Electronic file four-property detection and automatic archiving method and system based on asynchronous processing

Abstract

The present application relates to the technical field of electronic file archiving, and particularly relates to a four-property detection and automatic archiving method and system for electronic files based on asynchronous processing, which calculates multi-granularity content fingerprints and constructs a detection context object, drives four detection nodes in sequence to perform authenticity, integrity, availability and security detection by using an asynchronous bus, generates a detection conclusion set and a storage log, chain-binds the content fingerprints, the storage log and the detection conclusion set, forms a tamper-proof distributed archiving traceability chain, and dynamically optimizes detection weights and index structures based on historical data, so that efficient, reliable and traceable automatic archiving of electronic files is realized.

Description

Technical Field

[0001] This invention relates to the field of electronic document archiving technology, and in particular to a method and system for automatic archiving and detection of the four properties of electronic documents based on asynchronous processing. Background Technology

[0002] In the field of long-term preservation and archiving of electronic documents, ensuring the authenticity, integrity, usability, and security of documents are core requirements. Currently, the detection and archiving operations for these four properties of electronic documents typically employ linear serial or simple parallel processing modes. This conventional approach has significant limitations. Because the detection process is tightly coupled, any delay or blockage at any detection node directly affects the throughput and response time of the entire archiving process. The overall system performance is limited by the slowest link, especially when processing large batches or large volumes of electronic documents. This serial or statically parallel architecture is difficult to scale flexibly and easily becomes a performance bottleneck.

[0003] Furthermore, the status of the detection process is scattered across various modules and the central database, lacking a unified, time-series-clear global view. When an anomaly occurs in a detection stage or when tracing the historical detection process is required, it is difficult to quickly and completely reconstruct the detection context and intermediate states at that time, reducing the traceability and reliability of the process. At the same time, the connection between archived records and detection evidence is often loose, usually relying on foreign key associations in the database or simple log references, which lack sufficient strength and tamper resistance. Summary of the Invention

[0004] The present invention provides a method and system for detecting and automatically archiving electronic documents based on asynchronous processing, which can solve the problems in the prior art.

[0005] A first aspect of this invention provides a method for detecting and automatically archiving electronic documents based on asynchronous processing, comprising:

[0006] For archived electronic documents, calculate multi-granularity content fingerprints, fuse the multi-granularity content fingerprints with document metadata to construct a four-property detection context object, and generate a globally unique detection serial number;

[0007] The four-property detection context object is delivered to the asynchronous detection bus. The four detection nodes of authenticity, integrity, availability and security are activated by the detection conclusion event. After each detection node completes the detection, it publishes the detection conclusion to trigger the subsequent node and writes the detection intermediate state snapshot into the time-series evidence log.

[0008] The termination detection node aggregates all node detection conclusions from the asynchronous detection bus based on the detection serial number, and appends the multi-granularity content fingerprint to the aggregation result to form a set of four-property detection conclusions.

[0009] When writing the electronic file to be archived into the archive storage location, the multi-granularity content fingerprint and the time-series evidence log are jointly embedded into the archive index record, and the hash value chain is linked with the four-property detection conclusion set to form an immutable distributed archive traceability chain.

[0010] Based on the historical accumulation of the distributed archive tracing chain and time-series evidence log, predictive dynamic weighting based on historical anomaly patterns is performed on the node activation rules of the asynchronous detection bus, and the archive index structure is updated collaboratively.

[0011] For archived electronic documents, multi-granularity content fingerprints are calculated. These multi-granularity content fingerprints are then fused with document metadata to construct a four-property detection context object, and a globally unique detection serial number is generated, including:

[0012] The electronic files to be archived are scanned using a sliding window at three levels of granularity: byte level, paragraph level, and document level. Content features are extracted at each level of granularity, and hash digests are calculated for each level. The three-level hash digests are then organized into a multi-granularity content fingerprint with hierarchical dependencies in a tree structure.

[0013] The creation timestamp, modification timestamp, access permission identifier, and file format type are extracted from the system attributes of the electronic files to be archived. Combined with the archiving trigger source identifier and business classification code transmitted by the business system, a set of file metadata is formed.

[0014] The hash digests at each level in the multi-granularity content fingerprint are cross-correlated with the time dimension attributes, permission dimension attributes, and business dimension attributes in the file metadata set to form a four-property detection context object containing the fingerprint hierarchy and metadata structured fields.

[0015] Based on a distributed unique identifier generation mechanism, the current node identifier, nanosecond-level timestamp, and content digest of the four-property detection context object are combined and encoded to generate a detection serial number with global uniqueness and temporal monotonicity, which is then embedded as the primary key into the four-property detection context object.

[0016] The four-property detection context object is submitted to the asynchronous detection bus. The four detection nodes (authenticity, integrity, availability, and security) are activated, driven by the detection conclusion event. After each detection node completes its detection, it publishes its detection conclusion to trigger subsequent nodes and writes an intermediate detection snapshot to the time-series evidence log, including:

[0017] The four-property detection context object is submitted to the asynchronous detection bus, pushed to the authenticity detection node, and a detection timeout timer is started. When the authenticity detection node does not publish a detection conclusion event within the detection time, the asynchronous detection bus sends a detection status query instruction to the authenticity detection node.

[0018] The authenticity detection node receives the detection status query instruction and encapsulates the current detection progress into a progress response event and sends it back to the asynchronous detection bus. The asynchronous detection bus determines whether to reactivate the authenticity detection node based on the progress response event.

[0019] When the authenticity detection node publishes an authenticity detection conclusion carrying a verification failure flag, the asynchronous detection bus blocks the activation of the integrity detection node, availability detection node, and security detection node and generates a detection termination event, and writes the detection termination event and the detection serial number into the time-series evidence storage log.

[0020] When the authenticity test result shows that the verification is passed, the asynchronous test bus sequentially activates the integrity test node, the availability test node, and the security test node. During the test performed by each test node, the test duration is monitored in real time. When the test duration of any test node exceeds the test time, the intermediate state snapshot of the test node is triggered and written into the time-series evidence log.

[0021] The termination detection node aggregates all node detection conclusions from the asynchronous detection bus based on the detection serial number, and appends the multi-granularity content fingerprint to the aggregated result to form a four-property detection conclusion set, including:

[0022] After receiving the security test results, the termination test node parses the reference identifier of the preceding test results in the security test results, traces the release time of the integrity test results and the availability test results based on the reference identifier of the preceding test results, and calculates the test interval between each test node.

[0023] The termination detection node encapsulates the detection interval duration and the detection serial number into a detection link verification request and sends it to the asynchronous detection bus;

[0024] The asynchronous detection bus extracts the activation and completion times of each detection node from the time-series evidence log based on the detection serial number, calculates the time-series span of the actual detection link, and compares it with the detection interval duration for verification. After verification, the asynchronous detection bus retrieves each detection conclusion, extracts the status identifier from each detection conclusion, generates a detection status vector, and sends the detection status vector and each detection conclusion back to the termination detection node.

[0025] The termination detection node extracts the multi-granularity content fingerprint, combines it with the detection state vector, encodes it, and appends it to each detection conclusion to form a set of four-property detection conclusions.

