A data classification storage and security management system

Abstract

If the value ranges are different, the weight distribution in the calculation of the basic risk value will be weakened, for example, if the value range of a certain coefficient is too large, even if the weight is low, the influence on the basic risk value may be much higher than another coefficient, resulting in distorted calculation results. By unifying the value range, the access behavior risk coefficient can play a role in the calculation of the basic risk value according to the set weight ratio, ensuring that the basic risk value can accurately reflect the comprehensive influence of the two risk factors, and providing reliable basic data support for the correlation risk assessment and dynamic strategy execution. The specific embodiments of the present application are described in detail above, but they are only examples, and the present application is not equivalent to the specific embodiments described above. For those skilled in the art, any equivalent modification and substitution of the present application are also within the scope of the present application. Therefore, any equivalent transformation and modification made without departing from the spirit and scope of the present application should be covered within the scope of the present application.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and in particular to a data classification, storage and security management system. Background Technology

[0002] With the deepening of digital transformation, data classification, storage, and security management technologies have evolved from manual rule-based classification to automation-assisted tools. Early systems relied heavily on business departments manually labeling data categories, which was inefficient and susceptible to subjective influences. Subsequent automated classification tools introduced sensitivity grading mechanisms, classifying data into public, internal, and confidential levels through preset rules. However, these methods are often limited to single-dimensional judgments and struggle to adapt to complex scenarios with dynamically changing data relationships. In recent years, some solutions have attempted to integrate business attributes and access frequency characteristics, but they have significant shortcomings in the comprehensiveness of classification dimensions and the relevance of risk assessment, failing to form a complete closed loop from data identification to security protection.

[0003] Existing technologies reveal three prominent problems in practical applications: First, classification systems generally lack timely management. When key characteristics such as data association strength and access frequency change, classification labels cannot be automatically updated, leading to high-activity data occupying core storage resources for extended periods, or sensitive data being over-protected due to weakened associations. Second, risk assessment models often focus on calculating the threat probability of a single data entity, neglecting the risk transmission effect between strongly correlated data. This makes it difficult to provide early warning of the chain of risks in related data chains after a security incident occurs at one node. Third, there is insufficient linkage between security strategies and storage scheduling. Storage node health prediction relies on fixed smoothing coefficients, and risk weight parameter adjustments lag behind changes in the external threat landscape, resulting in low system response efficiency when facing sudden security incidents and a significant mismatch between resource allocation and protection requirements. Summary of the Invention

[0004] The purpose of this invention is to overcome the above-mentioned problems and provide a data classification, storage, and security management system. To achieve the above objective, this invention adopts the following technical solution:

[0005] A data classification, storage, and security management system includes a data acquisition module, a four-dimensional classification module, an intelligent storage scheduling module, an association risk assessment module, a dynamic policy execution module, and a multi-dimensional feedback optimization module. Data output from the data acquisition module is transmitted to the four-dimensional classification module. The classification results output from the four-dimensional classification module are transmitted to both the intelligent storage scheduling module and the association risk assessment module. The intelligent storage scheduling module schedules data to external storage nodes based on the classification results. The association risk assessment module transmits the risk assessment results to the dynamic policy execution module. The dynamic policy execution module performs security protection operations on the external storage nodes based on the risk assessment results and transmits the policy execution data to the multi-dimensional feedback optimization module. The multi-dimensional feedback optimization module generates optimization parameters based on the policy execution data and feeds them back to the four-dimensional classification module, the intelligent storage scheduling module, and the association risk assessment module.

[0006] Furthermore, the four-dimensional classification module includes a business attribute segmentation module, a sensitivity measurement module, a correlation strength analysis module, an activity frequency marking module, and a four-dimensional classification label generation module. The business attribute segmentation module divides the data output from the data acquisition module into customer data, financial data, operational data, and public data according to business attributes. The sensitivity measurement module calculates the data sensitivity measurement value using the entropy method, with the following formula:

[0007] ;

[0008] in, For data-sensitive metrics, The total number of fields contained in the data. For the first The probability of information leakage for each data field. The values ​​are obtained by querying a pre-defined data field attribute mapping table. The mapping table assigns a corresponding probability value to each field based on its sensitivity category; sensitivity levels are then determined based on the sensitivity quantification values.

[0009] The association strength analysis module calculates the association strength between the current data and other data in the system using the cosine similarity algorithm. The formula is as follows:

[0010] ;

[0011] in, The strength of the association between the current data and related data. For feature dimension, For the current data Each feature vector value For the first related data Each feature vector value is calculated based on the correlation strength. Classify the association strength level;

[0012] The active frequency marking module counts the number of visits within a preset period and classifies the active frequency level based on the number of visits. The four-dimensional classification tag generation module integrates business attributes, sensitivity level, association strength and active frequency.

