Data security management method and device based on dynamic encryption and real-time anomaly detection

Abstract

The application discloses a data security management method and device based on dynamic encryption and real-time anomaly detection, the method comprising: obtaining data from diversified data sources to obtain standard data; dynamically encrypting the standard data to obtain encrypted data; extracting features from the encrypted data to obtain data stream features; using a detection engine to perform anomaly detection processing on the data stream features to obtain a detection result; when the detection result is normal, marking the encrypted data as a safe state and storing the encrypted data in a distributed node; when the detection result is abnormal, disposing of the danger according to a confidence score to obtain a danger assessment result; and optimizing parameters of the detection engine according to the danger assessment result and generating a log. It can be seen that the application effectively overcomes the problems of static encryption failure, detection lag and response rigidity in the prior art.

Description

Technical Field

[0001] This invention relates to the field of data security technology, specifically to a data security management method and apparatus based on dynamic encryption and real-time anomaly detection. Background Technology

[0002] In the current era of deep development of the digital economy, scenarios such as real-time data monitoring, IoT terminal data collection, and internet service interaction have achieved dynamic flow of data throughout the entire process. As a key production factor, data security protection has upgraded from "passive defense" to "proactive protection." Whether it's the real-time transmission of equipment operation data in the Industrial Internet of Things (IIoT) or the interactive processing of user privacy data on internet platforms, extremely high demands are placed on the dynamic nature of data encryption, the immediacy of anomaly detection, and the flexibility of security response. However, current data security management technology systems have significant shortcomings, failing to meet the core requirements of "continuous protection and immediate response" in real-time data scenarios. Data leaks and attack penetration incidents occur frequently, necessitating the construction of a new security management mechanism. Existing technologies have the following deficiencies:

[0003] First, static encryption mechanisms have inherent risks, which conflict with the requirements of dynamic keys.

[0004] Existing data encryption technologies largely rely on static key systems, with typical solutions including fixed-key encryption based on the AES algorithm and long-term static storage of private keys in RSA asymmetric encryption. The core flaw of these technologies lies in the disconnect between the key lifecycle and the data lifecycle: taking financial transaction data encryption as an example, some banking systems still use static keys that are rotated quarterly or even annually. Over long-term use, these keys are vulnerable to cracking through side-channel attacks and key distribution loopholes. Furthermore, once a static key is leaked, attackers can directly decrypt historically encrypted data, creating a risk of "one leak, mass damage."

[0005] Secondly, the batch detection mode causes a delay in response, which cannot meet the requirements for real-time data protection.

[0006] Anomaly detection, serving as a "warning line" for data security, currently relies heavily on an "offline batch processing + post-event traceability" approach. This manifests in two main solutions: First, offline log-based analysis, such as using the ELK log analysis platform to centrally analyze system logs and data access logs accumulated the previous day at midnight to identify abnormal access behavior. Second, rule-based batch matching, such as setting a fixed threshold of "more than 100 accesses per IP per day is considered abnormal," and performing batch verification of accumulated access records every hour. The detection latency of these methods typically ranges from several hours to tens of hours, rendering them completely ineffective for scenarios with extremely high real-time requirements—for example, in IoT scenarios, when attackers steal sensor data by forging terminal device IDs, offline detection can only trigger an alarm after the logs accumulate to the threshold, by which time sensitive data has already been continuously stolen. In contrast, the real-time streaming anomaly detection algorithm proposed in this invention achieves "millisecond-level detection and immediate blocking" during data flow. Its core difference from existing batch detection technologies lies in moving the detection node from "after data storage" to "during data transmission," using a streaming computing framework to achieve real-time identification of abnormal behavior.

[0007] Third, the response strategies are rigid, relying on fixed rules and making it difficult to adapt to new attack patterns.

[0008] Current security response mechanisms are centered on "fixed rule matching," which involves manually pre-setting attack signature databases or risk behavior rules. When a behavior matching the rules is detected, a fixed response action (such as blocking IPs or terminating connections) is triggered. For example, an e-commerce platform's security system pre-sets "login from a different location + payment operation" as a high-risk rule, directly freezing accounts upon triggering it. However, this rule cannot identify new fraudulent payment patterns such as "simulating frequently used login locations + multiple small payments." Similarly, in industrial control systems, existing response rules mostly target known DDoS attack characteristics, rendering them completely ineffective against new steganography attacks based on protocol vulnerabilities. This rigid model, where "the scope of rule coverage determines protection capability," is increasingly inadequate in the face of iterative upgrades in attack techniques. The adaptive response model based on machine learning introduced in this invention can dynamically update risk identification dimensions by learning from historical attack data, automatically generating optimal response strategies for new attacks. Compared to existing fixed rule response technologies, its core advantage lies in achieving a shift from "passive matching" to "active learning."

[0009] In summary, the shortcomings of existing data security management technologies in terms of encryption mechanisms, detection timeliness, and response capabilities have created a sharp contradiction with the security requirements of real-time data scenarios. Therefore, providing a novel data security management device and method based on dynamic encryption and real-time anomaly detection, which integrates dynamic key rotation, real-time streaming detection, and machine learning adaptive response, to achieve dynamic protection, immediate early warning, and intelligent response throughout the data flow, is key to solving current data security pain points and has significant practical implications for promoting the upgrading of data security technologies and ensuring the healthy development of the digital economy. Summary of the Invention

[0010] To address the aforementioned issues, this application provides a data security management method and apparatus based on dynamic encryption and real-time anomaly detection. By introducing a dynamic key rotation mechanism, a real-time streaming anomaly detection algorithm, and a machine learning-based adaptive response model, it provides a data security management apparatus and method based on dynamic encryption and real-time anomaly detection that can continuously ensure data security during data flow, instantly identify and handle anomaly risks, and dynamically optimize security protection strategies. This effectively overcomes the problems of static encryption failure, detection lag, and rigid response in existing technologies.

[0011] To achieve the above objectives, the first aspect of this invention discloses a data security management method based on dynamic encryption and real-time anomaly detection, comprising:

[0012] S1. Obtain standard data from diverse data sources; the diverse data sources include IoT sensors (using MQTT protocol, etc.), industrial PLCs (using Modbus protocol, etc.), mobile terminal sets, or cloud servers, etc.; the data generated by the diverse data sources are structured data, unstructured data files, or streaming audio and video.

[0013] S2. Dynamically encrypt the standard data to obtain encrypted data;

[0014] S3. Extract features from the encrypted data to obtain data stream features;

[0015] S4. Using a detection engine, perform anomaly detection processing on the data stream features to obtain detection results and confidence scores; the detection results are either normal or abnormal.

[0016] When the detection result is normal, the encrypted data is stored in the distributed node and marked as secure, and step S1 is executed;

[0017] If the detection result is abnormal, proceed to step S5;

[0018] S5. Based on the confidence score, the hazard is addressed to obtain the hazard assessment result;

[0019] S6. Based on the hazard assessment results, optimize the parameters of the detection engine and generate logs. As an optional implementation, in the first aspect of this invention, obtaining standard data from diverse data sources includes:

[0020] S11. Obtain raw data from diverse data sources;

[0021] S12. Standardize the original data using the data plugin layer to obtain standard data;

[0022] The data plugin layer includes a data file plugin, a terminal device plugin, a cloud service plugin, and a sensor plugin. The data file plugin processes data input from various types of files (such as CSV, JSON, etc.). The terminal device plugin connects to and manages data streams from various terminal devices. The cloud service plugin interfaces with cloud platforms and SaaS services. The sensor plugin collects real-time data generated by various sensors.