[0026] When writing the electronic file to be archived to the archive storage location, the multi-granularity content fingerprint and the time-series evidence log are jointly embedded into the archive index record, and linked to the four-property detection conclusion set in a hash value chain to form an immutable distributed archive traceability chain, including:

[0027] When writing the electronic file to be archived to the archive storage location, the multi-granularity content fingerprint set is used as a leaf node to construct a first Merkle tree, and the root hash value is calculated as the content verification anchor point; the four-property detection conclusion set is used as a leaf node to construct a second Merkle tree, and the root hash value is calculated. A chain hash operation is performed with the content verification anchor point to generate the hash value of the current archive chain node.

[0028] Extract the time array of each operation step from the time-series evidence log, calculate the time interval between adjacent times to form a time-series interval array, perform a cumulative hash operation on the time-series interval array to generate a time-series anchoring identifier; extract the verification path of each leaf node in the first Merkle tree and the second Merkle tree respectively, encapsulate the verification path and the time-series anchoring identifier into a chained verification package, and write the chained verification package into the archived index record;

[0029] When a distributed node needs to verify an archived record, it reconstructs the Merkle root hash value through the verification path and verifies the chain continuity of the archived chain node hash values, forming an immutable distributed archived traceability chain.

[0030] Based on the historical accumulation of the distributed archive tracing chain and time-series evidence logs, predictive dynamic weighting based on historical anomaly patterns is performed on the node activation rules of the asynchronous detection bus, and the archive index structure is updated collaboratively, including:

[0031] Extract the abnormal state markers of the four-property detection conclusion set corresponding to the hash value of each archive chain node from the distributed archive traceability chain, and extract the abnormal trigger records in the intermediate state snapshots of each detection node under the corresponding detection serial number from the time-series evidence storage log. Align and merge them with the detection serial number as the association key, and construct a historical abnormal propagation path map based on the causal relationship of abnormal triggering between each detection node.

[0032] Normalization is performed using the trigger frequency of each propagation edge in the historical anomaly propagation path graph as input to generate an anomaly propagation probability matrix between nodes; the nodes are sorted according to the cumulative probability of each detection node as a propagation source to generate a node activation weight distribution.

[0033] The node activation weight distribution is written into the node activation rules of the asynchronous detection bus, and the activation priority and triggering conditions are reconfigured with the activation weight of each detection node to complete the predictive dynamic weighting of the node activation rules.

[0034] Based on the updated activation priority of each detection node, priority alignment and rearrangement are performed on the index fields corresponding to each detection node in the archived index record, and the anomaly propagation probability matrix between nodes is written into the extended field of the archived index record to complete the collaborative update of the archived index structure.

[0035] A second aspect of this invention provides an electronic document four-property detection and automatic archiving system based on asynchronous processing, comprising:

[0036] The fingerprint construction unit is used to calculate multi-granularity content fingerprints of the electronic documents to be archived, fuse the multi-granularity content fingerprints with the document metadata to construct a four-property detection context object, and generate a globally unique detection serial number;

[0037] The asynchronous detection unit is used to deliver the four-property detection context object to the asynchronous detection bus, activate the four detection nodes of authenticity, integrity, availability and security driven by the detection conclusion event, and publish the detection conclusion after each detection node completes the detection to trigger the subsequent node, and write the detection intermediate state snapshot into the time-series evidence log.

[0038] The conclusion aggregation unit is used to aggregate all node detection conclusions from the asynchronous detection bus based on the detection serial number by the termination detection node, and to attach the multi-granularity content fingerprint to the aggregation result to form a four-property detection conclusion set;

[0039] The archiving binding unit is used to embed the multi-granularity content fingerprint and the time-series evidence log together into the archiving index record when writing the electronic file to be archived into the archiving storage location, and bind it to the hash value chain of the four-property detection conclusion set to form an immutable distributed archiving traceability chain.

[0040] The rule tuning unit is used to perform predictive dynamic weighting of the node activation rules of the asynchronous detection bus based on historical anomaly patterns, based on the historical accumulation of the distributed archive tracing chain and time-series evidence log, and to collaboratively update the archive index structure.

[0041] A third aspect of the present invention provides an electronic device, comprising:

[0042] processor;

[0043] Memory used to store processor-executable instructions;

[0044] The processor is configured to invoke instructions stored in the memory to execute the aforementioned method.

[0045] A fourth aspect of the present invention provides a computer-readable storage medium having stored thereon computer program instructions that, when executed by a processor, implement the aforementioned method.

[0046] This method integrates multi-granularity content fingerprints and file metadata to provide unified and rich contextual information for the four properties (authenticity, integrity, availability, and security), ensuring the comprehensiveness and consistency of the detection criteria. The asynchronous detection bus architecture allows the four detection nodes to be independently activated and executed in an event-driven manner, significantly improving the concurrent processing capability of the detection tasks and the overall system throughput.

[0047] By embedding multi-granularity content fingerprints and time-series evidence logs into the archived index records and binding them to the detection conclusion set via a hash value chain, an immutable distributed archive traceability chain is constructed. This mechanism fundamentally guarantees the integrity and authenticity of the data throughout the entire lifecycle of archived electronic documents, from detection to archiving. Any tampering at any stage will cause the hash chain to break, thus being quickly detected. This chain binding structure provides a solid technical foundation for the long-term reliable preservation of electronic documents.

[0048] Based on historical data from the distributed archive traceability chain and time-series evidence logs, predictive dynamic weighting of node activation rules on the asynchronous detection bus can intelligently optimize resource allocation and execution order in the detection process, improve the system's adaptability and anomaly handling efficiency, and ensure real-time synchronization between the index and traceability logic through collaborative updates of the archive index structure, further enhancing the overall consistency and reliability of the archive system. Attached Figure Description

[0049] Figure 1 This is a flowchart illustrating the method for detecting and automatically archiving electronic documents based on asynchronous processing, according to an embodiment of the present invention.

[0050] Figure 2 This is a flowchart illustrating the method for submitting data to the asynchronous detection bus and writing it into the timing evidence log according to an embodiment of the present invention. Detailed Implementation

[0051] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0052] The technical solution of the present invention will be described in detail below with reference to specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments.

[0053] Figure 1 This is a flowchart illustrating the asynchronous processing-based electronic document four-property detection and automatic archiving method according to an embodiment of the present invention, as shown below. Figure 1 As shown, the method for detecting and automatically archiving electronic documents based on asynchronous processing includes:

[0054] For archived electronic documents, calculate multi-granularity content fingerprints, fuse the multi-granularity content fingerprints with document metadata to construct a four-property detection context object, and generate a globally unique detection serial number;

[0055] The four-property detection context object is delivered to the asynchronous detection bus. The four detection nodes of authenticity, integrity, availability and security are activated by the detection conclusion event. After each detection node completes the detection, it publishes the detection conclusion to trigger the subsequent node and writes the detection intermediate state snapshot into the time-series evidence log.

[0056] The termination detection node aggregates all node detection conclusions from the asynchronous detection bus based on the detection serial number, and appends the multi-granularity content fingerprint to the aggregation result to form a set of four-property detection conclusions.

