Information security intelligent protection method

Abstract

The invention discloses an information security intelligent protection method. The method comprises the following steps: generating a user behavior DNA vector based on a CNN-LSTM hybrid model of an attention mechanism and user operation behavior data; constructing an equipment uniqueness fingerprint model by using a multi-modal residual image convolutional network, and acquiring an equipment credibility score by using the hardware configuration parameters, the software environment data, the network features, the sensor calibration parameters and the equipment uniqueness fingerprint model; performing environment hierarchical risk assessment based on the abnormal feature fusion data of the multi-modal sensor to obtain an environment risk level; and determining an information security comprehensive risk level, and dynamically adjusting the user authentication strength based on the information security comprehensive risk level to realize information security intelligent protection. According to the method, the user behavior DNA vector, the equipment credibility score and the environmental danger level are jointly used as an evaluation basis of information security beforehand prevention, a comprehensive and associated early-stage judgment basis is provided for information security protection, and intelligent beforehand protection of information security is realized.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and specifically to an intelligent information security protection method. Background Technology

[0002] With the rapid development of information technology and the widespread application of the Internet, information security issues have become increasingly prominent. Traditional security protection methods mostly rely on static authentication mechanisms (such as passwords, fingerprints, facial recognition, etc.), which are insufficient to cope with increasingly complex network attacks and identity theft. Especially in the context of remote work and the widespread use of mobile terminals, the diversity of user operations has increased, the types of devices are complex, and the network environment is changeable. Relying on single-factor authentication is no longer sufficient to meet the current security protection needs.

[0003] While existing technologies employ methods based on user behavior analysis, device fingerprinting, or environmental risk assessment, most rely on isolated security assessment dimensions, failing to achieve deep fusion of multimodal information and dynamic risk assessment. For example, some solutions focus solely on user behavior characteristics, neglecting the trustworthiness of the device itself; others generate fingerprints based solely on device hardware information, lacking comprehensive utilization of software environment, network characteristics, and sensor data. Furthermore, environmental risk assessments are often limited to the network layer, failing to conduct layered analysis and fusion judgments from multiple dimensions such as the device layer, network layer, and physical layer, resulting in incomplete risk assessments and untimely responses.

[0004] Therefore, there is an urgent need for an intelligent information security protection method that can integrate multi-dimensional information such as user behavior, device status and environmental risks, and dynamically adjust the authentication strength, so as to improve the system's proactive defense capabilities and user experience. Summary of the Invention

[0005] In view of the above-mentioned shortcomings in the prior art, the present invention provides an intelligent information security protection method.

[0006] To achieve the above-mentioned objectives, the technical solution adopted by this invention is as follows: An intelligent information security protection method includes the following steps: Collect user operation behavior data, and generate user behavior DNA vectors based on the attention mechanism of the CNN-LSTM hybrid model and user operation behavior data; Collect hardware configuration parameters, software environment data, network features, and sensor calibration parameters; construct a unique fingerprint model for the device using a multimodal residual graph convolutional network; and obtain a device trust score using the hardware configuration parameters, software environment data, network features, sensor calibration parameters, and the unique fingerprint model. Acquire multimodal sensor data, perform anomaly detection on the multimodal sensor data to obtain multimodal sensor anomaly feature data, fuse the multimodal sensor anomaly feature data to obtain multimodal sensor anomaly feature fusion data, and perform environmental stratification hazard assessment based on the multimodal sensor anomaly feature fusion data to obtain the environmental hazard level. The comprehensive information security risk level is determined based on user behavior DNA vectors, device trust scores, and environmental hazard levels. The user authentication strength is then dynamically adjusted based on the comprehensive information security risk level to achieve intelligent information security protection.