[0023] As an optional implementation, in the first aspect of the present invention, the step of dynamically encrypting the standard data to obtain encrypted data includes:

[0024] S21. Generate an encryption key based on a timestamp or event trigger; the encryption key adopts a hybrid encryption mechanism, with the symmetric algorithm AES-256 encrypting the data body and the asymmetric algorithm RSA-2048 protecting the key transmission.

[0025] S22. Encrypt the standard data using the encryption key to obtain encrypted data;

[0026] S23. At preset time intervals, the risk weight is calculated using a rotating trigger weight function.

[0027] The expression for the rotation trigger weight function is:

[0028]

[0029] in, Indicates risk weight; For the complexity function of user behavior (such as the number of abnormal operations); This is a data access frequency function (e.g., the number of requests per unit time). For data sensitivity functions (such as sensitivity label coefficients); , , The weighting parameters are adjustable and satisfy... t represents time.

[0030] S24. Determine whether the risk weight is greater than the set threshold, and obtain the first judgment result;

[0031] If the first judgment result is yes, proceed to step S25; otherwise, proceed to step S23.

[0032] S25. Based on a preset set of encryption algorithms, a rotating encryption algorithm is obtained by using an encryption algorithm selection function for calculation.

[0033] The expression for the encryption algorithm selection function is:

[0034]

[0035] in, This represents the calculated rotation encryption algorithm. This is the set of currently available encryption algorithms; This refers to the algorithm's suitability for the current data type (e.g., its suitability for large data / small data blocks). The algorithm's current security rating (based on historical statistics or policy scores); The current computational complexity of the algorithm (considering CPU usage and latency); the set of available encryption algorithms includes AES, RSA, SM4, etc.

[0036] S26. Generate an updated encryption key using the rotation encryption algorithm and execute step S22.

[0037] As an optional implementation, in a first aspect of the present invention, the step of extracting features from the encrypted data to obtain data stream features includes:

[0038] S31. Perform feature preprocessing on the encrypted data to obtain a first data stream; the feature preprocessing includes standardization cleaning and normalization operations, which are used to unify different data formats and remove invalid or outlier values.

[0039] S32. The first data stream is segmented according to a time window to obtain a data window sequence;

[0040] Define window size as W Step size is S Then the k-th window is:

[0041] ;

[0042] Sliding windows are divided into two categories: fixed windows, used to calculate stability features (such as mean, variance, etc.); and weighted time decay windows, used to emphasize data behavior at different times.

[0043] S33. Using a feature extraction model, feature extraction is performed on the data window sequence to obtain data stream features;

[0044] The feature extraction model expression is:

[0045]

[0046] In the formula, W represents the size of the data window; This represents the i-th data point in the window; Indicates data points Feature extraction function; This represents the time decay factor, which controls the rate at which past data decays. This represents the weight assigned to each data point.

[0047] As an optional implementation, in the first aspect of the present invention, an anomaly detection process is performed on the data streaming features using a detection engine to obtain detection results and confidence scores; specifically:

[0048] S41. Using the statistical feature modeling module, the data stream features are processed to obtain the deviation degree; the deviation degree characterizes the degree of deviation of the current behavior.

[0049] S42. Using the sequence modeling module, the data streaming features are processed to obtain the contextual correlation degree; the contextual correlation degree represents long-term dependencies and contextual anomalies.

[0050] S43. Using the graph structure detection module, the data stream features are processed to obtain attack behavior values; the attack behavior values ​​characterize the strength of complex attack behaviors.

[0051] S44. Process the deviation, contextual relevance, and attack behavior values ​​to obtain the detection results and confidence scores.

[0052] As an optional implementation, in a first aspect of the present invention, storing the encrypted data in a distributed node includes:

[0053] SS11. Based on the preset block size and data characteristics, the encrypted data is divided into several data blocks to obtain a data block set; each data block contains an encryption payload, a key version identifier, a data hash value, a timestamp, and minimal metadata encapsulation to ensure its integrity and traceability.

[0054] SS12. Process the storage factors to obtain the storage method; the storage factors include: storage resource status, node load, network latency, historical access frequency, and estimated data lifecycle; the storage method includes replication-based, erasure coding, or hierarchical hot and cold distribution mechanisms.

[0055] SS13. Based on the aforementioned data block set, create an encrypted index;

[0056] Each index entry records metadata such as the unique identifier of the data block, encryption key version, distribution of its owning nodes, replica status, access permission tags, and lifecycle markers. These indexes are stored encrypted and synchronized to the index control cluster via a distributed consistency protocol to ensure consistency and fast retrieval capabilities. The index itself does not contain plaintext paths or data digests, structurally protecting against metadata leakage.

[0057] SS14. Based on the storage method and the encrypted index, the scheduling module initiates the node allocation mechanism to dynamically map each data block to multiple storage nodes;

[0058] SS15. Verify the integrity of the written data through hash verification to obtain the first verification result; determine whether a write confirmation and digest signature are returned from the remote node to obtain the second verification result.

[0059] When both the first and second verification results are yes, the data block is marked as having been written; otherwise, the node replacement and data retransmission mechanism is triggered, and the relevant behavior is recorded in the security log for auditing.

[0060] SS16. Generate corresponding metadata digests based on the structure and purpose of the data blocks and write them into the distributed metadata repository.

[0061] This repository supports version control, access control, and rapid rollback, ensuring a complete data and timeline during system recovery, migration, or compliance checks. The entire encrypted distributed storage process not only builds a zero-trust isolation system for data at the storage layer but also provides structural support for subsequent security testing, access scheduling, and compliance auditing.

[0062] As an optional implementation, in a first aspect of the present invention, marking the encrypted data as secure includes:

[0063] SS21. The system will dynamically generate a unique security credential, such as a cryptographic hash label or a lightweight digital signature, for the verified data stream. This credential is transmitted to the downstream module along with the original data and feature vector as the basis for exemption from inspection.

[0064] SS22: The security status is written to a real-time status table in the in-memory database, and microsecond-level status retrieval is achieved through key-value mapping to avoid computational waste caused by repeated detection.

[0065] SS23. To ensure traceability, the system automatically generates lightweight audit logs, which only record key metadata of security tags (such as timestamps, data source IDs, detection model versions, and confidence scores). Audit capabilities are decoupled from the main process by asynchronously writing to the log service.

[0066] SS24. For scenarios requiring long-term retention, security tags will trigger low-priority compressed storage, packaging the original data, feature vectors, and security credentials into a columnar storage format and archiving them to cold storage, such as HDFS or cloud object storage, which satisfies business requirements while avoiding the occupation of real-time processing resources.

[0067] SS25. Data branches marked as safe will be prioritized for routing to high-throughput channels and delivered directly to the data warehouse or visualization system.