[0057] When writing the electronic file to be archived into the archive storage location, the multi-granularity content fingerprint and the time-series evidence log are jointly embedded into the archive index record, and the hash value chain is linked with the four-property detection conclusion set to form an immutable distributed archive traceability chain.

[0058] Based on the historical accumulation of the distributed archive tracing chain and time-series evidence log, predictive dynamic weighting based on historical anomaly patterns is performed on the node activation rules of the asynchronous detection bus, and the archive index structure is updated collaboratively.

[0059] In one optional specific embodiment, a multi-granularity content fingerprint is calculated for the electronic document to be archived. The multi-granularity content fingerprint is then fused with the document metadata to construct a four-property detection context object, and a globally unique detection serial number is generated, including:

[0060] The electronic files to be archived are scanned using a sliding window at three levels of granularity: byte level, paragraph level, and document level. Content features are extracted at each level of granularity, and hash digests are calculated for each level. The three-level hash digests are then organized into a multi-granularity content fingerprint with hierarchical dependencies in a tree structure.

[0061] The creation timestamp, modification timestamp, access permission identifier, and file format type are extracted from the system attributes of the electronic files to be archived. Combined with the archiving trigger source identifier and business classification code transmitted by the business system, a set of file metadata is formed.

[0062] The hash digests at each level in the multi-granularity content fingerprint are cross-correlated with the time dimension attributes, permission dimension attributes, and business dimension attributes in the file metadata set to form a four-property detection context object containing the fingerprint hierarchy and metadata structured fields.

[0063] Based on a distributed unique identifier generation mechanism, the current node identifier, nanosecond-level timestamp, and content digest of the four-property detection context object are combined and encoded to generate a detection serial number with global uniqueness and temporal monotonicity, which is then embedded as the primary key into the four-property detection context object.

[0064] In this specific embodiment, when performing multi-granularity content fingerprint calculation on the electronic documents to be archived, a sliding window mechanism is used to perform three levels of granular scanning on the file content. Byte-level granular scanning treats the file as a continuous byte stream, setting the window size to 512 bytes and the sliding step size to 64 bytes. SHA-256 hash values ​​are calculated for the byte sequences within each window, forming a byte-level feature set. Paragraph-level granular scanning targets document-type files, identifying paragraph separators or semantic boundaries, extracting the text content and formatting tags of each paragraph, calculating the MD5 hash value for each paragraph unit, and constructing a paragraph-level feature set. Document-level granular scanning performs a one-time hash calculation on the entire file content, generating a document-level digest as the top-level feature identifier. There is a clear hierarchical dependency between the three levels of hash digests: the byte-level hash set as leaf nodes, the paragraph-level hash as intermediate nodes, and the document-level hash as the root node, organized into a tree-like multi-granularity content fingerprint structure. Adjacent levels in the tree structure are associated through parent nodes referencing child node hash values, ensuring that changes in content at any level propagate upwards to the root node.

[0065] File metadata extraction encompasses multiple dimensions of information. Creation timestamps, last modification timestamps, and last access timestamps are obtained from operating system file attributes. These timestamps are stored in the ISO 8601 standard format with millisecond-level precision. Access permission identifiers extract file owner information, user group permissions, and other user permissions, encoded using octal representation. File format type is determined through dual verification of the file header magic number and extension, supporting common formats such as office documents, image files, audio / video files, and compressed archives. The archive trigger source identifier transmitted by the business system records the name and version number of the system module initiating the archive request. Business classification codes identify the business domain and archive category to which the file belongs according to a predefined classification system. All of this information is aggregated to form a file metadata set containing time, permission, format, and business dimensions.

[0066] The fusion of multi-granularity content fingerprints and file metadata is achieved through structured association. Byte-level hash sets are associated with file creation timestamps, recording the time difference between the generation time of each byte window and the file creation time for anomaly timing detection. Paragraph-level hashes are associated with access permission identifiers, marking paragraph ranges corresponding to different permission levels for permission integrity verification. Document-level hashes are associated with business classification codes, establishing a mapping relationship between file content and business scenarios. This association relationship is organized through a nested JSO6 structure. The outer layer contains structured fields of metadata, while the inner layer embeds a hierarchical structure of multi-granularity content fingerprints, forming a four-property detection context object containing complete detection criteria. A dedicated fingerprint index field is set in the context object to record the position coordinates of each level of hash in the tree structure and the parent-child node reference relationship.

[0067] The generation of the serial number employs a distributed unique identifier generation algorithm. It obtains the physical identifier of the current node from the runtime environment, including the last six hexadecimal digits of the host MAC address and the process identifier. These two are combined and encoded as the node identifier, occupying the high 16 bits of the serial number. A nanosecond-level timestamp is obtained from the system, using a custom epoch time as a reference point. The nanosecond difference between the current time and the epoch time is calculated and encoded as the timestamp, occupying the middle 42 bits of the serial number, ensuring a monotonically increasing temporal sequence. After serializing the four-property detection context object, a CRC32 checksum is calculated. This checksum is used as the content digest, occupying the low 6 bits of the serial number, providing basic content differentiation capabilities. These three parts are concatenated in high-order to low-order order to generate a 64-bit long integer value as the detection serial number. This serial number is globally unique in the distributed environment. Serial numbers generated by the same node are strictly sequentially increasing, while serial numbers generated by different nodes are distinguished by the node identifier.

[0068] The generated detection serial number is embedded as a primary key into the four-property detection context object. A serial number field is added at the root level of the context object, with the field value being a generated 64-bit long integer value, along with a hexadecimal string representation of the serial number for easy log querying and manual retrieval. The serial number field is set to an immutable attribute, prohibiting any modification once assigned. A bidirectional reference is established between the serial number and the root node of the multi-granularity content fingerprint in the context object. The serial number allows for quick location of the root node of the content fingerprint tree, and the corresponding detection serial number can be retrieved from the root node. After the serial number embedding is completed, the entire four-property detection context object is completely encapsulated. The overall hash value of the object is calculated as the encapsulation signature, which is stored together with the object content for subsequent verification that the object has not been tampered with. The encapsulated four-property detection context object then possesses all the necessary conditions for delivery to the asynchronous detection bus, containing all the data and traceability identifiers required to perform the four-property detection.

[0069] Figure 2 This is a flowchart illustrating the method for submitting data to an asynchronous detection bus and writing it to a time-series evidence log according to an embodiment of the present invention. In one optional embodiment, the four-property detection context object is submitted to the asynchronous detection bus. Four detection nodes—authenticity, integrity, availability, and security—are activated by a detection conclusion event. After each detection node completes its detection, it publishes a detection conclusion to trigger subsequent nodes and writes an intermediate snapshot of the detection state to the time-series evidence log, including:

[0070] The four-property detection context object is submitted to the asynchronous detection bus, pushed to the authenticity detection node, and a detection timeout timer is started. When the authenticity detection node does not publish a detection conclusion event within the detection time, the asynchronous detection bus sends a detection status query instruction to the authenticity detection node.

