Data security protection method for software system

Abstract

The invention relates to the technical field of data security, in particular to a data security protection method for a software system, and the system monitors user behaviors in real time, dynamically adjusts an anomaly detection threshold value, accurately recognizes user behavior anomaly and triggers security response measures through user behavior analysis and data access mode recognition. And secondly, a dynamic encryption strength adjustment technology is adopted, and the data encryption strength is automatically improved or reduced according to the user behavior, the data sensitivity and the security risk assessment result, so that the security and the transmission efficiency of the data are ensured. Besides, the system stores all data operations and access records through a block chain technology, so that tampering resistance of audit logs is ensured, data integrity verification and traceability are supported, and transparency and traceability of data protection are improved. And finally, the system analyzes the safety condition in real time through an intelligent risk assessment and decision-making mechanism, dynamically adjusts the strength of protection measures, and ensures that the data is always optimally protected in different risk environments.

Description

Technical Field

[0001] This invention relates to the field of data security technology, and in particular to a data security protection method for a software system. Background Technology

[0002] With the rapid development of information technology, data security has become an increasingly important challenge for enterprises and users. Traditional data protection methods mainly focus on data storage encryption, access control, and network security. However, in the face of dynamically changing network environments and increasingly complex security threats, existing technical solutions face many limitations. Existing data security protection systems often fail to automatically adjust protection strategies according to actual security threats, leading to inadequate data protection in high-risk scenarios, and even serious security incidents such as data breaches and tampering. Therefore, there is a need to develop a software-based data security protection method. Summary of the Invention

