Data security management methods and systems based on a unified data foundation

Abstract

This application relates to the field of IoT data security technology, providing a data security management method and system based on a unified data foundation to address the problems of poor accuracy in anomaly detection and poor real-time security response for time-series data from heterogeneous devices. The method includes: collecting time-series data from multiple IoT devices through a unified data foundation; representing the data as low-dimensional feature vectors using a variational autoencoder and decoupling them; mapping and encoding the components into digital sequences according to preset rules and concatenating them into data to be analyzed; using a generative adversarial network to discriminate the data and filter out normal data segments; inputting the normal segments into a temporal convolutional network, processing them through its dilated causal convolutional layer, and outputting state prediction data; calculating the deviation between the predicted data and the actual data; and when the deviation continuously exceeds a preset security threshold, generating and executing security management instructions to achieve security management. This application improves the accuracy of anomaly detection and the real-time security response for time-series data from heterogeneous devices.

Description

Technical Field

[0001] This application relates to the field of IoT data security technology, and in particular to a data security management method and system based on a unified data foundation. Background Technology

[0002] With the widespread application of IoT technology in fields such as engineering monitoring and intelligent manufacturing, data security management methods have become the core technology for ensuring the security of critical information assets, and their application prospects have expanded to proactive security scenarios such as equipment anomaly early warning and system intrusion detection.

[0003] In existing technical solutions, data management based on a unified data platform often relies on static rules or conventional statistical methods. For example, unified identity authentication is implemented at the device access layer, and fixed thresholds are used to compare the aggregated data streams for anomaly detection. Some methods introduce traditional time series analysis techniques, such as autoregressive models, to predict device status and compare it with actual readings, thereby triggering alarms.

[0004] However, these methods exhibit certain limitations when dealing with data streams that have complex temporal correlations, high dimensionality, and require dynamic classification. For example, they are not sensitive enough in identifying highly concealed replay attack patterns, and there is room for improvement in their ability to learn and predict complex temporal patterns, thus affecting the accuracy of security responses. Therefore, existing technologies suffer from insufficient accuracy in detecting security threats from massive amounts of heterogeneous temporal data. Summary of the Invention

[0005] This application provides a data security management method and system based on a unified data foundation to solve the problems of poor accuracy in anomaly detection and poor real-time security response in the prior art for time-series data of heterogeneous devices.

[0006] To address the aforementioned technical problems, in a first aspect, this application provides a data security management method based on a unified data foundation, comprising:

[0007] Time-series measurement data from multiple IoT devices are collected through a unified data platform;

[0008] The time-series measurement data are represented by a variational autoencoder to obtain a low-dimensional feature vector, and the low-dimensional feature vector is then separated into a first feature component and a second feature component.

[0009] Based on preset encoding rules, the first feature component and the second feature component are mapped to a first digital encoding sequence and a second digital encoding sequence, respectively, and the first digital encoding sequence and the second digital encoding sequence are concatenated to generate a third digital encoding sequence.

[0010] The third digital encoding sequence is used as the data to be analyzed. Generative adversarial networks are used to judge the data to be analyzed in order to filter out normal data segments.

[0011] The normal data segment is input into a temporal convolutional network, and the normal data segment is processed by multiple dilated causal convolutional layers of the temporal convolutional network to output state prediction data.

[0012] The deviation between the predicted state data and the actual measured data is calculated. When the deviation exceeds a preset safety threshold, a safety management instruction is generated, and the data of the corresponding IoT device is managed for security based on the safety management instruction.

[0013] Optionally, the step of using a generative adversarial network to discriminate the data to be analyzed in order to filter out normal data segments includes:

[0014] Normal behavior pattern data is acquired and input into the generator of the generative adversarial network. The generator learns the latent distribution of the normal behavior pattern data through a multilayer perceptron to output a simulated data sequence that simulates normal behavior.

[0015] The data to be analyzed and the simulated normal sequence are input into the discriminator of the generative adversarial network. The discriminator uses a one-dimensional convolutional neural network to extract local features and, based on the local features, introduces a gated recurrent unit network to capture dynamic dependencies.

[0016] The discriminator outputs discrimination result data based on the dynamic dependency relationship;

[0017] The original data corresponding to the segments in the discrimination result data where the discrimination score is continuously greater than a preset score threshold is extracted from the data to be analyzed, and the extracted original data is used as normal data segments.

[0018] Secondly, this application provides a data security management system based on a unified data foundation, comprising:

[0019] The acquisition module is used to acquire time-series measurement data from multiple IoT devices through a unified data base.

[0020] The learning module is used to perform representation learning on the time-series measurement data through a variational autoencoder to obtain a low-dimensional feature vector, and to separate the low-dimensional feature vector into a first feature component and a second feature component.

[0021] The mapping module is used to map the first feature component and the second feature component into a first digital encoding sequence and a second digital encoding sequence respectively based on a preset encoding rule, and to concatenate the first digital encoding sequence and the second digital encoding sequence to generate a third digital encoding sequence.

[0022] The discrimination module is used to use the third digital encoding sequence as the data to be analyzed, and to use a generative adversarial network to discriminate the data to be analyzed in order to filter out normal data segments.

[0023] The input module is used to input the normal data segment into the temporal convolutional network, process the normal data segment through multiple dilated causal convolutional layers of the temporal convolutional network, and output state prediction data.

[0024] The calculation module is used to calculate the deviation between the state prediction data and the actual measurement data. When the deviation is greater than a preset safety threshold, a safety management instruction is generated, and the data of the corresponding IoT device is managed for security based on the safety management instruction.

[0025] Thirdly, this application provides an electronic device, comprising:

[0026] Memory, used to store computer programs;

[0027] A processor, used to execute the computer program to implement the steps of the data security management method based on a unified data foundation as described in the first aspect above.

[0028] Fourthly, this application provides a computer-readable storage medium storing a computer program that, when executed by a processor, can implement the steps of the data security management method based on a unified data foundation as described in the first aspect above.

[0029] The technical solution provided in this application has the following beneficial effects:

[0030] This application uses a variational autoencoder to perform representation learning and separation on the data, achieving dimensionality reduction and feature decoupling of the original high-dimensional time series data. This effectively removes sensitive information while retaining the analytical value of the data. Next, the separated feature components are encoded and concatenated to form a structured data stream to be analyzed. Then, a generative adversarial network is used to perform adversarial discrimination on this data stream, which can accurately filter out fragments that conform to normal behavior patterns from complex data, enhancing the ability to identify abnormal patterns such as injection attacks.

[0031] Then, the selected normal data segments are input into a temporal convolutional network for processing. This network effectively captures long-term dependencies in the data using its dilated causal convolutional structure, thereby outputting more accurate short-term state prediction data. Finally, by comparing the deviation between the predicted value and the actual measured value in real time, and triggering management instructions when the dynamic safety threshold is exceeded, timely early warning and closed-loop control of potential security risks of the device are realized, improving the automation and intelligence level of security management in the entire IoT data access scenario.

[0032] Furthermore, this application simulates normal data distribution through generative adversarial mechanisms and integrates local feature extraction and temporal dynamic modeling to improve the sensitivity and accuracy of identifying complex temporal anomaly patterns. This enables the more reliable separation of clean normal behavior data from data streams that may contain interference or attacks, laying a high-quality data foundation for subsequent accurate state prediction.