[0071] The authenticity detection node receives the detection status query instruction and encapsulates the current detection progress into a progress response event and sends it back to the asynchronous detection bus. The asynchronous detection bus determines whether to reactivate the authenticity detection node based on the progress response event.

[0072] When the authenticity detection node publishes an authenticity detection conclusion carrying a verification failure flag, the asynchronous detection bus blocks the activation of the integrity detection node, availability detection node, and security detection node and generates a detection termination event, and writes the detection termination event and the detection serial number into the time-series evidence storage log.

[0073] When the authenticity test result shows that the verification is passed, the asynchronous test bus sequentially activates the integrity test node, the availability test node, and the security test node. During the test performed by each test node, the test duration is monitored in real time. When the test duration of any test node exceeds the test time, the intermediate state snapshot of the test node is triggered and written into the time-series evidence log.

[0074] In this specific embodiment, the four-property verification of the electronic documents to be archived needs to ensure accuracy while avoiding blocking the main archiving process. Based on an event-driven asynchronous detection mechanism, after the four-property verification context object is delivered to the asynchronous detection bus, the detection bus needs to parse the detection serial number and multi-granularity content fingerprint information in the context object and create a corresponding entry in the internally maintained detection task registry. This entry records the initial state of the current detection task, the queue of nodes to be activated, and the expected completion timestamp. The asynchronous detection bus uses a publish-subscribe model to manage the four detection nodes, with the authenticity verification node being the primary detection step and having its four-property verification context object pushed to it first.

[0075] After receiving the context object, the authenticity detection node extracts the source identifier, creation timestamp, and existing digital signature information from the file metadata. Simultaneously, the detection bus starts a detection timeout timer. The initial value of this timer is dynamically determined based on the size of the file to be detected and historical detection time statistics. When the file size is less than 10MB, the detection time is set to 30 seconds; when the file size is between 10MB and 100MB, the detection time is calculated by increasing by 5 seconds for every 10MB; when the file size exceeds 100MB, the maximum detection time is set to 300 seconds. The timer uses time slices with a precision of 100 milliseconds for counting down. At the end of each time slice, the asynchronous detection bus checks whether the authenticity detection node has published a detection conclusion event.

[0076] During the verification process, the authenticity verification node needs to access the public key infrastructure of the certificate authority when verifying the digital signature of the electronic document. When network latency causes the public key acquisition time to exceed the expectation, the verification node will be unable to complete the entire verification process within the verification time. At this time, the verification timeout timer resets to zero, triggering a timeout event. The asynchronous verification bus captures this event and constructs a verification status query command. This command includes the verification serial number, the current system timestamp, and the query sequence number. It is sent to the authenticity verification node through a dedicated status query channel. The status query channel and the verification conclusion event channel are independent of each other to avoid the query command and the verification conclusion competing at the transmission layer.

[0077] The authenticity detection node maintains an internal detection state machine, recording the currently executing detection sub-steps. When it receives a detection status query command, the node reads the current step identifier, the number of completed verification items, the number of remaining verification items, and the estimated remaining time from the state machine. This information is encapsulated as a progress response event, which includes the detection progress percentage, a description field of the current detection stage, and a flag indicating whether an anomaly has been encountered. The progress response event is transmitted back to the asynchronous detection bus through the status query channel. After parsing the progress response event, the asynchronous detection bus executes judgment logic based on the detection progress percentage: if the progress percentage is greater than 50% and the anomaly flag is false, the remaining time of the detection timeout timer is extended to 50% of the original detection time; if the progress percentage is less than 30% and the time since the first push has exceeded 150% of the original detection time, it is determined that the detection node is in an infinite loop or resource contention state, and a node restart command is generated to reactivate the authenticity detection node.

[0078] After completing the entire verification process, the authenticity detection node publishes an authenticity detection conclusion event. This event's data structure includes a detection serial number, a verification result enumeration value, a verification failure reason code, and a verification timestamp. The verification result enumeration value includes six states: verification passed, signature not found, signature format error, certificate expired, certificate revoked, and signature value mismatch. After subscribing to the authenticity detection conclusion event, the asynchronous detection bus extracts the verification result enumeration value for branch judgment. When the verification result is a signature format error, certificate expired, certificate revoked, or signature value mismatch, the verification failure flag is set to true. At this time, the asynchronous detection bus removes the integrity detection node, availability detection node, and security detection node from the queue of nodes to be activated, avoiding subsequent detection consuming computational resources. Simultaneously, a detection termination event is constructed. This event includes a detection serial number, a termination reason code, a termination timestamp, and a list of completed detection nodes. The detection termination event and the detection serial number are jointly written to the time-series evidence log. The timestamps of the log entries use nanosecond precision to ensure accurate recording of the event sequence.

[0079] When the verification result enumeration value of the authenticity detection conclusion is "verification passed" or "signature does not exist," the asynchronous detection bus sets the verification passed flag to true. At this time, it retrieves the integrity detection node, availability detection node, and security detection node in sequence from the queue of nodes to be activated. The integrity detection node is activated first. After receiving the four-property detection context object, it performs hash value recalculation verification on the multi-granularity content fingerprint to detect whether the content of the file has been tampered with during transmission and temporary storage. The asynchronous detection bus also starts a detection timeout timer for the integrity detection node and collects the detection duration every 5 seconds during the detection execution. When the cumulative detection duration exceeds the detection time threshold set for the node, the detection intermediate state snapshot collection mechanism is triggered.

[0080] The intermediate snapshot records the current execution status of the detection node, the time consumed, the number of data blocks verified, and the temporary verification values ​​generated during the detection process. When performing multi-granularity content fingerprint verification, the integrity detection node needs to read the electronic file content block by block and calculate the hash value. When the number of file blocks is large, the verification time increases significantly. The snapshot acquisition module extracts the index list of currently verified blocks, the real-time hash value of each block, and the number of remaining blocks to be verified without interrupting the detection process. It constructs a snapshot data object, appends the current system timestamp and the detection serial number to this object, and writes it to the time-series evidence log. This ensures that even if the detection node crashes due to an anomaly, the subsequent recovery mechanism can continue the verification from the point of interruption based on the snapshot content, avoiding the duplication of verified parts.

[0081] After the integrity detection node completes the detection, it publishes an integrity detection conclusion event. The asynchronous detection bus captures this event and activates the availability detection node. The availability detection node attempts to parse the format header information of the electronic file, verify whether the file conforms to the declared format specification, and attempts to load the file content into the memory buffer to check for format corruption.

[0082] In one optional specific embodiment, the termination detection node aggregates all node detection conclusions from the asynchronous detection bus based on the detection serial number, and appends the multi-granularity content fingerprint to the aggregated result to form a four-property detection conclusion set, including:

[0083] After receiving the security test results, the termination test node parses the reference identifier of the preceding test results in the security test results, traces the release time of the integrity test results and the availability test results based on the reference identifier of the preceding test results, and calculates the test interval between each test node.

[0084] The termination detection node encapsulates the detection interval duration and the detection serial number into a detection link verification request and sends it to the asynchronous detection bus;

[0085] The asynchronous detection bus extracts the activation and completion times of each detection node from the time-series evidence log based on the detection serial number, calculates the time-series span of the actual detection link, and compares and verifies it with the detection interval duration.