[0013] Furthermore, the intelligent storage scheduling module includes a storage medium dynamic matching module, a node health prediction module, and a priority migration control module. The storage medium dynamic matching module matches the corresponding storage medium type based on the four-dimensional classification label. The node health prediction module predicts the health parameters for a future preset period based on storage node performance data within a preset period using an exponential smoothing method. The formula is as follows:

[0014] ;

[0015] in, For storage node health parameters, This is the actual health measurement value for the day. This is the actual health measurement value from the previous day. The smoothing coefficient is used to select nodes that meet the preset health conditions as target storage nodes. When the data activity frequency level changes, the priority migration control module triggers the migration of data between different storage media. During the migration process, the token bucket algorithm is used to control the bandwidth utilization rate within a preset range.

[0016] Furthermore, the associated risk assessment module includes a basic risk calculation module, an associated risk propagation module, and a risk value fusion module; the basic risk calculation module calculates the risk value of individual data points using the following formula:

[0017] ;

[0018] in, For single-data-based risk values, To determine the risk factor for access behavior, External threat risk coefficient, Risk weighting for access behavior As the external threat risk weight, and ;

[0019] The formula for calculating the access behavior risk coefficient is:

[0020] ;

[0021] in, To determine the risk factor for access behavior, For abnormal access frequency, To score the risk of the access source, and The preset weighting coefficients, and ;

[0022] The risk propagation module calculates the risk propagation value of strongly correlated data using the following formula:

[0023] ;

[0024] in, To correlate risk propagation value, For the number of strongly correlated data, For the first The strength of the association between related data. For the first Sensitivity metrics for each associated data point; the risk value fusion module calculates the final risk value. ,

[0025] ;

[0026] in, This is the final risk value. This is the number of days since the most recent risk event. The time decay coefficient, It is a natural constant.

[0027] Furthermore, the dynamic policy enforcement module includes a hierarchical access control module, an adaptive encryption module, and a risk isolation module. The hierarchical access control module executes access control at the corresponding level based on the final risk value, including single-factor authentication, two-factor authentication, and three-factor authentication, and triggers real-time auditing when executing higher-level access control. The adaptive encryption module uses the corresponding encryption algorithm to store and encrypt data according to the risk value, and adjusts the encryption strength and key length according to the risk value during data transmission. When the risk isolation module detects a data access request that meets the preset risk conditions, it automatically cuts off the logical link between the data and related data, generating an independent access sandbox.

[0028] Furthermore, the multi-dimensional feedback optimization module includes a classification dimension weight adjustment module, a risk model parameter correction module, and a storage strategy iteration module. The classification dimension weight adjustment module increases the weight of the corresponding classification dimension when the misclassification rate of a certain type of data exceeds a preset threshold. The risk model parameter correction module periodically adjusts the values ​​of access behavior risk weight and external threat risk weight based on the risk prediction accuracy. When the proportion of risk events caused by external threats exceeds a preset ratio, the value of the external threat risk weight is adjusted. When the deviation between the actual health and predicted health of a storage node exceeds a preset range, the storage strategy iteration module recalibrates the smoothing coefficient of the node health prediction.

[0029] Furthermore, the four-dimensional classification label generation module also includes a label timeliness management module, which periodically recalculates the four-dimensional classification labels. When the data association strength decreases from strong association to weak association, the association strength field in the label is automatically updated and synchronized to the intelligent storage scheduling module.

[0030] Furthermore, the external threat risk coefficient The value is based on the CVSS score conversion from a third-party threat intelligence platform, and the conversion formula is as follows:

[0031] ;

[0032] in, The external threat risk coefficient is the original score provided by a third-party platform, with a value of [0,10]. This conversion normalizes the value range of the external threat risk coefficient to the range of [0,1], so as to be consistent with the access behavior risk coefficient.

[0033] The advantages of this invention are:

[0034] 1. This invention comprehensively divides data into four dimensions: business attributes, sensitivity, association strength, and activity frequency. It combines the entropy method to quantify sensitivity and the cosine similarity to analyze association strength. Furthermore, it uses a tag timeliness management module to periodically calibrate the classification results, thus realizing the transformation of data classification from static division to dynamic adaptation. When the strength of data association changes, the tags can be automatically updated, effectively improving classification accuracy and timeliness.

[0035] 2. This invention integrates access behavior and external threat risk coefficients through a basic risk calculation module, introduces a related risk propagation mechanism to consider the risk transmission effect of strongly correlated data, and optimizes the final risk value by combining a time decay factor. This enables accurate judgment from single data risk assessment to comprehensive risk assessment of related data, providing a reliable basis for the dynamic execution of security strategies such as hierarchical access control and adaptive encryption.