[0068] As an optional implementation, in a first aspect of the present invention, the step of handling the hazard based on the confidence score to obtain a hazard assessment result includes:

[0069] S51. Execute the hazard response strategy based on the confidence score;

[0070] S52. The false alarm rate is calculated using the false alarm rate model. The false alarm rate represents the proportion of a response that is identified as abnormal but is later confirmed as normal by human intervention.

[0071] The false alarm rate model expression is as follows:

[0072]

[0073] In the formula, FP represents the number of response errors, and TN represents the number of correct responses;

[0074] S53. Calculate the blocking success rate using the blocking success rate model, whereby the blocking success rate represents the proportion of accurate blocking of real abnormal flows;

[0075] The expression for the blocking success rate model is:

[0076]

[0077] In the formula, Indicates the number of successfully blocked connections; Indicates the total number of blocks;

[0078] S54. Calculate the business capability degradation ratio using the business capability degradation ratio model;

[0079] The expression for the business capability degradation ratio model is:

[0080] ;

[0081] S55. Obtain the response delay and the penalty for accidental injury; the response delay This indicates the time elapsed from the detection trigger to the response completion of the strategy; false positive penalty. This indicates that the negative impact of false alarms on business and user experience is quantified;

[0082] S56. Integrate the false alarm rate, blocking success rate, service capability degradation ratio, response latency, and false alarm penalty to obtain the risk assessment result;

[0083] The hazard assessment results are expressed as follows:

[0084]

[0085] Among them, subscript t Indicates time, This indicates transpose.

[0086] Optionally, the hazard response strategy specifically includes:

[0087] When the anomaly detection engine determines that a data window contains a high-risk feature vector, the system immediately activates a multi-level response strategy, forming a "detection" mechanism. contain Evidence collection The "repair" automated defense loop is not executed linearly, but rather dynamically combines response actions based on threat graph analysis;

[0088] S511, Real-time Dynamic Containment

[0089] At the load balancing layer, such as when using Nginx, scripts can be injected to implement micro-segmentation of abnormal data source IPs, discarding attack packets and allowing legitimate traffic.

[0090] Resource circuit breaking strategies use container cluster management tools such as Kubernetes to adjust the CPU quota of abnormal containers or nodes in real time, limiting the resource brute-force attacks by malicious processes.

[0091] The credential freezing policy involves revoking the token and broadcasting the revocation to all service nodes if an abnormally associated authentication credential, such as a JWT token, is encountered.

[0092] S512, Deep Forensics and Attack Chain Reconstruction

[0093] When the anomaly detection engine triggers a high-risk alert, the system immediately enters the deep forensics and attack chain reconstruction process, achieving threat insight through a three-layered, interconnected technology stack:

[0094] At the physical layer, a memory pool is used to capture raw data packets, process memory snapshots, and feature vectors with zero loss, and the attack scene is solidified in binary format.

[0095] At the logic layer, historical attack characteristics are automatically associated to accurately pinpoint the attacker's complete chain from initial intrusion to lateral movement.

[0096] In the dynamic verification layer, abnormal data streams are injected into a lightweight sandbox environment. By hooking system call sequences and network behaviors, a behavioral analysis report containing process trees, file operations, and cross-host communication is generated, providing attack evidence for remediation strategies.

[0097] S513, Adaptive Repair Strategy

[0098] The forensic findings directly drive the precise execution of adaptive remediation strategies, the core of which lies in combining remediation actions as needed while ensuring business continuity. For vulnerability exploitation threats, hot-injection of programs replaces vulnerable functions in real time, achieving seamless remediation. In the face of data leakage risks, a memory-level AES-256 encryption engine is immediately triggered to seal sensitive data, and the key management service performs millisecond-level rotation. When encountering resource abuse attacks, an AI-powered elastic controller dynamically adjusts resource quotas while isolating hijacked service node processes. All remediation actions are atomically executed through a distributed transaction coordinator, ensuring consistency across systems such as network isolation, resource circuit breaking, and data encryption, and automatically rolling back to a secure state in case of failure.

[0099] As an optional implementation, in a first aspect of the present invention, optimizing the parameters of the detection engine and generating logs based on the hazard assessment results includes:

[0100] S61. The risk assessment results are processed using a comprehensive reward model to obtain an immediate reward value; the immediate reward value represents the reward obtained by the system based on the actual effect after executing the response strategy at time t.

[0101] The expression for the comprehensive reward model is:

[0102]

[0103] in, This is a positive incentive term, representing the proportion of successful interception of real attack behaviors; This is a false alarm penalty item, representing the proportion of normal data that is mistakenly identified as abnormal; For business impact items, this indicates the percentage of business downgrade impact. This is for the cost of accidental injury. , , , The weighting coefficient for the corresponding indicator indicates the importance of that item to system security.

[0104] S62. Optimize the parameters of the detection engine using the instant reward value and generate logs.

[0105] The second aspect of this invention discloses a data security management device based on dynamic encryption and real-time anomaly detection, employing the data security management method based on dynamic encryption and real-time anomaly detection disclosed in the first aspect of this invention. The device includes:

[0106] The data acquisition module is used to acquire data from diverse data sources and obtain standardized data.

[0107] The data encryption module is used to dynamically encrypt the standard data to obtain encrypted data;

[0108] The data feature extraction module is used to extract features from the encrypted data to obtain data stream features;

[0109] The anomaly detection module uses a detection engine to perform anomaly detection processing on the data stream features to obtain detection results and confidence scores.

[0110] The hazard assessment module is used to handle hazards based on the confidence score and obtain hazard assessment results; the hazard assessment results include false alarm rate, blocking success rate, and changes in environmental conditions;

[0111] The optimization and log generation module is used to optimize the parameters of the detection engine and generate logs based on the hazard assessment results.

[0112] A third aspect of this invention discloses yet another data security management device based on dynamic encryption and real-time anomaly detection, the device comprising:

[0113] Memory containing executable program code;

[0114] A processor coupled to the memory;

[0115] The processor calls the executable program code stored in the memory to execute the data security management method based on dynamic encryption and real-time anomaly detection disclosed in the first aspect of the present invention.

[0116] Compared with the prior art, the embodiments of the present invention have the following beneficial effects:

[0117] This invention provides a data security management method and device based on dynamic encryption and real-time anomaly detection. It can provide dynamic protection throughout the entire process of data transmission and storage, detect anomaly risks in real time and respond quickly. It effectively overcomes the shortcomings of existing technical solutions in terms of encryption security, anomaly detection timeliness and response intelligence. It has significant technical progress and broad application and promotion value, and has the following beneficial effects.

[0118] (1) Enhance data encryption security

[0119] By introducing a dynamic key rotation mechanism, the risk of cracking caused by long-term key exposure is effectively reduced, and the confidentiality and integrity of data during transmission and storage are significantly enhanced, thus solving the historical data leakage risks existing in traditional static encryption methods.

[0120] (2) Real-time detection and processing of abnormal behavior

[0121] This invention employs a streaming data processing architecture and a hybrid machine learning detection model, which can detect potential abnormal behaviors or attack patterns within a millisecond response time. It overcomes the limitations of existing batch offline analysis with its lag, and significantly improves the real-time performance and accuracy of data security protection.