[0086] After verification, the asynchronous detection bus retrieves each detection conclusion, extracts the status identifier from each detection conclusion and generates a detection status vector, and then sends the detection status vector and each detection conclusion back to the termination detection node.

[0087] The termination detection node extracts the multi-granularity content fingerprint, combines it with the detection state vector, encodes it, and appends it to each detection conclusion to form a set of four-property detection conclusions.

[0088] In this specific embodiment, the termination detection node, as the final stage of the four-property detection process, is activated upon receiving the security detection conclusion. The security detection conclusion, as the output of the last detection node, carries a preceding detection conclusion reference identifier field in its data structure. This field uses a chained reference structure to record the detection conclusion identifiers of the three preceding nodes: authenticity detection, integrity detection, and availability detection. The termination detection node extracts the preceding detection conclusion reference identifier by parsing the metadata area of ​​the security detection conclusion. This identifier uses a hierarchical encoding method: the first layer is the detection serial number, the second layer is the node type code, and the third layer is the timestamp. Based on this reference identifier, the termination detection node can locate the storage location of the integrity detection conclusion and the availability detection conclusion in the asynchronous detection bus.

[0089] By accessing the release time field of these detection conclusions, the time when each node completes the detection and releases the conclusion is obtained. During the calculation process, the release time of the availability detection conclusion is subtracted from the release time of the integrity detection conclusion to obtain the detection interval between the integrity node and the availability node; the release time of the security detection conclusion is subtracted from the release time of the availability detection conclusion to obtain the detection interval between the availability node and the security node. These detection intervals reflect the actual timing connection between the nodes in the detection link and are the key basis for subsequent link integrity verification.

[0090] The termination detection node encapsulates the calculated detection interval durations and detection serial numbers into a detection link verification request. This request uses a structured data format, including a request type identifier, a detection serial number, a node interval duration array, and verification strategy parameters. The node interval duration array is arranged according to the execution order of the detection nodes, sequentially recording the time intervals between the three detection stages: authenticity to integrity, integrity to availability, and availability to security. The verification strategy parameters set an allowable timing deviation threshold to determine whether the actual timing span of the detection link deviates abnormally from the expected interval duration. This verification request is sent to the link verification module of the asynchronous detection bus via a message queue mechanism, triggering the timing consistency verification process.

[0091] After receiving a verification request for the detection link, the asynchronous detection bus performs a precise retrieval from the time-series evidence log based on the detection serial number carried in the request. The time-series evidence log is stored in a time-series database, and each log record contains the detection serial number, node type, activation time, completion time, and intermediate snapshot hash value. During the retrieval process, using the detection serial number as the primary key, all time-series records of the file across the four detection nodes are filtered out. After extracting the activation time and completion time of each detection node, the actual time-series span of the detection link is calculated. Specifically, the activation time of the integrity detection node is subtracted from the completion time of the authenticity detection node to obtain the actual switching latency between nodes; the same calculation is performed on the availability nodes and security nodes to form an array of actual time-series spans. The array is compared item by item with the node interval duration array in the verification request. The timing deviation value of each stage is calculated. When all deviation values ​​are less than the threshold set by the verification strategy parameters, the link timing verification is deemed to have passed, confirming that no node omissions or timing tampering have occurred in the detection process. If the deviation value of a certain stage exceeds the threshold, an abnormal alarm is generated and recorded in the audit log, and the detection conclusion aggregation process is stopped.

[0092] After successful verification, the asynchronous detection bus initiates the detection conclusion retrieval process. Based on the detection serial number, it extracts the corresponding detection conclusion data from the conclusion storage areas of the four nodes: authenticity detection, integrity detection, availability detection, and security detection. Each detection conclusion includes fields such as node type identifier, detection pass status, description of the cause of the anomaly, and detection time. The status identifier field is extracted from each detection conclusion. This field uses a Boolean value or an enumeration type to indicate whether the detection passed. The status identifiers of the four nodes are arranged in a fixed order to generate a detection status vector. For example, authenticity detection passing is recorded as 1, integrity detection passing as 1, availability detection failing as 0, and security detection passing as 1. The detection status vector is then represented as a four-dimensional array. This detection status vector can quickly reflect the overall pass status of the four tests, facilitating subsequent archiving decisions and risk assessments. The asynchronous detection bus encapsulates the detection status vector and the complete data of each detection conclusion together and sends them to the termination detection node through a message feedback mechanism.

[0093] After receiving the returned detection status vector and each detection conclusion, the termination detection node extracts multi-granularity content fingerprints from the four-property detection context object. These multi-granularity content fingerprints include file-level hash values, paragraph-level hash values, and key field hash values, uniquely identifying file content at different granularities. The detection status vector and multi-granularity content fingerprints are combined and encoded using a structured concatenation method. First, the detection status vector is serialized into a fixed-length byte sequence. Then, each granularity content fingerprint is appended sequentially according to its granularity level, forming a combined encoding result. This combined encoding result serves as additional metadata and is bound to each detection conclusion. During the binding process, a metadata extension field is added to the data structure of each detection conclusion, and the combined encoding result is written to this field. In this way, each detection conclusion not only records its own detection status but also carries the file's multi-granularity content fingerprint and the overall detection status vector, ensuring a strong correlation between the detection conclusion and the file content and preventing the detection conclusion from being applied to other files. After binding is complete, the detection conclusions of the four detection nodes are arranged in the detection order to form a four-property detection conclusion set. This conclusion set, as the final output of the four properties of electronic documents detection, provides a complete detection basis for subsequent archiving decisions, index construction, and traceability chain binding, ensuring that each link in the archiving process can be traced back to the original data and time-series evidence of the detection stage.

[0094] In one optional specific embodiment, when writing the electronic file to be archived to the archive storage location, the multi-granularity content fingerprint and the time-series evidence log are jointly embedded into the archive index record, and linked to the four-property detection conclusion set in a hash value chain to form an immutable distributed archive traceability chain, including:

[0095] When writing the electronic file to be archived to the archive storage location, the multi-granularity content fingerprint set is used as the leaf node to construct the first Merkle tree, and the root hash value is calculated as the content verification anchor point.

[0096] The four-property detection conclusion set is used as leaf nodes to construct a second Merkle tree, and the root hash value is calculated. It is then chained with the content verification anchor point to generate the hash value of the current archive chain node.

[0097] Extract the time array of each operation step from the time-series evidence log, calculate the time interval between adjacent times to form a time-series interval array, and perform a cumulative hash operation on the time-series interval array to generate a time-series anchoring identifier;

[0098] The verification paths of each leaf node in the first Merkle tree and the second Merkle tree are extracted respectively. The verification paths and the time-series anchoring identifiers are encapsulated into a chained verification package, and the chained verification package is written into the archived index record.

[0099] When a distributed node needs to verify an archived record, it reconstructs the Merkle root hash value through the verification path and verifies the chain continuity of the archived chain node hash values, forming an immutable distributed archived traceability chain.