[0033] These or other aspects of this application will become more apparent in the following description of the embodiments. Attached Figure Description

[0034] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0035] Figure 1 A flowchart illustrating a data security management method based on a unified data platform, provided in this application embodiment;

[0036] Figure 2 This application provides a schematic diagram illustrating a specific implementation of a data security management method based on a unified data platform.

[0037] Figure 3 This is a schematic diagram of the structure of a data security management system based on a unified data foundation, provided in an embodiment of this application. Detailed Implementation

[0038] The existing data security management methods based on a unified data platform suffer from insufficient accuracy in detecting security threats when processing massive amounts of heterogeneous IoT time-series data. This stems from the limited ability of traditional methods to learn the characteristics of complex time-series patterns and covert attack behaviors. The static rules or conventional statistical models employed are insufficient to effectively characterize the dynamic changes in normal device behavior, resulting in insensitive identification of advanced threats with time-series correlations, such as data injection attacks and replay attacks. Therefore, the accuracy of security warnings needs improvement. Thus, achieving high-precision detection of complex time-series anomalies based on the unified aggregation of data from multiple heterogeneous devices has become a key technical challenge.

[0039] To address the aforementioned issues, this application proposes a data security management method based on a unified data foundation. The core idea of ​​this method is as follows: First, deep representation learning and feature decoupling are performed on the collected raw time-series data to transform the raw data into low-dimensional feature components that distinguish between sensitive and public information. Then, the feature components are encoded and combined to form the data to be analyzed, and a generative adversarial network is introduced to filter abnormal data. This network learns and identifies normal patterns in the data flow through an adversarial training mechanism. Next, a temporal convolutional network is used to process the filtered normal data, capturing its long-term dependencies and predicting future states. Finally, security management is triggered by comparing the deviation between the predicted and actual values.

[0040] Therefore, this solution combines data desensitization representation, dynamic pattern recognition, and accurate state prediction through a collaborative technology chain of "representation learning - anomaly detection - time series prediction - deviation analysis". Within a unified data processing framework, it enhances the perception and recognition accuracy of complex time series anomaly patterns, thereby effectively solving the problem of insufficient accuracy in detecting security threats to IoT time series data in existing technologies.

[0041] To enable those skilled in the art to better understand the present application, the present application will be further described in detail below with reference to the accompanying drawings and specific embodiments. Obviously, the described embodiments are merely some embodiments of the present application, and not all embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0042] The core of this application is to provide a data security management method based on a unified data foundation, and a flowchart of one specific implementation is shown below. Figure 1 As shown, the method includes:

[0043] Step 101: Collect time-series measurement data from multiple IoT devices through a unified data base.

[0044] In step 101, the unified data foundation refers to the enterprise-level data platform built by China Railway. As a centralized data management center, the unified data foundation provides basic capabilities for data aggregation, storage, governance and sharing.

[0045] Internet of Things (IoT) devices refer to various sensors and terminals deployed in specific application scenarios to continuously collect real-time information about the physical world;

[0046] Time-series measurement data refers to measurement readings continuously generated by these devices at fixed time intervals. These data naturally carry timestamps and reflect the changing trend of the monitored object's state over time.

[0047] In this embodiment, relying on the IoT data development workbench capabilities provided by China Railway's unified data base product, a variety of sensors and engineering machinery terminals in pilot scenarios such as construction sites are uniformly accessed and managed. The specific process is as follows: First, the IoT platform of the unified data base establishes a connection channel with various heterogeneous IoT devices on site. Then, the platform continuously and actively reads or receives the raw measurement data reported by these connected devices according to a preset data acquisition strategy. This data enters the platform in the form of a time-stamped data stream. Finally, the platform initially aggregates this data from different sources to form a time-series measurement dataset that can be processed in subsequent steps.

[0048] Step 102: The time-series measurement data is subjected to representation learning by a variational autoencoder to obtain a low-dimensional feature vector, and the low-dimensional feature vector is separated into a first feature component and a second feature component.

[0049] Variational autoencoders are artificial intelligence models that include encoder and decoder networks. They learn the high-dimensional distribution of input data and transform it into a more compact and lower-dimensional mathematical representation, which serves as a low-dimensional feature vector.

[0050] Low-dimensional feature vectors refer to dense numerical vectors that reflect the core operating status of equipment and reduce the amount of data obtained by compressing and learning massive, high-dimensional raw time-series data generated by sensors, mechanical terminals and other equipment from construction sites through intelligent algorithms.

[0051] The first feature component is specifically defined as the publicly available data portion that reflects the general operating trends and macroscopic status of the carrying equipment, separated from the vector. The second feature component is correspondingly defined as the hidden data portion that contains sensitive information requiring protection, such as specific measurement values.

[0052] This application does not impose specific limitations on the structural design of the internal structure of the variational autoencoder, such as the layers used, and can set them accordingly based on the actual situation.

[0053] In this embodiment, step 102 includes the following process:

[0054] Step 1021: Input the time series measurement data into the encoder of the variational autoencoder, calculate the statistical distribution parameters of the time series measurement data through the encoder, and generate a low-dimensional feature vector based on the statistical distribution parameters.

[0055] In this embodiment, firstly, the time-series measurement data collected in step 101 is input into a pre-trained variational autoencoder network. This encoder network consists of a multi-layer neural network. The encoder network calculates the input data, analyzes the overall distribution pattern of the data, and outputs two sets of key statistical distribution parameters, namely the mean parameter and the variance parameter. These parameters together define a potential probability distribution. Then, the encoder performs random sampling based on this probability distribution to generate a fixed-length low-dimensional feature vector. This low-dimensional feature vector, as a compact representation of the original high-dimensional data, is passed to the subsequent decoder part for further processing.

[0056] Step 1022: Input the low-dimensional feature vector into the decoder of the variational autoencoder. Through the separation unit inside the decoder, combined with the preset orthogonal constraint rules, the low-dimensional feature vector is mapped to two orthogonal subspaces to obtain the first feature component and the second feature component.

[0057] In step 1022, the separation unit is a specific structural module in the front end of the decoder network; the orthogonal constraint rule is a set of pre-set mathematical conditions that require the two generated components to be perpendicular to each other in the vector space, that is, their dot product is zero, so as to ensure that the information represented by the two components is independent of each other and does not overlap.

[0058] In this embodiment, firstly, the low-dimensional feature vector generated in step 1021 is input into the decoder network of the variational autoencoder; at the front end of the decoder, the separation unit receives the low-dimensional feature vector; the separation unit decomposes and maps the input low-dimensional feature vector into two mutually orthogonal mathematical subspaces by matrix projection calculation according to the preset orthogonality constraint rules; after this mapping process, the original single vector is separated into two new, independent vectors, which are defined as the first feature component and the second feature component, respectively, and are prepared for use in subsequent encoding steps.

[0059] This application, through the above steps, enables automated and intelligent compression and information decoupling of complex equipment time-series data from scenarios such as China Railway Construction Corporation, laying the foundation for subsequent secure data processing and accurate analysis.

[0060] Step 103: Based on the preset encoding rules, map the first feature component and the second feature component to a first digital encoding sequence and a second digital encoding sequence, respectively, and concatenate the first digital encoding sequence and the second digital encoding sequence to generate a third digital encoding sequence.