[0003] To overcome the above deficiencies, this invention provides a data security protection method for software systems, aiming to improve the shortcomings of existing technologies in dynamic encryption strength adjustment, abnormal user behavior detection, audit log anti-tampering and traceability capabilities, as well as real-time risk assessment and decision adjustment. This invention provides the following technical solution: a data security protection method for a software system, comprising: S1. By analyzing users' access behavior and historical operation patterns in real time, a user behavior model is established, which is used to identify normal and abnormal access patterns. S2. Based on the analysis results of the user behavior model, dynamically adjust the encryption strength of the data; S3. Record all data access and modification behaviors to the blockchain to ensure the immutability and traceability of the data, encrypt the data recorded on the blockchain, regularly verify the data integrity, and trigger an alarm when an anomaly is detected; S4. Monitor user access behavior in real time and identify potential security threats through anomaly detection algorithms; S5. Automatically adjust data access permissions and encryption strategies based on anomaly detection results; S6. Record all data operations and abnormal responses to the blockchain to form a complete audit log; S7. The system performs automated risk assessments based on real-time behavioral data and security events, and automatically adjusts the protection level and response measures according to the assessment results to improve protection effectiveness. Preferably, the user behavior analysis and data access pattern recognition steps include: Collect user access data and build user behavior models to define users' regular access patterns; Real-time monitoring of user behavior, comparison of current access with the user's historical behavior model, and when the current behavior is detected to be inconsistent with the historical pattern, the cosine similarity algorithm is used to determine it as abnormal behavior; Based on changes in user behavior, the recognition thresholds in the behavior model are automatically adjusted to adapt to changes in user access patterns and improve the accuracy of abnormal behavior recognition. Preferably, dynamic encryption strength adjustment includes: When the analysis result of the user behavior model is an abnormal access pattern, the system analyzes the user's behavior pattern and determines whether the user's current behavior is consistent with historical behavior. If abnormal behavior is detected, the encryption strength will be increased. The encryption strength is automatically adjusted based on the sensitivity of the accessed data. For sensitive data, the encryption strength is automatically increased, while for ordinary data, the original encryption strength is maintained. Preferably, the blockchain record and data integrity protection steps include: Each data access and modification operation is recorded in the blockchain to generate an immutable operation log. The log includes the operation time, user ID, operation type, and the specific content of the data modification, ensuring the integrity and transparency of data operations. Each record stored in the blockchain is encrypted using symmetric or asymmetric encryption algorithms to ensure the security of the recorded data and the confidentiality of the data during storage and transmission. Regularly perform integrity checks on the data stored in the blockchain to verify whether the data has been tampered with. If an anomaly or data tampering is found, trigger an alarm and record the event for subsequent investigation and tracing. Preferably, the adaptive anomaly detection and response steps include: By monitoring user behavior in real time and using anomaly detection algorithms to analyze whether the current behavior deviates from the normal pattern, the system will mark abnormal behavior as a potential security threat when it is detected. Based on changes in user behavior, the system automatically updates and adjusts the user behavior model to adapt to new access patterns. The system continuously optimizes the model through machine learning algorithms to improve the accuracy and precision of anomaly detection. When abnormal behavior is detected, the system automatically triggers security response measures to prevent potential security risks. Preferably, the security policy adjustment and data protection steps include: Based on real-time security risk assessment results, the security strategy is automatically adjusted. If anomalies or potential threats are detected, the system will dynamically adjust the protection level. Based on the adjustment of security policies, user data access permissions will be reconfigured. For sensitive data, the system will restrict access permissions, allowing only authorized users to access it; for non-sensitive data, the system may appropriately relax access restrictions to improve efficiency. After the security policy is adjusted, the system automatically activates the data protection mechanism to ensure that the data is protected during storage and transmission, preventing data leakage or tampering. Preferably, the audit log update and tracing steps include: The system records audit logs in real time during each data access or operation to ensure that every data interaction process is fully recorded. The generated audit logs are encrypted and stored to prevent the log data from being tampered with during storage and transmission. The encryption uses symmetric or asymmetric encryption algorithms to ensure the integrity and confidentiality of the log data. The system can trace back to specific user behaviors and data operations through audit logs. When an abnormal event is detected, the system automatically traces the source of the event based on the logs and provides detailed event time, user information and operation content for subsequent investigation and processing. Preferably, the risk assessment and intelligent decision-making steps include: The system analyzes user behavior data, network traffic, and operation logs to assess potential security risks in real time and adjusts the strength of protective measures based on the assessment results. Based on the risk assessment results, the system automatically determines whether certain security measures need to be strengthened; Based on real-time security assessments, protective measures are automatically and dynamically adjusted to ensure that data is always optimally protected under different risk environments. The present invention has the following beneficial effects: 1. In this invention, by dynamically adjusting the encryption strength, the system can automatically increase or decrease the data encryption strength based on real-time changes in user behavior and data sensitivity. For users who frequently access sensitive data or exhibit abnormal behavior, the system can enhance data encryption protection in real time, effectively reducing the risk of data leakage and tampering. Simultaneously, in low-risk environments, the system can appropriately relax protection measures, optimize resource utilization, and improve overall system performance. This flexible protection mechanism greatly enhances the data's ability to withstand various security threats. 