stage, and when receiving a data access request, comprehensively analyze an access context, a right fragment state and the access rule of each right fragment by an intelligent negotiation mechanism, and perform combined verification in the adaptive security channel to realize dynamic adjustment of access rights.

[0191] The artificial intelligence-based data security dynamic strategy adjustment system according to the embodiments of the present application is used to implement the artificial intelligence-based data security dynamic strategy adjustment method described above, and therefore the specific embodiments of the artificial intelligence-based data security dynamic strategy adjustment system can be seen from the foregoing embodiments of the artificial intelligence-based data security dynamic strategy adjustment method, and the specific embodiments can be referred to the descriptions of the corresponding embodiments, which will not be repeated here.

[0192] The present application also provides an electronic device, which comprises a memory for storing a computer program and a processor for executing the computer program to implement the steps of the artificial intelligence-based data security dynamic strategy adjustment method described above.

[0193] The present application also provides a computer readable storage medium having a computer program stored thereon, the computer program being executed by a processor to implement the steps of the artificial intelligence-based data security dynamic strategy adjustment method described above.

[0194] In an exemplary embodiment, the computer readable storage medium described above can include, but is not limited to, a U disk, a read-only memory, a random access memory, a mobile hard disk, a magnetic disk or an optical disk, and various media that can store computer programs.

[0195] The embodiments of the present application also provide a computer program product, the computer program product comprising a computer program, the computer program being executed by a processor to implement the steps of the artificial intelligence-based data security dynamic strategy adjustment method described above.

[0196] Those skilled in the art will further realize that the mere concepts, teachings, and embodiments described herein are merely meant to provide an enabling description of embodiments of the present application and are not intended to limit the scope of the present application. Accordingly, embodiments as described herein contemplate all modifications that come within the scope of the present application.

[0197] The above provides a kind of data security dynamic strategy adjustment method, system, device and storage medium based on artificial intelligence provided in the present application in detail.The principle and implementation mode of the present application are described in this paper by applying specific examples, the above example is only used to help understanding the method and its core idea of the present application.It should be pointed out that, for the ordinary skilled in the art, without departing from the principle of the present application, the present application can be improved and modified, and these improvements and modifications also fall within the scope of the present application.

Claims

1. A data security dynamic strategy adjustment method based on artificial intelligence, characterized in that, include: Capture the state trajectory of the target data at each stage of its existence and form a time-stamped feature vector; Based on the system environment characteristics and operation access characteristics in the feature vector, the security risk and value level of the target data are dynamically evaluated to generate a dynamic security level that changes with the duration of existence. Based on the dynamic security level and the state trajectory, a state-aware policy covering multiple life stages is derived through a preset policy network. The state-aware policy defines the security policy switching conditions between different life stages. Based on the state-aware strategy, basic access permissions are constructed through an artificial intelligence engine. The basic access permissions are then decomposed in a structured manner according to the duration stage, generating permission fragments corresponding to each stage. Access rules matching the corresponding duration stage are then configured for each permission fragment. Based on the state-aware strategy, an adaptive security channel is formed that matches the risk level of each stage of life. When a data access request is received, the access context, permission fragmentation status, and access rules of each permission fragment are comprehensively analyzed through an intelligent negotiation mechanism and combined and verified in the adaptive security channel to achieve dynamic adjustment of access permissions.

2. The data security dynamic strategy adjustment method based on artificial intelligence according to claim 1, characterized in that, Based on the dynamic security level and the state trajectory, a state-aware policy covering multiple life stages is derived through a preset policy network. The state-aware policy defines the security policy switching conditions between different life stages, including: The dynamic security level and the time-stamped feature vectors in the state trajectory are input into a preset policy network. Feature propagation calculation is performed through multiple layers of nodes in the preset policy network to obtain the policy weight for each survival stage. Based on the policy weights and the time stamps in the state trajectory, the transition probability between the survival stages is calculated, and the trigger threshold for policy switching is determined by combining the changing trend of the dynamic security level. Based on the trigger threshold and the policy weight, a state-aware policy covering multiple life stages is generated, wherein the state-aware policy includes a policy switching condition, and the policy switching condition defines that a security policy transfer operation is performed when the dynamic security level crosses the trigger threshold.

3. The data security dynamic strategy adjustment method based on artificial intelligence according to claim 2, characterized in that, Based on the policy weights and the time stamps in the state trajectory, the transition probability between existence phases is calculated. Combined with the changing trend of the dynamic security level, the trigger threshold for policy switching is determined, including: Based on the time markers in the state trajectory, the start and end times of adjacent existence phases are identified to calculate the duration span of each existence phase. Based on the duration span and the distribution density of the strategy weights in the corresponding time interval, the conditional probability of transitioning from the previous stage to the next stage is calculated and used as the transition probability. Extract the change values ​​of the dynamic security level in multiple continuous existence stages to form a security level change sequence, analyze the fluctuation amplitude and change direction of the security level change sequence, and determine the critical point of security level rise and fall; The transition probability is associated with the critical point to establish a mapping table between probability and level. The security level boundary value corresponding to each transition probability is found according to the mapping table, and the security level boundary value is set as the trigger threshold for policy switching.