[0100] In this specific embodiment, after the electronic document to be archived passes the four-property checks, the various verification data generated during the detection process need to be encrypted and bound to the document itself to ensure that the archived data has complete traceability and anti-tampering characteristics. Before writing the electronic document to the archive storage location, the multi-granularity content fingerprint needs to be structured. The multi-granularity content fingerprint includes file-level hash values, block hash values, and local hash values ​​of key content areas. These fingerprint data are organized into an ordered set, and each fingerprint value in the set is used as a leaf node. The first Merkle tree is constructed in order from left to right. During the construction process, the hash values ​​of two adjacent leaf nodes are concatenated and the hash value is calculated again to generate the next-level node. The calculation is carried out layer by layer until a unique root hash value is obtained. This root hash value serves as the content verification anchor point, which can verify the integrity of any content fingerprint with minimal storage cost.

[0101] Simultaneously, the detection results from the four-property verification conclusion set are used as another set of leaf nodes. This set includes authenticity verification scores, integrity verification status, usability assessment results, and security scan reports, with each conclusion serialized into a fixed-format byte stream. These byte streams are used as leaf nodes to construct a second Merkle tree, employing the same construction algorithm as the first Merkle tree to calculate the root hash value layer by layer. The content verification anchor point is concatenated with the root hash value of the second Merkle tree in a fixed order. The concatenated byte sequence is then subjected to SHA-256 hashing again to generate the hash value of the archive chain node corresponding to the current archiving operation. This hash value will serve as a node in the distributed archive tracing chain, forming a chained association with historical archive records.

[0102] To ensure verifiability in the time dimension, it is necessary to extract timestamp information of key operations from the time-series evidence log. The time-series evidence log records the entire process from file submission to archiving completion, including key time points such as fingerprint calculation time, detection node start time, detection completion time, and archive writing time. These times are organized into a time array according to their occurrence order, and the time difference between two adjacent times is calculated to form a time interval array. This array reflects the actual time consumption of each processing step. Any abnormal time jump will indicate tampering. A cumulative hash operation is performed on the time interval array, that is, the first interval value is hashed to obtain the first intermediate hash value, and this intermediate hash value is concatenated with the second interval value and hashed again. This process is repeated until all interval values ​​are processed. The final hash value is used as the time-series anchor identifier. This identifier compresses the time dimension information into a fixed-length digest. Any modification at any time will cause the time-series anchor identifier to change completely.

[0103] After constructing the two Merkle trees, it is necessary to extract the verification path for each leaf node. For any leaf node in the first Merkle tree, its verification path includes the hash values ​​of all sibling nodes along the path from that leaf node to the root node. For example, if a content fingerprint is a leaf node, its verification path includes the hash values ​​of its sibling leaf nodes, the hash values ​​of the parent node's sibling nodes, and the hash values ​​of sibling nodes at each level upwards, up to the root node. By verifying the path, it can be proven that a leaf node does indeed belong to the tree without exposing the entire tree structure. The verification path for each leaf node in the second Merkle tree is extracted using the same method. All verification paths, time-series anchoring identifiers, and archive chain node hash values ​​are encapsulated into a chained verification package. This verification package is organized in JSO6 format and includes an array of verification paths, a time-series anchoring identifier field, tree structure metadata, and a chain node hash value field.

[0104] The chained verification package is written to the extended attribute area of ​​the archived index record. The archived index record originally contained basic metadata such as file name, storage path, and archive time; now, a verification data field is added. This field stores the complete content of the chained verification package, enabling each archived record to carry its own verification capability. Simultaneously, the hash value of the current archived chain node needs to be linked with the hash value of the node in the previous archived record. Specifically, the hash value of the previous node is concatenated with the hash value of the current node and then hashed again. The result is used as the chain connection proof and written to the current record. This chain structure ensures that any modification to the historical record will cause a mismatch in the hash values ​​of all subsequent records.

[0105] When any node in a distributed storage network needs to verify the authenticity of an archived record, it reads a chained verification packet from the record's archive index. Based on the verification path, it reconstructs the root hash value of the first Merkle tree. This involves starting from the leaf node of the content fingerprint to be verified and sequentially performing chained hash operations with the hash values ​​of sibling nodes in the verification path, calculating upwards layer by layer until the root hash value is obtained. The calculated root hash value is then compared with the content verification anchor stored in the record. If they match, it proves that the content fingerprint has not been tampered with. The same method is used to verify the second Merkle tree, confirming the completeness of the four-property detection conclusions. Further verification of the time-series anchoring identifier is achieved by recalculating the cumulative hash value of the time-series interval array, confirming the continuity of the time series.

[0106] Verifying the chain continuity of archived data node hash values ​​involves checking whether the current node's hash value is correctly calculated from the content verification anchor point and the root hash value of the detection conclusion, and verifying the integrity of the link relationships with preceding and following nodes. Through this series of verification steps, a comprehensive verification system is formed, encompassing content to conclusions and chronological order to chain relationships, constructing an immutable distributed archived traceability chain. Modification to any link in this traceability chain will result in multiple verification failures, thus ensuring the credibility and traceability of archived data throughout its entire lifecycle.

[0107] In one optional specific embodiment, based on the historical accumulation of the distributed archive tracing chain and time-series evidence logs, predictive dynamic weighting based on historical anomaly patterns is performed on the node activation rules of the asynchronous detection bus, and the archive index structure is updated collaboratively, including:

[0108] Extract the abnormal state markers of the four-property detection conclusion set corresponding to the hash value of each archive chain node from the distributed archive traceability chain, and extract the abnormal trigger records in the intermediate state snapshots of each detection node under the corresponding detection serial number from the time-series evidence storage log. Align and merge them with the detection serial number as the association key, and construct a historical abnormal propagation path map based on the causal relationship of abnormal triggering between each detection node.

[0109] Normalization is performed using the trigger frequency of each propagation edge in the historical anomaly propagation path graph as input to generate an anomaly propagation probability matrix between nodes;

[0110] The nodes are sorted based on the cumulative probability of each detection node being a propagation source, and a node activation weight distribution is generated.

[0111] The node activation weight distribution is written into the node activation rules of the asynchronous detection bus, and the activation priority and triggering conditions are reconfigured with the activation weight of each detection node to complete the predictive dynamic weighting of the node activation rules.

[0112] Based on the updated activation priority of each detection node, priority alignment and rearrangement are performed on the index fields corresponding to each detection node in the archived index record, and the anomaly propagation probability matrix between nodes is written into the extended field of the archived index record to complete the collaborative update of the archived index structure.

[0113] In this specific embodiment, during the continuous operation of the electronic document archiving system, a large amount of historical detection data and archiving records will be accumulated. This historical data not only records the detection results, but also contains the patterns and rules of anomaly occurrence. By deeply mining the distributed archiving traceability chain and time-series evidence log, the inherent connection of anomaly propagation between different detection nodes can be discovered, thereby intelligently optimizing the detection process.

