Data asset security management-oriented data incremental backup method and system

Abstract

The invention relates to the technical field of data backup, in particular to a data asset security management-oriented data incremental backup method and system. According to the access frequency, the update frequency and the security level of different types of core asset data, the distinction degree of each type of core asset data is obtained; for any kind of core asset data, forming a to-be-analyzed data group by the data at each moment, the attribute data and the security management data; obtaining a plurality of to-be-analyzed data group clusters according to the attribute data corresponding to different to-be-analyzed data groups and the network transmission state data and the backup record information data in the security management data; according to the data distribution and the distinction degree in all the to-be-analyzed data groups in different to-be-analyzed data group clusters, obtaining the backup significance of each type of core asset data; and obtaining candidate incremental data, and carrying out incremental data backup. According to the method, the safety of the backup data is improved by accurately obtaining the incremental data of different core asset data assets.

Description

Technical Field

[0001] This invention relates to the field of data backup technology, specifically to an incremental data backup method and system for data asset security management. Background Technology

[0002] Incremental backup of data is a key step in protecting data assets. It can effectively prevent data loss and reduce the impact of malicious attacks, thereby ensuring business continuity. By backing up newly added or changed data in a timely manner, it can meet the requirements for secure storage in the process of data asset management, reduce the problems of large storage resource consumption and high data transmission bandwidth consumption during the backup process, and improve the efficiency of data backup for data asset security management.

[0003] In existing technologies, directly performing incremental backups on data assets ignores the complexity of data types and the differences in storage formats, update frequencies, and security levels. This results in traditional incremental backup methods having poor data processing adaptability, making it difficult to meet the backup needs of multi-source data assets. Furthermore, they are prone to misclassifying invalid and redundant data as incremental data, leading to poor backup data integrity and low security. Summary of the Invention

[0004] To address the technical problems of poor data integrity and security caused by complex data types, varying storage formats, and update frequencies, this invention aims to provide a data incremental backup method and system for data asset security management. The specific technical solution adopted is as follows: This invention proposes a method for incremental data backup for data asset security management, the method comprising: Acquire attribute data and security management data of various core assets; Based on the access frequency, update frequency, and security level of different types of core asset data in attribute data and security management data, the distinguishability of each type of core asset data is obtained; for any type of core asset data, the data at each moment, attribute data, and security management data are combined into a data group to be analyzed; based on the network transmission status data and backup record information data in the attribute data and security management data corresponding to different data groups to be analyzed, the incremental backup difference value between different data groups to be analyzed is obtained. Based on the distribution of incremental backup differences between different data groups to be analyzed, multiple clusters of data groups to be analyzed are obtained; based on the data distribution within all data groups to be analyzed in different clusters of data groups to be analyzed for different types of core asset data, the backup uniqueness of each type of core asset data is obtained. Based on the distinguishability and backup uniqueness of each type of core asset data, the backup saliency of each type of core asset data is obtained; based on the backup saliency distribution of different types of core asset data and the data group to be analyzed, candidate incremental data is obtained; based on the attribute data and security management data of the candidate incremental data, incremental data backup is performed.

[0005] Furthermore, the method for obtaining the distinguishability includes: The vector consisting of the update frequency, access frequency, and security level of each core asset data is used as the first feature vector; Obtain the relative distance of the first feature vector between each core asset data and each other core asset data, as the distinguishability of each core asset data.

[0006] Furthermore, the method for obtaining the incremental backup difference value includes: Obtain the data integrity verification results for each data group to be analyzed; The vector consisting of all data in each data group to be analyzed, including the data integrity verification results, network transmission status data, and backup record information data, is used as the second feature vector. Based on the relative distance between the second feature vectors of different groups of data to be analyzed, and the hash consistency between different groups of data to be analyzed, the incremental backup difference value between different groups of data to be analyzed is obtained. The relative distance is positively correlated with the incremental backup difference value, while the hash consistency is negatively correlated with the incremental backup difference value.