2. This invention integrates user behavior analysis and data access pattern recognition methods, enabling real-time monitoring of user access behavior and the establishment of a dynamically updated user behavior model. By comparing real-time behavior with historical patterns, the system can accurately identify abnormal behavior and trigger a timely security response. This mechanism effectively improves the accuracy of abnormal behavior identification, reduces false alarms or missed alarms, and helps the system respond quickly to potential security threats, thereby providing a higher level of security protection. 3. In this invention, by recording each data access and operation in the blockchain, an immutable audit log is generated, ensuring the integrity and transparency of data during storage and transmission. Even if data is tampered with or a security incident occurs, the system can accurately trace the source of each operation and its content through the audit log. Encrypted storage and regular integrity checks further ensure the security of the log data, supporting subsequent incident investigations and evidence preservation, and improving the system's traceability and credibility. Attached Figure Description Figure 1 This is a flowchart of a data security protection method for a software system proposed in this invention. Detailed Implementation The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention. Example 1 In a first embodiment of the present invention, the present invention provides a data security protection method for a software system, such as... Figure 1 As shown, it includes the following steps: S1. By analyzing users' access behavior and historical operation patterns in real time, a user behavior model is established. The user behavior model is used to identify normal and abnormal access patterns. Furthermore, the user behavior analysis and data access pattern recognition steps include: Collect user access data and build user behavior models to define users' regular access patterns; Real-time monitoring of user behavior, comparison of current access with user's historical behavior model, and use of cosine similarity algorithm to determine abnormal behavior when the current behavior does not match the historical pattern. Based on changes in user behavior, the recognition thresholds in the behavior model are automatically adjusted to adapt to changes in user access patterns and improve the accuracy of abnormal behavior recognition. Specifically, the system collects user access data in real time through background monitoring, including access time, frequency, device type, IP address, operation path, and specific data content accessed. This data is used to build user behavior models and define users' regular access patterns. The system analyzes the collected user behavior data, extracts access features using machine learning algorithms, and builds a behavior model for each user. The model includes the user's regular access patterns, typical access times, frequently used devices, and frequently accessed data types, ensuring it can describe the user's normal behavior. The system monitors each user access in real time and compares the real-time access behavior with the user's historical behavior model using a cosine similarity algorithm. By calculating the difference between the current behavior and the model, it determines whether it exceeds a set anomaly threshold. When the difference exceeds the threshold, the system classifies it as abnormal behavior. The criteria for anomalies include, but are not limited to, changes in access time, frequency, device, and content of the operation. The system dynamically adjusts its anomaly detection thresholds based on changes in user access patterns. For example, if a user's work hours change or their device is replaced, the system automatically updates the identification criteria in the model to adapt to the new behavioral patterns. This adjustment is performed through an automatic learning algorithm, ensuring the system can continuously adapt to changes in user behavior and improve the accuracy of anomaly detection. When the system detects abnormal behavior, it automatically triggers response measures, including enhanced authentication (such as SMS verification codes, fingerprint recognition, etc.), temporary restriction of data access permissions, or issuing an alert to the administrator. The strength of the system response is adjusted according to the severity of the anomaly. In this way, the system can not only accurately identify abnormal behavior, but also automatically adapt to changes in user behavior, improving the accuracy of abnormal behavior detection. At the same time, dynamically adjusting thresholds ensures the system's flexibility, reducing false alarms and false negatives, and enhancing security protection. S2. Dynamically adjust the encryption strength of the data based on the analysis results of the user behavior model; Furthermore, dynamic encryption strength adjustment includes: When the analysis result of the user behavior model is an abnormal access pattern, the system analyzes the user's behavior pattern and determines whether the user's current behavior is consistent with historical behavior. If abnormal behavior is detected, the encryption strength will be increased. The encryption strength is automatically adjusted based on the sensitivity of the accessed data. For sensitive data, the encryption strength is automatically increased, while for ordinary data, the original encryption strength is maintained. Specifically, the system monitors user behavior in real time, analyzes user access data, and compares it with historical behavior models. Then, the system uses machine learning algorithms to compare the user's current behavior with historical patterns. When the difference in behavior exceeds a set threshold, the system determines it as abnormal behavior. The system automatically adjusts the encryption strength of the data based on the type and sensitivity of the data accessed by the user. Sensitive data identification: The system categorizes data based on its sensitivity. For example, user financial information and personal identification information are marked as sensitive data, while regular queries or ordinary data are classified as non-sensitive data. Encryption strength adjustment: For sensitive data, the system increases encryption strength by employing more complex encryption algorithms, such as AES-256; for ordinary data, a lower encryption strength is used, such as AES-128. This process requires no user intervention and relies entirely on the system's intelligent recognition and dynamic adjustment. When the system detects abnormal user behavior, it automatically increases the encryption strength of all data accessed by that user to address potential security threats. The system automatically raises the encryption level of all data related to that user, regardless of its sensitivity, ensuring that the data is not easily decrypted by attackers during transmission