[0114] When predictive dynamic weighting is required to activate the nodes of the asynchronous detection bus, anomaly-related information needs to be extracted from historical data. From each node of the distributed archive tracing chain, the four-property detection conclusion set corresponding to the hash value is read, and the anomaly status marker field is parsed. This anomaly status marker is encoded using a bitmap, with each bit corresponding to one of the four states: authenticity detection anomaly, integrity detection anomaly, availability detection anomaly, and security detection anomaly. Simultaneously, from the time-series evidence log, an index query is performed based on the detection serial number to extract all intermediate state snapshots recorded by all detection nodes associated with that serial number. These snapshots contain detailed state information of the detection nodes during execution, with particular attention paid to the anomaly trigger record field, which records the specific detection item that triggered the anomaly, the trigger timestamp, and the severity level of the anomaly.

[0115] The abnormal state markers extracted from the archived traceability chain and the abnormal trigger records extracted from the time-series evidence log are aligned and merged using the detection serial number as the association key. During the alignment process, the synchronization of timestamps needs to be handled because the clocks of different nodes in the distributed system may deviate. A logical clock mechanism is used to ensure the correctness of the event sequence. The merged dataset contains a complete sequence of abnormal occurrences, which can reflect the order in which abnormalities occur on various detection nodes under the same detection serial number.

[0116] Based on the chronological order and node relationships of these anomalies, a historical anomaly propagation path graph is constructed. This graph adopts a directed graph structure, where vertices represent four detection nodes and edges represent anomaly propagation relationships. When the historical record of detection serial number i shows that node A first exhibits an anomaly, followed by node B, a directed edge is established in the graph from node A to node B. The initial weight of the edge is set to the number of times this propagation path occurs. By traversing all historical detection serial numbers, anomaly propagation patterns are identified one by one, and the graph is updated accordingly. The final graph clearly shows which detection node anomalies are likely to trigger anomalies in other nodes, as well as the strength of this propagation relationship.

[0117] To transform the graph into a quantifiable metric that can be used to adjust node activation rules, a normalization operation is performed on the historical anomaly propagation path graph. The trigger frequency of each propagation edge in the graph is counted, and the sum of the trigger frequencies S of all edges originating from node j is calculated. j For an edge from node j to node k, its normalized anomaly propagation probability is calculated as the trigger frequency of that edge divided by S. j Organize all normalized results into an anomaly propagation probability matrix P between nodes, with matrix elements P jk This represents the probability that node k will subsequently become abnormal when node j becomes abnormal.

[0118] Based on the anomaly propagation probability matrix between nodes, the influence of each detection node as a propagation source is calculated. For node j, all non-zero elements in the j-th row of matrix P are summed to obtain the cumulative anomaly propagation amount W of node j. j A larger value indicates that an anomaly in this node is more likely to trigger anomalies in other nodes, and therefore a higher activation weight should be assigned to achieve early detection. All detection nodes are then incremented according to the anomaly propagation accumulation W. j Sort the nodes from largest to smallest and generate a sequence of node activation weight distribution. For nodes that are ranked higher, assign them higher basic activation weight values, for example, by using an exponential decay method to distribute the weights.

[0119] The generated node activation weight distribution is written into the node activation rule configuration item of the asynchronous detection bus. The asynchronous detection bus maintains the activation priority queue and trigger condition table for each detection node. Based on the new activation weights, the priority values ​​of each detection node are reconfigured, with higher-weight nodes having lower priority values ​​to ensure they are activated earlier in the detection process. Simultaneously, the trigger condition thresholds are adjusted: the thresholds are lowered for high-weight nodes to make them more easily activated by preceding detection conclusion events, while the thresholds are appropriately increased for low-weight nodes. This adjustment mechanism, based on historical anomaly propagation patterns, allows the detection process to adaptively focus on stages more likely to cause problems.

[0120] Adjustments to node activation rules inevitably affect the organizational structure of the archive index. The archive index records organize the index fields of each detection item according to the order of the detection nodes. When the activation priority of a detection node changes, the index fields need to be rearranged to align their priorities. The updated activation priority values ​​of each detection node are read, and the index fields of the corresponding detection nodes in the archive index records are rearranged in descending order of priority. This rearrangement ensures that the index structure remains consistent with the actual detection execution order, improving index access efficiency.

[0121] To trace abnormal relationships between nodes during subsequent queries and audits, the anomaly propagation probability matrix P is serialized and written into an extended field of the archived index record. This extended field uses a compressed encoding format to store the non-zero elements of the matrix and their position information, saving storage space. When it is necessary to analyze the detection history of a specific archived file, the anomaly propagation probability matrix can be reconstructed from the extended field, and in-depth source tracing analysis can be performed in conjunction with time-series evidence logs.

[0122] After completing the above operations, the archive index structure achieves coordinated updates with the node activation rules. This coordinated mechanism ensures that the optimization of the detection process and the optimization of data organization are carried out simultaneously, enabling the entire archive system to continuously improve itself based on historical experience and improve the accuracy and efficiency of anomaly detection.

[0123] A second aspect of this invention provides an electronic document four-property detection and automatic archiving system based on asynchronous processing, comprising:

[0124] The fingerprint construction unit is used to calculate multi-granularity content fingerprints of the electronic documents to be archived, fuse the multi-granularity content fingerprints with the document metadata to construct a four-property detection context object, and generate a globally unique detection serial number;

[0125] The asynchronous detection unit is used to deliver the four-property detection context object to the asynchronous detection bus, activate the four detection nodes of authenticity, integrity, availability and security driven by the detection conclusion event, and publish the detection conclusion after each detection node completes the detection to trigger the subsequent node, and write the detection intermediate state snapshot into the time-series evidence log.

[0126] The conclusion aggregation unit is used to aggregate all node detection conclusions from the asynchronous detection bus based on the detection serial number by the termination detection node, and to attach the multi-granularity content fingerprint to the aggregation result to form a four-property detection conclusion set;

[0127] The archiving binding unit is used to embed the multi-granularity content fingerprint and the time-series evidence log together into the archiving index record when writing the electronic file to be archived into the archiving storage location, and bind it to the hash value chain of the four-property detection conclusion set to form an immutable distributed archiving traceability chain.

[0128] The rule tuning unit is used to perform predictive dynamic weighting of the node activation rules of the asynchronous detection bus based on historical anomaly patterns, based on the historical accumulation of the distributed archive tracing chain and time-series evidence log, and to collaboratively update the archive index structure.

[0129] A third aspect of the present invention provides an electronic device, comprising:

[0130] processor;

[0131] Memory used to store processor-executable instructions;

[0132] The processor is configured to invoke instructions stored in the memory to execute the aforementioned method.

[0133] A fourth aspect of the present invention provides a computer-readable storage medium having stored thereon computer program instructions that, when executed by a processor, implement the aforementioned method.

[0134] This invention can be a method, apparatus, system, and / or computer program product. The computer program product may include a computer-readable storage medium having computer-readable program instructions loaded thereon for performing various aspects of the invention.