[0007] Furthermore, the attention mechanism CNN-LSTM hybrid model includes an input layer, a CNN feature extraction layer, an LSTM sequence modeling layer, an attention mechanism layer, a feature fusion layer, and an output layer connected in sequence; the output of the CNN feature extraction layer is also connected to the input of the feature fusion layer. The input layer is used to input user action data; The CNN feature extraction layer is used to extract features from user action behavior data to obtain user action behavior feature vectors; The LSTM sequence modeling layer is used to model the sequence features of user operation behavior feature vectors to obtain the sequence features of user operation behavior. The attention mechanism layer is used to selectively weight the user operation line sequence features to obtain weighted features of user operation behavior; The feature fusion layer is used to fuse user operation behavior feature vectors and user operation behavior features to obtain fused user operation behavior features, and generate user behavior DNA vectors based on the fused user operation behavior features. The output layer is used to output the user behavior DNA vector.

[0008] Furthermore, the device unique fingerprint model includes a hardware feature extractor, a software feature extractor, a network feature extractor, a sensor feature extractor, a multimodal feature fusion layer, a graph convolutional layer, a residual attention module, a channel attention module, a spatial attention module, a device fingerprint vector generation layer, and a device trust score output layer. The hardware feature extractor, software feature extractor, network feature extractor, and sensor feature extractor are connected in parallel, and the outputs of the hardware feature extractor, software feature extractor, network feature extractor, and sensor feature extractor are all connected to the input of the multimodal feature fusion layer. The output of the multimodal feature fusion layer is simultaneously connected to the input of the graph convolutional layer and the input of the residual attention module. The output of the graph convolutional layer is connected to the input of the residual attention module. The output of the residual attention module is connected to the input of the channel attention module. The output of the channel attention module is connected to the input of the spatial attention module. The output of the spatial attention module is connected to the input of the device fingerprint vector generation layer. The output of the device fingerprint vector generation layer is connected to the input of the device trust score output layer.

[0009] Furthermore, the expression for the channel attention module is:

[0010] in: For the output of the channel attention module, It is the sigmoid activation function. This is the weight matrix of the second fully connected layer. It is the ReLU activation function. This is the weight matrix of the first fully connected layer. This represents the total number of channel positions in the feature map. For the channel attention module in the first Input of each channel position, For Hadama accumulation, This is the input for the channel attention module.

[0011] Furthermore, the expression for the spatial attention module is:

[0012] in: This is the output of the spatial attention module. It is the sigmoid activation function. For convolution operations, To take the sign of the maximum value, This serves as the input for the spatial attention module. This represents the total number of spatial locations in the feature map. For the spatial attention module in the first Input of a spatial location, For Hadama accumulation. Furthermore, the expression for the device trust score output layer is:

[0013] in: For the first Trust rating for each device For equipment sets, For the first Fingerprint vector of a device For the first The fingerprint vector of each device.

[0014] Furthermore, an environmental hazard assessment is performed based on multimodal sensor anomaly feature fusion data to obtain the environmental hazard level. The specific process is as follows: Based on the multimodal sensor anomaly feature fusion data, equipment layer hazard assessment, network layer hazard assessment and physical layer hazard assessment are performed sequentially to obtain equipment layer hazard score, network layer hazard score and physical layer hazard score respectively. The equipment layer hazard score, network layer hazard score and physical layer hazard score are weighted and summed to obtain a comprehensive environmental hazard score. The comprehensive environmental hazard score is then normalized to obtain the environmental hazard level.

[0015] The beneficial effects of this invention are as follows: (1) This invention constructs a multi-dimensional comprehensive risk assessment mechanism by combining user behavior DNA vectors, device trust scores and environmental hazard levels, which significantly reduces the false identification rate and the risk of impersonation, and enhances the overall security of the system; (2) This invention dynamically adjusts the authentication method and strength based on the comprehensive information security risk level assessed in real time, which not only ensures strict authentication in high-risk scenarios, but also avoids frequent disturbance to users in low-risk scenarios, thereby improving the user experience. (3) This invention extracts user behavior features by using a CNN-LSTM hybrid model with attention mechanism and constructs device fingerprints by combining a multimodal residual graph convolutional network, which effectively resists imitation attacks, device forgery and abnormal environment intrusion, and improves the robustness of the system. (4) This invention achieves layered risk assessment from the device layer, network layer to the physical layer by performing anomaly detection and fusion of multimodal sensor data, and comprehensively covers possible sources of security threats. Attached Figure Description