and storage. The system updates its encryption strategy periodically or based on real-time data. By learning long-term changes in user behavior, the system can adjust encryption strength and strategies to adapt to evolving user behavior and ensure long-term data security. Through the above implementation steps, the system can intelligently and dynamically adjust the encryption strength based on user behavior patterns, data sensitivity, and anomaly detection results, ensuring that data maintains high security in different scenarios. This step reduces the need for manual intervention by automating the flexible adjustment of encryption strategies, while improving the overall security and responsiveness of the system. S3. Record all data access and modification behaviors to the blockchain to ensure the immutability and traceability of the data, encrypt the data recorded on the blockchain, regularly verify the data integrity, and trigger an alarm when an anomaly is detected; Furthermore, the blockchain record and data integrity protection steps include: Each data access and modification operation is recorded in the blockchain to generate an immutable operation log. The log includes the operation time, user ID, operation type, and the specific content of the data modification, ensuring the integrity and transparency of data operations. Each record stored in the blockchain is encrypted using symmetric or asymmetric encryption algorithms to ensure the security of the recorded data and the confidentiality of the data during storage and transmission. Regularly perform integrity checks on the data stored in the blockchain to verify whether the data has been tampered with. If an anomaly or data tampering is found, trigger an alarm and record the event for subsequent investigation and tracing. Specifically, the system automatically generates an operation record and writes it to the blockchain each time a data access or modification operation occurs. The record content includes: Operation time: Records the timestamp of data access or modification. User ID: Identifies the user performing the operation. Operation types: including read, modify, delete, and other operation types. Data modification details: Describe in detail the data that has been modified, such as the modified fields, the original values, and the new values. Each record is written into an immutable block, ensuring the integrity and transparency of data operations. Blockchain technology guarantees that records cannot be subsequently modified or deleted. To protect the security of data stored in the blockchain, the system encrypts each record to ensure confidentiality during storage and transmission. Depending on specific requirements, the system employs either symmetric or asymmetric encryption algorithms to encrypt the data. Symmetric encryption algorithms: such as AES (Advanced Encryption Standard). AES is a symmetric-key encryption algorithm that uses the same key for both encryption and decryption. AES supports different key lengths (128 bits, 192 bits, 256 bits), making it suitable for protecting the transmission and storage of large amounts of data, and providing efficient and powerful encryption capabilities. Asymmetric encryption algorithms: such as RSA or ECC (Elliptic Curve Cryptography). The RSA algorithm uses a pair of keys: a public key for encryption and a private key for decryption. RSA is typically used to encrypt small amounts of data or for key exchange. ECC (Elliptic Curve Cryptography) is a type of asymmetric encryption algorithm that provides higher security and shorter key lengths through the mathematical principles of elliptic curves, and is therefore frequently used in modern encryption applications for key exchange and digital signatures. Regardless of whether a symmetric or asymmetric encryption algorithm is used, the system encrypts the operation log before each data is written to the blockchain. This encryption ensures that even if blockchain data is leaked, malicious users cannot read the encrypted content. To ensure the immutability of records in the blockchain, the system periodically performs integrity checks on all data within the blockchain. This is done by calculating the hash value of the stored data and comparing it to the stored value in the blockchain to verify whether the data has been tampered with. The hash value is a fixed-length, unique output generated by processing the input data using a hash algorithm. If the check detects data tampering, the system will automatically trigger an alarm, log the event, and notify the administrator to investigate. All abnormal behavior is logged, supporting post-event traceability and auditing, ensuring data traceability and operational transparency. Through the above implementation steps, the system utilizes blockchain technology to achieve immutability and transparency in data operations. Each operation generates an encrypted record and stores it in the blockchain, ensuring data security, integrity, and confidentiality. Simultaneously, regular integrity checks and anomaly detection mechanisms provide continuous monitoring for data security, further enhancing the system's tamper-proof capabilities and data traceability. S4. Monitor user access behavior in real time and identify potential security threats through anomaly detection algorithms; Furthermore, the adaptive anomaly detection and response steps include: By monitoring user behavior in real time and using anomaly detection algorithms to analyze whether the current behavior deviates from the normal pattern, the system will mark abnormal behavior as a potential security threat when it is detected. Based on changes in user behavior, the system automatically updates and adjusts the user behavior model to adapt to new access patterns. The system continuously optimizes the model through machine learning algorithms to improve the accuracy and precision of anomaly detection. When abnormal behavior is detected, the system automatically triggers security response measures to prevent potential security risks. Specifically, the system first monitors user behavior in real time, collecting various data related to user access, such as access time, access frequency, access path, modified data types, and device information. The collected behavioral data will undergo preprocessing, including noise removal and missing value filling, to ensure data quality. The system analyzes user behavior data using algorithms such as IsolationForest, One-ClassSVM, or K-means clustering. IsolationForest: This algorithm isolates data points by constructing multiple decision trees. If a data point can be isolated in a minority of trees, it is considered an outlier. This algorithm is particularly suitable for processing high-dimensional data and can effectively identify anomalous behaviors that differ significantly from normal behavior patterns. One-ClassSVM: This algorithm finds the decision boundary of normal data in a high-dimensional space and determines whether the behavior deviates from the normal pattern based on this boundary. It detects potential abnormal behavior by learning the boundary of normal behavior without any abnormal labels. K-means clustering: This algorithm divides