[0007] Furthermore, the method for obtaining the incremental backup difference value includes: The relative distance between the second feature vectors of different groups of data to be analyzed is obtained and normalized, serving as the first difference coefficient. The difference between the positive integer 1 and the consistency is calculated, and the product of the difference result and the first difference coefficient is used as the incremental backup difference value between different groups of data to be analyzed. Further, the method for obtaining the clusters of the data groups to be analyzed includes: Based on the incremental backup differences between different groups of data to be analyzed, the CFSFDP algorithm is used to cluster all the data to be analyzed, resulting in multiple clusters of data to be analyzed.

[0008] Furthermore, the method for obtaining the backup uniqueness includes: For any data set to be analyzed of any core asset data, cluster the fluctuation characteristics of the same elements in different data sets to be analyzed, and perform normalization mapping as the feature weight of each element; obtain the mean of the same elements in all data sets to be analyzed. The sum of the products of the mean and the corresponding feature weight of the same element in different clusters of data to be analyzed is obtained as the weighted mean of the corresponding element; the weighted mean of all elements is used to form the comprehensive feature vector of the core asset data. Obtain the mean relative distance between the comprehensive feature vectors of each core asset data and other core asset data, as a backup uniqueness of each core asset data.

[0009] Furthermore, the method for obtaining the salience of the backup includes: The mean of the sum of the distinguishability and backup uniqueness of each core asset data is obtained as the backup saliency of each core asset data.

[0010] Furthermore, the method for obtaining the candidate incremental data includes: Based on the backup significance distribution of different types of core asset data, highly significant core asset data and low significant core asset data are obtained. For highly significant core asset data, the latest set of data to be analyzed is used as the baseline data; for low-significance core asset data, the earliest set of data to be analyzed each day is used as the baseline data. Obtain the hash values ​​of the data group to be analyzed and the baseline data group at the latest moment for different core asset data. If the hash value of the data group to be analyzed in the core asset data does not have a hash value of the baseline data within a preset range, the data within the corresponding preset range will be used as candidate incremental data.

[0011] Furthermore, the methods for obtaining the highly significant core asset data and the low significant core asset data include: The significance of backups of all core asset data is normalized. The Otsu threshold algorithm is used to obtain the segmentation threshold of the normalized backup significance. If the normalized backup significance of core asset data is greater than the segmentation threshold, the corresponding core asset data is regarded as highly significant core asset data; other core asset data are regarded as low-significance core asset data.

[0012] The present invention also proposes a data incremental backup system for data asset security management, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the steps of any one of the data incremental backup methods for data asset security management.

[0013] The present invention has the following beneficial effects: This invention obtains the distinguishability of each type of core asset data based on the access frequency, update frequency, and security level of different types of core asset data in attribute data and security management data, reflecting the degree of difference of each type of core asset relative to the overall data set. For any type of core asset data, data at each moment, attribute data, and security management data are combined into a data group to be analyzed. Based on the network transmission status data and backup record information data in the attribute data and security management data corresponding to different data groups to be analyzed, multiple clusters of data groups to be analyzed are obtained, classifying data with similar backup demand fluctuations, security risk distribution, and business change characteristics. Based on the data distribution and distinguishability within all data groups to be analyzed in different clusters of different types of core asset data, candidate incremental data is obtained, considering both the static importance of assets and their dynamic behavior patterns to improve the accuracy of incremental identification. Incremental data backup is performed based on the attribute data and security management data of the candidate incremental data. This invention improves the security of backup data by accurately obtaining incremental data of different core asset data assets. Attached Figure Description

[0014] To more clearly illustrate the technical solutions and advantages in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0015] Figure 1 This is a flowchart illustrating an incremental data backup method for data asset security management, provided as an embodiment of the present invention. Detailed Implementation

[0016] To further illustrate the technical means and effects adopted by the present invention to achieve its intended purpose, the following, in conjunction with the accompanying drawings and preferred embodiments, details the specific implementation, structure, features, and effects of a data incremental backup method and system for data asset security management proposed according to the present invention. In the following description, different "one embodiment" or "another embodiment" do not necessarily refer to the same embodiment. Furthermore, specific features, structures, or characteristics in one or more embodiments can be combined in any suitable form.

[0017] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0018] The following description, in conjunction with the accompanying drawings, details a specific solution for an incremental data backup method and system for data asset security management provided by this invention.