[0016] Figure 1 This is a flowchart illustrating an intelligent information security protection method. Detailed Implementation

[0017] The specific embodiments of the present invention are described below to enable those skilled in the art to understand the present invention. However, it should be understood that the present invention is not limited to the scope of the specific embodiments. For those skilled in the art, various changes are obvious as long as they are within the spirit and scope of the present invention as defined and determined by the appended claims. All inventions utilizing the concept of the present invention are protected.

[0018] like Figure 1 As shown, an intelligent information security protection method includes steps S1-S4, as detailed below: S1. Collect user operation behavior data, and generate user behavior DNA vectors based on the attention mechanism of the CNN-LSTM hybrid model and user operation behavior data.

[0019] In an optional embodiment of the present invention, the attention mechanism CNN-LSTM hybrid model includes an input layer, a CNN feature extraction layer, an LSTM sequence modeling layer, an attention mechanism layer, a feature fusion layer, and an output layer connected in sequence; the output of the CNN feature extraction layer is also connected to the input of the feature fusion layer. The input layer is used to input user action data.

[0020] Specifically, user action data includes keystroke rhythm, mouse trajectory, and environmental context (GPS location, device ID, network environment, timestamp). User action data X ∈ R^(n×d), where R is a real number, n is the total number of user action sequences, and d is the feature dimension.

[0021] The CNN feature extraction layer is used to extract features from user action behavior data to obtain user action behavior feature vectors.

[0022] The data processing procedure for the CNN feature extraction layer is as follows: Conv1D(filters=64, kernel_size=3) → ReLU → MaxPooling1D Conv1D(filters=128, kernel_size=3) → ReLU → MaxPooling1D

[0023] Where: Conv1D is a 1D convolutional layer, filters is the number of convolutional kernels, kernel_size is the kernel size, ReLU is the ReLU activation function, and MaxPooling1D is a 1D pooling layer. The output of the CNN feature extraction layer is the user action behavior feature vector. It is the sigmoid activation function. This is the weight matrix of the CNN feature extraction layer. These are the bias coefficients of the CNN feature extraction layer. For user behavior data.

[0024] The LSTM sequence modeling layer is used to model the sequence features of user operation behavior feature vectors in order to obtain the sequence features of user operation behavior.

[0025] The data processing procedure for the LSTM sequence modeling layer is as follows: LSTM(units=256, return_sequences=True) LSTM(units=128, return_sequences=False)

[0026] Where: units is the number of neurons, return_sequences indicates whether to return the complete sequence, True indicates confirming the return of the complete sequence, False indicates confirming the absence of the complete sequence. The output of the LSTM sequence modeling layer is the sequence features of user operation behavior.

[0027] The attention mechanism layer is used to selectively weight the user operation line sequence features to obtain weighted features of user operation behavior.

[0028] The expression for the attention mechanism layer is:

[0029]

[0030] in: For the output of the attention mechanism, for Activation function Here is the weight matrix for the attention mechanism. The output of the LSTM sequence modeling layer with attention mechanism.

[0031] The feature fusion layer is used to fuse user operation behavior feature vectors and user operation behavior features to obtain fused user operation behavior features, and generate user behavior DNA vectors based on the fused user operation behavior features.

[0032] The expression for the feature fusion layer is:

[0033]

[0034] in: Integrate user operation behavior features For concatenation functions, This is the output of the convolutional layer. This is a DNA vector for user behavior.

[0035] The output layer is used to output the user behavior DNA vector.

[0036] S2. Collect hardware configuration parameters, software environment data, network features and sensor calibration parameters, construct a unique fingerprint model of the device using a multimodal residual graph convolutional network, and obtain the device trust score using hardware configuration parameters, software environment data, network features and sensor calibration parameters and the unique fingerprint model of the device.

