Method and system for multi-dimensional analysis and situation early warning of examination data

Abstract

The application relates to the technical field of education examination information security, in particular to a kind of examination data multidimensional analysis and situation early warning method and system.The method and system aim to solve the problems of data island, early warning isolation and inability to identify cross-linkage collaborative risks in the existing examination security system.The scheme includes: collecting the original state data of examination core data entities in real time from four defense levels of physics, process, personnel and data;creating a dynamic digital passport for each entity to gather and structure cross-layer data;using a hidden Markov model to establish a personnel behavior baseline and predefine cross-layer threat mode rules;conducting in-depth correlation analysis by calculating behavior deviation score and matching complex event rules;quantifying risks based on a comprehensive risk assessment formula, and automatically generating an in-depth penetration early warning report when the risk value exceeds the threshold.

Description

Technical Field

[0001] This application relates to the field of educational examination information security technology, and in particular to a method and system for multi-dimensional analysis and situational early warning of examination data. Background Technology

[0002] The fairness and impartiality of national education examinations (such as the National College Entrance Examination and postgraduate entrance examinations) are the cornerstone of social trust. The confidentiality, integrity, and controllability of core examination data, including test questions, answer sheets, and grading standards, are of paramount importance for examination security. Currently, examination security primarily relies on establishing independent physical and information management systems for each stage, including question setting, printing, transportation, storage, and grading, and on post-event traceability through decentralized log auditing.

[0003] However, existing solutions have significant shortcomings: First, security status data at each stage (such as physical environment sensor data, information system operation logs, personnel behavior records, and the data's own anti-counterfeiting labels) are in an "information silo" state, lacking effective means of correlation and integration, and unable to form a complete, unified view of a piece of data from its generation to its destruction. Second, security alerts are mostly based on simple rule thresholds triggered by a single line or single event (such as login alarms outside working hours), and cannot identify systemic and covert security threats formed by the spatiotemporal correlation of subtle anomalies in multiple independent stages, which aim to bypass a single line of defense (e.g., leaks by internal personnel). Finally, the presentation of the security posture is mostly in the form of scattered alarm lists or static reports, making it difficult for decision-makers to quickly grasp the overall risk distribution, key vulnerable links, and risk transmission paths.

[0004] It is understood that existing solutions for exam monitoring or data tracking mostly focus on preventing cheating in the exam room or the informatization of a single process. There is no complete solution that builds a four-layer defense system across physical, process, personnel, and data layers, and uses time-series behavior models and cross-layer association rules for in-depth analysis to achieve intelligent early warning of internal penetrating risks throughout the entire lifecycle of exam data. Summary of the Invention

[0005] The purpose of this invention is to overcome the shortcomings of existing examination security technologies, such as data fragmentation, isolated early warning, and unclear situational awareness, and to provide a method and system for multi-dimensional analysis and situational early warning of examination data. This method and system aim to achieve full lifecycle and cross-defense layer status perception and fusion analysis of core examination data entities. Through quantitative assessment and correlation reasoning, it can proactively detect and warn of complex internal collaborative cheating or data leakage risks, thereby improving the proactive defense and overall control capabilities of examination security management. To achieve the above objectives, the embodiments of this application disclose the following technical solutions:

[0006] In a first aspect, embodiments of this application provide a method for multi-dimensional analysis and situational early warning of examination data, the method comprising:

[0007] The system collects raw status data in real time from four defense layers covering the entire lifecycle of core examination data entities: physical layer, process layer, personnel layer, and data layer.

[0008] A dynamic digital passport is created and maintained for each of the core data entities of the examination administration. The digital passport is used to aggregate, timestamp-align, and structure the collected cross-layer raw state data related to the same core data entity of the examination administration, and generate and continuously update the structured passport state record of the entity.

[0009] Using the operational behavior sequence in the original state data of historical personnel, a baseline model of normal operational behavior is established for personnel of different roles through a hidden Markov model. At the same time, a set of threat pattern rules across the four defense layers is predefined, and the threat pattern rules are formally represented by event condition action rules.

[0010] For each of the core data entities of the examination administration, perform in-depth correlation analysis: input the current operation behavior sequence in the record into the corresponding hidden Markov model, calculate the behavior deviation score to determine single-layer behavior anomalies, and at the same time, treat the passport status record as a complex event stream and match it with the threat pattern rules to determine cross-layer threat events.

[0011] Based on the results of the in-depth correlation analysis, the comprehensive risk value of the core data entity of the examination administration is calculated using a comprehensive risk assessment formula, which is:

[0012]

[0013] in, For the comprehensive risk value, For the first Preset weights for single-layer anomalies occurring at each defense layer. This represents the deviation score or preset severity score corresponding to the single-layer anomaly event. For the first Layer and First Association weights when there are correlations between layered anomaly events. A binary function representing whether the cross-level association holds;

[0014] When the overall risk value exceeds a preset threshold, a depth penetration warning report is generated and output.

[0015] Optionally, establishing a baseline model of normal operational behavior for different roles using a Hidden Markov Model specifically includes: for a specific role's historical operational behavior sequence, defining different work intentions or task stages as the hidden states of the Hidden Markov Model, and defining specific system operation instructions as the observed states; using the historical operational behavior sequence as a training set, iteratively learning through the Baum-Welch algorithm to obtain the initial state probability distribution of the Hidden Markov Model. State transition probability matrix and the probability matrix of observed states This completes the construction of the baseline model for normal operating behavior.

[0016] Optionally, the calculation of the behavior deviation score specifically involves: for a current operational behavior sequence to be evaluated... The forward algorithm is used to compute the hidden Markov model of the corresponding role in the constructed sequence. The observed probability The behavioral deviation score Through formula The calculation shows that a higher deviation score indicates a greater deviation from the normal baseline.

[0017] Optionally, the antecedent of the threat pattern rule is a composite event composed of atomic events through timing and logical operators, and the consequent is a warning action to be triggered. The atomic event is a state assertion extracted from the passport status record of a defense layer. The timing operator includes "after" and the logical operator includes "AND".

[0018] Optionally, the threat pattern rules include:

[0019] Rule 1: When atomic event A "Personnel layer: Abnormal download operation for test question X" and atomic event B "Data layer: Digital watermark of test question X is successfully parsed in an unauthorized network environment" are detected to be true within a preset time window, an alert is triggered.

[0020] Rule 2: When an atomic event C "Physical layer: The transportation trajectory of test paper package Y deviates from the predetermined route" is detected, and then atomic event D "Process layer: The handover confirmation log of test paper package Y is abnormally modified", an early warning is triggered.

[0021] Optionally, the raw state data collected from the physical layer specifically includes: temperature and humidity data inside the secure room and the test paper transport vehicle obtained through IoT sensors, entry and exit record data obtained through the access control system, transport trajectory data obtained through the global positioning system device, and seal and open status data obtained through the electronic seal device.

[0022] The raw state data collected from the data layer specifically includes: the integrity and decoded content data of the watermark in the test question or answer sheet image obtained by the digital watermark parsing module, and the electronic document hash value obtained by the hash calculation module for integrity comparison.