behavioral data into several clusters. If a data point is significantly distant from the center of its cluster, it is considered to represent anomalous behavior. K-means clustering is suitable for situations where user behavior is diverse, as it can group data and identify outliers that deviate from the majority of user behavior. By comparing the differences between the current user behavior and the historical behavior model using the above algorithm, when the difference between the detected behavior and the normal pattern exceeds the set threshold, the system determines it as abnormal behavior and marks the behavior as a potential security threat. By collecting new behavioral data, the system automatically adjusts the parameters of the existing behavioral model to reflect users' new behavioral habits. The system uses machine learning algorithms to continuously optimize the user behavior model, automatically identifying and learning new user access patterns, thereby improving the accuracy and precision of anomaly detection. When the system detects abnormal behavior, it immediately triggers corresponding security response measures to reduce potential security risks. For example, the system can immediately authenticate users exhibiting abnormal behavior or restrict their access permissions; at the same time, it can prevent abnormal access through multi-factor authentication or temporarily freezing user sessions. The detection and response process for abnormal behavior will be recorded in detail in the security audit log to ensure data traceability and support subsequent investigations and analysis. By monitoring user behavior in real time and applying anomaly detection algorithms, the system can identify behaviors that deviate from normal patterns and automatically mark them as potential security threats. Based on continuous changes in user behavior, the system automatically adjusts and optimizes its behavior model to improve the accuracy of anomaly detection. When the system detects abnormal behavior, it immediately triggers corresponding security response measures to ensure timely handling of potential threats and safeguard system security. S5. Automatically adjust data access permissions and encryption strategies based on anomaly detection results; Furthermore, security policy adjustments and data protection steps include: Based on real-time security risk assessment results, the security strategy is automatically adjusted. If anomalies or potential threats are detected, the system will dynamically adjust the protection level. Based on the adjustment of security policies, user data access permissions will be reconfigured. For sensitive data, the system will restrict access permissions, allowing only authorized users to access it; for non-sensitive data, the system may appropriately relax access restrictions to improve efficiency. After the security policy is adjusted, the system automatically activates the data protection mechanism to ensure that the data is protected during storage and transmission, preventing data leakage or tampering. Specifically, when the system detects abnormal behavior or potential threats, such as unusual access frequency or changes in sensitive data access patterns, it immediately triggers the security risk assessment unit. Based on the assessment results, the system automatically adjusts the protection level. For example, when the risk level increases, the system automatically raises the protection level and strengthens data protection measures. Based on real-time security risk assessments, the system dynamically adjusts user access permissions. For sensitive data, such as personal information and financial data, the system restricts access, allowing only authorized users to access it. For non-sensitive data, the system may appropriately relax access restrictions to improve work efficiency and avoid unnecessary waste of resources. After the security policy is adjusted, the system will automatically activate the corresponding data protection mechanism according to the new protection level. Encryption measures are applied to the stored data to ensure its security when stored at rest. During data transmission, the system uses TLS / SSL encryption protocols or other encryption technologies to ensure data transmission security and prevent data leakage or tampering during transmission. The system employs encryption and access control measures to ensure the confidentiality and integrity of data during storage and transmission. If unauthorized access or tampering of data is detected, the system will trigger an alarm and log the event, ensuring that data leaks or tampering can be traced in a timely manner. In the security policy adjustment and data protection steps, the system automatically adjusts the protection level and dynamically configures user access permissions by assessing security risks and abnormal behaviors in real time. Based on the adjusted security policy, the system activates the corresponding data protection mechanisms to ensure that data is adequately protected during storage and transmission, preventing data leakage or tampering. This process can flexibly adjust protection measures according to different risk scenarios, improving data security. S6. Record all data operations and abnormal responses to the blockchain to form a complete audit log; Furthermore, the audit log update and tracing steps include: The system records audit logs in real time during each data access or operation to ensure that every data interaction process is fully recorded. The generated audit logs are encrypted and stored to prevent the log data from being tampered with during storage and transmission. The encryption uses symmetric or asymmetric encryption algorithms to ensure the integrity and confidentiality of the log data. The system can trace back to specific user behaviors and data operations through audit logs. When an abnormal event is detected, the system automatically traces the source of the event based on the logs and provides detailed event time, user information and operation content for subsequent investigation and processing. Specifically, the system records relevant audit logs in real time every time a user accesses or performs a data operation. Each log entry includes key information such as the operation time, user ID, operation type, and the specific content of the operation data. This log data is automatically stored in secure storage media to ensure that the log records are complete and tamper-proof. To ensure log security, the system encrypts and stores generated audit logs. Encryption employs either symmetric or asymmetric algorithms to ensure the confidentiality and integrity of log data during storage and transmission. Encrypted logs can only be decrypted and accessed by authorized users or the system, thus preventing unauthorized access or tampering. The system can trace back specific user behaviors and data operations through audit logs. When the system detects abnormal events or security threats, the audit logs will provide detailed event time, user information, and operation content, helping the system quickly locate the source of the anomaly. Through audit logs, the system can perform event