[0019] Please see Figure 1 The diagram illustrates a flowchart of an incremental data backup method for data asset security management according to an embodiment of the present invention, specifically including: Step S1: Obtain attribute data and security management data for various core asset data.

[0020] In an embodiment of the present invention, in order to ensure the real-time processing of incremental backup of data assets, the Agent software is used to periodically acquire data from the data asset carriers of various departments within the enterprise, and Kafka is used to push incremental data from each data carrier in real time. That is, when data assets are added or changed, a synchronous update is triggered, and the changed data is backed up.

[0021] Acquire core asset data, core data asset attributes, and security management data. Core asset data includes at least enterprise financial data, customer information data, business transaction record data, document file data, image and video data, audio data, and log file data. Core data asset attribute data includes, but is not limited to, data storage path, file size, creation time, modification time, business module, data owner, and security level. The security level is categorized into three levels: the highest (3), the middle (2), and the lowest (1). Security management data includes, but is not limited to, update frequency, data access frequency, read / write operation records, network transmission status data, and historical backup records. Network transmission status data includes, but is not limited to, average transmission rate, packet loss rate, peak transmission latency, and transmission interruption recovery time. Backup record information includes, but is not limited to, recovery verification success rate and backup time. It should be noted that, to facilitate subsequent data processing, data preprocessing is required. The methods include: standardizing the format of core data assets by converting structured, semi-structured, or unstructured data of different formats into a unified format; converting all types of document files to PDF format; and uniformly converting log files with different encodings to UTF-8 encoding. Simultaneously, meaningless and noisy data are filtered out using regular expressions. The specific format standardization process is well-known to those skilled in the art and will not be elaborated upon here. For numerical data in data asset attribute data and security management-related data, missing values ​​are filled using the mean imputation method, and all data undergoes Z-score standardization to eliminate the influence of dimensions during data processing. The specific methods are well-known to those skilled in the art and will not be elaborated upon here.

[0022] Step S2: Based on the access frequency, update frequency, and security level of different types of core asset data in attribute data and security management data, obtain the distinguishability of each type of core asset data; for any type of core asset data, construct a data group to be analyzed by combining the attribute data and security management data of the data at each moment; and obtain the incremental backup difference value between different data groups to be analyzed based on the network transmission status data and backup record information data in the corresponding attribute data and security management data of different data groups to be analyzed.

[0023] Since the accuracy of incremental data identification is greatly affected by differences in data update frequency, hierarchical level, closeness of business correlation and invalid interference data during the incremental data backup process, the distinguishability of each type of core asset data is obtained based on the access frequency, update frequency and security level of different types of core asset data in the data access log.

[0024] Preferably, in one embodiment of the present invention, the method for obtaining the distinguishability includes: The vector consisting of the update frequency, access frequency, and security level of each core asset data is used as the first feature vector; Obtain the relative distance of the first feature vector between each core asset data and each other core asset data, as the distinguishability of each core asset data.

[0025] It should be noted that in the data access logs of the security management data, the cumulative number of times the data is queried or accessed is calculated according to the unit time window, and the calculation results are standardized to obtain the access frequency.

[0026] It should be noted that in the embodiments of the present invention, the relative distance is obtained by existing distance calculation methods such as Euclidean distance or Manhattan distance. The specific means are well known to those skilled in the art and will not be described in detail here.

[0027] To improve the accuracy of data traceability analysis and processing, and to avoid incremental judgment bias caused by data dispersion, the attribute data of each time point in each type of core asset data and the security management data are combined into a data group to be analyzed. Due to the differences in incremental backup verification and data change processes of each core asset data in different historical periods during the process of differential incremental identification and processing of different core asset data, the judgment on differential incremental processing between different core asset data has the problems of strong dependence on historical scenarios and insufficient dynamic adaptation. Based on different groups of data to be analyzed, as well as corresponding attribute data, network transmission status data, and backup record information, the incremental backup difference value between different groups of data to be analyzed is obtained.