[0023] Optionally, the method further includes: dynamically constructing a global security defense posture map based on the real-time passport status records and early warning reports of all core examination data entities; wherein, entities in the examination system are abstracted as nodes, and the data flow or physical movement relationships between entities are abstracted as directed edges to construct a directed graph model; based on the directed graph model, an iterative formula is used... Calculate the risk impact value of each node ,in The damping coefficient is... Indicates from node A directed edge pointing to the current node. For nodes The output degree; based on the risk impact value, the node is visually rendered and displayed in a differentiated manner.

[0024] Secondly, embodiments of this application provide a multi-dimensional analysis and situational early warning system for examination data, used to implement the above method, the system comprising:

[0025] A multi-layered data acquisition module is used to collect raw status data in real time from four defense layers;

[0026] The digital passport management module is used to create and maintain digital passports for each core data entity of the examination administration, and to generate structured passport status records.

[0027] The behavior analysis and rule management module is used to store the baseline model of normal operating behavior constructed through the Hidden Markov Model and the threat pattern rules represented in the form of event-conditional actions.

[0028] The in-depth correlation analysis engine is used to receive the passport status record, call the hidden Markov model to calculate the behavior deviation score, perform the matching of the threat pattern rules, and finally calculate the comprehensive risk value according to the comprehensive risk assessment formula.

[0029] The early warning report generation module is used to generate and output a depth penetration early warning report when the comprehensive risk value exceeds a preset threshold.

[0030] Optionally, the in-depth correlation analysis engine includes:

[0031] The behavior analysis unit has an embedded forward algorithm calculator for efficiently calculating the observation probability of the operation behavior sequence under the hidden Markov model.

[0032] The complex event processing unit is equipped with a complex event processing engine, which is used to perform atomic event recognition and time-series logic-based composite event detection on the input passport status record stream.

[0033] The multi-level data acquisition module includes:

[0034] The physical layer acquisition submodule is used to collect physical environment and trajectory data through IoT interface, access control system interface, GPS interface and electronic seal interface;

[0035] The process layer data acquisition submodule is used to collect operation logs and process status data from the question setting, printing management, examination administration and marking systems.

[0036] The personnel data collection submodule is used to collect personnel identity and operation sequence data from the identity authentication system and business logs;

[0037] The data acquisition submodule is used to extract watermark information and calculate hash values ​​from test questions, test paper packages, and answer sheet files.

[0038] Optionally, the system further includes a situation visualization module, which is configured with a key node analyzer and a graphics renderer; the key node analyzer is used to perform iterative calculations to obtain the risk impact value of each node; the graphics renderer is used to generate and display the global security defense situation map based on the risk impact value, passport status records and early warning information.

[0039] The beneficial effects of this application are as follows:

[0040] (1) This application introduces the concept of “digital passport” to integrate the status data scattered in various links and of various types around the core data entity, forming a complete and continuous life cycle archive, so that any security incident can be quickly and accurately located to the specific data entity and flow link;

[0041] (2) By applying Hidden Markov Models to model the temporal behavior of personnel, it is possible to effectively identify hidden abnormal behaviors that deviate from normal operating patterns, overcoming the shortcomings of simple rule threshold methods. Combined with cross-layer threat pattern rules, it is possible to discover major systemic risks formed by the correlation of multiple independent minor anomalies, realizing the leap from "single-point alarm" to "correlated intelligent early warning";

[0042] (3) By using a comprehensive risk assessment formula, multi-source and heterogeneous abnormal information is aggregated into a quantifiable risk value, providing an objective basis for early warning decisions. At the same time, global situation visualization based on graph algorithms can intuitively display risk distribution, key vulnerable nodes and transmission paths, greatly improving the global situation awareness and scientific decision-making capabilities of security managers. Attached Figure Description

[0043] To more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings in the following description are merely exemplary, and those skilled in the art can derive other embodiments based on the provided drawings without creative effort.

[0044] Figure 1 This is a flowchart illustrating a method for multi-dimensional analysis and situational early warning of examination data provided in an embodiment of the present invention;

[0045] Figure 2 This is a schematic diagram of the structure of a digital passport in one embodiment of the present invention;

[0046] Figure 3 This is a schematic diagram illustrating the principle of behavior analysis using a hidden Markov model in one embodiment of the present invention.

[0047] Figure 4 This is a structural block diagram of a multi-dimensional analysis and situational early warning system for examination data provided in an embodiment of the present invention;

[0048] Figure 5 This is a schematic diagram of a global security defense situation diagram in one embodiment of the present invention. Detailed Implementation

[0049] Specific embodiments of the invention will now be described in detail. Although the invention is described in conjunction with these specific embodiments, it should be understood that it is not intended to limit the invention to these specific embodiments. Rather, these embodiments are intended to cover alternative, modified, or equivalent embodiments that may be included within the spirit and scope of the invention as defined by the claims. In the following description, numerous specific details are set forth in order to provide a thorough understanding of the invention. The invention may be practiced without some or all of these specific details.

[0050] When used in conjunction with the terms "comprising," "method comprising," or similar language in this specification and appended claims, the singular forms "a," "some," and "the" include plural references unless the context clearly indicates otherwise. Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0051] The following description, with reference to the accompanying drawings, illustrates a method and system for multi-dimensional analysis and situational early warning of examination data according to embodiments of the present invention. By constructing a "digital passport" tracking system covering the entire data lifecycle and a cross-defense layer in-depth correlation analysis model, discrete single-point anomalies can be intelligently linked into a systemic risk chain. This enables early detection and accurate early warning of potential internal collaborative cheating and complex leakage paths, thereby elevating examination security management from post-event tracing and passive response to pre-event prevention and proactive immunity.

[0052] Specifically, by creating a "digital passport" for each "core examination data entity" throughout its lifecycle, the system for the first time aggregates and correlates isolated data from four defense layers: physical environment, business processes, personnel operations, and data ontology. This allows any security incident to be quickly and accurately located to the specific data entity, workflow, and associated personnel, solving the problems of data fragmentation and difficulty in traceability in traditional models. This method not only uses Hidden Markov Models to quantitatively identify single-point behavioral anomalies but also uses predefined cross-layer threat pattern rules to perform correlation analysis on multi-source anomaly events that conform to specific spatiotemporal logical relationships. This mechanism can effectively identify high-risk penetration behaviors composed of multiple independent low-risk anomalies linked together, aiming to circumvent a single line of defense, significantly improving the ability to detect covert and collaborative security threats. Through a comprehensive risk assessment formula, multi-source heterogeneous risk information is aggregated into a comparable and decision-making comprehensive risk value. This transforms early warning decisions from relying on subjective experience to being based on objective quantitative indicators, allowing managers to respond according to clear risk thresholds and optimizing the efficiency of emergency resource allocation. The behavioral baseline model can be continuously learned and updated using historical data, while the threat pattern rule base can be dynamically expanded based on emerging risks. Furthermore, global situational awareness analysis based on graph algorithms can identify key vulnerable nodes in the network. Together, these factors enable the system to self-evolve, continuously adapting to evolving cheating methods and management vulnerabilities, achieving a spiral-like improvement in security defense capabilities.

[0053] The following is in conjunction with the appendix Figure 1-5 The preferred embodiments of the present invention will be described in detail so that those skilled in the art can implement the present invention accordingly.