[0061] In step 103, the preset encoding rule refers to a set of data conversion logic pre-defined within a unified data base. This encoding rule specifies in detail how to convert numerical vectors with different meanings into a sequence of numbers according to a specific format. In this embodiment, the preset encoding rule includes, but is not limited to, binary encoding, decimal encoding, or Huffman encoding. Specifically, for each numerical element in the first and second feature components, it is converted into a fixed-length binary string or decimal number string according to its numerical range and precision requirements. For discrete features, Huffman encoding is used for variable-length encoding for compressed representation. This encoding rule ensures a balance between the numerical stability of the feature vector and the efficiency of subsequent processing, resulting in a mapped numerical encoding sequence with good computability and information integrity.

[0062] The first and second digit encoding sequences are two independent digit strings obtained by converting the first and second feature components according to the rule, respectively.

[0063] The third digit encoding sequence is a new, longer digit string formed by concatenating the two independent digit strings in their respective order. This third digit encoding sequence is the unified input format for subsequent security analysis steps.

[0064] In this embodiment, based on the preset encoding rules, the first feature component is first processed and mapped into a first digital encoding sequence consisting of consecutive digits; simultaneously, the second feature component is processed according to the same rules and mapped into a second digital encoding sequence; then, the generated first and second digital encoding sequences are joined end-to-end in the data dimension and merged into a complete third digital encoding sequence. This newly generated sequence integrates both public and private information and is marked as data to be analyzed so that it can be transmitted to the subsequent generative adversarial network for security judgment.

[0065] By mapping the decoupled feature components to digital encoded sequences, this application achieves an efficient structured representation of the original time-series data. This encoding process not only preserves key information but also enables subsequent generative adversarial networks to discriminate data patterns in a unified numerical space, thereby improving the sensitivity to anomaly detection. Simultaneously, the encoded sequences possess fixed numerical ranges and distribution characteristics, which helps temporal convolutional networks maintain numerical stability during training and inference, improving the accuracy and generalization ability of state prediction.

[0066] It is important to note that the third digital encoding sequence and the low-dimensional feature vector output by the variational autoencoder differ fundamentally in their data representation and application purpose. The low-dimensional feature vector is a continuous compressed representation of the original data in the latent space by the variational autoencoder, primarily used for information decoupling and feature extraction. The third digital encoding sequence, however, builds upon this by mapping the feature components in two orthogonal subspaces to a digital sequence through discrete encoding rules and then concatenating them. Its purpose is to transform the feature information into a structured input format suitable for processing by generative adversarial networks and temporal convolutional networks. Compared to directly using low-dimensional feature vectors, the third digital encoding sequence offers advantages in dimensionality alignment, numerical stability, and semantic interpretability, thereby improving the robustness of subsequent security discrimination and state prediction.

[0067] Step 104: Using the third digital encoding sequence as the data to be analyzed, a generative adversarial network is used to judge the data to be analyzed in order to filter out normal data segments.

[0068] Among them, normal data segments are continuous data portions that are identified from the data to be analyzed and that conform to the historical normal behavior patterns of the equipment.

[0069] The structure of a generative adversarial network mainly consists of two substructures: a generator and a discriminator. The generator uses a multilayer perceptron consisting of an input layer, three fully connected hidden layers, and an output layer. The input layer receives a random noise vector sampled from a standard normal distribution with a dimension of 100. The number of neurons in the three hidden layers are 256, 512, and 256, respectively, and all use the ReLU activation function. The output layer uses the Tanh activation function to generate simulated data sequences that match the scale of real data.

[0070] The discriminator employs a hybrid structure consisting of a one-dimensional convolutional neural network and a gated recurrent unit network. The one-dimensional convolutional part comprises two convolutional layers: the first layer uses 32 convolutional kernels with a width of 5, and the second layer uses 64 convolutional kernels with a width of 3. Each layer is followed by ReLU activation and max pooling to extract local features. The feature map is then flattened and fed into a single-layer gated recurrent unit network with 128 hidden units to capture dynamic dependencies. Finally, a fully connected layer is connected, and the discriminant score is output using the Sigmoid activation function.

[0071] The training process of this model can be carried out through alternating iterative training: First, the generator parameters are fixed, and the discriminator is trained using a mixed batch containing real normal behavior pattern data and simulated data generated by the generator. Its discrimination ability is improved by minimizing the binary cross-entropy loss. Then, the discriminator parameters are fixed, and the generator is trained so that the simulated data it generates can deceive the discriminator to the greatest extent, that is, maximize the probability of the discriminator misjudging its output data. This process is repeated until the performance of the two reaches a dynamic balance.

[0072] It should be noted that the above structure is exemplary. This application does not impose specific limitations on the structural design of layers and other components used in the internal structure of the generative adversarial network. The corresponding settings can be made according to the actual situation.

[0073] In this embodiment, step 104 includes the following process, such as... Figure 2 As shown:

[0074] Step 1041: Obtain normal behavior pattern data, input the normal behavior pattern data into the generator of the generative adversarial network, and learn the latent distribution of the normal behavior pattern data through the multilayer perceptron of the generator to output a simulated data sequence simulating normal behavior.

[0075] In step 1041, normal behavior pattern data refers to the set of time-series measurement data collected and confirmed from the time-series database of the unified data foundation during the historical operation of the system without faults or attacks; a multilayer perceptron is a feedforward neural network composed of multiple fully connected layers, which can learn complex nonlinear mapping relationships between inputs and outputs.

[0076] In this embodiment, firstly, normal behavior pattern data of IoT devices within a preset historical time period is retrieved from the time-series database of the unified data foundation; then, the normal behavior pattern data is input into a pre-trained generator in a generative adversarial network, the core of which is a multilayer perceptron network; the multilayer perceptron network performs nonlinear transformations on the input data layer by layer to learn the distribution pattern of normal data in the hidden space; finally, based on the learned distribution pattern, the generator outputs a simulated data sequence that is statistically similar to the normal behavior pattern data, which is the simulated normal sequence.

[0077] In practical applications, for example, at the construction site of a pilot project of China Railway Construction Corporation, various IoT sensors for monitoring stress and displacement were deployed. Time-series measurement data generated by these devices during their historical safe operation cycles were obtained from the time-series database of a unified data base as normal behavior pattern data. This data reflecting the normal state of the devices was input into a trained generator. The generator's multilayer perceptron network, after forward propagation calculation, can output a simulated data sequence that is similar to the real data flow pattern in the time dimension. This sequence is used to compare with the data to be analyzed, which may contain anomalies, in the subsequent discrimination steps to complete the safety discrimination process.

[0078] Step 1042: Input the data to be analyzed and the simulated normal sequence as input data into the discriminator of the generative adversarial network. The discriminator uses a one-dimensional convolutional neural network to extract local features and, based on the local features, introduces a gated recurrent unit network to capture dynamic dependencies.

[0079] The input data refers to the data to be analyzed and the simulated normal sequence. A one-dimensional convolutional neural network is a convolutional network specifically designed to process sequence data. Its convolutional kernels slide in the time dimension to extract data features within a local time period. A gated recurrent unit network is a type of recurrent neural network that can remember or forget past information through its internal update gate and reset gate mechanism, thereby effectively capturing the long-term dynamic dependencies of sequence data in time.

[0080] It should be noted that the above structure is exemplary. This application does not impose specific limitations on the layer and other structural designs used in the internal structure of one-dimensional convolutional neural networks and gated recurrent unit networks. The corresponding settings can be made according to the actual situation.

[0081] Local features refer to numerical values ​​extracted through convolution operations that reflect the change pattern of data within a specific short time window. Local features are extracted jointly from the data to be analyzed, which is part of the input data, and the simulated normal sequence.