[0028] Preferably, in one embodiment of the present invention, the method for obtaining incremental backup difference values ​​includes: Obtain the data integrity verification results for each data group to be analyzed; It should be noted that obtaining the data integrity verification result through the SHA-256 hash function involves comparing the obtained hash value with a pre-stored, known, and correct baseline hash string. If the hash values ​​are the same, the result is 1; if the hash values ​​are different, the result is 0. The specific methods are well-known to those skilled in the art and will not be elaborated here.

[0029] The vector consisting of all data in each data group to be analyzed, including the data integrity verification results, network transmission status data, and backup record information data, is used as the second feature vector. Based on the relative distance between the second feature vectors of different data groups to be analyzed, and the hash consistency between different data groups to be analyzed, the incremental backup difference value of the data between different data groups to be analyzed is obtained. The relative distance is positively correlated with the incremental backup difference value, while the hash consistency is negatively correlated with the incremental backup difference value.

[0030] It should be noted that relative distance reflects the differences in the second feature vector between different data groups to be analyzed. The larger the relative distance, the more obvious the differences in the security execution status, transmission quality, and risk control characteristics of different data groups to be analyzed during the historical incremental backup process, and the larger the incremental backup difference value. Consistency reflects the level of similarity in the core business information of different data groups to be analyzed. The greater the consistency, the more similar the different data groups to be analyzed in terms of structure, and the smaller the incremental backup difference value. Therefore, relative distance is positively correlated with the incremental backup difference value, while consistency is negatively correlated with the incremental backup difference value.

[0031] In one embodiment of the present invention, field-level hash comparison is used to obtain the consistency between different data groups to be analyzed; that is, the hash value of each data group to be analyzed is obtained by using the SHA-256 hash function, and the number of elements with the same hash value in the same order is counted as the overlap; the overlap is calculated by dividing it by the hash element data of all elements as the hash consistency between different data groups to be analyzed; the relative distance of the second feature vector between different data groups to be analyzed is obtained and normalized as the first difference coefficient; the difference between the positive integer 1 and the consistency is calculated, and the product of the difference result and the first difference coefficient is calculated as the incremental backup difference value of the data between different data groups to be analyzed.

[0032] It should be noted that, in the embodiments of the present invention, normalization is performed by linear normalization or a normalization function, such as maximum and minimum value normalization, to obtain the maximum and minimum values ​​of the corresponding relative distances between all different data groups to be analyzed, and then normalization is performed. The specific means are well known to those skilled in the art and will not be described in detail here.

[0033] Step S3: Based on the distribution of incremental backup differences between different data groups to be analyzed, obtain multiple clusters of data groups to be analyzed; based on the data distribution within all data groups to be analyzed in different clusters of data groups to be analyzed for different types of core asset data, obtain the backup uniqueness of each type of core asset data.

[0034] The incremental backup difference value reflects the fluctuation of incremental backup demand, security risk distribution, and business change characteristics of the core asset data in different data groups to be analyzed. The larger the incremental backup difference value, the greater the fluctuation of incremental backup demand. By clustering, data groups to be analyzed with similar incremental backup values ​​are classified into one category, reducing the impact of historical differences and random interference factors. Based on the distribution of incremental backup difference values ​​among different data groups to be analyzed, multiple clusters of data groups to be analyzed are obtained.

[0035] Preferably, in one embodiment of the present invention, the method for obtaining the clusters of the data set to be analyzed includes: Based on the incremental backup differences between different data groups to be analyzed, the CFSFDP algorithm is used to cluster all data groups to be analyzed, resulting in multiple clusters of data groups to be analyzed.

[0036] It should be noted that by analyzing the change difference patterns of each data group during continuous backups, the CFSFDP algorithm is used to automatically discover data groups with similar change characteristics. Specifically, the determination of the cutoff distance in the CFSFDP algorithm involves: using the K-nearest neighbor algorithm to obtain the K nearest neighbor data groups for each data group to be analyzed, where the value of K is rounded down to 5% of the total number of data groups to be analyzed; calculating the incremental backup difference between each data group and its K nearest neighbor data groups, taking the maximum value as the maximum distance; and using the average of the calculated maximum distances for all data groups to be analyzed as the cutoff distance. Local density is determined by counting the number of data groups whose incremental backup difference values ​​with their K nearest neighbor data groups are less than the cutoff distance, thus forming clusters of the data groups to be analyzed. The CFSFDP algorithm is a well-known technique in the field and will not be elaborated upon here.