[0122] (3) Establish an adaptive and intelligent security response mechanism

[0123] By introducing strategy optimization methods based on online learning and reinforcement learning, the system can continuously adjust its detection rules and response strategies according to actual operating results, and has the ability to cope with the evolution of unknown threats and attack methods. Compared with traditional fixed rule-based responses, it has higher flexibility and continuous evolution capabilities. Attached Figure Description

[0124] Figure 1 This is a schematic diagram of a data security management method based on dynamic encryption and real-time anomaly detection disclosed in an embodiment of the present invention;

[0125] Figure 2 This is a schematic diagram of a data security management device based on dynamic encryption and real-time anomaly detection disclosed in an embodiment of the present invention;

[0126] Figure 3 This is a schematic diagram of another data security management device based on dynamic encryption and real-time anomaly detection disclosed in an embodiment of the present invention. Detailed Implementation

[0127] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0128] Example 1

[0129] Please see Figure 1 , Figure 1 This is a schematic diagram of a data security management method based on dynamic encryption and real-time anomaly detection disclosed in an embodiment of the present invention;

[0130] like Figure 1As shown in the figure, the data security management method based on dynamic encryption and real-time anomaly detection described in this embodiment includes:

[0131] S1. Obtain standard data from diverse data sources; the diverse data sources include IoT sensors (using MQTT protocol, etc.), industrial PLCs (using Modbus protocol, etc.), mobile terminal sets, or cloud servers, etc.; the data generated by the diverse data sources are structured data, unstructured data files, or streaming audio and video.

[0132] S2. Dynamically encrypt the standard data to obtain encrypted data;

[0133] S3. Extract features from the encrypted data to obtain data stream features;

[0134] S4. Using a detection engine, perform anomaly detection processing on the data stream features to obtain detection results and confidence scores; the detection results are either normal or abnormal.

[0135] When the detection result is normal, the encrypted data is stored in the distributed node and marked as secure, and step S1 is executed;

[0136] If the detection result is abnormal, proceed to step S5;

[0137] S5. Based on the confidence score, the hazard is addressed to obtain the hazard assessment result;

[0138] S6. Based on the hazard assessment results, optimize the parameters of the detection engine and generate logs.

[0139] In another optional embodiment, obtaining standard data from diverse data sources includes:

[0140] S11. Obtain raw data from diverse data sources;

[0141] S12. Standardize the original data using the data plugin layer to obtain standard data;

[0142] The data plugin layer includes a data file plugin, a terminal device plugin, a cloud service plugin, and a sensor plugin. The data file plugin processes data input from various file types (such as CSV, JSON, etc.). The terminal device plugin connects to and manages data streams from various terminal devices. The cloud service plugin interfaces with cloud platforms and SaaS services. The sensor plugin collects real-time data generated by various sensors.

[0143] It should be noted that the data plugin layer provided in this embodiment converts data from different sources into standardized formats and protocols through a framework. Various types of data are accessed through corresponding plugins. The plugins pass the raw data to the core framework, which performs standardization processing, converting the data into a unified data structure. The processed data is then passed to downstream modules. The data access framework is scalable, supporting rapid access to new data sources through a plugin mechanism; it is unified, providing standardized data structures and interfaces; and it is flexible, adapting to different scenarios and business needs. For example, in an online transaction scenario, the transaction system receives thousands of order data entries per second, covering information such as price, quantity, and timestamps. After standardization conversion, these entries enter the subsequent processing pipeline.

[0144] In yet another optional embodiment, the step of dynamically encrypting the standard data to obtain encrypted data includes:

[0145] S21. Generate an encryption key based on a timestamp or event trigger; the encryption key adopts a hybrid encryption mechanism, with the symmetric algorithm AES-256 encrypting the data body and the asymmetric algorithm RSA-2048 protecting the key transmission.

[0146] S22. Encrypt the standard data using the encryption key to obtain encrypted data;

[0147] S23. At preset time intervals, the risk weight is calculated using a rotating trigger weight function.

[0148] The expression for the rotation trigger weight function is:

[0149]

[0150] in, Indicates risk weight; For the complexity function of user behavior (such as the number of abnormal operations); This is a data access frequency function (number of requests per unit time). For data sensitivity functions (e.g., sensitivity label coefficients); , , The weighting parameters are adjustable and satisfy... t represents time.

[0151] S24. Determine whether the risk weight is greater than the set threshold, and obtain the first judgment result;

[0152] If the first judgment result is yes, proceed to step S25; otherwise, proceed to step S23.

[0153] S25. Based on a preset set of encryption algorithms, a rotating encryption algorithm is obtained by using an encryption algorithm selection function for calculation.

[0154] The expression for the encryption algorithm selection function is:

[0155]

[0156] in, This represents the calculated rotation encryption algorithm. This is the set of currently available encryption algorithms; This refers to the algorithm's suitability for the current data type (e.g., its suitability for large data / small data blocks). The algorithm's current security rating (based on historical statistics or policy scores); The current computational complexity of the algorithm (considering CPU usage and latency); the set of available encryption algorithms includes AES, RSA, SM4, etc.

[0157] S26. Generate an updated encryption key using the rotation encryption algorithm and execute step S22.

[0158] It's important to note that the encryption process is completed in memory, and the plaintext key exists only within a secure enclave. For example, sensor readings uploaded by IoT devices are encrypted with a dynamic key before transmission, and the ciphertext is sent along with the key index, ensuring that even if network traffic is intercepted, the original data cannot be decrypted.

[0159] In yet another optional embodiment, the step of extracting features from the encrypted data to obtain data stream features includes:

[0160] S31. Perform feature preprocessing on the encrypted data to obtain a first data stream; the feature preprocessing includes standardization cleaning and normalization operations, which are used to unify different data formats and remove invalid or outlier values.

[0161] S32. The first data stream is segmented according to a time window to obtain a data window sequence;

[0162] Define window size as Step size is Then the k-th window is:

[0163] ;

[0164] Sliding windows are divided into two categories: fixed windows, used to calculate stability features (such as mean, variance, etc.); and weighted time decay windows, used to emphasize data behavior at different times.

[0165] S33. Using a feature extraction model, feature extraction is performed on the data window sequence to obtain data stream features;

[0166] The feature extraction model expression is:

[0167]

[0168] In the formula, W represents the size of the data window; This represents the i-th data point in the window; Indicates data points Feature extraction function; This represents the time decay factor, which controls the rate at which past data decays. This represents the weight assigned to each data point.

[0169] It's important to note that the data slices divided by the window are then fed into a feature extractor for in-depth analysis. Here, the system performs multi-dimensional feature extraction, including analyzing the inherent protocol behavior patterns of the data (such as connection characteristics in network traffic), constructing time-series or frequency-domain models (such as calculating statistical indicators and performing Fourier transforms to identify periodic signals), and mining contextual semantic information (such as understanding meaning by combining preceding and following data points). The extracted rich features are combined into feature vectors representing the current state of the data window. Finally, these real-time generated feature vectors are temporarily stored in a feature vector cache. This cache typically employs an efficient circular buffer design to implement first-in-first-out management, ensuring that the latest results are not lost during high-speed data inflow. It is responsible for stably and with low latency delivering the feature vectors to the downstream detection engine, completing the end-to-end streaming transformation from raw data to actionable insights. Data closer to the current moment has a higher weight, while older data has a lower weight, allowing for more sensitive capture of the latest behavioral changes.