[0082] Step 1042 may specifically include the following steps:

[0083] A1: The input data is convolved using multiple convolution kernels of the one-dimensional convolutional neural network to obtain local features at multiple time scales.

[0084] In step A1, the convolution operation refers to the process of sliding the convolution kernel sequentially on the input sequence and performing a dot product summation with the corresponding local data window at each position.

[0085] In this embodiment, the discriminator's one-dimensional convolutional neural network is loaded with multiple convolutional kernels with preset weight parameters. These convolutional kernels have different time widths. Each convolutional kernel slides independently along the time dimension of the input data sequence. Each time it slides, the weight parameters of the convolutional kernel are multiplied by the corresponding values ​​of the currently covered local data window and then summed to obtain an output value.

[0086] After sliding across the entire sequence, each convolutional kernel generates a new feature sequence related to the length of the input sequence. This feature sequence represents the local features extracted at the time scale corresponding to that convolutional kernel. Multiple convolutional kernels work in parallel to obtain multiple sets of local features at different time scales.

[0087] In practical applications, for example, the input data sequence can be encoded data segments to be analyzed from a single IoT device at consecutive time points, aggregated from a unified data base. The one-dimensional convolutional neural network in the discriminator uses a preset convolutional kernel, such as a kernel with a width of 3 and weight parameters of [0.1, 0.8, 0.1], to perform convolution operations on the sequence to extract local time patterns. The convolutional kernel slides from the beginning time point of the sequence, first covering the data values ​​of the first three time points, multiplying the data within the coverage window with the corresponding positions of the convolutional kernel weights, and then summing the results to obtain a value reflecting the characteristics of that local time period. Sliding to the next time point, this calculation process is repeated, and finally a new numerical sequence is generated. This sequence is the local feature sequence extracted from the original time series data, emphasizing specific time dependencies, and is used to capture dynamic dependencies in the future.

[0088] A2: Merge the local features across all time scales to obtain a comprehensive feature sequence.

[0089] In step A2, the comprehensive feature sequence is a new sequence in which the vector at each time step contains the different local feature information extracted by all convolutional kernels at that time step.

[0090] In this embodiment of the application, after step A1 is completed, multiple sets of local feature sequences from multiple convolutional kernels of different widths are obtained. These sequences have the same time step. Then, along the feature dimension, the feature values ​​extracted by all convolutional kernels at the same time step are combined together to form a longer feature vector. After performing such a combination operation at each time step, a new sequence is obtained. This sequence is the comprehensive feature sequence, which integrates multiple pattern information of the input data under different local time windows.

[0091] In practical applications, assuming three convolutional kernels are used, the following local feature sequences are obtained: Sequence 1: [0.91, 1.37, 1.25], Sequence 2: [0.85, 1.40, 1.30], and Sequence 3: [0.88, 1.35, 1.28]. At the first time step, the first values ​​of the three sequences are merged into a vector [0.91, 0.85, 0.88]. At the second time step, they are merged into [1.37, 1.40, 1.35]. At the third time step, they are merged into [1.25, 1.30, 1.28]. The final comprehensive feature sequence is formed by arranging these three vectors in chronological order.

[0092] A3: The comprehensive feature sequence is input into a gated recurrent unit network, which processes the comprehensive feature sequence in chronological order to obtain the dynamic dependencies of the data in the time dimension.

[0093] In this embodiment, the comprehensive feature sequence obtained in step A2 is sequentially input into the gated recurrent unit network in the order of time steps. At each time step, the gated recurrent unit network receives the feature vector of the current input and the hidden state passed down from the previous time step. The update gate inside the network calculates a value between 0 and 1 based on the current input and the previous hidden state to determine how much information from the previous time step should be retained. At the same time, the reset gate calculates another value to determine how much information from the previous time step should be combined with the current input to generate new memory content.

[0094] Through the coordinated control of these two gates, the network outputs a new hidden state at each time step. This hidden state contains both current information and relevant past information. After all time steps have been processed, the final hidden state sequence or output sequence contains the dynamic dependencies of the input data over the entire time span, i.e., how the data points before and after are related and evolve.

[0095] In practical applications, assuming the first time step input of the comprehensive feature sequence is vector [0.91, 0.85, 0.88], and the initial hidden state is a zero vector [0, 0, 0]; the gated recurrent unit network calculates the update gate vector zt and the reset gate vector rt according to the preset weight matrix and activation function, and then calculates the candidate hidden state and the new hidden state ht; for example, the new hidden state ht may become [0.15, 0.10, 0.12]; in the next time step, the input vector [1.37, 1.40, 1.35] and the previous hidden state [0.15, 0.10, 0.12] participate in the calculation to obtain the updated hidden state; this process is repeated, and the final output sequence captures the dynamic change pattern of the features over time.

[0096] Step 1043: The discriminator outputs discrimination result data based on the dynamic dependency relationship.

[0097] In step 1043, the discrimination result data is a numerical sequence that is finally output by the discriminator after internal calculation. Each value in the sequence corresponds to the probability assessment of the data at a certain time point in the data to be analyzed belonging to the normal pattern. The higher the score, the more normal the data.

[0098] In this embodiment, after the gated recurrent unit network outputs a high-level feature sequence containing dynamic dependencies in step 1042, the discriminator inputs these high-level features into a fully connected output layer. This fully connected output layer is typically a neural network layer with a single output unit, which maps the input high-dimensional feature vector to a scalar value. The discriminator performs this mapping operation for each time step of the input sequence, thereby obtaining a discriminant score sequence with the same time step as the input. This score sequence is the discriminant result data. This data directly reflects the discriminator's confidence in the authenticity of the data at each time step in the data to be analyzed.

[0099] In practical applications, assuming that after processing by a gated recurrent unit network, 500 high-level feature vectors are obtained for 500 time steps of input; the fully connected output layer of the discriminator calculates for each feature vector. For example, for a feature vector [0.2, 0.5, -0.1, ...], after weight matrix multiplication and bias addition, and then through the Sigmoid activation function, a score of 0.85 may be output; after calculating sequentially for 500 time steps, a discrimination result data sequence consisting of 500 scores between 0 and 1 is obtained, such as [0.85, 0.92, 0.13, 0.88, ...].

[0100] Step 1044: Extract the original data corresponding to the segments in the discrimination result data where the discrimination score is continuously greater than the preset score threshold from the data to be analyzed, and use the extracted original data as normal data segments.

[0101] In step 1044, the preset score threshold is a pre-defined numerical limit used to divide the confidence level between normal and abnormal; the segment refers to the continuous time index range in the discrimination result data where the discrimination score continuously meets the condition of being greater than the threshold.

[0102] This application does not specifically limit the value of the preset score threshold; it can be set according to the actual situation.

[0103] In this embodiment, firstly, a preset score threshold is set, for example, 0.7; then, the discrimination result data output in step 1043 is scanned to find all continuous time intervals in which the discrimination score is continuously greater than 0.7; next, based on the start and end position indices corresponding to these time intervals, the original data to be analyzed is traced back; finally, according to these index positions, the corresponding continuous data subsequences in the data to be analyzed are completely extracted, and the set of these extracted subsequences is defined as normal data segments for subsequent time series prediction analysis.