[0037] By analyzing the differences in security status of different data groups to be analyzed and the overall characteristics of clusters, we can accurately compare the differences in incremental backup security execution status, transmission quality level and risk control capabilities of different core asset data at different times. The greater the difference, the more obvious the distinction and the greater the uniqueness relative to other core asset data. Based on the data distribution within all data groups to be analyzed in different clusters of different core asset data, we can obtain the backup uniqueness of each type of core asset data.

[0038] Preferably, in one embodiment of the present invention, the method for obtaining backup uniqueness includes: For any data set to be analyzed of any core asset data, cluster the fluctuation characteristics of the same elements in different data sets to be analyzed, and perform normalization mapping as the feature weight of each element; obtain the mean of the same elements in all data sets to be analyzed. The sum of the products of the mean and the corresponding feature weight of the same element in different clusters of data to be analyzed is obtained as the weighted mean of the corresponding element; the weighted mean of all elements is used to form the comprehensive feature vector of the core asset data. Obtain the mean relative distance between the comprehensive feature vectors of each core asset data and other core asset data, as a backup uniqueness of each core asset data.

[0039] It should be noted that the greater the relative distance, the more inconsistent the characteristics of each core asset data with other core asset data, and the greater the uniqueness of the backup.

[0040] It should be noted that, in one embodiment of the present invention, the variance is used to reflect the fluctuation characteristics. The larger the variance, the larger the fluctuation characteristics, and the smaller the variance, the smaller the fluctuation characteristics. In other embodiments of the present invention, the standard deviation can also be used to reflect the fluctuation characteristics. The specific means are well known to those skilled in the art and will not be described in detail here.

[0041] Step S4: Based on the distinguishability and backup uniqueness of each type of core asset data, obtain the backup saliency of each type of core asset data; based on the backup saliency distribution of different types of core asset data and the data group to be analyzed, obtain candidate incremental data; based on the attribute data and security management data of the candidate incremental data, perform incremental data backup.

[0042] Distinctiveness reflects the degree of difference between the core asset data and the overall dataset. The larger the first characteristic difference value, the more significant the difference between its backup requirements and other core asset data. Backup uniqueness reflects the uniqueness of the core asset data in terms of full-cycle backup security and execution characteristics compared to other core asset data. The greater the backup uniqueness, the more obvious the difference between its backup security management, transmission quality requirements, and risk response requirements compared to other core asset data, and the greater the backup significance. Based on the distinctiveness and backup uniqueness of each type of core asset data, the backup significance of each type of core asset data is obtained.

[0043] Preferably, in one embodiment of the present invention, the method for obtaining backup salience includes: The mean of the sum of the distinguishability and backup uniqueness of each core asset data is obtained as the backup saliency of each core asset data.

[0044] Therefore, the larger the significance value, the more significant the difference between the backup requirements and security characteristics of the core asset data and other core asset data, and the stronger the necessity for differentiated processing.

[0045] The larger the significance value, the more significant the difference between the backup requirements and security characteristics of the core asset data and other core asset data, and the stronger the necessity of differentiated processing. Based on the backup significance distribution of different types of core asset data and the data group to be analyzed, candidate incremental data are obtained.

[0046] Preferably, in one embodiment of the present invention, the method for obtaining candidate incremental data includes: Based on the backup significance distribution of different types of core asset data, highly significant core asset data and low significant core asset data are obtained. Preferably, in one embodiment of the present invention, the method for obtaining highly significant core asset data and low significant core asset data includes: The significance of backups of all core asset data is normalized. The Otsu threshold algorithm is used to obtain the segmentation threshold of the normalized backup significance. If the normalized backup significance of core asset data is greater than the segmentation threshold, the corresponding core asset data is regarded as highly significant core asset data; other core asset data are regarded as low-significance core asset data.

[0047] It should be noted that the saliency of all core asset data is used as input, and the Z-score method is used for normalization. The Otsu threshold algorithm is a well-known technique in the field and will not be elaborated here.