[0170] In another optional embodiment, an anomaly detection process is performed on the streaming data features using a detection engine to obtain detection results and confidence scores; specifically:

[0171] S41. Using the statistical feature modeling module, the data stream features are processed to obtain the deviation degree; the deviation degree characterizes the degree of deviation of the current behavior.

[0172] S42. Using the sequence modeling module, the data streaming features are processed to obtain the contextual correlation degree; the contextual correlation degree represents long-term dependencies and contextual anomalies.

[0173] S43. Using the graph structure detection module, the data stream features are processed to obtain attack behavior values; the attack behavior values ​​characterize the strength of complex attack behaviors.

[0174] S44. Process the deviation, contextual relevance, and attack behavior values ​​to obtain the detection results and confidence scores.

[0175] In yet another optional embodiment, the detection engine includes:

[0176] (1) Statistical feature modeling module: Based on Gaussian mixture model (GMM), construct the distribution baseline of normal behavior, and evaluate the degree of deviation of the current behavior through Bayesian inference;

[0177] (2) Sequence modeling module: The Gated Recurrent Unit (GRU) model is used to model temporal behaviors such as access sequences and operation paths, and to mine long-term dependencies and context anomalies. The sequence modeling module is based on the GRU as the core structure, and is combined with a feature input layer, an attention enhancement layer and an output layer to form a complete link of "feature encoding - dependency capture - correlation output", which is specifically composed as follows:

[0178] Feature Input Layer: Receives preprocessed streaming time-series features (such as continuous operation intervals, access sequence encoding, real-time transmission rate, etc.), transforms discrete features into low-dimensional vectors through the embedding layer, and concatenates them with continuous features to form a sequence feature matrix with uniform dimensions, which serves as the input to the GRU.

[0179] GRU core layer: It uses a gating mechanism to dynamically adjust the forgetting and updating of temporal information, efficiently captures the dependencies in long sequences, and avoids the gradient vanishing problem of traditional recurrent neural networks (RNNs);

[0180] Attention Enhancement Layer: Introduces a self-attention mechanism to assign weights to the hidden states of the GRU output, enhances the contribution of features at key time steps (such as before and after abnormal operations), and improves the accuracy of context association analysis.

[0181] Relevance Calculation Layer: Based on the output of GRU and attention layer, a quantitative context relevance index is generated through similarity calculation and normalization.

[0182] (3) Graph structure detection module, used to detect complex attack behaviors such as lateral movement and permission bypass; the graph structure detection module takes "graph construction-feature encoding-graph learning-attack value output" as the core link, covering the data preprocessing layer, graph construction layer, GCN learning layer, feature fusion layer and attack behavior value calculation layer, and its specific composition and functions are as follows:

[0183] Data preprocessing layer: Receives candidate anomaly data from the second-level detection output, extracts the core triplet information of "user-resource-operation", performs one-hot encoding or embedding encoding on discrete attributes (such as user ID, resource identifier, operation type), and provides structured input for graph construction;

[0184] Graph Construction Layer: Constructs a heterogeneous graph (containing two types of nodes: user nodes and resource nodes), establishes node association edges based on access behavior, and generates weighted graph structure data;

[0185] GCN learning layer: Through multi-layer graph convolution operations, it aggregates the features of the node itself and the features of its neighboring nodes to capture the local dependency and global association patterns in the graph structure;

[0186] Feature fusion layer: The embedded features of graph nodes output by GCN are concatenated with the temporal features output by LSTM / GRU, and feature fusion is completed through a fully connected layer to strengthen the correlation of multi-dimensional anomaly information;

[0187] Attack behavior value calculation layer: Calculates anomaly scores based on fused features, and obtains quantified attack behavior values ​​after normalization.

[0188] As an optional implementation, the statistical feature modeling module processes the streaming data features to obtain the deviation; the deviation characterizes the degree of deviation of the current behavior, including:

[0189] S411. Using a probability density model, process the data stream features to obtain the probability density;

[0190] The probability density model is composed of a linear combination of K single Gaussian distributions (components), and its expression is:

[0191]

[0192] The probability density function of a single Gaussian component is:

[0193]

[0194] In the formula, x represents the data streaming feature, and K represents the number of Gaussian components, which is adaptively determined by BIC (Bayesian Information Criterion). Preferably, K takes a value of 3-5. The parameter set of the probability density model is obtained by training with the EM (Expectation Maximization) algorithm. The number of training iterations is set to 100-200, and the convergence threshold is set to 1e-4. This represents the weight of the k-th Gaussian component, with the initial weight set to 1 / K; The mean vector of the k-th Gaussian component represents the center of the normal behavior feature corresponding to that component; This represents the covariance matrix of the k-th Gaussian component, reflecting the correlation and dispersion of the features within that component. Indicates a Gaussian distribution. Represents the covariance matrix The determinant, It is its inverse matrix.

[0195] S412. Based on the probability density, the deviation model is used to process the data to obtain the deviation.

[0196] The deviation model expression is:

[0197]

[0198] in, Indicates the degree of deviation; This represents the probability density of the current data stream feature vector x. When calculating the probability value... In this case, the value should be uniformly treated as 1e-10 to avoid underflow. 、 This was obtained through statistics from a historical normal sample set (sample size not less than 100,000 records); if The default is... It was determined to be normal.

[0199] As an optional implementation, the step of using a sequence modeling module to process the streaming features of the data to obtain contextual relevance includes:

[0200] S421. Using the feature input layer, the data streaming features are preprocessed to obtain the data time series feature vector;

[0201] S422. Using the GRU core layer, process the data time-series feature vector set to generate time-series dependency information;

[0202] The GRU core layer expression is:

[0203]

[0204] in, Represents the temporal feature vector of the data; W Represents the weight matrix; Indicates the bias term; This indicates an update to the gate calculation; This indicates a reset of the door calculation; This represents the computation of candidate hidden states; This represents the final hidden state at time t, which contains the temporal dependency information up to time t;

[0205] S423. Using the attention enhancement layer, calculate the similarity between the hidden state and the query vector at each time step to obtain the attention weights;

[0206] The expression for the attention enhancement layer is:

[0207]

[0208]

[0209]

[0210] in, H The hidden state matrix for all time steps. , , These are query, key, and value matrices, respectively. The dimension of the key vector (used for normalization). Let be the attention weight at time step t. This is the hidden state after attention enhancement.

[0211] S424. Process the data using the relevance calculation layer to obtain the context relevance.

[0212] The expression for the correlation calculation layer is:

[0213]

[0214]

[0215] in, Represents the hidden state sequence after attention enhancement Hidden state of baseline The similarity is represented by CCD, which indicates the normalized contextual relevance. T is the time step.

[0216] It should be noted that the Context Correlation Degree (CCD) is calculated by comparing the similarity between the hidden state of the current sequence segment and the baseline hidden state of the normal behavior sequence. After averaging the similarity at each time step, the value is normalized to the range of [0, 100] to obtain the final context correlation degree. The smaller the value, the more obvious the context abnormality.