tracing, providing a complete operation trajectory to support subsequent security investigations and handling. When an abnormal event is detected, the system automatically traces the event back to its source based on the audit logs, identifying the executor and the specific actions performed. Through source tracing analysis of the logs, the system can provide administrators with detailed event reports, helping investigators quickly find the origin of the anomaly and the responsible parties. In the audit log update and tracing process, the system ensures log integrity and transparency by recording every data access and operation in real time. Log data is encrypted and stored to prevent tampering and unauthorized access. Through audit log backtracking and tracing, the system can provide detailed operational information when anomalies are detected, assisting administrators in subsequent investigations and security responses. S7. The system performs automated risk assessment based on real-time behavioral data and security events, and automatically adjusts the protection level and response measures according to the assessment results to improve protection effectiveness. Furthermore, the risk assessment and intelligent decision-making steps include: The system analyzes user behavior data, network traffic, and operation logs to assess potential security risks in real time and adjusts the strength of protective measures based on the assessment results. Based on the risk assessment results, the system automatically determines whether certain security measures need to be strengthened; Based on real-time security assessments, protective measures are automatically and dynamically adjusted to ensure that data is always optimally protected under different risk environments. Specifically, this method comprehensively assesses potential security risks by analyzing user behavior data, network traffic, and operation logs in real time. The system first collects user operation logs and network traffic data. Combining this with user access patterns, data operation types, and the amount of data transmitted, it uses machine learning algorithms to assess current security threats. Based on the risk assessment results, the system automatically decides whether to strengthen certain security measures, such as increasing data encryption strength, enabling two-factor authentication, or restricting access to certain sensitive data. If the assessment results indicate a low risk, the system will automatically reduce the protection level to optimize resource usage and system performance. Based on real-time security assessments, the system dynamically adjusts the strength of its protective measures to ensure optimal data protection under varying risk environments. When the system detects a potential threat, it automatically triggers enhanced protection measures, such as strengthening authentication requirements or enabling stricter encryption methods. In stable security situations, the system automatically relaxes protective measures to improve user experience and efficiency. The system also features continuous optimization capabilities, constantly monitoring user behavior and environmental changes to refine risk assessment and decision-making algorithms, ensuring the accuracy and efficiency of the intelligent decision-making mechanism and enhancing overall security capabilities. In the risk assessment and intelligent decision-making process, the system analyzes user behavior, network traffic, and operation logs in real time to evaluate potential security risks and adjusts the strength of protective measures based on the assessment results. The system dynamically adjusts the strength of protective measures according to different risk environments to ensure that data is always under optimal protection. Example 2: When user behavior patterns become abnormal, traditional systems cannot dynamically increase encryption strength, resulting in sensitive data not being adequately protected in high-risk environments. To address this issue, this invention provides a data security protection method for software systems, the structure of which is as follows: Figure 1 As shown. The specific implementation process of this system is as follows: The system collects user behavior data in real time, builds user behavior models, and compares them with historical data. When it detects that the current behavior does not match the historical pattern, the system triggers an anomaly alarm and dynamically adjusts the recognition threshold according to changes in user behavior, thereby improving the accuracy of anomaly detection. The system automatically adjusts the encryption strength based on real-time analysis of user behavior and data sensitivity. For sensitive data, the system automatically increases the encryption strength, while for non-sensitive data, the encryption strength can be appropriately reduced to improve system performance and resource utilization efficiency. Every data access and operation is recorded in the blockchain, generating an immutable audit log. The log data is stored encrypted to prevent tampering during storage and transmission, and its integrity is regularly verified to ensure that the data has not been altered. The system analyzes user behavior, network traffic, and operation logs in real time to assess current security risks and automatically adjusts the strength of security measures based on the assessment results. In high-risk environments, the system automatically strengthens security measures, such as increasing authentication strength and encrypting data transmission, while in low-risk environments, it appropriately reduces the protection strength to optimize performance. Finally, it should be noted that the above are merely preferred embodiments of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing embodiments or make equivalent substitutions for some of the technical features. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A data security protection method for a software system, characterized in that, include: S1. By analyzing users' access behavior and historical operation patterns in real time, a user behavior model is established, which is used to identify normal and abnormal access patterns. S2. Based on the analysis results of the user behavior model, dynamically adjust the encryption strength of the data; S3. Record all data access and modification behaviors to the blockchain to ensure the immutability and traceability of the data, encrypt the data recorded on the blockchain, regularly verify the data integrity, and trigger an alarm when an anomaly is detected; S4. Monitor user access behavior in real time and identify potential security threats through anomaly detection algorithms; S5. Automatically adjust data access permissions and encryption strategies based on anomaly detection results; S6. Record all data operations and abnormal responses to the blockchain to form a complete audit log; S7. The system performs automated risk assessments based on real-time behavioral data and security events, and automatically adjusts the protection level and response measures according to the assessment results to improve protection effectiveness.