[0048] For highly significant core asset data, a set of data to be analyzed at the latest backup time is used as the baseline data; for low-significance core asset data, a set of data to be analyzed at the earliest time of each day is used as the baseline data. Obtain the hash values ​​of the data group to be analyzed and the baseline data group at the latest moment for different core asset data. If the hash value of the data group to be analyzed in the core asset data does not have a hash value of the baseline data within a preset range, the data within the corresponding preset range will be used as candidate incremental data.

[0049] The baseline data is stored in the form of a range-based hash table. The data is divided into a range of 4KB to 8KB, which is the preset range. The hash value of the data in each preset range is calculated using the SHA-256 hash algorithm and then compared.

[0050] Incremental data backup is performed based on the attribute data and security management data of the candidate incremental data.

[0051] It should be noted that anomaly analysis is performed by collecting packet loss rate and transmission delay in real time. If the packet loss rate or transmission delay exceeds the threshold, which is 5% and 30s respectively based on relevant historical experience, it indicates a transmission anomaly. In this case, the transmission is paused and entered into the retry queue for interrupted transmission to avoid data loss due to transmission anomalies. Incremental data transmission is performed using SSL or TLS protocols to prevent data from being eavesdropped on or tampered with during transmission.

[0052] After transmission is complete, a consistency check is performed using a hash function algorithm. This involves recalculating the SHA-256 hash value of the incremental data after transmission and comparing it with the hash value of the data before transmission. If the hash values ​​match, the data transmission is error-free; if they do not match, the data transmission is incorrect and retransmission is required. On the other hand, the number of retransmissions is recorded. If the number of retransmissions exceeds 3, troubleshooting is required.

[0053] It should be noted that, based on the anomaly detection and verification results of incremental data transmission, incremental data is backed up and stored. The incremental data is categorized according to its security level in the security management data, including: using high-performance SSD storage media to store high-security-level incremental data, achieving low latency and high read / write speeds to ensure rapid backup and recovery of core data; using ordinary mechanical hard disk storage arrays to store medium-security-level incremental data, achieving a balance between storage performance and cost; and using low-cost, high-capacity tape library storage media to store low-security-level incremental data, meeting long-term archiving storage needs.

[0054] In summary, this invention obtains the distinguishability of each type of core asset data based on its access frequency, update frequency, and security level. For any given type of core asset data, it constructs a data group to be analyzed by combining data at each moment, attribute data, and security management data. Based on the network transmission status data and backup record information in the corresponding attribute data and security management data of different data groups to be analyzed, multiple clusters of data groups to be analyzed are obtained. Based on the data distribution and distinguishability within all data groups to be analyzed in different clusters, the backup saliency of each type of core asset data is obtained. Candidate incremental data is obtained, and incremental data backup is performed. This invention improves the security of backup data by accurately acquiring incremental data of different core asset data assets.

[0055] This invention also proposes a data incremental backup system for data asset security management, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements any of the steps of a data incremental backup method for data asset security management.

[0056] It should be noted that the order of the above embodiments of the present invention is merely for descriptive purposes and does not represent the superiority or inferiority of the embodiments. The processes depicted in the accompanying drawings do not necessarily require a specific or sequential order to achieve the desired result. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0057] The various embodiments in this specification are described in a progressive manner. The same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on describing the differences from other embodiments.

Claims

1. A method for incremental data backup for data asset security management, characterized in that, The method includes: Acquire attribute data and security management data of various core assets; Based on the access frequency, update frequency, and security level of different types of core asset data in attribute data and security management data, the distinguishability of each type of core asset data is obtained; for any type of core asset data, the data at each moment, attribute data, and security management data are combined into a data group to be analyzed; based on the network transmission status data and backup record information data in the attribute data and security management data corresponding to different data groups to be analyzed, the incremental backup difference value between the data groups to be analyzed is obtained. Based on the distribution of incremental backup differences between different data groups to be analyzed, multiple clusters of data groups to be analyzed are obtained; based on the data distribution within all data groups to be analyzed in different clusters of data groups to be analyzed for different types of core asset data, the backup uniqueness of each type of core asset data is obtained. Based on the distinguishability and backup uniqueness of each type of core asset data, the backup saliency of each type of core asset data is obtained; based on the backup saliency distribution of different types of core asset data and the data group to be analyzed, candidate incremental data is obtained; based on the attribute data and security management data of the candidate incremental data, incremental data backup is performed.