[0217] Baseline hidden state construction: The normal behavior time series dataset has a sample size of no less than 50,000 records, covering at least 30 days of normal behavior data. The clustering algorithm used is... The number of clusters is set to 8-12 to obtain the baseline hidden state matrix for normal behavior. .

[0218] In another optional embodiment, the process of using the graph structure detection module to process the data stream features to obtain attack behavior values ​​includes:

[0219] S431. Construct a normal graph structure sample set using a large amount of normal access behavior data, and extract graph-level features of each normal sample by training a stable graph convolutional network (GCN) model to form a normal feature library. ;

[0220] S432. Construct graph-level features for data streaming features to obtain the current graph-level features. ;

[0221] S433. The deviation distance between the current graph-level features and the normal feature library is calculated using the Mahalanobis distance model. This distance can eliminate the influence of correlation between features and more accurately reflect structural anomalies.

[0222] The Mahalanobis distance calculation model expression is:

[0223]

[0224] Indicates normal feature library The mean;

[0225] S434. Normalize the deviation distance to obtain the final attack behavior value:

[0226] in, , These are the maximum and minimum Mahalanobis distances for the normal and abnormal sample sets, respectively, obtained through historical data statistics to ensure the interpretability of ABV business.

[0227] In another optional embodiment, the processing of the deviation, contextual relevance, and attack behavior values ​​to obtain the detection result and confidence score includes:

[0228] S441. Calculate the Temporal Outlier (TA) based on Contextual Correlation (CCD).

[0229] The calculation formula is:

[0230] It should be noted that since a smaller CCD value indicates a more obvious anomaly, it needs to be converted into an anomaly-guided indicator, a time-series outlier, first.

[0231] S442. Calculate the confidence score using the confidence calculation model;

[0232] The reliability calculation model is expressed as follows:

[0233]

[0234] The scoring range is [0, 100], with higher values ​​indicating a higher confidence level in the behavioral abnormality.

[0235] S443. The detection result is obtained based on the confidence score, specifically:

[0236] Combining confidence scores with multiple anomaly labels, a judgment rule of "score-driven + label-assisted" is adopted:

[0237] Confidence score Score: Regardless of the tag combination, it is judged as "abnormal";

[0238] 40 points Confidence score Score: If at least two indicators are marked as abnormal, the score is determined as "abnormal"; otherwise, it is determined as "pending review".

[0239] Confidence score Score: Regardless of the tag combination, it is judged as "normal";

[0240] Special rules: If The score (high-risk structural anomaly), even with a confidence score If the score is still directly judged as "abnormal", priority will be given to preventing advanced attacks such as lateral movement.

[0241] In yet another optional embodiment, storing the encrypted data in a distributed node includes:

[0242] SS11. Based on the preset block size and data characteristics, the encrypted data is divided into several data blocks to obtain a data block set; each data block contains an encryption payload, a key version identifier, a data hash value, a timestamp, and minimal metadata encapsulation to ensure its integrity and traceability.

[0243] SS12. Process the storage factors to obtain the storage method; the storage factors include: storage resource status, node load, network latency, historical access frequency, and estimated data lifecycle; the storage method includes replication-based, erasure coding, or hierarchical hot and cold distribution mechanisms.

[0244] SS13. Based on the aforementioned data block set, create an encrypted index;

[0245] Each index entry records metadata such as the unique identifier of the data block, encryption key version, distribution of its owning nodes, replica status, access permission tags, and lifecycle markers. These indexes are stored encrypted and synchronized to the index control cluster via a distributed consistency protocol to ensure consistency and fast retrieval capabilities. The index itself does not contain plaintext paths or data digests, structurally protecting against metadata leakage.

[0246] SS14. Based on the storage method and the encrypted index, the scheduling module initiates the node allocation mechanism to dynamically map each data block to multiple storage nodes;

[0247] SS15. Verify the integrity of the written data through hash verification to obtain the first verification result; determine whether a write confirmation and digest signature are returned from the remote node to obtain the second verification result.

[0248] When both the first and second verification results are yes, the data block is marked as having been written; otherwise, the node replacement and data retransmission mechanism is triggered, and the relevant behavior is recorded in the security log for auditing.

[0249] SS16. Generate corresponding metadata digests based on the structure and purpose of the data blocks and write them into the distributed metadata repository.

[0250] This repository supports version control, access control, and rapid rollback, ensuring a complete data and timeline during system recovery, migration, or compliance checks. The entire encrypted distributed storage process not only builds a zero-trust isolation system for data at the storage layer but also provides structural support for subsequent security testing, access scheduling, and compliance auditing.

[0251] In yet another optional embodiment, marking the encrypted data as secure includes:

[0252] SS21. The system will dynamically generate a unique security credential, such as a cryptographic hash label or a lightweight digital signature, for the verified data stream. This credential is transmitted to the downstream module along with the original data and feature vector as the basis for exemption from inspection.

[0253] SS22: The security status is written to a real-time status table in the in-memory database, and microsecond-level status retrieval is achieved through key-value mapping to avoid computational waste caused by repeated detection.

[0254] SS23. To ensure traceability, the system automatically generates lightweight audit logs, which only record key metadata of security tags (such as timestamps, data source IDs, detection model versions, and confidence scores). Audit capabilities are decoupled from the main process by asynchronously writing to the log service.

[0255] SS24. For scenarios requiring long-term retention, security tags will trigger low-priority compressed storage, packaging the original data, feature vectors, and security credentials into a columnar storage format and archiving them to cold storage, such as HDFS or cloud object storage, which satisfies business requirements while avoiding the occupation of real-time processing resources.

[0256] SS25. Data branches marked as safe will be prioritized for routing to high-throughput channels and delivered directly to the data warehouse or visualization system.

[0257] In another optional embodiment, the step of handling the hazard based on the confidence score to obtain a hazard assessment result includes:

[0258] S51. Execute the hazard response strategy based on the confidence score;

[0259] S52. The false alarm rate is calculated using the false alarm rate model. The false alarm rate represents the proportion of a response that is identified as abnormal but is later confirmed as normal by human intervention.

[0260] The false alarm rate model expression is as follows:

[0261]

[0262] In the formula, FP represents the number of response errors, and TN represents the number of correct responses;

[0263] S53. Calculate the blocking success rate using the blocking success rate model, whereby the blocking success rate represents the proportion of accurate blocking of real abnormal flows;

[0264] The expression for the blocking success rate model is:

[0265]

[0266] In the formula, Indicates the number of successfully blocked connections; Indicates the total number of blocks;

[0267] S54. Calculate the business capability degradation ratio using the business capability degradation ratio model;

[0268] The expression for the business capability degradation ratio model is:

[0269] ;

[0270] S55. Obtain the response delay and the penalty for accidental injury; the response delay This indicates the time elapsed from the detection trigger to the response completion of the strategy; false positive penalty. This indicates that the negative impact of false alarms on business and user experience is quantified;

[0271] S56. Integrate the false alarm rate, blocking success rate, service capability degradation ratio, response latency, and false alarm penalty to obtain the risk assessment result;

[0272] The hazard assessment results are expressed as follows:

[0273]

[0274] Among them, subscript t Indicates time, This indicates transpose.