[0036] 3. This invention uses a multi-dimensional feedback optimization module to monitor the misclassification rate, risk prediction accuracy, and node health deviation in real time, and dynamically adjusts the classification dimension weights, risk model parameters, and storage strategy smoothing coefficients. This enables the system to continuously self-optimize during operation, and even in the face of changes in the proportion of external threats or fluctuations in storage node performance, it can still maintain efficient and stable classification storage and security protection capabilities. Attached Figure Description

[0037] The accompanying drawings, which form part of this application, are used to provide a further understanding of the application and to make other features, objects, and advantages of the application more apparent. The illustrative embodiments and descriptions of this application are used to explain the application and do not constitute an undue limitation of the application.

[0038] In the attached diagram:

[0039] Figure 1 This is a system framework diagram of a data classification, storage, and security management system in Example 1.

[0040] Figure 2 This is a flowchart of the four-dimensional classification module of a data classification, storage and security management system in Example 1.

[0041] Figure 3 This is a flowchart of the intelligent storage scheduling module of a data classification, storage and security management system in Example 1.

[0042] Figure 4 This is a flowchart of the associated risk assessment module calculation in a data classification, storage, and security management system in Example 1.

[0043] Figure 5 This is a flowchart of the dynamic policy execution module response of a data classification, storage and security management system in Example 1.

[0044] Figure 6 This is a closed-loop optimization diagram of the multi-dimensional feedback optimization module of a data classification, storage, and security management system in Example 1. Detailed Implementation

[0045] The present invention will now be described in detail and specifically through specific embodiments to enable a better understanding of the invention. However, the following embodiments do not limit the scope of protection of the present invention.

[0046] Example 1

[0047] like Figure 1 As shown, a data classification, storage, and security management system includes a data acquisition module, a four-dimensional classification module, an intelligent storage scheduling module, an association risk assessment module, a dynamic policy execution module, and a multi-dimensional feedback optimization module. Data output from the data acquisition module is transmitted to the four-dimensional classification module. The classification results output from the four-dimensional classification module are transmitted to the intelligent storage scheduling module and the association risk assessment module, respectively. The intelligent storage scheduling module schedules data to external storage nodes based on the classification results. The association risk assessment module transmits the risk assessment results to the dynamic policy execution module. The dynamic policy execution module performs security protection operations on the external storage nodes based on the risk assessment results and transmits the policy execution data to the multi-dimensional feedback optimization module. The multi-dimensional feedback optimization module generates optimization parameters based on the policy execution data and feeds them back to the four-dimensional classification module, the intelligent storage scheduling module, and the association risk assessment module, respectively.

[0048] In a specific embodiment, the system acquires various types of data to be processed starting from the data acquisition module. These data are the foundation for classification and management. Only by ensuring the integrity of the acquired data can reliable input be provided for the operation of each module.

[0049] After data collection, the data is transmitted to the four-dimensional classification module for processing. The multi-dimensional classification design makes data attributes clearer and avoids management blind spots caused by single-dimensional classification. The classification results output by the four-dimensional classification module simultaneously flow to the intelligent storage scheduling module and the associated risk assessment module. The dual-path transmission design allows storage scheduling and risk assessment to work based on the same classification criteria, reducing the time cost of data flow and improving the overall operating efficiency of the system.

[0050] The intelligent storage scheduling module allocates data to corresponding external storage nodes based on the classification results. Data with different attributes is matched with suitable storage environments; for example, highly sensitive data corresponds to high-security storage nodes, thereby improving the rationality and security of data storage. The associated risk assessment module analyzes the potential risks of the data based on the classification results and then passes the assessment results to the dynamic policy execution module, providing a clear basis for security protection operations and avoiding blind protection.

[0051] The dynamic policy execution module implements targeted security protection for external storage nodes based on risk assessment results. Simultaneously, it sends policy execution data generated during the process to the multi-dimensional feedback optimization module. This data records the actual effects of the policies and serves as a crucial basis for system optimization. The multi-dimensional feedback optimization module analyzes the policy execution data to generate optimization parameters, which are then fed back to the four-dimensional classification module, the intelligent storage scheduling module, and the associated risk assessment module. This continuous adjustment of the operating parameters of each module leads to more accurate classification, more rational storage scheduling, and more precise risk assessment, thereby improving the overall system performance and security.