[0104] In practical applications, assuming the discrimination result data is [0.85, 0.92, 0.13, 0.88, 0.91, 0.95], and the preset score threshold is 0.7; the scan finds that the first and second scores (0.85, 0.92) and the fourth and sixth scores (0.88, 0.91, 0.95) are consecutively greater than 0.7; the corresponding original data to be analyzed is the third digit encoding sequence [S1, S2, S3, S4, S5, S6]; then, the data corresponding to index 1-2 [S1, S2] and the data corresponding to index 4-6 [S4, S5, S6] are extracted and merged as normal data segments.

[0105] This application utilizes the adversarial learning mechanism of generative adversarial networks and combines it with in-depth analysis of temporal local features and long-term dynamic relationships to accurately filter out data segments that conform to the normal operation rules of equipment from potentially mixed and abnormal data streams, providing a reliable and clean data foundation for subsequent accurate state prediction.

[0106] Step 105: Input the normal data segment into a temporal convolutional network, process the normal data segment through multiple dilated causal convolutional layers of the temporal convolutional network, and output state prediction data.

[0107] Among them, the state prediction data is the value of the device's operating state at one or more future time points, predicted by the temporal convolutional network based on the input normal data segments.

[0108] The structure of a temporal convolutional network consists of an input layer, four dilated causal convolutional blocks, and a linear output layer connected sequentially. Each dilated causal convolutional block is designed as follows: first, a dilated causal convolutional sub-layer with a kernel width of 3; the dilation coefficients of the four blocks are 1, 2, 4, and 8 respectively. Each sub-layer is followed by a ReLU activation function sub-layer for non-linear transformation, and then a batch normalization sub-layer for standardization. The linear output layer is a fully connected layer with the number of neurons set to the number of future time steps to be predicted, for example, three.

[0109] The training process of this model is as follows: First, a large number of historical normal data segments of devices and corresponding real state data of the next time period are prepared from the time series database of the unified data base as training samples. Then, the stochastic gradient descent optimizer is used with mean squared error as the loss function. The samples are input into the network for forward propagation to obtain the predicted value. The loss between the predicted value and the real value is calculated. Then, the gradient of the loss with respect to the parameters of each layer of the network is calculated through the backpropagation algorithm. The optimizer is used to update these parameters. This process is repeated for multiple rounds until the prediction error of the network on the validation set no longer decreases, thus obtaining a time series convolutional network model that can accurately predict the future state of the device.

[0110] It should be noted that the above structure is exemplary. This application does not impose specific limitations on the layer and other structural designs used in the internal structure of the temporal convolutional network, and corresponding settings can be made according to the actual situation.

[0111] In this embodiment, step 105 includes the following process:

[0112] Step 1051: Input the normal data segment into the first dilated causal convolutional layer of the temporal convolutional network. The first dilated causal convolutional layer performs one-dimensional convolution calculation on the normal data segment to obtain the first intermediate data.

[0113] In step 1051, the first dilated causal convolutional layer is the first processing unit in the temporal convolutional network; the first intermediate data is a new numerical sequence obtained after the convolution calculation is completed, which contains preliminary temporal features extracted from the original data.

[0114] In this embodiment, firstly, the normal data segments selected in step 104 are input sequentially into a pre-trained temporal convolutional network. The first dilated causal convolutional layer of the network receives the input sequence. Inside this layer, a pre-defined convolutional kernel begins to slide along the temporal dimension of the input sequence. At each position, the weight parameters of the convolutional kernel are multiplied by the corresponding value of the currently covered local data window, and then all the product results are added together to generate an output value. After the convolutional kernel slides through the entire input sequence, a new numerical sequence with adjusted length is obtained. This sequence is the first intermediate data, which represents the result after preliminary feature extraction.

[0115] In practical applications, assume that the normal data segment is a sequence of displacement data of a device at the most recent 50 time points obtained from a unified data base, with the value sequence being [2.1, 2.15, 2.05, 2.2, 2.18, ...]. The first dilated causal convolutional layer is processed using a convolutional kernel with a width of 3 and weights of [0.2, 0.6, 0.2]. The convolutional kernel slides from the beginning of the sequence, and the first calculation covers [2.1, 2.15, 2.05], resulting in the output value 2.1×0.2+2.15×0.6+2.05×0.2=0.42+1.29+0.41=2.12. It slides to the next position, calculates the next set of data, and so on, finally generating the first intermediate data sequence [2.12, 2.17, ...].

[0116] Step 1052: The first dilated causal convolutional layer further performs nonlinear transformation and standardization operations on the first intermediate data in sequence to obtain the first output data.

[0117] In step 1052, the first output data is the data obtained after completing the above two operations. This first output data, as the final output of the first dilated causal convolutional layer, will be passed to the next layer of the network.

[0118] In this embodiment, after obtaining the first intermediate data, the first dilated causal convolutional layer immediately performs post-processing on it. First, a nonlinear transformation operation is performed on each value in the first intermediate data sequence, specifically by inputting it into the ReLU function, which is defined as f(x) = max(0, x), where f(x) represents the output value of the ReLU function. This represents a single value in the first intermediate data sequence. If the value x is greater than 0, x is output; otherwise, 0 is output. After this operation, all negative values ​​in the data are set to zero, while positive values ​​are retained, thereby enhancing the network's representation ability.

[0119] Then, a standardization operation is performed on the nonlinearly transformed data, typically on a small batch of data; first, the mean of this batch of data is calculated. and standard deviation Then, the standardization value is obtained by transforming each data point x. Its transformation formula is ,in It is a very small constant used to prevent division by zero errors; finally, then... Perform scaling and translation, i.e. ,in and These are learnable parameters. This represents the first output data value of the final output; after this series of calculations, the first output data is finally obtained, which has good numerical characteristics and is sent to the next layer of the network.

[0120] Step 1053: Input the first output data into the second dilated causal convolutional layer of the temporal convolutional network. The processing procedure of the second dilated causal convolutional layer is the same as that of the first dilated causal convolutional layer.

[0121] In step 1053, the second dilated causal convolutional layer is the next processing unit in the temporal convolutional network that follows the first dilated causal convolutional layer.

[0122] In this embodiment, the first output data of the first dilated causal convolutional layer is passed as the input sequence to the second dilated causal convolutional layer. The second dilated causal convolutional layer has a pre-set convolutional kernel that may be different from the first layer and uses a larger dilation coefficient, such as a dilation coefficient of 2. When the dilation coefficient is 2, the convolutional kernel will skip 1 input data point each time it slides, which allows the convolutional kernel to cover a wider time window.

[0123] This layer then performs the same processing flow as the first layer: first, a one-dimensional dilated convolution is calculated to obtain the intermediate data of this layer; then, nonlinear transformation and standardization operations are performed on the intermediate data in sequence; finally, the output data of the second dilated causal convolution layer is obtained, which contains longer-term time-dependent features than the output of the first layer.

[0124] Step 1054: Based on the preset network depth of the temporal convolutional network, repeat the convolution calculation, nonlinear transformation operation and normalization operation layer by layer until the network output data of the last dilated causal convolutional layer is obtained.

[0125] In step 1054, the preset network depth refers to the total number of dilated causal convolutional layers contained in the temporal convolutional network; the last dilated causal convolutional layer is the last convolutional layer in the network stack, and its output network output data is a highly condensed temporal feature representation obtained after all layers have been abstracted and feature extracted step by step. This temporal feature representation integrates various time dependency patterns from short-term to long-term.