[0037] In an optional embodiment of the present invention, the device unique fingerprint model includes a hardware feature extractor, a software feature extractor, a network feature extractor, a sensor feature extractor, a multimodal feature fusion layer, a graph convolutional layer, a residual attention module, a channel attention module, a spatial attention module, a device fingerprint vector generation layer, and a device trust score output layer. The hardware feature extractor, software feature extractor, network feature extractor, and sensor feature extractor are connected in parallel, and the outputs of the hardware feature extractor, software feature extractor, network feature extractor, and sensor feature extractor are all connected to the input of the multimodal feature fusion layer. The output of the multimodal feature fusion layer is simultaneously connected to the input of the graph convolutional layer and the input of the residual attention module. The output of the graph convolutional layer is connected to the input of the residual attention module. The output of the residual attention module is connected to the input of the channel attention module. The output of the channel attention module is connected to the input of the spatial attention module. The output of the spatial attention module is connected to the input of the device fingerprint vector generation layer. The output of the device fingerprint vector generation layer is connected to the input of the device trust score output layer.

[0038] The expression for the hardware feature extractor is:

[0039] in: This is the output of the hardware feature extractor. for Activation function This is the weight matrix of the hardware feature extractor. The bias coefficient of the hardware feature extractor. This refers to hardware configuration parameters, including CPU model, memory size, and storage capacity.

[0040] The expression for the software feature extractor is:

[0041] in: This is the output of the software feature extractor. For software feature extractors, The bias coefficient of the software feature extractor. This includes software environment data, such as operating system version, installed software, and patch information.

[0042] The expression for the network feature extractor is:

[0043] in: The output of the network feature extractor. This is the weight matrix of the network feature extractor. These are the bias coefficients of the network feature extractor. These are network characteristics, including IP address, MAC address, and network protocol stack.

[0044] The expression for the sensor feature extractor is:

[0045] in: The output of the sensor feature extractor This is the weight matrix of the sensor feature extractor. This represents the bias coefficient of the sensor feature extractor. The parameters for sensor calibration include temperature, humidity, and voltage.

[0046] The expression for the multimodal feature fusion layer is:

[0047]

[0048] in: For feature vectors of different layers, This is the output of the multimodal feature fusion layer. For layer normalization, This is the weight matrix of the multimodal feature fusion layer. represents the bias coefficient of the multimodal feature fusion layer.

[0049] The expression for a graph convolutional layer is:

[0050] in: The output of the graph convolutional layer, It is the sigmoid activation function. For degree matrix, It is an adjacency matrix. The weights of the graph convolutional layer are shown.

[0051] The expression for the residual attention module is:

[0052] in: This is the output of the residual attention module.

[0053] The expression for the channel attention module is:

[0054] in: For the output of the channel attention module, It is the sigmoid activation function. This is the weight matrix of the second fully connected layer. It is the ReLU activation function. This is the weight matrix of the first fully connected layer. This represents the total number of channel positions in the feature map. For the channel attention module in the first Input of each channel position, For Hadama accumulation, This is the input for the channel attention module.

[0055] The expression for the spatial attention module is:

[0056] in: This is the output of the spatial attention module. It is the sigmoid activation function. For convolution operations, To take the sign of the maximum value, This serves as the input for the spatial attention module. This represents the total number of spatial locations in the feature map. For the spatial attention module in the first Input of a spatial location, For Hadama accumulation. The expression for the device fingerprint vector generation layer is:

[0057] in: The output of the device fingerprint vector generation layer. The weight matrix for the device fingerprint vector generation layer. This represents the bias coefficient of the device fingerprint vector generation layer.

[0058] The expression for the device trust score output layer is:

[0059] in: For the first Trust rating for each device For equipment sets, For the first Fingerprint vector of a device For the first The fingerprint vector of each device.

[0060] S3. Acquire multimodal sensor data, perform anomaly detection on the multimodal sensor data to obtain multimodal sensor anomaly feature data, fuse the multimodal sensor anomaly feature data to obtain multimodal sensor anomaly feature fusion data, and perform environmental stratification hazard assessment based on the multimodal sensor anomaly feature fusion data to obtain the environmental hazard level.