[0052] Furthermore, such as Figure 2 As shown, the four-dimensional classification module includes a business attribute segmentation module, a sensitivity measurement module, a correlation strength analysis module, an activity frequency marking module, and a four-dimensional classification label generation module. The business attribute segmentation module divides the data output from the data acquisition module into customer data, financial data, operational data, and public data according to business attributes. The sensitivity measurement module calculates the data sensitivity measurement value using the entropy method, with the formula as follows:

[0053] ;

[0054] in, For data-sensitive metrics, The total number of fields contained in the data. For the first The probability of information leakage for each data field. The values ​​are obtained by querying a pre-defined data field attribute mapping table. The mapping table assigns a corresponding probability value to each field based on its sensitivity category; sensitivity levels are then determined based on the sensitivity quantification values.

[0055] The association strength analysis module calculates the association strength between the current data and other data in the system using the cosine similarity algorithm. The formula is as follows:

[0056] ;

[0057] in, The strength of the association between the current data and related data. For feature dimension, For the current data Each feature vector value For the first related data Each feature vector value is calculated based on the correlation strength. Classify the association strength level;

[0058] The active frequency marking module counts the number of visits within a preset period and classifies the active frequency level based on the number of visits. The four-dimensional classification tag generation module integrates business attributes, sensitivity level, association strength and active frequency.

[0059] In a specific embodiment, the four-dimensional classification module achieves refined data classification through the cooperation of five sub-modules. The business attribute classification module first categorizes the collected data into customer data, financial data, operational data, and public data according to their business attributes. This classification method allows for close integration of data with actual business scenarios, enabling the development of specific management strategies for different business data types. For example, financial data requires strict protection of integrity and confidentiality, while public data can have access restrictions appropriately relaxed to improve management targeting. The sensitivity measurement module uses the entropy method to calculate data sensitivity measurement values. The calculation process requires the total number of fields contained in the data and the information leakage probability of the i-th data field. The information leakage probability is not a statistical value that needs to be dynamically calculated; its value is obtained by querying a pre-set data field attribute mapping table. This mapping table is established according to data security classification specifications during system deployment. Its core logic is to pre-assign a corresponding baseline probability value to each type of field based on its inherent sensitivity category, such as personal identification, financial account information, health privacy information, and general public information.

[0060] This calculation transforms data sensitivity from an abstract concept into a quantifiable value. Sensitivity levels are then categorized based on these values, allowing for differentiated protection of data with varying degrees of sensitivity. This avoids overprotecting low-sensitivity data, which would otherwise waste resources, and also prevents insufficient protection of high-sensitivity data from causing security risks.

[0061] The association strength analysis module uses the cosine similarity algorithm to calculate the association strength between the current data and other data in the system. The calculation will compare the two in terms of Vector values ​​in each feature dimension and Finally, the correlation strength value is obtained. And then according to Classifying data by correlation strength level allows for precise identification of relationships between data, providing a basis for preventing the spread of risks. For example, if a high-risk data point is strongly correlated with multiple other data points, the associated data can be screened for risks in advance. The activity frequency marking module tracks the number of accesses within a preset period and classifies activity frequency levels based on the number of accesses. This design reflects data usage needs, allowing highly active data to be allocated to faster storage media, thus improving data utilization efficiency.

[0062] The four-dimensional classification label generation module integrates business attributes, sensitivity levels, association strength, and activity frequency into unified classification labels, giving data comprehensive and clear attribute identification. The intelligent storage scheduling and association risk assessment modules can both work efficiently based on these labels, ensuring consistency in the operation of each link.

[0063] Furthermore, such as Figure 3 As shown, the intelligent storage scheduling module includes a storage medium dynamic matching module, a node health prediction module, and a priority migration control module. The storage medium dynamic matching module matches the corresponding storage medium type based on the four-dimensional classification label. The node health prediction module predicts the health parameters for a future preset period based on the storage node performance data of a preset period using the exponential smoothing method. The formula is as follows:

[0064] ;

[0065] in, For storage node health parameters, This is the actual health measurement value for the day. This is the actual health measurement value from the previous day. The smoothing coefficient is used to select nodes that meet the preset health conditions as target storage nodes. When the data activity frequency level changes, the priority migration control module triggers the migration of data between different storage media. During the migration process, the token bucket algorithm is used to control the bandwidth utilization rate within a preset range.

[0066] In a specific embodiment, the intelligent storage scheduling module achieves efficient and stable data storage through the cooperation of three sub-modules. The storage medium dynamic matching module matches the data with the corresponding storage medium type based on the four-dimensional classification labels. For example, highly sensitive and frequently active data will be matched with high-performance and high-security storage media, while low-sensitivity and infrequently active data will be matched with lower-cost storage media. This dynamic matching can achieve reasonable allocation of storage resources, reducing storage costs while ensuring data storage needs are met.