[0054] A method for multi-dimensional analysis and situation early warning of examination administration data, the method includes:

[0055] S100 collects raw status data in real time from four defense layers: physical layer, process layer, personnel layer and data layer, covering the entire life cycle of core examination data entities.

[0056] The raw state data collected from the physical layer specifically includes: temperature and humidity data inside the secure room and the test paper transport vehicle obtained through IoT sensors; entry and exit record data obtained through the access control system; transport trajectory data obtained through GPS devices; and sealing and opening status data obtained through electronic seal devices.

[0057] The raw state data collected from the data layer specifically includes: the integrity and decoded content data of the watermark in the test question or answer sheet image obtained through the digital watermark parsing module, and the electronic document hash value obtained through the hash calculation module for integrity comparison.

[0058] It should be noted that core examination data refers to critical data generated, used, and stored throughout the entire process of organizing and managing national education examinations. This data is highly confidential and sensitive, and its security directly impacts the fairness, impartiality, and credibility of the examination. It encompasses the information assets most critically protected for examination security. This primarily includes: test question data, encompassing all versions of questions and answers, including shortlisted questions, backup questions, official examination papers, and supplementary papers; answer sheet data, i.e., images of answer sheets generated after candidates answer, computer-based test records, and the paper answer sheets themselves; scoring data, i.e., scoring standards, reference answers, scoring details, and officially generated candidate scores; and other derivative data, i.e., data generated based on the above core data that can be used to deduce core content, such as statistical analysis of test questions and the logic behind score synthesis. The core examination data entity, on the other hand, refers to a specific instance or physical / digital carrier of core examination data within a specific examination activity, possessing a clear lifecycle boundary, unique identifiability, and independent traceability. It is the materialization or instantiation of core examination data in a specific business scenario.

[0059] The physical layer monitoring focuses on the physical environment, carriers, and flow paths of the core examination data entities. Data collection relies on IoT devices and sensor networks deployed at key nodes. Temperature and humidity data are continuously collected using digital temperature and humidity sensors installed in the secure room, exam paper storage room, and transport vehicles. This data is used to monitor whether the storage environment meets confidentiality management regulations (e.g., temperature 20±2°C, humidity 50%±5%), preventing deformation or damage to paper exam papers or malfunction of electronic equipment due to unsuitable environments. It is understood that environmental disorder may indirectly affect physical security or equipment reliability. Entry and exit record data is automatically obtained through a networked access control system (e.g., card swiping, fingerprint, or facial recognition systems). The time and identity information of all personnel entering and exiting the secure area are recorded in real time, forming an accurate physical access log, which is crucial for achieving "person-place-time" correlation and traceability. Transportation trajectory data is collected through GPS / BeiDou positioning terminals installed on exam paper transport vehicles. These terminals report the vehicle's geographical coordinates, speed, and timestamp at a preset frequency (e.g., every 30 seconds), forming a continuous trajectory stream. This data is used to verify in real time whether the transportation route complies with the established safety plan and to promptly detect risks such as abnormal stops and route deviations. The seal / opening status data is obtained through electronic seal devices installed on the test paper bags and safes. These seals typically have a built-in irreversible anti-tampering mechanism; once illegally opened or damaged, they immediately send a status change alarm to the system via a wireless network (such as NB-IoT), providing real-time digital proof of the physical seal integrity.

[0060] The data layer monitors the intrinsic attributes and integrity of the core examination data entities themselves. Its collection is independent of the external environment, relying instead on proactive analysis of data files or image content. Digital watermark parsing data, through an integrated digital watermark parsing software module, detects files such as electronic exam questions and scanned answer sheets. This module can extract specific watermark information (an invisible or difficult-to-detect identifier) ​​hidden within the file content and verify its integrity. Watermark encoding is typically bound to the unique ID of the data entity. If the file is copied, photographed, or partially tampered with, the watermark information may be lost or decoded abnormally, triggering an alarm. Electronic file hash values ​​are calculated for any electronic form of examination documents using a hash calculation module (such as calling the SHA-256 algorithm). The hash algorithm maps file data of any length to a fixed-length, unique "digital fingerprint." Even a single bit change in the file content will drastically alter its hash value. The system pre-stores the base hash value during the file generation or authorization transfer stage, which can be recalculated and compared at any subsequent stage, thereby efficiently and reliably verifying whether the data has been tampered with during transmission or storage.

[0061] Personnel-level raw status data refers to the recorded data collected in information systems that is directly related to the digital identity authentication and operational behavior of natural persons (examination staff) on core examination data entities or their related systems. It originates from systems such as the question-setting management system, printing management system, examination execution system, online marking system, and grade management system. Specific data includes operation logs, approval status, and process node status.

[0062] Raw state data at the data layer refers to characteristic data extracted or calculated directly from the digital content of the core examination data entity using specific algorithms or technologies. This data is used to verify the authenticity, integrity, and origin of the entity. It originates from the unified identity authentication system, operating system logs, database access logs, and application system operation audit logs. Specifically, this data includes identity authentication data and sequences of operational behaviors.

[0063] Understandably, by collecting raw state data from four defense layers, the originally scattered and heterogeneous physical security events (such as door openings) and data integrity states (such as hash values) are transformed into structured digital records with spatiotemporal tags. This makes it possible to create a comprehensive and continuous digital mirror image of each core examination data entity, an indispensable raw material for building a "digital passport." Logs that integrate physical sensor data (such as GPS coordinates and access control records) and digital feature data (such as hash values ​​and watermarks) constitute an irrefutable and mutually corroborating chain of electronic evidence. In the event of a security incident, this chain of evidence can clearly demonstrate "who, when, where, what data, and what impact," providing a solid technical basis for subsequent liability determination and process improvement.

[0064] S200. Create and maintain a dynamic digital passport for each core data entity of the examination administration. The digital passport is used to aggregate, timestamp-align, and structure the collected cross-layer raw status data related to the same core data entity of the examination administration, and generate and continuously update the structured passport status record of the entity.

[0065] Specifically, the "digital passport" is not a simple database record, but a proactively managed and dynamically evolving data object. When a new core examination data entity is officially registered in the system (e.g., after the test questions are entered into the database in the question-setting system), the system triggers the passport creation process. This process first assigns a globally unique passport identifier (e.g., generated using a UUID algorithm) to the entity and strongly binds this identifier to the entity's original identifier in the business system (e.g., test question number "GK2024-MATH-A-001"), ensuring a one-to-one correspondence. This identifier becomes the unique index key for all subsequent related data aggregation. The system monitors data streams from four defense layers. The data aggregation engine, based on preset rules, identifies the core examination data entity identifier associated with each incoming raw status data. For example, a record from the access control system, "Zhang San, 2024-06-01 20:15, entered the secure room of the test center," will be associated with all test question entity IDs located in that secure room at that time through the rule engine; a log from the print management system, "Test question 'GK2024-MATH-A-001' has been sent to the printing workshop," will be directly associated with the corresponding passport. All data identified as related to the same passport identifier, regardless of its source (physical sensor or business system), is pushed to the data receiving buffer of that passport in real time. Due to the diverse data sources, there may be millisecond-level deviations in the clocks of different systems. To achieve accurate time-series analysis, this step includes a timestamp alignment sub-process. When receiving data, in addition to recording the event timestamp inherent in the data, the system also uniformly appends a high-precision system receiving timestamp. For the analysis of critical event chains, the Network Time Protocol (NTP) can be used to synchronize the clocks of each data source, or calibration can be performed based on a reliable time source to ensure that the chronological order of events across layers can be accurately restored. Furthermore, fields from different data sources (such as location coordinate formats and operation codes) are standardized to conform to a standard data format defined internally by the system. The standardized data is organized into structured "status entries" and appended to the passport's "status record list" in chronological order. Each status entry can be designed as a data structure with fixed fields. This structuring process transforms unstructured log or streaming data into ordered records that are easy to query, analyze, and visualize. Passport status records are continuously updated throughout the entity's existence, forming a complete "digital footprint."