4. The data security dynamic strategy adjustment method based on artificial intelligence according to claim 1, characterized in that, Based on the aforementioned state-aware strategy, an adaptive security channel is formed that matches the risk level of each stage of life. When a data access request is received, an intelligent negotiation mechanism comprehensively analyzes the access context, permission fragmentation status, and access rules of each permission fragment, and performs combined verification within the adaptive security channel to achieve dynamic adjustment of access permissions, including: According to the state-aware strategy, an independent secure communication path is established for each survival stage, and the encryption strength of the path is adjusted in combination with the dynamic security level of each survival stage to form an adaptive secure channel. When a data access request is received, the request parameters in the access context are extracted through the intelligent negotiation mechanism, including the request time, access identity and operation type, while checking the status of each permission fragment and access rules. In the adaptive security channel, the request parameters, permission fragmentation status, and access rules are subjected to multi-condition matching verification to determine the permission fragmentation combination scheme that meets the conditions. Access permissions are dynamically adjusted according to the permission segmentation and combination scheme, and permission adjustment logs are recorded.

5. The data security dynamic strategy adjustment method based on artificial intelligence according to claim 4, characterized in that, In the adaptive security channel, multi-condition matching verification is performed on the request parameters, permission fragmentation status, and access rules to determine a permission fragmentation combination scheme that meets the conditions, including: Extract the request time parameter, access identity identifier, and request operation type from the request parameters in the access context to form an access feature set; Read the current status flag of each permission segment and parse the constraints in the access rules corresponding to each permission segment; In the adaptive security channel, the access feature set is compared one by one with the current status flag and the constraint conditions of each permission fragment to filter out permission fragments whose request time parameter is within the allowed time range, whose access identity identifier meets the identity requirements, and whose request operation type does not exceed the operation limit, thus forming a candidate permission fragment set. Calculate the matching degree between each permission segment in the candidate permission segment set and the access feature set, sort the candidate permission segments according to the matching degree, and select several permission segments with the highest matching degree to form a permission segment combination scheme.

6. The data security dynamic strategy adjustment method based on artificial intelligence according to claim 1, characterized in that, Based on the system environment characteristics and operation access characteristics in the feature vector, the security risk and value level of the target data are dynamically assessed to generate a dynamic security level that changes with the duration of the data, including: The number of network connections and system processing load parameters are extracted from the system environment characteristics to calculate the environmental fluctuation index of the system environment characteristics; Based on the aforementioned environmental fluctuation index and combined with historical environmental data, the rate of change of the environmental fluctuation index is calculated as an environmental risk factor. The frequency of access requests and the identity of the access source are parsed from the operation access features to calculate the behavioral deviation of the operation access features; Based on the aforementioned behavioral deviation, and combined with the normal access pattern, the current access sequence is compared with the normal pattern item by item to obtain the operational risk factor; The environmental risk factors and operational risk factors are weighted and fused to generate a safety risk level. Based on the type identifier and duration time of the target data, a predefined value mapping table is queried to obtain the basic value coefficient. Based on the basic value coefficient and the time point of the survival stage, a value decay compensation value is calculated as the value level of the target data. Based on the security risk level and the value level, a dynamic security level that changes with the duration of existence is output by comparing predefined level thresholds.

7. The data security dynamic strategy adjustment method based on artificial intelligence according to claim 1, characterized in that, Based on the state-aware strategy, a basic access permission is constructed using an artificial intelligence engine. This basic access permission is then structurally decomposed according to its duration, generating permission fragments corresponding to each stage. Each permission fragment is then configured with access rules matching its corresponding duration, including: Based on the state-aware strategy, the global access requirements of the target data are analyzed by the artificial intelligence engine to generate basic access permissions covering all stages of existence. According to the time sequence of the existence stages, the basic access permissions are segmented and cut to generate permission fragments corresponding to each existence stage. Each permission fragment contains the access operation types allowed in the corresponding stage. Based on the dynamic security level and policy switching conditions of the corresponding existence stage, a matching access rule is configured for each permission segment, and the access rule includes the time range for allowed access and operational constraints.

8. A data security dynamic policy adjustment system based on artificial intelligence, characterized in that, include: The capture module is used to capture the state trajectory of the target data at each stage of its existence and form a time-stamped feature vector. The generation module is used to dynamically assess the security risk and value level of the target data based on the system environment characteristics and operation access characteristics in the feature vector, so as to generate a dynamic security level that changes with the duration of existence. The derivation module is used to derive a state-aware policy covering multiple life stages through a preset policy network based on the dynamic security level and the state trajectory. The state-aware policy defines the security policy switching conditions between different life stages. The matching module is used to construct basic access permissions based on the state-aware strategy through an artificial intelligence engine, decompose the basic access permissions in a structured manner according to the duration stage, generate permission fragments corresponding to each stage, and configure access rules that match the corresponding duration stage for each permission fragment. The verification module is used to form an adaptive security channel that matches the risk level of each stage of existence based on the state awareness strategy. When a data access request is received, the access context, permission fragment status, and access rules of each permission fragment are comprehensively analyzed through an intelligent negotiation mechanism, and combined verification is performed in the adaptive security channel to achieve dynamic adjustment of access permissions.

9. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor, configured to implement the steps of the AI-based dynamic data security policy adjustment method as described in any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, enables the implementation of the AI-based dynamic data security strategy adjustment method as described in any one of claims 1 to 7.

Images