2. The incremental data backup method for data asset security management according to claim 1, characterized in that, The method for obtaining the distinguishability includes: The vector consisting of the update frequency, access frequency, and security level of each core asset data is used as the first feature vector; Obtain the relative distance of the first feature vector between each core asset data and each other core asset data, as the distinguishability of each core asset data.

3. The incremental data backup method for data asset security management according to claim 1, characterized in that, The method for obtaining the incremental backup difference value includes: Obtain the data integrity verification results for each data group to be analyzed; The vector consisting of all data in each data group to be analyzed, including the data integrity verification results, network transmission status data, and backup record information data, is used as the second feature vector. Based on the relative distance between the second feature vectors of different groups of data to be analyzed, and the hash consistency between different groups of data to be analyzed, the incremental backup difference value between different groups of data to be analyzed is obtained. The relative distance is positively correlated with the incremental backup difference value, while the hash consistency is negatively correlated with the incremental backup difference value.

4. The incremental data backup method for data asset security management according to claim 3, characterized in that, The method for obtaining the incremental backup difference value includes: Obtain the relative distance between the second feature vectors of different groups of data to be analyzed, and normalize them as the first difference coefficient; calculate the difference between the positive integer 1 and the consistency, and calculate the product of the difference result and the first difference coefficient as the incremental backup difference value between different groups of data to be analyzed.

5. The incremental data backup method for data asset security management according to claim 1, characterized in that, The method for obtaining the clusters of the data set to be analyzed includes: Based on the incremental backup differences between different groups of data to be analyzed, the CFSFDP algorithm is used to cluster all the data to be analyzed, resulting in multiple clusters of data to be analyzed.

6. The incremental data backup method for data asset security management according to claim 1, characterized in that, The method for obtaining the uniqueness of the backup includes: For any data set to be analyzed of any core asset data, cluster the fluctuation characteristics of the same elements in different data sets to be analyzed, and perform normalization mapping as the feature weight of each element; obtain the mean of the same elements in all data sets to be analyzed. The sum of the products of the mean and the corresponding feature weight of the same element in different clusters of data to be analyzed is obtained as the weighted mean of the corresponding element; the weighted mean of all elements is used to form the comprehensive feature vector of the core asset data. Obtain the mean relative distance between the comprehensive feature vectors of each core asset data and other core asset data, as a backup uniqueness of each core asset data.

7. The incremental data backup method for data asset security management according to claim 1, characterized in that, The method for obtaining the saliency of the backup includes: The mean of the sum of the distinguishability and backup uniqueness of each core asset data is obtained as the backup saliency of each core asset data.

8. A data incremental backup method for data asset security management according to claim 1, characterized in that, The method for obtaining the candidate incremental data includes: Based on the backup significance distribution of different types of core asset data, highly significant core asset data and low significant core asset data are obtained. For highly significant core asset data, the latest set of data to be analyzed is used as the baseline data; for low-significance core asset data, the earliest set of data to be analyzed each day is used as the baseline data. Obtain the hash values ​​of the data group to be analyzed and the baseline data group at the latest moment for different core asset data. If the hash value of the data group to be analyzed in the core asset data does not have a hash value of the baseline data within a preset range, the data within the corresponding preset range will be used as candidate incremental data.

9. A data incremental backup method for data asset security management according to claim 8, characterized in that, The methods for obtaining the highly significant core asset data and the low significant core asset data include: The significance of backups of all core asset data is normalized. The Otsu threshold algorithm is used to obtain the segmentation threshold of the normalized backup significance. If the normalized backup significance of core asset data is greater than the segmentation threshold, the corresponding core asset data is regarded as highly significant core asset data; other core asset data are regarded as low-significance core asset data.

10. A data incremental backup system for data asset security management, the system comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the incremental data backup method for data asset security management as described in any one of claims 1 to 9.

Images