[0126] In this embodiment of the application, the temporal convolutional network design includes multiple dilated causal convolutional layers stacked sequentially, for example, the preset network depth is 4 layers; each layer takes the output of the previous layer as input and repeatedly performs the core processing described in steps 1051 to 1053, namely dilated convolution calculation, nonlinear transformation and normalization; as the number of layers increases, the dilation coefficient used in each layer usually increases exponentially, for example, 1, 2, 4, 8, which makes the receptive field of the deep network expand rapidly and can associate very early and current data points;

[0127] The data starts from the first layer input and is passed and transformed layer by layer. The features are gradually abstracted from specific local patterns to global temporal patterns. When the data passes through the last layer of dilated causal convolutional layer and completes all its processing, the result is the network output data. This network output data no longer needs to go through more convolutional layers and will be sent to the final prediction output layer.

[0128] Step 1055: Input the network output data into the linear transformation layer of the temporal convolutional network. The linear transformation layer converts the network output data into a predicted value for at least one future time. The predicted values ​​for all future time periods constitute the state prediction data.

[0129] In step 1055, the linear transformation layer is the last layer of the temporal convolutional network, which is usually a fully connected layer. The function of this fully connected layer is to map the high-dimensional and complex temporal features extracted by all the previous dilated causal convolutional layers to the final prediction target space, that is, the predicted value of one or more specific future moments.

[0130] In this embodiment, the network output data from the last dilated causal convolutional layer is input into the linear transformation layer of the temporal convolutional network. The linear transformation layer contains a set of learnable weight parameters and a bias parameter. The calculation process is to perform matrix multiplication between the input network output data vector and the weight parameter matrix, and then add the bias parameter vector. This calculation process can be expressed by the formula Y=W×X+b, where X is the input network output data vector, W is the weight matrix of the linear transformation layer, b is the bias vector, and Y is the output predicted value vector.

[0131] Through this linear mapping, the network transforms the learned complex features into direct numerical predictions of future states; each element of the Y vector output by the linear transformation layer corresponds to a predicted value at a future time. All these predicted values, arranged in order, constitute complete state prediction data, which will be used in the subsequent safety deviation comparison step.

[0132] This application uses a temporal convolutional network to perform deep temporal modeling on the filtered normal device data segments. Its dilated causal convolutional structure can effectively extract multi-scale dependencies from short-term fluctuations to long-term trends in the data, thereby outputting high-precision prediction data of future device status, providing a reliable technical basis for accurately identifying small data deviations caused by hidden threats such as replay attacks.

[0133] Step 106: Calculate the deviation between the predicted state data and the actual measured data. When the deviation is greater than a preset safety threshold, generate a safety management instruction and perform security management on the data of the corresponding IoT device based on the safety management instruction.

[0134] Among them, the deviation value refers to the absolute value of the difference between each predicted point value in the state prediction data and the actual measured value at the corresponding time point in the actual measurement data; the safety threshold is a pre-set numerical limit used to determine whether the data is abnormal; the safety management instruction refers to a data structure containing specific operation commands that is automatically generated when an abnormality is determined to occur, and this instruction is used to trigger subsequent safety management operations.

[0135] In this embodiment, step 106 includes the following process:

[0136] Step 1061: Obtain the actual measurement data corresponding to the time of the state prediction data.

[0137] In this embodiment of the application, after the temporal convolutional network completes the prediction and outputs the state prediction data, the specific future time range corresponding to the prediction data is first determined; then, a query request is immediately initiated to the temporal database of the unified data base to request the acquisition of the actual measurement data generated by the same IoT device within the future time range; the actual measurement data is uploaded from the field device in real time and stored in the database, extracted and precisely aligned with the prediction data at the time point for subsequent calculation.

[0138] Step 1062: Calculate the difference between each predicted point in the state prediction data and the corresponding point in the actual measurement data to obtain the corresponding deviation value. The number of deviation values ​​is the same as the number of predicted points.

[0139] In this embodiment of the application, the actual measurement data sequence obtained in step 1061 and the state prediction data sequence output in step 105 are arranged in a one-to-one correspondence according to the chronological order of the time points; then, for each position with the same time index, the actual measurement value is subtracted from the prediction value, and the absolute value of the difference is taken; the absolute difference is recorded as a deviation value; after performing this subtraction and taking the absolute value operation on all corresponding points in the sequence, a deviation value sequence of the same length as the prediction sequence is obtained.

[0140] Step 1063: Compare each deviation value with the safety threshold. When the first deviation value is greater than the safety threshold, the time corresponding to the deviation value is used as the starting time to determine a monitoring period of preset duration.

[0141] In this embodiment, a preset safety threshold is set, which is derived from the statistical analysis of the device's historical normal operation data. Then, the sequence of deviation values ​​calculated in step 1062 is checked one by one in chronological order. Each deviation value is compared with the safety threshold to determine whether it is greater than the threshold. When the first deviation value in the sequence that is greater than the safety threshold is detected, the specific time point corresponding to the deviation value is recorded. This time point is used as the starting time of monitoring, and a fixed time window is defined according to preset rules, such as 10 time steps. This time window is the monitoring period, which is used to centrally observe the subsequent persistence of anomalies.

[0142] Step 1064: During the monitoring period, count the number of deviation values ​​that continuously exceed the safety threshold. When the number reaches a preset threshold, determine that an anomaly has occurred and generate a safety management instruction.

[0143] In this embodiment, during the monitoring period defined in step 1063, all subsequent deviation values ​​appearing within that period are continuously compared with the safety threshold. The number of deviation values ​​that are consecutively greater than the safety threshold starting from the start time is counted; that is, as long as a deviation value is not greater than the threshold, the count is interrupted and reset. At the same time, a preset quantity threshold is set, such as 3 times. If the number of deviation values ​​that consecutively exceed the safety threshold reaches the preset 3 times, it is determined that the device data stream has a continuous abnormal pattern, rather than an occasional fluctuation. Once the determination is established, a safety management instruction is automatically generated, which includes at least the abnormal device identifier, the abnormal type code, and the trigger time.

[0144] In this embodiment, after step 106, the following process is also included:

[0145] B1: Obtain device identification information and anomaly association data of IoT devices that have performed security management operations.

[0146] In step B1, the device identification information is a code used to uniquely identify an IoT device in the system, such as a device ID; the anomaly association data refers to the context data related to the abnormal event that triggered this security management instruction. The anomaly association data includes the abnormal deviation value sequence, the time period in which the anomaly occurred, and some of the original data of the device before and after the abnormal period.

[0147] In this embodiment of the application, after a security management instruction is executed, such as when a device data stream is marked or an alarm is issued, the device identification information of the IoT device being operated is extracted from the instruction. At the same time, detailed data related to the device during the abnormal monitoring period is queried and obtained from the storage of the unified data base, and this data is packaged as abnormal association data. The device identification information and the abnormal association data together constitute the input for the source tracing analysis.

[0148] B2: Input the device identification information and the anomaly association data into the pre-trained source tracing analysis model. Through the directed graph neural network in the source tracing analysis model, map the device identification information into a target node and encode the anomaly association data into the initial anomaly features of the target node.

[0149] In step B2, the source tracing analysis model is an artificial intelligence model used to infer the source of an anomaly; a directed graph neural network is its core component, which is a type of neural network used to process graph-structured data; in this model, the nodes of the graph represent IoT devices, and the directed edges represent the data flow or physical connection relationship between devices. The target node is the node in the graph that represents the currently anomalous device; the initial anomaly features are numerical vectors representing information such as the severity and type of the current anomaly event.