[0066] S300: Utilizing the operational behavior sequences in the original state data of historical personnel, a baseline model of normal operational behavior is established for personnel of different roles through a hidden Markov model. At the same time, a set of threat pattern rules across four defense layers is predefined. The threat pattern rules are formally represented using event-conditional action rules.

[0067] Specifically, establishing a baseline model of normal operational behavior for personnel in different roles using a Hidden Markov Model (HMM) includes: for a specific role's historical operational behavior sequence, defining different work intentions or task stages as the hidden states of the HMM, and defining specific system operation instructions as the observed states; using the historical operational behavior sequence as a training set, iteratively learning through the Baum-Welch algorithm to obtain the initial state probability distribution of the HMM. State transition probability matrix and the probability matrix of observed states This completes the construction of a baseline model for normal operating behavior.

[0068] The antecedent of a threat pattern rule is a composite event consisting of atomic events through timing and logical operators, and the consequent is the warning action to be triggered. An atomic event is a state assertion extracted from a passport state record of a defense layer. The timing operator includes "after" and the logical operator includes "AND".

[0069] Furthermore, the threat pattern rules include:

[0070] Rule 1: When atomic event A "Personnel layer: Abnormal download operation for test question X" and atomic event B "Data layer: Digital watermark of test question X is successfully parsed in an unauthorized network environment" are detected to be true within a preset time window, an alert is triggered.

[0071] Rule 2: When an atomic event C "Physical layer: The transportation trajectory of test paper package Y deviates from the predetermined route" is detected, and then atomic event D "Process layer: The handover confirmation log of test paper package Y is abnormally modified", an early warning is triggered.

[0072] It's important to note that Hidden Markov Models (HMMs) are classic time-series probabilistic models, particularly suitable for describing scenarios where only the output (specific operations) of a system can be observed externally, while its internal true state (behavioral intent) remains unseen. This perfectly aligns with the reality of exam administration monitoring, where "only operation logs are visible, but the operator's true purpose cannot be directly ascertained." The hidden state set is defined as the operator's potential, unobservable "work intent" or "task phase." For example, for a "provincial-level exam administrator," their hidden states might include: {"daily exam question setting and maintenance," "exam question review and revision," "emergency task handling," "non-working state"}. The observed state set is defined as the specific "system operation instructions" that can be directly captured from the system logs. For example: {"login to system," "browse question bank," "edit exam questions," "submit for review," "download complete question package," "user logout"}. The observed sequence is the ordered list of operation instructions generated by a person during a work session, i.e., the behavioral sequence in the "personnel-level original state data."

[0073] The training and construction process for the baseline model of normal operating behavior is as follows: Collect a large number (hundreds to thousands) of historical normal operating sequences for this role as a training set. This data should come from compliant work cycles without security incidents. The Baum-Welch algorithm is an unsupervised learning algorithm that iteratively optimizes and solves for the following model parameters:

[0074] Initial state probability distribution : Represents the initial probability of the character being in each hidden state (intent) when starting work.

[0075] State transition probability matrix Elements in the matrix Indicates from hidden state Move to hidden state The probability of this shift reflects the pattern of job intention transitions (e.g., a higher probability of transitioning from "routine question setting" to "test question review," and a lower probability of jumping directly to "urgent tasks").

[0076] Observation state probability matrix Elements in the matrix Indicates when in a hidden state At that time, an observation state is generated. The probability of (specific operation). This reflects the likelihood of performing various operations under a specific intention (e.g., in the "daily question setting" state, the observed probability of "editing questions" is high, while the observed probability of "downloading the complete question package" is extremely low).

[0077] After training, an HMM model for that specific role is obtained. This model serves as the baseline for normal operational behavior, encoding the typical timeline and operational habits of this role's compliance work.

[0078] Atomic events in threat models constitute the basic units of rules. They are assertions extracted from "passport status records" that can be judged as true or false. They describe a specific state at a single defense layer, such as: personnel layer.behavioral deviation score > threshold, or data layer.file hash value != baseline value. Composite events (rule antecedents) combine multiple atomic events using logical operators (such as "AND ∧" and "OR ∨") and temporal operators (such as "after →") to define more complex risk scenarios. For example, (event A ∧ event B) means A and B occur simultaneously; (event C → event D) means D occurs after C. Warning actions (rule consequents) are actions automatically executed by the system when the composite event described by the antecedent is detected as "true," triggering a warning of a specific level.

[0079] The atomic event A in Rule 1 above depends on the Hidden Markov Model (HMM). When an operation sequence for question X is monitored, the behavioral deviation score calculated by the HMM (e.g., using the forward algorithm) is used. This event is valid when the number of points (converted to a score) is abnormally high. Atomic event B relies on data layer monitoring. This event is valid when the digital watermark of question X is successfully parsed on an unauthorized server, network node, or internet environment. The correlation logic is to perform an AND operation between "abnormal personnel behavior" and "evidence of substantial data leakage" within a time window (e.g., 72 hours). This describes a high-risk scenario: after suspicious actions by internal personnel, the data content quickly appears externally. Individual events may result in false alarms (e.g., A may be a misoperation, B may be a false detection), but the correlation between the two greatly increases the certainty of the risk.

[0080] Atomic event C in rule 2 above relies on physical layer GPS data. It determines whether the vehicle trajectory transporting test paper package Y significantly and continuously deviates from the preset electronic fence route. Atomic event D relies on process layer logs. It checks whether there are unauthorized modifications to the database logs responsible for recording the handover of test paper package Y, made outside of working hours, or initiated from unknown IP addresses. The correlation logic uses the "after" operator. This describes a possible attempt to cover up theft: first, tampering with the electronic handover record through hacking or internal privileges (creating the illusion of a "compliant handover"), and then actually driving the vehicle to an abnormal location to perform illegal operations. This timing logic can effectively identify well-planned attacks designed to deceive process audits.