[0275] The specific danger response strategy includes:

[0276] When the anomaly detection engine determines that a certain data window contains high-risk feature vectors (such as exceeding dynamic thresholds or model confidence levels), When this occurs, the system immediately activates a multi-level response strategy, forming a "detection" mechanism. contain Evidence collection The automated defense loop of "repair" is not executed linearly, but rather dynamically combines response actions based on threat graph analysis;

[0277] S511, Real-time Dynamic Containment

[0278] At the load balancing layer, such as when using Nginx, scripts can be injected to implement micro-segmentation of abnormal data source IPs, discarding attack packets and allowing legitimate traffic.

[0279] Resource circuit breaking strategies use container cluster management tools such as Kubernetes to adjust the CPU quota of abnormal containers or nodes in real time, limiting the resource brute-force attacks by malicious processes.

[0280] The credential freezing policy involves revoking the token and broadcasting the revocation to all service nodes if an abnormally associated authentication credential, such as a JWT token, is encountered.

[0281] S512, Deep Forensics and Attack Chain Reconstruction

[0282] When the anomaly detection engine triggers a high-risk alert, the system immediately enters the deep forensics and attack chain reconstruction process, achieving threat insight through a three-layered, interconnected technology stack:

[0283] At the physical layer, a memory pool is used to capture raw data packets, process memory snapshots, and feature vectors with zero loss, and the attack scene is solidified in binary format.

[0284] At the logic layer, historical attack characteristics are automatically associated to accurately pinpoint the attacker's complete chain from initial intrusion to lateral movement.

[0285] In the dynamic verification layer, abnormal data streams are injected into a lightweight sandbox environment. By hooking system call sequences and network behaviors, a behavioral analysis report containing process trees, file operations, and cross-host communication is generated, providing attack evidence for remediation strategies.

[0286] S513, Adaptive Repair Strategy

[0287] The forensic findings directly drive the precise execution of adaptive remediation strategies, the core of which lies in combining remediation actions as needed while ensuring business continuity. For vulnerability exploitation threats, hot-injection of programs replaces vulnerable functions in real time, achieving seamless remediation. In the face of data leakage risks, a memory-level AES-256 encryption engine is immediately triggered to seal sensitive data, and the key management service performs millisecond-level rotation. When encountering resource abuse attacks, an AI-powered elastic controller dynamically adjusts resource quotas while isolating hijacked service node processes. All remediation actions are atomically executed through a distributed transaction coordinator, ensuring consistency across systems such as network isolation, resource circuit breaking, and data encryption, and automatically rolling back to a secure state in case of failure.

[0288] In yet another optional embodiment, the step of optimizing the parameters of the detection engine and generating logs based on the hazard assessment results includes:

[0289] S61. The risk assessment results are processed using a comprehensive reward model to obtain an immediate reward value; the immediate reward value represents the reward obtained by the system based on the actual effect after executing the response strategy at time t.

[0290] The expression for the comprehensive reward model is:

[0291]

[0292] in, This is a positive incentive term, representing the proportion of successful interception of real attack behaviors; This is a false alarm penalty item, representing the proportion of normal data that is mistakenly identified as abnormal; For business impact items, this indicates the percentage of business downgrade impact. This is for the cost of accidental injury. , , , The weighting coefficient for the corresponding indicator indicates the importance of that item to system security.

[0293] S62. Optimize the parameters of the detection engine using the instant reward value and generate logs.

[0294] It should be noted that, in order to improve the adaptability and stability of the detection system in real-world operating environments, this invention introduces a reinforcement learning-driven feedback optimization mechanism. To address the problem that traditional models struggle to adapt to changes in attack strategies, this reinforcement learning-driven feedback optimization mechanism enables the detection system to possess continuous learning and self-optimization capabilities.

[0295] Feedback signal acquisition

[0296] The system uses the manual response actions of security administrators (such as "confirm anomaly", "mark as false alarm", "ignore") as the core reward signal, and combines the subsequent impact of the business system, such as the loss control situation after confirming the anomaly, to calculate the immediate reward value as an auxiliary signal, thus constructing a complete feedback data system.

[0297] Strengthen learning optimization mechanism

[0298] A reinforcement learning sequence is constructed based on "current detection feature state - model adjustment action - feedback reward," and the detection policy network is trained using the proximal policy optimization (PPO) algorithm. This network dynamically adjusts the parameter weights of each sub-model, the threshold of the rule engine, and the detection threshold, enabling the system to gradually learn new risk patterns and behavioral change trends, continuously optimizing detection performance.

[0299] Model dynamic update

[0300] An online retraining mechanism is established, whereby the system periodically updates the training sample library based on newly collected labeled data (including abnormal samples reported by humans) and normal behavior data, and incrementally trains the model. Simultaneously, it supports model version management and canary releases to ensure that the update process does not affect normal business operations.

[0301] Example 2

[0302] Please see Figure 2 , Figure 2 This is a schematic diagram of a data security management device based on dynamic encryption and real-time anomaly detection disclosed in an embodiment of the present invention; this embodiment provides a data security management device based on dynamic encryption and real-time anomaly detection, such as... Figure 2 As shown, the device includes:

[0303] The second aspect of this invention discloses a data security management device based on dynamic encryption and real-time anomaly detection, employing the data security management method based on dynamic encryption and real-time anomaly detection disclosed in the first aspect of this invention. The device includes:

[0304] Data acquisition module 201 is used to acquire data from diverse data sources and obtain standard data;

[0305] Data encryption module 202 is used to dynamically encrypt the standard data to obtain encrypted data;

[0306] The data feature extraction module 203 is used to extract features from the encrypted data to obtain data stream features;

[0307] The anomaly detection module 204 uses a detection engine to perform anomaly detection processing on the data stream features to obtain detection results and confidence scores.

[0308] The hazard assessment module 205 is used to handle hazards based on the confidence score and obtain hazard assessment results; the hazard assessment results include false alarm rate, blocking success rate and changes in environmental conditions;

[0309] The optimization and log generation module 206 is used to optimize the parameters of the detection engine and generate logs based on the hazard assessment results.

[0310] This second embodiment is a product-type embodiment corresponding to the data security management method based on dynamic encryption and real-time anomaly detection disclosed in the first embodiment. It adopts the same implementation scheme as the data security management method based on dynamic encryption and real-time anomaly detection disclosed in the first embodiment, and the specific implementation steps will not be repeated.

[0311] Example 3

[0312] Please see Figure 3 , Figure 3 This is a schematic diagram of another data security management device based on dynamic encryption and real-time anomaly detection disclosed in an embodiment of the present invention; Embodiment 3 discloses yet another data security management device based on dynamic encryption and real-time anomaly detection, such as... Figure 3 As shown, the device includes:

[0313] Memory containing executable program code;

[0314] A processor coupled to the memory;

[0315] The processor calls the executable program code stored in the memory to execute the data security management method based on dynamic encryption and real-time anomaly detection disclosed in Embodiment 1.