[0061] In an optional embodiment of the present invention, the present invention performs environmental stratification hazard assessment based on multimodal sensor anomaly feature fusion data to obtain an environmental hazard level. The specific process is as follows: based on the multimodal sensor anomaly feature fusion data, equipment layer hazard assessment, network layer hazard assessment and physical layer hazard assessment are performed sequentially to obtain equipment layer hazard score, network layer hazard score and physical layer hazard score respectively. The equipment layer hazard score, network layer hazard score and physical layer hazard score are weighted and summed to obtain a comprehensive environmental hazard score. The comprehensive environmental hazard score is then normalized to obtain the environmental hazard level.

[0062] This invention acquires multimodal sensor data, including camera data, microphone data, and WiFi data.

[0063] This invention performs anomaly detection on multimodal sensor data to obtain multimodal sensor anomaly feature data. The specific process is as follows: using YOLOv8 to perform abnormal device detection on camera data to obtain camera anomaly feature data; performing spectral analysis and abnormal sound detection on microphone data to obtain microphone anomaly feature data; performing signal strength anomaly detection on WiFi data to obtain WiFi anomaly feature data; and obtaining multimodal sensor anomaly feature data based on camera anomaly feature data, microphone anomaly feature data, and WiFi anomaly feature data.

[0064] This invention, based on multimodal sensor anomaly feature fusion data, sequentially performs device-layer hazard assessment, network-layer hazard assessment, and physical-layer hazard assessment to obtain device-layer hazard scores, network-layer hazard scores, and physical-layer hazard scores, respectively, expressed as:

[0065]

[0066]

[0067]

[0068]

[0069] Among them: In device threat calculation, Device threat The device threat value is calculated by multiplying the overall threat level (Threat_level) obtained from the previous module by the camera-related threat value (camera). threat Microphone-related threat value threat Unknown device related threat value devicethreat The maximum value in the range (selected by the max operation) is obtained; in network threat calculation, Network... threat The network threat value is the overall threat level (Threat_level) multiplied by the individual network threat sub-items (DNS). spoofing For DNS spoofing threat value, Mani nmiddle The sum of the product of the man-in-the-middle attack threat value and the DDoS risk value, respectively, multiplied by their corresponding weight coefficients w1, w2, and w3; for physical threat calculation, Physical... threat The physical threat value is calculated by multiplying the overall threat level (Threat_level) by the sum of the individual physical threat sub-items (Surveillance). risk To monitor risk values, Eavesdropping risk For eavesdropping risk value, Shoulder surfing The sum is obtained by multiplying the shoulder-peeping risk value by the corresponding weight coefficients w1, w2, and w3 respectively.

[0070] This invention uses a weighted summation of equipment-layer hazard scores, network-layer hazard scores, and physical-layer hazard scores to obtain a comprehensive environmental hazard score. This comprehensive environmental hazard score is then normalized to obtain the environmental hazard level, expressed as:

[0071]

[0072] Among them: Environment threat The environmental threat value is represented by the device threat value. threat Multiply by coefficient α, Network Threat Value threat Multiply by a coefficient β, Physical Threat Value threatMultiply by the coefficient γ, then add these three parts together to get the result; while Threat score The final threat score represents the Environmental Threat Value. threat The result obtained after applying the sigmoid function is that the sigmoid function can map the environmental threat value between 0 and 1, which can be used to intuitively reflect the degree of threat.

[0073] S4. Determine the comprehensive information security risk level based on user behavior DNA vector, device trust score and environmental hazard level, and dynamically adjust the user authentication strength based on the comprehensive information security risk level to achieve intelligent information security protection.