[0081] Understandably, traditional alerts based on fixed thresholds (such as "downloads > 3 times") cannot distinguish between "high-frequency downloads under urgent tasks" and "malicious theft," resulting in a high false alarm rate. The HMM behavioral baseline model, by learning the probability distribution of normal behavior sequences, can quantify the "normality" of any given sequence of operations, thereby accurately identifying seemingly legitimate but unusual "gray operations," significantly improving the accuracy of internal threat detection. A single-dimensional anomaly (such as a login outside of working hours) may be insignificant, but if it is associated with an event in another dimension (such as a watermark leak), it constitutes a significant threat. This step, through formalized rules, transforms for the first time this expert experience requiring multi-dimensional, spatiotemporal correlation analysis into automatically executable, real-time detection logic. Rules 1 and 2 are typical examples of this type of analysis, capable of discovering collaborative risks that traditional independent systems could never identify. Both the low probability values ​​(behavioral deviations) calculated by the HMM and the triggered threat rules provide a clear, data- and logic-based "chain of evidence" for early warning. This allows security personnel to not only receive alerts, but also understand "why the alert was issued," thereby supporting faster and more accurate emergency decision-making.

[0082] S400. For each core data entity of the examination administration, perform in-depth correlation analysis on the current passport status record: input the current operation behavior sequence in the record into the corresponding hidden Markov model, calculate the behavior deviation score to determine single-layer behavior anomalies, and at the same time, treat the passport status record as a complex event stream and match it with threat pattern rules to determine cross-layer threat events.

[0083] Specifically, the calculation of the behavioral deviation score is as follows: for a current operational behavior sequence to be evaluated... The forward algorithm is used to compute the hidden Markov model of the corresponding role in the constructed sequence. The observed probability Behavioral deviation score Through formula The calculations show that a higher score indicates a greater deviation from the normal baseline.

[0084] Specifically, the forward algorithm is an efficient dynamic programming algorithm for Hidden Markov Models (HMMs), specifically designed to solve the "Evaluation Problem," that is, to compute the evaluation of a given observation sequence. In a specific model The probability of the following occurrence This algorithm avoids the computational disaster caused by directly enumerating all possible state sequences through recursive computation, thus reducing the computational burden on model parameters. Given the known information, it can be obtained quickly. . This represents the currently observed sequence of operations. This suggests a possibility that the individual's behavior aligns with the baseline model λ for normal behavior within that role. This is a value between 0 and 1. A higher value indicates that the sequence is more common and conforms to historical normal patterns; a lower value (e.g., close to 0) indicates that the sequence is very rare or bizarre, and extremely unlikely to have been generated by normal working intent. Use the probability value directly. It's inconvenient to set thresholds and make comparisons because it's usually a very small number. Therefore, using a formula... A transformation is performed. The logarithmic function maps extremely small probability values ​​(such as 0.000001) to a moderate positive number (such as 6), making the numerical scale more favorable. The negative sign performs the inverse mapping. Because... The smaller the value, the more abnormal it is; after taking the negative logarithm, The larger the value, the more intuitively it represents "the higher the deviation". For example, a normal sequence with a probability of 0.9 has a score of approximately 0.05; while a sequence with a probability of... The abnormal sequence had a score of 6. The score amplifies the difference between the abnormal and normal sequences. The calculated... The score will be compared to a preset threshold. This threshold is typically determined by calculating the distribution of scores over historical normal data and selecting a high percentile (such as the 99th percentile). If the threshold is exceeded, the current operation sequence is determined to be a "single-layer behavior anomaly". This "abnormal event" itself will be treated as an atomic event and input into the subsequent complex event processing engine for cross-layer rule matching.

[0085] The input for cross-layer threat pattern matching based on the Complex Event Processing (CEP) engine is a stream of "passport status records" generated in S200, ordered by timestamps, concerning a specific core examination data entity. The complex event stream treats the continuously updated passport status records as an event stream, with each record carrying attributes such as defense level, event type, timestamp, and entity ID. The CEP engine first identifies atomic events from the stream based on predefined templates. These templates correspond to atomic event assertions defined in S300. For example, when a personnel-level record's behavior deviation score exceeds a threshold, it is identified as atomic event A, "Personnel Level: Abnormal Download Operation for Question X"; when a data-level record shows a watermark being resolved on an unauthorized IP, it is identified as atomic event B. The engine maintains a sliding time window in memory, continuously tracking all identified atomic events. It checks, according to the threat pattern rules (rule antecedents) predefined in S300, whether there exists a combination of atomic events that satisfies specific logical and temporal relationships within the specified time window. For example, rule one requires detecting that "atomic events A and B" are simultaneously true within the window; rule two requires detecting that "atomic event D occurs after atomic event C". Once the engine detects that the antecedent (composite event) of a rule is fully satisfied, it considers a threat pattern to be matched. Subsequently, the engine immediately executes the consequent of the rule, that is, sends a signal to the warning module that a "cross-layer threat event" has occurred.

[0086] Understandably, by using HMM and forward algorithms, the system no longer relies on coarse-grained rules such as "download count > 5 times," but can instead quantify and assess the overall anomaly probability of behavioral sequences. This allows the system to detect "low, slow, and small" penetration behaviors where each step seems within their authority, but the combination is highly illogical, greatly enhancing its ability to detect internal abuse of power or information theft. Through the CEP engine, the system can capture, with millisecond latency, real-time events in massive event streams that are scattered across different systems and at different times, but interconnected to form a complete attack chain. For example, while "logs were modified" or "vehicles deviated from their routes" can be explained individually, the CEP engine can immediately identify the suspicious attempt to cover up the "vehicle deviation after log modification." This is something that manual inspection or independent system analysis cannot achieve.

[0087] S500. Based on the results of in-depth correlation analysis, the comprehensive risk value of the core data entities in the examination administration is calculated using a comprehensive risk assessment formula. The comprehensive risk assessment formula is as follows:

[0088]

[0089] in, For the comprehensive risk value, For the first Preset weights for single-layer anomalies occurring at each defense layer. This represents the deviation score or preset severity score corresponding to the single-layer anomaly event. For the first Layer and First Association weights when there are correlations between layered anomaly events. A binary function representing whether the cross-layer association holds.

[0090] Specifically, This represents the baseline value for single-layer anomaly risk. (Single-layer anomaly severity score) represents the severity score at the first layer. The severity of anomalies detected at each defense layer. For the personnel layer, The behavior deviation score is directly taken from the S400 calculation for the physical layer, process layer, and data layer. In one alternative implementation, the severity score is preset based on the type of abnormal event at that layer. (Defense layer weight) is a preset coefficient representing the weight of the first defense layer. The relative importance of each defense layer within the overall security system. Weighting should be based on business logic; for example, the data layer has the highest weight because data leakage or tampering is the ultimate risk; the personnel layer has the next highest weight because internal personnel are one of the biggest threat sources; the process and physical layers have relatively lower weights, but their anomalies are often precursors or accompanying phenomena of other risks. This section calculates the sum of the risk contributions of all single-layer anomalies.

[0091] This represents the increased risk associated with cross-level connections. It is an indicator function whose value depends on whether the complex event processing engine in the S400 detects the first... Layer and First There are correlations between layered anomalous events that conform to threat rules. If a correlation is established, then... If not, then . It is a preset, and usually significantly larger than a single one. The coefficient represents the additional, amplified risk that arises when two anomaly events from different defense layers are proven to have a logical or temporal correlation. This design stems from a fundamental understanding in the security field: the synergistic occurrence of multi-dimensional anomalies poses a risk far greater than the simple sum of the individual anomalies, often indicating a purposeful and planned attack. This section iterates through all possible combinations of defense layers. Apply an additional risk bonus to all valid association pairs. .