2. The data security protection method for a software system according to claim 1, characterized in that, The steps involved in user behavior analysis and data access pattern recognition include: Collect user access data and build user behavior models to define users' regular access patterns; Real-time monitoring of user behavior, comparison of current access with the user's historical behavior model, and when the current behavior is detected to be inconsistent with the historical pattern, the cosine similarity algorithm is used to determine it as abnormal behavior; Based on changes in user behavior, the recognition thresholds in the behavior model are automatically adjusted to adapt to changes in user access patterns and improve the accuracy of abnormal behavior recognition.

3. The data security protection method for a software system according to claim 1, characterized in that, Dynamic encryption strength adjustment includes: When the analysis result of the user behavior model is an abnormal access pattern, the system analyzes the user's behavior pattern and determines whether the user's current behavior is consistent with historical behavior. If abnormal behavior is detected, the encryption strength will be increased. The encryption strength is automatically adjusted based on the sensitivity of the accessed data. For sensitive data, the encryption strength is automatically increased, while for ordinary data, the original encryption strength is maintained.

4. The data security protection method for a software system according to claim 1, characterized in that, Blockchain record and data integrity protection steps include: Each data access and modification operation is recorded in the blockchain to generate an immutable operation log. The log includes the operation time, user ID, operation type, and the specific content of the data modification, ensuring the integrity and transparency of data operations. Each record stored in the blockchain is encrypted using symmetric or asymmetric encryption algorithms to ensure the security of the recorded data and the confidentiality of the data during storage and transmission. Regularly perform integrity checks on the data stored in the blockchain to verify whether the data has been tampered with. If an anomaly or data tampering is found, trigger an alarm and record the event for subsequent investigation and tracing.