[0067] The node health prediction module uses exponential smoothing to predict health parameters for a future preset period based on the performance data of storage nodes within a preset period. The calculation needs to be combined with the actual measured health value of the day. Previous day's measured health value And through the smoothing coefficient By balancing the impact of both factors on the prediction results, this prediction method can make full use of historical and current performance data, making the health prediction more in line with the actual operating status of the nodes. Then, nodes that meet the preset health conditions are selected as target storage nodes, which effectively reduces the risk of data loss or access interruption caused by storage node failure and improves storage stability.

[0068] The priority migration control module monitors changes in data activity frequency levels in real time. When a level changes, it immediately triggers data migration between different storage media. For example, data that was previously inactive becomes highly active and will be migrated to a faster storage medium to meet changing data usage needs. During the migration process, a token bucket algorithm is used to control bandwidth utilization within a preset range, preventing excessive network bandwidth consumption during data migration that could impact normal business data transmission and ensuring overall system smooth operation.

[0069] Furthermore, such as Figure 4 As shown, the associated risk assessment module includes a basic risk calculation module, an associated risk propagation module, and a risk value fusion module; the basic risk calculation module calculates the risk value of a single data point using the following formula:

[0070] ;

[0071] in, For single-data-based risk values, To determine the risk factor for access behavior, External threat risk coefficient, Risk weighting for access behavior As the external threat risk weight, and ;

[0072] The formula for calculating the access behavior risk coefficient is:

[0073] ;

[0074] in, To determine the risk factor for access behavior, For abnormal access frequency, To score the risk of the access source, and The preset weighting coefficients, and ;

[0075] The risk propagation module calculates the risk propagation value of strongly correlated data using the following formula:

[0076] ;

[0077] in, To correlate risk propagation value, For the number of strongly correlated data, For the first The strength of the association between related data. For the first Sensitivity metrics for each associated data point; the risk value fusion module calculates the final risk value. ,

[0078] ;

[0079] in, This is the final risk value. This is the number of days since the most recent risk event. The time decay coefficient, It is a natural constant.

[0080] In a specific embodiment, the associated risk assessment module achieves a comprehensive assessment of data risk through hierarchical calculation. The basic risk calculation module first calculates the basic risk value of a single data item. During the calculation, it comprehensively considers the access behavior risk coefficient and the external threat risk coefficient. At the same time, it allocates the influence of the two through access behavior risk weights and external threat risk weights, and the sum of these two factors is 1 to ensure the rigor of the calculation logic.

[0081] The access behavior risk coefficient is a comprehensive score composed of two sub-indicators: access frequency anomaly score, which reflects the frequency of abnormal accesses, and access source risk score, which reflects the credibility of the access source. These are weighted according to a preset formula. , This is a combination of factors, and the abnormality of access frequency can be obtained by comparing the statistical deviation of the current access frequency with the historical baseline; the risk score of the access source can be assessed based on the geographical location of the access source IP, reputation database information, or internal blacklists and whitelists; weighting. and These are configurable parameters.

[0082] This approach can simultaneously cover both internal access risks and external threat risks to data, avoiding biased assessment results caused by focusing on only a single risk factor. For example, a piece of data may be secure in internal access behavior but face a high external attack threat. This calculation method can accurately reflect its basic risk.

[0083] Based on this, the risk propagation module calculates the risk propagation value of strongly correlated data. The calculation process will use the number of strongly correlated data. , No. The correlation strength of related data and the Sensitivity metrics for each related data point Finally obtained This calculation can identify the potential for risk to spread among related data. The risk of one piece of data may affect other data through correlation, especially data with strong correlation and high sensitivity, where the impact of risk spread will be greater. By quantifying the spread value, the scope of risk spread can be known in advance.

[0084] The risk value fusion module then integrates the basic risk value. Related risk propagation value In addition, a time decay factor is introduced, which is determined by the number of days since the most recent risk event. Time decay coefficient and natural constants The more days since the most recent risk event, the greater the impact of the attenuation factor, and the higher the correlation risk propagation value in the final risk value. The smaller the proportion of risk in the overall risk profile, the better. This design aligns with the actual patterns of risk change; as time progresses, the impact of past risks on current data gradually weakens, leading to a decrease in the final risk value. It more closely reflects the current actual risk status of the data, providing accurate risk basis for the execution of dynamic strategies.