[0092] S600 When the comprehensive risk value exceeds the preset threshold, generate and output a depth penetration early warning report.

[0093] In one optional implementation, the preset threshold is set using a historical data calibration method. That is, during the trial operation phase of system deployment, the distribution of the comprehensive risk value R under a large number of normal business cycles is collected. The preset threshold T is set at a high percentile (e.g., 99% or 99.5%), ensuring that the R value is lower than T in most normal situations, thereby controlling the false alarm rate of the system during stable periods.

[0094] In another optional implementation, the preset threshold is set through risk scenario simulation. Combining the threat pattern rules defined in S300, security experts can simulate typical risk scenarios (such as "insiders attempting to steal exam questions"), calculate the theoretical R-value range for this scenario through system simulation, and set a threshold that can reliably capture such scenarios. The preset threshold T can be globally uniform, or it can be configured differently and dynamically based on different stages (such as the question-setting period, transportation period) or different types (such as top secret, confidential).

[0095] when In this case, the system does not simply display a "high risk" warning, but automatically generates a detailed and comprehensive in-depth risk warning report with a complete chain of evidence. This report is automatically synthesized by aggregating relevant data and intermediate results from all preceding steps, and includes at least the following parts: risk overview, risk tracing and evidence chain, related contextual information, and preliminary handling recommendations.

[0096] The generated early warning reports will be output through preset channels to ensure timely delivery. Output formats include pushing to the large screen of the examination security command center, sending to the terminals of relevant personnel, and storing in the security incident database.

[0097] Optionally, the above method also includes dynamically constructing a global security defense posture map based on the real-time passport status records and early warning reports of all core examination data entities; wherein, entities in the examination system are abstracted as nodes, and the data flow or physical movement relationships between entities are abstracted as directed edges; based on a directed graph model, an iterative formula is used. Calculate the risk impact value of each node ,in The damping coefficient is... Indicates from node A directed edge pointing to the current node. For nodes The output degree; based on the risk impact value, the nodes are visually rendered and displayed in a differentiated manner.

[0098] Specifically, the construction process of a directed graph model includes: abstracting all traceable and active entities in the examination administration system as nodes in the graph. This includes, but is not limited to, personnel entities, physical entities, and data / process entities. The interactions, flows, or influences between entities are abstracted as directed edges, with the direction representing the potential transmission direction of risks or influences. For example: the exam paper package from the question-setting experts... Transferred to transport vehicles Then there exists a path from point to The edge. Custodian Responsible for the safekeeping of the confidential room Then there exists a path from point to Management responsibility side. Server Stores test questions Then there exists a path from point to The storage depends on the edges. The topology (nodes and edges) of the directed graph is not predefined statically, but is dynamically constructed and updated based on the real-time relationships implied in the "passport status record" in step S200. For example, when the passport record shows "Question A was uploaded to server C by person B", the system automatically creates or updates nodes B and C and the directed edges between them.

[0099] Iteration formula The design concept draws on the PageRank algorithm in network analysis to measure a node’s “influence” or “vulnerability” in the entire risky network. This is the risk impact value of the current node to be calculated. The higher the value, the more critical the node's position is in the global risk network, and the more likely its own risks or abnormal states are to trigger systemic impacts. The damping coefficient is a preset constant between 0 and 1. It represents the attenuation ratio of the risk impact transmitted along the network edges. This represents a randomness factor, ensuring algorithm convergence. This indicates the existence of a slave node. Point to the current node Directed edges. Summation symbol. Traverse all such predecessor nodes . It is a node The out-degree, i.e., from node The number of edges originating from other nodes. This value is used to normalize the nodes. Distribution of influence The influence of a node will be evenly distributed among all the successor nodes it points to. For nodes The real-time risk status value. This value can be combined with the node's... The combined risk value of its own abnormal state (such as deviation from the score of personnel behavior, equipment failure status) and all associated "passport entities". (From S500) Aggregated. This calculation process is iterative. The system assigns initial values ​​to all nodes. The value is calculated as 1 / N, where N is the total number of nodes. The above formula is then applied iteratively until all nodes reach a certain value. If the value change is less than a very small threshold, the computation is considered convergent, and a stable global value is obtained. Value distribution.

[0100] Then, based on the calculation of each node after convergence... The values ​​are visualized and encoded. Nodes with higher values ​​are displayed on the graph with larger sizes, more prominent colors (such as dark red), and stronger pulse animation effects. The thickness or color intensity of edges can map their weights or the real-time risk traffic they carry (such as the number of associated abnormal events). This ultimately forms a global security defense posture map, a dynamic and interactive topology map that visually displays: which personnel, warehouses, and vehicles are current risk "hubs"; on which business paths (edges) risks are concentrated; and in which local area of ​​the graph a newly triggered alert (from S600) is located.

[0101] It is understandable that by adopting a multi-dimensional analysis and situation warning method for examination management data of the present invention, by introducing the concept of "digital passport", the status data scattered in various links and types are integrated around the core data entity, forming a complete and continuous life cycle file, so that any security event can be quickly and accurately located to a specific data entity and its transfer link; by applying the Hidden Markov Model to model the sequential behavior of personnel, it can effectively identify hidden abnormal behaviors that deviate from the normal operation mode and overcome the deficiencies of the simple rule threshold method. Combining with the cross-layer threat pattern rules, it can discover major systemic risks formed by the association of multiple independent minor anomalies, achieving the leap from "single-point warning" to "associated intelligent warning"; through the comprehensive risk assessment formula, multi-source and heterogeneous abnormal information is aggregated into a quantifiable risk value, providing an objective basis for warning decision-making. At the same time, the global situation visualization based on graph algorithms can intuitively display the risk distribution, key vulnerable nodes and conduction paths, greatly enhancing the global situation perception and scientific decision-making ability of security managers.

[0102] Hereinafter, specific embodiments will be listed to illustrate a multi-dimensional analysis and situation warning method and system of the embodiments of the present invention schematically. In this embodiment, the "Mathematics Test Paper A of the National Unified College Entrance Examination in 2025" is used as the core data entity for examination management, and the implementation process of the present invention will be described in detail.

[0103] The system collects the relevant data of this test paper in real time from four levels through sensors and interfaces deployed in each link.

[0104] The data collected at the physical layer includes: collecting the temperature, humidity and access control records of the confidentiality room of the proposition center; collecting the GPS trajectory data of the test paper transportation vehicle and the opening and closing status of the electronic seal. For example, the data "At 14:30 on May 20, 2025, the vehicle with the license plate 'Beijing A-XXXXX' stayed on the XX section of the non-planned route for more than 30 minutes during transportation" is obtained.

[0105] The data collected at the process layer includes: collecting the creation, review and finalization logs of the test questions from the proposition management system; collecting the layout, printing task list and completion status of this test question from the printing management system. For example, the log record shows that "Test Paper A was downloaded by user 'Zhang San' (a member of the proposition group) at 23:15 on May 18".