[0074] In an optional embodiment of the present invention, the present invention determines the comprehensive information security risk level based on user behavior DNA vectors, device trust scores, and environmental hazard levels. The specific process is as follows: Based on the user behavior DNA vector, it is matched with user behavior DNA vectors in the user behavior DNA vector library, the similarity between the two is calculated, and it is determined as the user behavior risk score. The user behavior risk score, device trust score, and environmental hazard level are standardized respectively, and the standardized user behavior risk score, device trust score, and environmental hazard level are weighted and fused to obtain the comprehensive information security risk score. A low threshold and a high threshold for the comprehensive information security risk score are set. It is determined whether the comprehensive information security risk score is less than or equal to the low threshold. If so, the comprehensive information security risk level is determined to be low risk; otherwise, it is further determined whether the comprehensive information security risk level is within the range of the low and high thresholds. If so, the comprehensive information security risk level is determined to be medium risk; otherwise, the comprehensive information security risk level is determined to be high risk.

[0075] This invention dynamically adjusts user authentication strength based on the comprehensive information security risk level to achieve intelligent information security protection, including steps S41-S42, as follows: S41. Construct a certification factor library, including basic factors, secondary factors, behavioral factors, and environmental factors; Basic factors include passwords, biometrics, and hardware tokens; secondary factors include SMS verification, email verification, and app push notifications; behavioral factors include behavioral verification, device fingerprints, and geolocation; and environmental factors include network verification, time windows, and device environment.

[0076] S42. Based on the authentication factor library and the comprehensive information security risk level, dynamically adjust the user authentication strength to achieve intelligent information security protection.

[0077] Step S42 includes the following steps: S421. Determine the basic authentication strength based on the comprehensive information security risk level, specifically as follows: When the overall risk level is ≤0.3, the basic certification intensity is Level 1, and single-factor certification is adopted; When 0.3 < Comprehensive Risk Level ≤ 0.6, the basic certification strength is Level 2, and two-factor certification is adopted; When 0.6 < Comprehensive Risk Level ≤ 0.8, the basic certification strength is Level 3, and multi-factor certification is adopted; When the overall risk level is greater than 0.8, the basic certification strength is level 4, and enhanced multi-factor certification is adopted.

[0078] S422. Adjust the basic certification strength based on operational sensitivity to obtain the final certification strength. The calculation formula is as follows: Final certification strength = Base certification strength × (1 + K × Operational sensitivity) Where: K is the weight of operational sensitivity.

[0079] Specifically, the sensitivity of operations is divided into the following levels according to different operation types: 0.1 for ordinary file access, 0.3 for system settings modification, 0.5 for sensitive data access, 0.7 for large-amount transfers, and 1.0 for system management operations.

[0080] S423. Determine the required combination of authentication factors based on the final authentication strength to achieve intelligent protection of information security.

[0081] When the final certification strength is ≤1.5, only the base factor needs to be used; When 1.5 < final certification strength ≤ 2.5, a combination of basic and secondary factors must be used; When 2.5 < final certification strength ≤ 3.5, a combination of basic factors, secondary factors, and behavioral factors must be used; When the final certification strength is greater than 3.5, a combination of all four factors must be used.

[0082] Those skilled in the art will recognize that the embodiments described herein are intended to help the reader understand the principles of the invention, and should be understood that the scope of protection of the invention is not limited to such specific statements and embodiments. Those skilled in the art can make various other specific modifications and combinations based on the technical teachings disclosed in this invention without departing from the spirit of the invention, and these modifications and combinations are still within the scope of protection of this invention.

Claims

1. An intelligent information security protection method, characterized in that, Includes the following steps: Collect user operation behavior data, and generate user behavior DNA vectors based on the attention mechanism of the CNN-LSTM hybrid model and user operation behavior data; Collect hardware configuration parameters, software environment data, network features, and sensor calibration parameters; construct a unique fingerprint model for the device using a multimodal residual graph convolutional network; and obtain a device trust score using the hardware configuration parameters, software environment data, network features, sensor calibration parameters, and the unique fingerprint model. Acquire multimodal sensor data, perform anomaly detection on the multimodal sensor data to obtain multimodal sensor anomaly feature data, fuse the multimodal sensor anomaly feature data to obtain multimodal sensor anomaly feature fusion data, and perform environmental stratification hazard assessment based on the multimodal sensor anomaly feature fusion data to obtain the environmental hazard level. The comprehensive information security risk level is determined based on user behavior DNA vectors, device trust scores, and environmental hazard levels. The user authentication strength is then dynamically adjusted based on the comprehensive information security risk level to achieve intelligent information security protection.