[0085] Furthermore, such as Figure 5 As shown, the dynamic policy execution module includes a hierarchical access control module, an adaptive encryption module, and a risk isolation module. The hierarchical access control module executes access control at the corresponding level based on the final risk value, including single-factor authentication, two-factor authentication, and three-factor authentication, and triggers real-time auditing when executing higher-level access control. The adaptive encryption module uses the corresponding encryption algorithm to store and encrypt data according to the risk value, and adjusts the encryption strength and key length according to the risk value during data transmission. When the risk isolation module detects a data access request that meets the preset risk conditions, it automatically cuts off the logical link between the data and related data, generating an independent access sandbox.

[0086] In a specific embodiment, the dynamic policy execution module implements targeted security protection operations based on the risk assessment results. The hierarchical access control module selects the corresponding access control level according to the final risk value. Different risk values ​​employ different authentication methods, ranging from single-factor authentication to two-factor authentication and then to three-factor authentication; the higher the risk, the stricter the authentication level. This hierarchical design ensures security while maintaining access convenience. Low-risk data uses simple authentication to reduce user steps, while high-risk data uses multi-factor authentication to raise the security threshold and prevent unauthorized access. Simultaneously, real-time auditing is triggered when executing high-level access control, recording access behavior in real time. Any abnormal operations can be promptly detected and traced, further strengthening the security of high-risk data.

[0087] The adaptive encryption module selects the appropriate encryption algorithm for data storage based on the risk value. During data transmission, it also adjusts the encryption strength and key length according to the risk value. When the risk value is high, it will use a stronger encryption and a longer key to ensure that the data is adequately protected during storage and transmission. For data with a low risk value, the encryption strength can be appropriately reduced to avoid over-encryption affecting data storage efficiency and transmission speed.

[0088] The risk isolation module monitors data access requests in real time. When a request that meets the preset risk conditions is detected, it will automatically cut off the logical link between the data and related data to prevent the risk from spreading to other data through the relationship. At the same time, it generates an independent access sandbox so that access requests with risks are processed in an independent environment. This does not affect the access and use of normal data, and can effectively control the scope of risk and prevent the risk from expanding and affecting the entire system.

[0089] Furthermore, such as Figure 6 As shown, the multi-dimensional feedback optimization module includes a classification dimension weight adjustment module, a risk model parameter correction module, and a storage strategy iteration module. The classification dimension weight adjustment module increases the weight of the corresponding classification dimension when the misclassification rate of a certain type of data exceeds a preset threshold. The risk model parameter correction module periodically adjusts the values ​​of access behavior risk weight and external threat risk weight based on the risk prediction accuracy. When the proportion of risk events caused by external threats exceeds a preset ratio, the value of the external threat risk weight is adjusted. When the deviation between the actual health and predicted health of a storage node exceeds a preset range, the storage strategy iteration module recalibrates the smoothing coefficient of the node health prediction.

[0090] In a specific embodiment, the multi-dimensional feedback optimization module continuously optimizes the operating parameters of each module by analyzing system operation data, thereby improving the overall system performance. The classification dimension weight adjustment module monitors the misclassification rate of various types of data in real time. When the misclassification rate of a certain type of data exceeds a preset threshold, the weight of the corresponding classification dimension for that type of data is increased. An excessively high misclassification rate indicates that the current classification dimension weight setting for that type of data is unreasonable and cannot accurately distinguish data attributes. By increasing the corresponding weight, the classification module can focus more on the features of that dimension when processing that type of data, reducing misclassification, improving classification accuracy, and providing more reliable classification results for storage scheduling and risk assessment.

[0091] The risk model parameter correction module will periodically adjust the access behavior risk weight and external threat risk weight based on the risk prediction accuracy. A low prediction accuracy indicates that the current weight allocation cannot accurately reflect the actual impact of the two risk factors on the data. Adjustment can make the risk assessment model more accurate.

[0092] Meanwhile, when the proportion of risk events caused by external threats exceeds a preset percentage, the risk weight of external threats will be specifically adjusted. At this point, external threats have a greater impact on data security, and increasing their weight allows risk assessments to better reflect the current security situation and identify risks posed by external threats in a timely manner. The storage strategy iteration module focuses on the deviation between the actual health of storage nodes and their predicted health. When the deviation exceeds a preset range, the smoothing coefficient of the node health prediction will be recalibrated.

[0093] The smoothing coefficient directly affects the accuracy of health prediction results. Excessive deviation indicates that the current smoothing coefficient cannot effectively balance the influence of historical and current data. Calibration can make the prediction results closer to the actual health status of the nodes, reduce storage node selection errors caused by prediction deviations, and improve the stability and reliability of the storage system.

[0094] Furthermore, the four-dimensional classification label generation module also includes a label timeliness management module, which periodically recalculates the four-dimensional classification labels. When the data association strength decreases from strong association to weak association, the association strength field in the label is automatically updated and synchronized to the intelligent storage scheduling module.