[0316] Through the detailed description of the above embodiments, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, including read-only memory (ROM), random access memory (RAM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), one-time programmable read-only memory (OTPROM), electrically-Erasable Programmable Read-Only Memory (EEPROM), compact disc read-only memory (CD-ROM) or other optical disc storage, disk storage, magnetic tape storage, or any other computer-readable medium that can be used to carry or store data.

[0317] Finally, it should be noted that the data security management method and apparatus based on dynamic encryption and real-time anomaly detection disclosed in the embodiments of the present invention are merely preferred embodiments of the present invention and are only used to illustrate the technical solutions of the present invention, not to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A data security management method based on dynamic encryption and real-time anomaly detection, characterized in that, The method includes: S1. Obtain standard data from diverse data sources; S2. Dynamically encrypt the standard data to obtain encrypted data; S3. Extract features from the encrypted data to obtain data stream features; S4. Using a detection engine, perform anomaly detection processing on the data stream features to obtain detection results and confidence scores; the detection results are either normal or abnormal; the detection engine includes: a statistical feature modeling module, a sequence modeling module, and a graph structure detection module; When the detection result is normal, the encrypted data is stored in the distributed node and marked as secure, and step S1 is executed; If the detection result is abnormal, proceed to step S5; S5. Based on the confidence score, the hazard is addressed to obtain the hazard assessment result; S6. Based on the hazard assessment results, optimize the parameters of the detection engine and generate logs.

2. The data security management method based on dynamic encryption and real-time anomaly detection according to claim 1, characterized in that, The process of obtaining standardized data from diverse data sources includes: S11. Obtain raw data from diverse data sources; S12. Standardize the raw data to obtain standard data.

3. The data security management method based on dynamic encryption and real-time anomaly detection according to claim 1, characterized in that, The process of dynamically encrypting the standard data to obtain encrypted data includes: S21. Generate an encryption key based on a timestamp; S22. Encrypt the standard data using the encryption key to obtain encrypted data; S23. At preset time intervals, the risk weight is calculated using a rotating trigger weight function. The expression for the rotation trigger weight function is: in, Indicates risk weight; The complexity function of user behavior; This is a data access frequency function; For data sensitivity function; , , The weighting parameters are adjustable and satisfy... t represents time. S24. Determine whether the risk weight is greater than the set threshold, and obtain the first judgment result; If the first judgment result is yes, proceed to step S25; otherwise, proceed to step S23. S25. Based on a preset set of encryption algorithms, a rotating encryption algorithm is obtained by using an encryption algorithm selection function for calculation. The expression for the encryption algorithm selection function is: in, This represents the calculated rotation encryption algorithm. This is the set of currently available encryption algorithms; This represents the algorithm's fit to the current data type. The current security rating of the algorithm; This represents the current computational complexity of the algorithm. S26. Generate an updated encryption key using the rotation encryption algorithm and execute step S22.

4. The data security management method based on dynamic encryption and real-time anomaly detection according to claim 1, characterized in that, The step of extracting features from the encrypted data to obtain data stream features includes: S31. Perform feature preprocessing on the encrypted data to obtain a first data stream; S32. The first data stream is segmented to obtain a data window sequence; S33. Using a feature extraction model, feature extraction is performed on the data window sequence to obtain data stream features; The feature extraction model expression is: In the formula, W represents the size of the data window; This represents the i-th data point in the window; Indicates data points Feature extraction function; This represents the time decay factor, which controls the rate at which past data decays. This represents the weight assigned to each data point.

5. The data security management method based on dynamic encryption and real-time anomaly detection according to claim 1, characterized in that, The process of using a detection engine to perform anomaly detection on the streaming data features, obtaining detection results and confidence scores, includes: S41. Using the statistical feature modeling module, the data stream features are processed to obtain the deviation degree; the deviation degree characterizes the degree of deviation of the current behavior. S42. Using the sequence modeling module, the data streaming features are processed to obtain the contextual correlation degree; the contextual correlation degree represents long-term dependencies and contextual anomalies. S43. Using the graph structure detection module, the data stream features are processed to obtain attack behavior values; the attack behavior values ​​characterize the strength of complex attack behaviors. S44. Process the deviation, contextual relevance, and attack behavior values ​​to obtain the detection results and confidence scores.

6. The data security management method based on dynamic encryption and real-time anomaly detection according to claim 1, characterized in that, The process of handling the hazard based on the confidence score to obtain a hazard assessment result includes: S51. Execute the hazard response strategy based on the confidence score; S52. Calculate the response false alarm rate using the false alarm rate model; The false alarm rate model expression is as follows: In the formula, FP represents the number of response errors, and TN represents the number of correct responses; S53. Calculate the blocking success rate using the blocking success rate model; The expression for the blocking success rate model is: In the formula, Indicates the number of successfully blocked connections; Indicates the total number of blocks; S54. Calculate the business capability degradation ratio using the business capability degradation ratio model; The expression for the business capability degradation ratio model is: ； S55. Obtain the response delay and the penalty for accidental injury; the response delay This indicates the time elapsed from the detection trigger to the response completion of the strategy; false positive penalty. This indicates that the negative impact of false alarms on business and user experience is quantified; S56. Integrate the false alarm rate, blocking success rate, service capability degradation ratio, response latency, and false alarm penalty to obtain the risk assessment result; The hazard assessment results are expressed as follows: Among them, subscript t Indicates time, This indicates transpose.

7. The data security management method based on dynamic encryption and real-time anomaly detection according to claim 6, characterized in that, The step of optimizing the parameters of the detection engine based on the hazard assessment results and generating logs includes: S61. The risk assessment results are processed using a comprehensive reward model to obtain an immediate reward value; the immediate reward value represents the reward obtained by the system based on the actual effect after executing the response strategy at time t. The expression for the comprehensive reward model is: in, This is a positive incentive term, representing the proportion of successful interception of real attack behaviors; This is a false alarm penalty item, representing the proportion of normal data that is mistakenly identified as abnormal; For business impact items, this indicates the percentage of business downgrade impact. This is for the cost of accidental injury. , , , The weighting coefficient for the corresponding indicator indicates the importance of that item to system security. S62. Optimize the parameters of the detection engine using the instant reward value and generate logs.

8. A data security management device based on dynamic encryption and real-time anomaly detection, characterized in that, The data security management method based on dynamic encryption and real-time anomaly detection as described in any one of claims 1-7, wherein the apparatus comprises: The data acquisition module is used to acquire data from diverse data sources and obtain standardized data. The data encryption module is used to dynamically encrypt the standard data to obtain encrypted data; The data feature extraction module is used to extract features from the encrypted data to obtain data stream features; The anomaly detection module uses a detection engine to perform anomaly detection processing on the data stream features to obtain detection results and confidence scores. The hazard assessment module is used to handle hazards based on the confidence score and obtain hazard assessment results; the hazard assessment results include false alarm rate, blocking success rate, and changes in environmental conditions; The optimization and log generation module is used to optimize the parameters of the detection engine and generate logs based on the hazard assessment results.

9. A data security management device based on dynamic encryption and real-time anomaly detection, characterized in that, The device includes: Memory containing executable program code; A processor coupled to the memory; The processor calls the executable program code stored in the memory to execute the data security management method based on dynamic encryption and real-time anomaly detection as described in any one of claims 1-7.

Images