[0106] The data collected at the personnel layer includes: collecting the login time and IP address of 'Zhang San' from the unified identity authentication system; collecting his operation sequence from the system audit log, such as "login -> search for 'final questions' -> preview test question details -> download the complete question package".

[0107] The data collected by the data layer includes: confirming the watermark code "MATH2025-A-SECRET" embedded in the test question file through the digital watermark parsing module; calculating the MD5 hash value "a1b2c3d4..." of the test question file through the hash calculation module, and comparing it with the benchmark value.

[0108] The digital passport management module creates a unique passport identifier "PSP-2025-MATH-A" for the "2025 National College Entrance Examination (NCEE) Mathematics Paper A". This passport contains a list of status entries. The system sorts and formats the collected cross-layer data by timestamp and appends it as a new status entry to the passport. For example, a status entry is generated as follows: {Timestamp: 2025-05-20 14:30, Defense Layer: Physical Layer, Status Summary: Abnormal Stop of Transport Vehicle Trajectory, Data Index: GPS_LOG_001}.

[0109] The Behavior Analysis and Rule Management module performs the following tasks:

[0110] Historical operation logs of all question-setting team members during their normal working hours over the past three years were collected as the training set. "Routine editing," "internal review," and "final submission" were defined as hidden states, while "saving drafts," "submitting for review," and "downloading files" were defined as observed states. The Baum-Welch algorithm was used to optimize the Hidden Markov Model (HMM) parameters for the "question-setting team member" role. Training was performed to obtain a baseline model of the character's normal behavior. .

[0111] Define threat pattern rules. For example, define a rule: "If (atomic event 1: personnel level - deviation score of test question setter behavior > 90) and (atomic event 2: data level - the test question watermark is detected by unauthorized IP) occur within 72 hours, then trigger the 'high risk of leakage' warning."

[0112] The in-depth correlation analysis engine loads the current status record of the "PSP-2025-MATH-A" passport.

[0113] The engine extracts a series of actions performed by user "Zhang San" on the night of May 18th, forming sequence O, and inputs it into the model. The forward algorithm was used to calculate... The probability is extremely low, and therefore... The calculated behavioral deviation score is 95 (threshold set to 80).

[0114] The engine treats "behavior deviation score = 95" as atomic event 1. Simultaneously, it learns from information subscribed to in the data layer that on May 19th, the watermark "MATH2025-A-SECRET" was recorded and attempted to be resolved at a certain overseas IP address (atomic event 2). The complex event processing engine detects that these two atomic events occurred within 72 hours and have an AND relationship, perfectly matching the predefined rules in step three.

[0115] The engine is based on the formula Calculate the overall risk value. Set the anomaly weights for the personnel level. Its score Data layer anomaly weights Its default severity The correlation weight between the two The association is established. .

[0116] The calculation yields: .

[0117] The preset risk threshold is 75. Because... The early warning report generation module automatically generates an in-depth early warning report. The report includes: risk entity (2025 National College Entrance Examination Mathematics Paper A), risk value (88.3), details of triggering rules, associated personnel (Zhang San), associated abnormal links (abnormal operation, watermark leakage), and suggested handling measures (immediately verify Zhang San's account, trace the source of watermark leakage, and assess whether the test questions need to be replaced).

[0118] The situational visualization module acquires the status and early warning information of all test questions. It abstracts elements such as test creators, warehouses, transport vehicles, and test centers as graph nodes, and data flow relationships as edges. It utilizes iterative formulas... Calculate the risk impact value of each node. For example, the calculation found that the impact values ​​of the "Zhang San" node and the "Beijing A-XXXXX transport vehicle" node increased significantly, and were highlighted in red on the situation map, indicating that the examination command center and these two points are the key risk hubs in the current network.

[0119] The system used to implement the above method includes:

[0120] The multi-layered data acquisition module consists of a physical layer acquisition submodule that connects to temperature and humidity sensors and GPS terminals via an IoT gateway; a process layer acquisition submodule that pulls logs from various business systems via a database connector or API; a personnel layer acquisition submodule that interfaces with an LDAP / AD authentication server and an operation audit database; and a data layer acquisition submodule that integrates a digital watermark decoding SDK and a hash calculation library.

[0121] The digital passport management module consists of passport registration service, data aggregation service and status record database, providing CRUD (Create, Read, Update, Delete) and status update interfaces for passports.

[0122] The model and rule base module includes an HMM model library and a rule base. The HMM model library stores pre-trained baseline model files for each role; the rule base stores threat pattern rules in a format compatible with rule engines such as Drools.

[0123] The in-depth correlation analysis engine, as the core computing unit, includes a behavior analysis unit (integrating forward algorithms) and a complex event processing unit (such as the Esper engine). It subscribes to the change flow of the digital passport and calls upon the model and rule base for calculation and matching.

[0124] The early warning report generation module receives risk events output by the engine, generates structured early warning reports according to templates, and distributes them to examination security personnel through message queues, APIs, or interface notifications.

[0125] The situation visualization module includes a graph computing engine (such as Neo4j or an in-memory graph computing library) and a web graphics rendering front-end (such as ECharts or G6), providing an interactive global situation dashboard.

[0126] This application also provides a multi-dimensional analysis and situational early warning system for examination data, used to implement the aforementioned multi-dimensional analysis and situational early warning method for examination data. The system includes: a multi-level data acquisition module for real-time acquisition of raw status data from four defense levels; a digital passport management module for creating and maintaining digital passports for each core examination data entity and generating structured passport status records; a behavior analysis and rule management module for storing a baseline model of normal operating behavior constructed using a hidden Markov model and threat pattern rules formalized using event-conditional actions; a deep correlation analysis engine for receiving passport status records, calling the hidden Markov model to calculate behavior deviation scores, performing threat pattern rule matching, and finally calculating a comprehensive risk value based on a comprehensive risk assessment formula; and an early warning report generation module for generating and outputting a deep penetration early warning report when the comprehensive risk value exceeds a preset threshold.

[0127] Furthermore, the in-depth correlation analysis engine includes: a behavior analysis unit, which has an embedded forward algorithm calculator for efficiently calculating the observation probability of the operation behavior sequence under the Hidden Markov Model; and a complex event processing unit, which is equipped with a complex event processing engine for performing atomic event recognition and time-series logic-based composite event detection on the input passport status record stream.

[0128] The multi-layered data acquisition module includes: a physical layer acquisition submodule, used to collect physical environment and trajectory data through IoT interfaces, access control system interfaces, GPS interfaces, and electronic seal interfaces; a process layer acquisition submodule, used to collect operation logs and process status data from the question setting, printing management, examination administration, and marking systems; a personnel layer acquisition submodule, used to collect personnel identity and operation sequence data from the identity authentication system and business logs; and a data layer acquisition submodule, used to extract watermark information and calculate hash values ​​from test questions, test paper packages, and answer sheet files.

[0129] Optionally, the system also includes a situation visualization module, which is equipped with a key node analyzer and a graphics renderer. The key node analyzer is used to perform iterative calculations to obtain the risk impact value of each node. The graphics renderer is used to generate and display a global security defense situation map based on the risk impact value, passport status records and early warning information.

[0130] It should be noted that the foregoing explanation of an embodiment of a method for multi-dimensional analysis and situational early warning of examination data also applies to an embodiment of a system for multi-dimensional analysis and situational early warning of examination data, and will not be repeated here.