[0150] It should be noted that the above structure is exemplary. This application does not impose specific limitations on the structural design of layers and other components used in the internal structure of the source tracing analysis model. The design can be adjusted according to the actual situation.

[0151] In this embodiment, firstly, the device identification information is input into the traceability analysis model; the model maintains a device relationship graph, and the corresponding node is found in the graph according to the device identification information and marked as the target node; at the same time, the abnormal correlation data is input into a feature encoder, which is usually a small neural network. The small neural network compresses the structured abnormal data and converts it into a fixed-length numerical vector; then, the numerical vector is used as the initial feature of the target node and assigned to the target node.

[0152] B3: The directed graph neural network performs multiple rounds of feature propagation calculations based on the initial abnormal features and the historical interaction graph. In each round of calculation, each node updates its own feature vector based on the features of its neighboring nodes.

[0153] In step B3, the historical interaction graph is a mathematical model constructed based on the data interaction records generated by IoT devices operating over a long period in a unified data platform. In this graph, each node uniquely corresponds to an IoT device, and the directed edges between nodes represent the data flow or logical dependencies between devices. For example, if data from sensor A is read by device B for computation, then there is a directed edge in the graph pointing from node A to node B. The construction process of this graph includes extracting interaction events between devices from the unified data platform's logs, data lineage records, or network traffic records, and filtering and aggregating them according to preset time windows and interaction frequencies, ultimately forming a structured network graph reflecting the historical collaboration patterns among device groups. This graph is the essential basic data structure for subsequent directed graph neural network feature propagation and anomaly tracing calculations.

[0154] In this embodiment, a pre-constructed historical interaction graph is loaded into the directed graph neural network. This graph is generated based on historical data interaction records between devices. After the feature propagation calculation begins, the target node first carries its initial abnormal features. Then, the network begins to perform the first round of calculation. In this round, each node in the graph collects the current features of all its upstream neighbor nodes. Each node aggregates the collected neighbor features with its own features, for example, by taking the mean or weighted sum, and then transforms them through a learnable weight matrix and passes them through a non-linear activation function to update and generate its own new feature vector. After the first round is completed, the features of all nodes are updated for the first time.

[0155] B4: After multiple rounds of feature propagation calculations, the directed graph neural network outputs the final feature representations of all nodes, and determines at least one suspicious device identifier based on the similarity between the final feature representations of each node and the feature vector of the target node, thus forming the source tracing result.

[0156] In this embodiment, the feature propagation calculation in step B3 is repeated multiple times, for example, 3 to 5 times. In each round, information is transmitted and diffused along the edges of the graph, and abnormal features are propagated from the target node to its upstream nodes and even further upstream nodes. After multiple iterations, the calculation stops, and at this time, each node in the graph has a final feature vector, which integrates the structural information of the graph and the information of abnormal propagation. Subsequently, the cosine similarity between the final feature vector of each node in the graph except the target node and the final feature vector of the target node is calculated. The node or several nodes with the highest similarity are identified as the most likely suspicious source device that may have caused this abnormality. The identification information of these suspicious device nodes is extracted to form the final tracing result.

[0157] B5: The source tracing results are used to generate security action instructions using a policy learning network. Based on the security action instructions, a device control policy is generated and the device control policy is sent to the unified data base for execution.

[0158] In step B5, the policy learning network is a model trained based on deep reinforcement learning. This policy learning network learns to select the optimal safety response action under a given safety state. The device control policy is a set of control parameters that are refined from the safety action instructions and can be directly sent to the data base for execution.

[0159] It should be noted that the above structure is exemplary. This application does not impose specific limitations on the layer and other structural designs used in the internal structure of the policy learning network, and can make corresponding settings according to the actual situation.

[0160] In this embodiment of the application, the source tracing result obtained in step B4 is input into a pre-trained policy learning network. The network takes the source tracing result and the overall security status of the current system as input, and performs calculations through its internal deep Q network structure to evaluate the long-term value of different security response actions. The network outputs the security action instruction with the highest value, such as "perform deep audit of the data flow of source device A" or "limit the network bandwidth of device B".

[0161] Then, based on this abstract instruction and combined with the specific control interface of the unified data base, an executable device control policy is generated. This policy clarifies the operation object, operation type, and parameters. Finally, this policy is sent to the security management module of the unified data base through the application programming interface. This module is responsible for implementing specific control operations on the target device, thereby completing a closed loop from anomaly detection and tracing to proactive defense.

[0162] This application, through steps 106 and above, achieves automated and refined judgment and alarm for predicted abnormal states. Through subsequent source tracing and strategy generation processes, based on the identification of single-point anomalies, it further locates potential risk sources and executes precise dynamic security strategies, thereby upgrading data security management from passive response to intelligent closed-loop control with certain predictive and proactive containment capabilities.

[0163] Figure 3 This application provides a schematic diagram of the structure of a data security management system based on a unified data foundation, as shown in the embodiments of this application. Figure 3 As shown, the system includes:

[0164] The acquisition module 31 is used to acquire time-series measurement data from multiple IoT devices through a unified data base.

[0165] The learning module 32 is used to perform representation learning on the time-series measurement data through a variational autoencoder to obtain a low-dimensional feature vector, and to separate the low-dimensional feature vector into a first feature component and a second feature component.

[0166] The mapping module 33 is used to map the first feature component and the second feature component into a first digital encoding sequence and a second digital encoding sequence respectively based on a preset encoding rule, and to concatenate the first digital encoding sequence and the second digital encoding sequence to generate a third digital encoding sequence.

[0167] The discrimination module 34 is used to use the third digital encoding sequence as the data to be analyzed, and to use a generative adversarial network to discriminate the data to be analyzed in order to filter out normal data segments.

[0168] The input module 35 is used to input the normal data segment into the temporal convolutional network, process the normal data segment through multiple dilated causal convolutional layers of the temporal convolutional network, and output state prediction data.

[0169] The calculation module 36 is used to calculate the deviation between the state prediction data and the actual measurement data. When the deviation is greater than a preset safety threshold, a safety management instruction is generated, and the data of the corresponding IoT device is managed for security based on the safety management instruction.

[0170] The data security management system based on a unified data foundation in this application is used to implement the aforementioned data security management method based on a unified data foundation. Therefore, the specific implementation of the data security management system based on a unified data foundation can be found in the embodiment section of the data security management method based on a unified data foundation above. The specific implementation can be referred to the description of the corresponding embodiments, which will not be repeated here.

[0171] This application also provides an electronic device, comprising: a memory for storing a computer program; and a processor for executing the computer program to implement the steps of any of the above-described data security management methods based on a unified data platform.

[0172] This application also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of any of the above-described data security management methods based on a unified data foundation.

[0173] In one exemplary embodiment, the aforementioned computer-readable storage medium may include, but is not limited to, various media capable of storing computer programs, such as USB flash drives, read-only memory, random access memory, portable hard drives, magnetic disks, or optical disks.

[0174] Embodiments of this application also provide a computer program product, which includes a computer program that, when executed by a processor, implements the steps in any of the above embodiments of the data security management method based on a unified data foundation.

[0175] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0176] It should be noted that the user information and data involved in one or more embodiments of this specification are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of related data must comply with relevant laws, regulations and standards, and corresponding operation entry points are provided for users to choose to authorize or refuse.