[0095] In a specific embodiment, the four-dimensional classification label generation module adds a label timeliness management module to ensure that the classification labels remain consistent with the actual data status. The label timeliness management module will periodically recalculate the four-dimensional classification labels. The attributes of the data are not static. As business operations and data flow, attributes such as their correlation and activity frequency may change. Periodic recalculation can capture these changes in a timely manner and prevent the management strategy from becoming ineffective due to outdated labels.

[0096] Especially when the data association strength decreases from strong to weak, the module automatically updates the association strength field in the tag. Data that was originally strongly associated may no longer be closely associated due to business adjustments or data updates. If the old tag is still used, it may lead to over-considering association risk during risk assessment or adopting an unsuitable association storage strategy during storage scheduling. The updated tag will be synchronized to the intelligent storage scheduling module, allowing the storage scheduling module to keep abreast of changes in data association strength and adjust the storage plan accordingly. For example, strongly associated data may have originally been stored on adjacent nodes for easy access, but after the association strength decreases, it can be adjusted to a storage node that is more suitable for its current attributes, improving storage resource utilization efficiency and avoiding improper storage management problems caused by changes in association relationships.

[0097] Furthermore, the external threat risk coefficient The value is based on the CVSS score conversion from a third-party threat intelligence platform, and the conversion formula is as follows:

[0098] ;

[0099] in, The external threat risk coefficient is the original score provided by a third-party platform, with a value of [0,10]. This conversion normalizes the value range of the external threat risk coefficient to the range of [0,1], so as to be consistent with the access behavior risk coefficient.

[0100] In a specific embodiment, to ensure that the external threat risk coefficient and the access behavior risk coefficient are effectively integrated when calculating the basic risk value, the value of is converted based on the CVSS score of a third-party threat intelligence platform. The CVSS score of the third-party threat intelligence platform is a commonly used threat assessment indicator in the industry, which can objectively reflect the severity of external threats. The objectivity and authority of are ensured by converting based on this score.

[0101] The core of the transformation is to perform numerical normalization on the CVSS score. This is achieved using a formula. The original CVSS score is a continuous value in the range of [0,10]. By dividing by 10, a linear transformation, it can be mapped losslessly to the interval [0,1]. This normalization process is a common data preprocessing technique, the purpose of which is to eliminate the influence of the original data units.

[0102] If the two coefficients have different value ranges, the significance of weight allocation in the calculation of the basic risk value will be weakened. For example, if the value range of one coefficient is too large, even if its weight is low, its impact on the basic risk value may be far greater than that of the other coefficient, leading to distorted calculation results. By unifying the value range, the access behavior risk coefficient and the risk value can be aligned. The basic risk value is calculated according to the set weight ratio to ensure that the basic risk value can accurately reflect the combined impact of the two risk factors, and provide reliable basic data support for associated risk assessment and dynamic strategy execution.

[0103] The specific embodiments of the present invention have been described in detail above, but they are merely examples, and the present invention is not equivalent to the specific embodiments described above. For those skilled in the art, any equivalent modifications and substitutions to the present invention are also within the scope of the present invention. Therefore, all equivalent transformations and modifications made without departing from the spirit and scope of the present invention should be covered within the scope of the present invention.

Claims

1. A data classification, storage, and security management system, characterized in that, The system includes a data acquisition module, a four-dimensional classification module, an intelligent storage scheduling module, an association risk assessment module, a dynamic strategy execution module, and a multi-dimensional feedback optimization module. The data output from the data acquisition module is transmitted to the four-dimensional classification module. The classification results output by the four-dimensional classification module are transmitted to both the intelligent storage scheduling module and the association risk assessment module. The intelligent storage scheduling module schedules the data to external storage nodes based on the classification results. The association risk assessment module transmits the risk assessment results to the dynamic strategy execution module. The dynamic policy execution module performs security protection operations on the external storage node based on the risk assessment results, and transmits the policy execution data to the multi-dimensional feedback optimization module. The multidimensional feedback optimization module generates optimization parameters based on the strategy execution data, and feeds them back to the four-dimensional classification module, the intelligent storage scheduling module, and the associated risk assessment module, respectively.