[0131] The detailed description of the above specific embodiments fully illustrates the feasibility, preferred implementation, and technical effects achieved by the technical solution of the present invention. Those skilled in the art can make several modifications and substitutions based on the above description without departing from the principles and spirit of the present invention, and these modifications and substitutions should also be considered within the scope of protection of the present invention.

[0132] The present invention and its embodiments have been described above. This description is not restrictive, and the accompanying drawings are only one embodiment of the present invention. The actual method is not limited to this. In conclusion, if those skilled in the art are inspired by this description and design similar methods and embodiments without departing from the spirit of the present invention, they should all fall within the protection scope of the present invention.

Claims

1. A method for multi-dimensional analysis and situational early warning of examination data, characterized in that, The method includes: The system collects raw status data in real time from four defense layers covering the entire lifecycle of core examination data entities: physical layer, process layer, personnel layer, and data layer. A dynamic digital passport is created and maintained for each of the core data entities of the examination administration. The digital passport is used to aggregate, timestamp-align, and structure the collected cross-layer raw state data related to the same core data entity of the examination administration, and generate and continuously update the structured passport state record of the entity. Using the operational behavior sequence in the original state data of historical personnel, a baseline model of normal operational behavior is established for personnel of different roles through a hidden Markov model. At the same time, a set of threat pattern rules across the four defense layers is predefined, and the threat pattern rules are formally represented by event condition action rules. For each of the core data entities of the examination administration, perform in-depth correlation analysis: input the current operation behavior sequence in the record into the corresponding hidden Markov model, calculate the behavior deviation score to determine single-layer behavior anomalies, and at the same time, treat the passport status record as a complex event stream and match it with the threat pattern rules to determine cross-layer threat events. Based on the results of the in-depth correlation analysis, the comprehensive risk value of the core data entity of the examination administration is calculated using a comprehensive risk assessment formula, which is: in, For the comprehensive risk value, For the first Preset weights for single-layer anomalies occurring at each defense layer. This represents the deviation score or preset severity score corresponding to the single-layer anomaly event. For the first Layer and First Association weights when there are correlations between layered anomaly events. A binary function representing whether the cross-level association holds; When the overall risk value exceeds a preset threshold, a depth penetration warning report is generated and output.

2. The method according to claim 1, characterized in that, The specific steps of establishing a baseline model of normal operational behavior for different roles using a Hidden Markov Model (HMM) include: for a specific role's historical operational behavior sequence, defining different work intentions or task stages as the hidden states of the HMM, and defining specific system operation instructions as the observed states; using the historical operational behavior sequence as a training set, iteratively learning through the Baum-Welch algorithm to obtain the initial state probability distribution of the HMM. State transition probability matrix and the probability matrix of observed states This completes the construction of the baseline model for normal operating behavior.

3. The method according to claim 2, characterized in that, The calculation of the behavioral deviation score is specifically as follows: for a current operational behavior sequence to be evaluated... The forward algorithm is used to compute the hidden Markov model of the corresponding role in the constructed sequence. The observed probability The behavioral deviation score Through formula The calculation shows that a higher deviation score indicates a greater deviation from the normal baseline.

4. The method according to claim 1, characterized in that, The antecedent of the threat pattern rule is a composite event consisting of atomic events through timing and logical operators, and the consequent is a warning action to be triggered. The atomic event is a state assertion extracted from the passport state record of a defense layer. The timing operator includes "after" and the logical operator includes "AND".

5. The method according to claim 4, characterized in that, The threat pattern rules include: Rule 1: When atomic event A "Personnel layer: Abnormal download operation for test question X" and atomic event B "Data layer: Digital watermark of test question X is successfully parsed in an unauthorized network environment" are detected to be true within a preset time window, an alert is triggered. Rule 2: When an atomic event C "Physical layer: The transportation trajectory of test paper package Y deviates from the predetermined route" is detected, and then an atomic event D "Process layer: The handover confirmation log of test paper package Y is abnormally modified" occurs, an early warning is triggered.

6. The method according to claim 1, characterized in that, The raw state data collected from the physical layer specifically includes: temperature and humidity data inside the secure room and the test paper transport vehicle obtained through IoT sensors, entry and exit record data obtained through the access control system, transport trajectory data obtained through the global positioning system device, and seal and open status data obtained through the electronic seal device. The raw state data collected from the data layer specifically includes: the integrity and decoded content data of the watermark in the test question or answer sheet image obtained by the digital watermark parsing module, and the electronic document hash value obtained by the hash calculation module for integrity comparison.

7. The method according to claim 1, characterized in that, The method further includes: dynamically constructing a global security defense posture map based on the real-time passport status records and early warning reports of all core examination data entities; wherein, entities in the examination system are abstracted as nodes, and the data flow or physical movement relationships between entities are abstracted as directed edges to construct a directed graph model; based on the directed graph model, an iterative formula is used... Calculate the risk impact value of each node ,in The damping coefficient is... Indicates from node A directed edge pointing to the current node. For nodes The output degree; based on the risk impact value, the node is visually rendered and displayed in a differentiated manner.

8. A multi-dimensional analysis and situational early warning system for examination data, used to implement the method described in any one of claims 1 to 7, characterized in that, The system includes: A multi-layered data acquisition module is used to collect raw status data in real time from four defense layers; The digital passport management module is used to create and maintain digital passports for each core data entity of the examination administration, and to generate structured passport status records. The behavior analysis and rule management module is used to store the baseline model of normal operating behavior constructed through the Hidden Markov Model and the threat pattern rules represented in the form of event-conditional actions. The in-depth correlation analysis engine is used to receive the passport status record, call the hidden Markov model to calculate the behavior deviation score, perform the matching of the threat pattern rules, and finally calculate the comprehensive risk value according to the comprehensive risk assessment formula. The early warning report generation module is used to generate and output a depth penetration early warning report when the comprehensive risk value exceeds a preset threshold.

9. The system according to claim 8, characterized in that, The in-depth correlation analysis engine includes: The behavior analysis unit has an embedded forward algorithm calculator for efficiently calculating the observation probability of the operation behavior sequence under the hidden Markov model. The complex event processing unit is equipped with a complex event processing engine, which is used to perform atomic event recognition and time-series logic-based composite event detection on the input passport status record stream. The multi-level data acquisition module includes: The physical layer acquisition submodule is used to collect physical environment and trajectory data through IoT interface, access control system interface, GPS interface and electronic seal interface; The process layer data acquisition submodule is used to collect operation logs and process status data from the question setting, printing management, examination administration and marking systems. The personnel data collection submodule is used to collect personnel identity and operation sequence data from the identity authentication system and business logs; The data acquisition submodule is used to extract watermark information and calculate hash values ​​from test questions, test paper packages, and answer sheet files.

10. The system according to claim 8, characterized in that, The system also includes a situation visualization module, which is equipped with a key node analyzer and a graphics renderer. The key node analyzer is used to perform iterative calculations to obtain the risk impact value of each node. The graphics renderer is used to generate and display the global security defense situation map based on the risk impact value, passport status records and early warning information.

Images