5. A data security protection method for a software system according to claim 1, characterized in that, The adaptive anomaly detection and response steps include: By monitoring user behavior in real time and using anomaly detection algorithms to analyze whether the current behavior deviates from the normal pattern, the system will mark abnormal behavior as a potential security threat when it is detected. Based on changes in user behavior, the system automatically updates and adjusts the user behavior model to adapt to new access patterns. The system continuously optimizes the model through machine learning algorithms to improve the accuracy and precision of anomaly detection. When abnormal behavior is detected, the system automatically triggers security response measures to prevent potential security risks.

6. The data security protection method for a software system according to claim 1, characterized in that, Security policy adjustments and data protection steps include: Based on real-time security risk assessment results, the security strategy is automatically adjusted. If anomalies or potential threats are detected, the system will dynamically adjust the protection level. Based on the adjustment of security policies, user data access permissions will be reconfigured. For sensitive data, the system will restrict access permissions, allowing only authorized users to access it; for non-sensitive data, the system may appropriately relax access restrictions to improve efficiency. After the security policy is adjusted, the system automatically activates the data protection mechanism to ensure that the data is protected during storage and transmission, preventing data leakage or tampering.

7. A data security protection method for a software system according to claim 1, characterized in that, The audit log update and tracing steps include: The system records audit logs in real time during each data access or operation to ensure that every data interaction process is fully recorded. The generated audit logs are encrypted and stored to prevent the log data from being tampered with during storage and transmission. The encryption uses symmetric or asymmetric encryption algorithms to ensure the integrity and confidentiality of the log data. The system can trace back to specific user behaviors and data operations through audit logs. When an abnormal event is detected, the system automatically traces the source of the event based on the logs and provides detailed event time, user information and operation content for subsequent investigation and processing.

8. A data security protection method for a software system according to claim 1, characterized in that, Risk assessment and intelligent decision-making steps include: The system analyzes user behavior data, network traffic, and operation logs to assess potential security risks in real time and adjusts the strength of protective measures based on the assessment results. Based on the risk assessment results, the system automatically determines whether certain security measures need to be strengthened; Based on real-time security assessments, protective measures are automatically and dynamically adjusted to ensure that data is always optimally protected under different risk environments.

Images