2. The intelligent information security protection method according to claim 1, characterized in that, The CNN-LSTM hybrid model with attention mechanism consists of an input layer, a CNN feature extraction layer, an LSTM sequence modeling layer, an attention mechanism layer, a feature fusion layer, and an output layer connected in sequence; the output of the CNN feature extraction layer is also connected to the input of the feature fusion layer. The input layer is used to input user action data; The CNN feature extraction layer is used to extract features from user action behavior data to obtain user action behavior feature vectors; The LSTM sequence modeling layer is used to model the sequence features of user operation behavior feature vectors to obtain the sequence features of user operation behavior. The attention mechanism layer is used to selectively weight the user operation line sequence features to obtain weighted features of user operation behavior; The feature fusion layer is used to fuse user operation behavior feature vectors and user operation behavior features to obtain fused user operation behavior features, and generate user behavior DNA vectors based on the fused user operation behavior features. The output layer is used to output the user behavior DNA vector.

3. The intelligent information security protection method according to claim 1, characterized in that, The device unique fingerprint model includes a hardware feature extractor, a software feature extractor, a network feature extractor, a sensor feature extractor, a multimodal feature fusion layer, a graph convolutional layer, a residual attention module, a channel attention module, a spatial attention module, a device fingerprint vector generation layer, and a device trust score output layer. The hardware feature extractor, software feature extractor, network feature extractor, and sensor feature extractor are connected in parallel, and the outputs of the hardware feature extractor, software feature extractor, network feature extractor, and sensor feature extractor are all connected to the input of the multimodal feature fusion layer. The output of the multimodal feature fusion layer is simultaneously connected to the input of the graph convolutional layer and the input of the residual attention module. The output of the graph convolutional layer is connected to the input of the residual attention module. The output of the residual attention module is connected to the input of the channel attention module. The output of the channel attention module is connected to the input of the spatial attention module. The output of the spatial attention module is connected to the input of the device fingerprint vector generation layer. The output of the device fingerprint vector generation layer is connected to the input of the device trust score output layer.

4. The intelligent information security protection method according to claim 3, characterized in that, The expression for the channel attention module is: in: For the output of the channel attention module, It is the sigmoid activation function. This is the weight matrix of the second fully connected layer. It is the ReLU activation function. This is the weight matrix of the first fully connected layer. This represents the total number of channel positions in the feature map. For the channel attention module in the first Input of each channel position, For Hadama accumulation, This is the input for the channel attention module.

5. The intelligent information security protection method according to claim 3, characterized in that, The expression for the spatial attention module is: in: This is the output of the spatial attention module. It is the sigmoid activation function. For convolution operations, To take the sign of the maximum value, This serves as the input for the spatial attention module. This represents the total number of spatial locations in the feature map. For the spatial attention module in the first Input of a spatial location, For Hadama accumulation.

6. The intelligent information security protection method according to claim 3, characterized in that, The expression for the device trust rating output layer is: in: For the first Trust rating for each device For equipment sets, For the first fingerprint vector of a device For the first The fingerprint vector of each device.

7. The intelligent information security protection method according to claim 1, characterized in that, Environmental hazard assessment based on multimodal sensor anomaly feature fusion data is performed to obtain the environmental hazard level. The specific process is as follows: Based on the multimodal sensor anomaly feature fusion data, equipment layer hazard assessment, network layer hazard assessment and physical layer hazard assessment are performed in sequence to obtain equipment layer hazard score, network layer hazard score and physical layer hazard score respectively. The equipment layer hazard score, network layer hazard score and physical layer hazard score are weighted and summed to obtain the comprehensive environmental hazard score. The comprehensive environmental hazard score is then normalized to obtain the environmental hazard level.

Images