2. The data classification, storage, and security management system according to claim 1, characterized in that, The four-dimensional classification module includes a business attribute segmentation module, a sensitivity quantification module, a correlation strength analysis module, an activity frequency marking module, and a four-dimensional classification label generation module. The business attribute segmentation module divides the data output from the data acquisition module into customer data, financial data, operational data, and public data according to business attributes. The sensitivity quantification module calculates the data sensitivity quantification value using the entropy method, with the following formula: ； in, For data-sensitive metrics, The total number of fields contained in the data. For the first The probability of information leakage for each data field, the probability of information leakage The values ​​are obtained by querying a pre-set data field attribute mapping table, which assigns a corresponding probability value to each field based on the sensitivity category of the data field; and the sensitivity level is divided according to the sensitivity quantification value. The association strength analysis module calculates the association strength between the current data and other data in the system using a cosine similarity algorithm. The formula is as follows: ； in, The strength of the association between the current data and related data. For feature dimension, For the current data Each feature vector value For the first related data Each feature vector value is calculated based on the correlation strength. Classify the association strength level; The active frequency marking module counts the number of visits within a preset period and classifies the active frequency level according to the number of visits. The four-dimensional classification tag generation module integrates business attributes, sensitivity level, association strength and active frequency.

3. The data classification, storage, and security management system according to claim 2, characterized in that, The intelligent storage scheduling module includes a storage medium dynamic matching module, a node health prediction module, and a priority migration control module. The storage medium dynamic matching module matches the corresponding storage medium type based on four-dimensional classification labels. The node health prediction module predicts the health parameters for a future preset time period based on storage node performance data over a preset period using an exponential smoothing method, with the following formula: ； in, For storage node health parameters, This is the actual health measurement value for the day. This is the actual health measurement value from the previous day. The smoothing coefficient is used to select nodes that meet the preset health conditions as target storage nodes. When the data activity frequency level changes, the priority migration control module triggers the migration of data between different storage media. During the migration process, the token bucket algorithm is used to control the bandwidth utilization rate within a preset range.

4. The data classification, storage, and security management system according to claim 3, characterized in that, The associated risk assessment module includes a basic risk calculation module, an associated risk propagation module, and a risk value fusion module; the basic risk calculation module calculates the risk value of a single data point using the following formula: ； in, For single-data-based risk values, To determine the risk factor for access behavior, External threat risk coefficient, Risk weighting for access behavior As the external threat risk weight, and ; The formula for calculating the risk coefficient of the access behavior is as follows: ； in, To determine the risk factor for access behavior, For abnormal access frequency, To score the risk of the access source, and The preset weighting coefficients, and ; The associated risk propagation module calculates the risk propagation value of strongly correlated data using the following formula: ； in, To correlate risk propagation value, For the number of strongly correlated data, For the first The strength of the association between related data. For the first The risk value quantification value of each associated data; the risk value fusion module calculates the final risk value. , ； in, This is the final risk value. This is the number of days since the most recent risk event. The time decay coefficient, It is a natural constant.

5. A data classification, storage, and security management system according to claim 4, characterized in that, The dynamic policy execution module includes a hierarchical access control module, an adaptive encryption module, and a risk isolation module; the hierarchical access control module executes access control at the corresponding level according to the final risk value, including single-factor authentication, two-factor authentication, and three-factor authentication, and triggers real-time auditing when executing higher-level access control; The adaptive encryption module uses the corresponding encryption algorithm to store and encrypt the data according to the risk value, and adjusts the encryption strength and key length according to the risk value during data transmission; when the risk isolation module detects a data access request that meets the preset risk conditions, it automatically cuts off the logical link between the data and the associated data and generates an independent access sandbox.

6. A data classification, storage, and security management system according to claim 5, characterized in that, The multidimensional feedback optimization module includes a classification dimension weight adjustment module, a risk model parameter correction module, and a storage strategy iteration module. When the misclassification rate of a certain type of data exceeds a preset threshold, the classification dimension weight adjustment module increases the weight of the corresponding classification dimension of that type of data. The risk model parameter correction module periodically adjusts the values ​​of access behavior risk weight and external threat risk weight according to the risk prediction accuracy. When the proportion of risk events caused by external threats exceeds a preset proportion, the value of external threat risk weight is adjusted. When the actual health of a storage node deviates from its predicted health by more than a preset range, the storage strategy iteration module recalibrates the smoothing coefficient of the node health prediction.

7. A data classification, storage, and security management system according to claim 6, characterized in that, The four-dimensional classification label generation module also includes a label timeliness management module, which periodically recalculates the four-dimensional classification labels. When the data association strength decreases from strong association to weak association, the association strength field in the label is automatically updated and synchronized to the intelligent storage scheduling module.

8. A data classification, storage, and security management system according to claim 7, characterized in that, external threat risk coefficient The value is based on the CVSS score conversion from a third-party threat intelligence platform, and the conversion formula is: ； in, The external threat risk coefficient is the original score provided by a third-party platform, with a value of [0,10]. This conversion normalizes the value range of the external threat risk coefficient to the range of [0,1], so as to be consistent with the access behavior risk coefficient.

Images