[0177] The foregoing has provided a detailed description of a data security management method and system based on a unified data foundation provided in this application. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the embodiments above are merely for the purpose of helping to understand the method and its core ideas. It should be noted that those skilled in the art can make various improvements and modifications to this application without departing from its principles, and these improvements and modifications also fall within the protection scope of this application.

Claims

1. A data security management method based on a unified data foundation, characterized in that, include: Time-series measurement data from multiple IoT devices are collected through a unified data platform; The time-series measurement data is represented by a variational autoencoder to obtain a low-dimensional feature vector, and the low-dimensional feature vector is then separated into a first feature component and a second feature component. Based on preset encoding rules, the first feature component and the second feature component are mapped to a first digital encoding sequence and a second digital encoding sequence, respectively, and the first digital encoding sequence and the second digital encoding sequence are concatenated to generate a third digital encoding sequence. The third digital encoding sequence is used as the data to be analyzed. Generative adversarial networks are used to judge the data to be analyzed in order to filter out normal data segments. The normal data segment is input into a temporal convolutional network, and the normal data segment is processed by multiple dilated causal convolutional layers of the temporal convolutional network to output state prediction data. The deviation between the predicted state data and the actual measured data is calculated. When the deviation exceeds a preset safety threshold, a safety management instruction is generated, and the data of the corresponding IoT device is managed for security based on the safety management instruction. The step of using a generative adversarial network to discriminate the data to be analyzed in order to filter out normal data segments includes: Normal behavior pattern data is acquired and input into the generator of the generative adversarial network. The generator learns the latent distribution of the normal behavior pattern data through a multilayer perceptron to output a simulated data sequence that simulates normal behavior. The data to be analyzed and the simulated data sequence are input into the discriminator of the generative adversarial network. The discriminator uses a one-dimensional convolutional neural network to extract local features and, based on the local features, introduces a gated recurrent unit network to capture dynamic dependencies. The discriminator outputs discrimination result data based on the dynamic dependency relationship; The original data corresponding to the segments in the discrimination result data where the discrimination score is continuously greater than a preset score threshold is extracted from the data to be analyzed, and the extracted original data is used as normal data segments. The step of performing representation learning on the time-series measurement data through a variational autoencoder to obtain a low-dimensional feature vector, and then separating the low-dimensional feature vector into a first feature component and a second feature component, includes: The time-series measurement data is input into the encoder of the variational autoencoder. The encoder calculates the statistical distribution parameters of the time-series measurement data and generates a low-dimensional feature vector based on the statistical distribution parameters. The low-dimensional feature vector is input into the decoder of the variational autoencoder. Through the separation unit inside the decoder, combined with the preset orthogonal constraint rules, the low-dimensional feature vector is mapped to two orthogonal subspaces to obtain the first feature component and the second feature component. The step involves calculating the deviation between the predicted state data and the actual measured data. When the deviation exceeds a preset safety threshold, a safety management instruction is generated, including: Obtain the actual measurement data corresponding to the time of the state prediction data; Calculate the difference between each predicted point in the state prediction data and the corresponding point in the actual measurement data to obtain the corresponding deviation value. The number of deviation values ​​is the same as the number of predicted points. Each deviation value is compared with the safety threshold. When the first deviation value is greater than the safety threshold, the time corresponding to the deviation value is used as the start time to determine a monitoring period of a preset duration. During the monitoring period, the number of deviation values ​​that continuously exceed the safety threshold is counted. When the number reaches a preset threshold, an anomaly is determined and a safety management instruction is generated. After performing security management on the data of the corresponding IoT device based on the security management instructions, the method further includes: Obtain device identification information and anomaly association data of IoT devices that have performed security management operations; The device identification information and the anomaly association data are input into a pre-trained source tracing analysis model. The directed graph neural network in the source tracing analysis model maps the device identification information to a target node and encodes the anomaly association data into the initial anomaly features of the target node. The directed graph neural network performs multiple rounds of feature propagation calculations based on the initial abnormal features and the historical interaction graph. In each round of calculation, each node updates its own feature vector based on the features of its neighboring nodes. After multiple rounds of feature propagation calculations, the directed graph neural network outputs the final feature representations of all nodes, and determines at least one suspicious device identifier based on the similarity between the final feature representations of each node and the feature vector of the target node, thus forming the source tracing result. The source tracing results are used to generate security action instructions using a policy learning network. Based on the security action instructions, a device control policy is generated and then sent to the unified data base for execution.

2. The data security management method based on a unified data foundation according to claim 1, characterized in that, The discriminator uses a one-dimensional convolutional neural network to extract local features, and based on these local features, introduces a gated recurrent unit network to capture dynamic dependencies, including: The input data is convolved using multiple convolution kernels of the one-dimensional convolutional neural network to obtain local features at multiple time scales; By merging local features across all time scales, a comprehensive feature sequence is obtained. The comprehensive feature sequence is input into a gated recurrent unit network, which processes the comprehensive feature sequence in chronological order to obtain the dynamic dependencies of the data in the time dimension.

3. The data security management method based on a unified data foundation according to claim 1, characterized in that, The process of inputting the normal data segment into a temporal convolutional network, processing the normal data segment through multiple dilated causal convolutional layers of the temporal convolutional network, and outputting state prediction data includes: The normal data segment is input into the first dilated causal convolutional layer of the temporal convolutional network, and the first dilated causal convolutional layer performs one-dimensional convolution calculation on the normal data segment to obtain the first intermediate data. The first dilated causal convolutional layer also performs nonlinear transformation and standardization operations on the first intermediate data in sequence to obtain the first output data; The first output data is input into the second dilated causal convolutional layer of the temporal convolutional network, and the processing procedure of the second dilated causal convolutional layer is the same as that of the first dilated causal convolutional layer. Based on the preset network depth of the temporal convolutional network, convolution calculation, nonlinear transformation operation and normalization operation are repeatedly performed layer by layer until the network output data of the last dilated causal convolutional layer is obtained. The network output data is input into the linear transformation layer of the temporal convolutional network, and the linear transformation layer converts the network output data into a predicted value for at least one future time. The predicted values ​​for all future time points constitute the state prediction data.

4. A data security management system based on a unified data foundation, characterized in that, The data security management method based on a unified data foundation as described in any one of claims 1 to 3 includes: The acquisition module is used to acquire time-series measurement data from multiple IoT devices through a unified data base. The learning module is used to perform representation learning on the time-series measurement data through a variational autoencoder to obtain a low-dimensional feature vector, and to separate the low-dimensional feature vector into a first feature component and a second feature component. The mapping module is used to map the first feature component and the second feature component into a first digital encoding sequence and a second digital encoding sequence respectively based on a preset encoding rule, and to concatenate the first digital encoding sequence and the second digital encoding sequence to generate a third digital encoding sequence. The discrimination module is used to use the third digital encoding sequence as the data to be analyzed, and to use a generative adversarial network to discriminate the data to be analyzed in order to filter out normal data segments. The input module is used to input the normal data segment into the temporal convolutional network, process the normal data segment through multiple dilated causal convolutional layers of the temporal convolutional network, and output state prediction data. The calculation module is used to calculate the deviation between the state prediction data and the actual measurement data. When the deviation is greater than a preset safety threshold, a safety management instruction is generated, and the data of the corresponding IoT device is managed for security based on the safety management instruction.

5. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor, configured to implement the steps of the data security management method based on a unified data foundation as described in any one of claims 1 to 3 when executing the computer program.

6. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, enables the data security management method based on a unified data platform as described in any one of claims 1 to 3.

Images