[0135] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for detecting and automatically archiving electronic documents based on asynchronous processing, characterized in that: include: For archived electronic documents, calculate multi-granularity content fingerprints, fuse the multi-granularity content fingerprints with document metadata to construct a four-property detection context object, and generate a globally unique detection serial number; The four-property detection context object is delivered to the asynchronous detection bus. The four detection nodes of authenticity, integrity, availability and security are activated by the detection conclusion event. After each detection node completes the detection, it publishes the detection conclusion to trigger the subsequent node and writes the detection intermediate state snapshot into the time-series evidence log. The termination detection node aggregates all node detection conclusions from the asynchronous detection bus based on the detection serial number, and appends the multi-granularity content fingerprint to the aggregation result to form a set of four-property detection conclusions. When writing the electronic file to be archived into the archive storage location, the multi-granularity content fingerprint and the time-series evidence log are jointly embedded into the archive index record, and the hash value chain is linked with the four-property detection conclusion set to form an immutable distributed archive traceability chain. Based on the historical accumulation of the distributed archive tracing chain and time-series evidence logs, predictive dynamic weighting based on historical anomaly patterns is performed on the node activation rules of the asynchronous detection bus, and the archive index structure is updated collaboratively, including: Extract the abnormal state markers of the four-property detection conclusion set corresponding to the hash value of each archive chain node from the distributed archive traceability chain, and extract the abnormal trigger records in the intermediate state snapshots of each detection node under the corresponding detection serial number from the time-series evidence storage log. Align and merge them with the detection serial number as the association key, and construct a historical abnormal propagation path map based on the causal relationship of abnormal triggering between each detection node. Normalization is performed using the trigger frequency of each propagation edge in the historical anomaly propagation path graph as input to generate an anomaly propagation probability matrix between nodes; the nodes are sorted according to the cumulative probability of each detection node as a propagation source to generate a node activation weight distribution. The node activation weight distribution is written into the node activation rules of the asynchronous detection bus, and the activation priority and triggering conditions are reconfigured with the activation weight of each detection node to complete the predictive dynamic weighting of the node activation rules. Based on the updated activation priority of each detection node, priority alignment and rearrangement are performed on the index fields corresponding to each detection node in the archived index record, and the anomaly propagation probability matrix between nodes is written into the extended field of the archived index record to complete the collaborative update of the archived index structure.

2. The method according to claim 1, characterized in that, For archived electronic documents, multi-granularity content fingerprints are calculated. These multi-granularity content fingerprints are then fused with document metadata to construct a four-property detection context object, and a globally unique detection serial number is generated, including: The electronic files to be archived are scanned using a sliding window at three levels of granularity: byte level, paragraph level, and document level. Content features are extracted at each level of granularity and hash digests are calculated for each level. The three-level hash digests are then organized into a multi-granularity content fingerprint with hierarchical dependencies in a tree structure. The creation timestamp, modification timestamp, access permission identifier, and file format type are extracted from the system attributes of the electronic files to be archived. Combined with the archiving trigger source identifier and business classification code transmitted by the business system, a set of file metadata is formed. The hash digests at each level in the multi-granularity content fingerprint are cross-correlated with the time dimension attributes, permission dimension attributes, and business dimension attributes in the file metadata set to form a four-property detection context object containing the fingerprint hierarchy and metadata structured fields. Based on a distributed unique identifier generation mechanism, the current node identifier, nanosecond-level timestamp, and content digest of the four-property detection context object are combined and encoded to generate a detection serial number with global uniqueness and temporal monotonicity, which is then embedded as the primary key into the four-property detection context object.

3. The method according to claim 1, characterized in that, The four-property detection context object is delivered to the asynchronous detection bus. The four detection nodes (authenticity, integrity, availability, and security) are activated, driven by the detection conclusion event. After each detection node completes the detection, it publishes its detection conclusion to trigger subsequent nodes and writes an intermediate detection snapshot to the time-series evidence log, including: The four-property detection context object is submitted to the asynchronous detection bus, pushed to the authenticity detection node, and a detection timeout timer is started. When the authenticity detection node does not publish a detection conclusion event within the detection time, the asynchronous detection bus sends a detection status query instruction to the authenticity detection node. The authenticity detection node receives the detection status query instruction and encapsulates the current detection progress into a progress response event and sends it back to the asynchronous detection bus. The asynchronous detection bus determines whether to reactivate the authenticity detection node based on the progress response event. When the authenticity detection node publishes an authenticity detection conclusion carrying a verification failure flag, the asynchronous detection bus blocks the activation of the integrity detection node, availability detection node, and security detection node and generates a detection termination event, and writes the detection termination event and the detection serial number into the time-series evidence storage log. When the authenticity test result shows that the verification is passed, the asynchronous test bus sequentially activates the integrity test node, the availability test node, and the security test node. During the test performed by each test node, the test duration is monitored in real time. When the test duration of any test node exceeds the test time, the intermediate state snapshot of the test node is triggered and written into the time-series evidence log.

4. The method according to claim 1, characterized in that, The termination detection node aggregates all node detection conclusions from the asynchronous detection bus based on the detection serial number, and appends the multi-granularity content fingerprint to the aggregated result to form a four-property detection conclusion set, including: After receiving the security test results, the termination test node parses the reference identifier of the preceding test results in the security test results, traces the release time of the integrity test results and the availability test results based on the reference identifier of the preceding test results, and calculates the test interval between each test node. The termination detection node encapsulates the detection interval duration and the detection serial number into a detection link verification request and sends it to the asynchronous detection bus; The asynchronous detection bus extracts the activation and completion times of each detection node from the time-series evidence log based on the detection serial number, calculates the time-series span of the actual detection link, and compares it with the detection interval duration for verification. After verification, the asynchronous detection bus retrieves each detection conclusion, extracts the status identifier from each detection conclusion, generates a detection status vector, and sends the detection status vector and each detection conclusion back to the termination detection node. The termination detection node extracts the multi-granularity content fingerprint, combines it with the detection state vector, encodes it, and appends it to each detection conclusion to form a set of four-property detection conclusions.

5. The method according to claim 1, characterized in that, When writing the electronic file to be archived to the archive storage location, the multi-granularity content fingerprint and the time-series evidence log are jointly embedded into the archive index record, and linked to the four-property detection conclusion set in a hash value chain to form an immutable distributed archive traceability chain, including: When writing the electronic file to be archived to the archive storage location, the multi-granularity content fingerprint set is used as a leaf node to construct a first Merkle tree, and the root hash value is calculated as the content verification anchor point; the four-property detection conclusion set is used as a leaf node to construct a second Merkle tree, and the root hash value is calculated. A chain hash operation is performed with the content verification anchor point to generate the hash value of the current archive chain node. Extract the time array of each operation step from the time-series evidence log, calculate the time interval between adjacent times to form a time-series interval array, perform a cumulative hash operation on the time-series interval array to generate a time-series anchoring identifier; extract the verification path of each leaf node in the first Merkle tree and the second Merkle tree respectively, encapsulate the verification path and the time-series anchoring identifier into a chained verification package, and write the chained verification package into the archived index record; When a distributed node needs to verify an archived record, it reconstructs the Merkle root hash value through the verification path and verifies the chain continuity of the archived chain node hash values, forming an immutable distributed archived traceability chain.

6. An electronic document four-property detection and automatic archiving system based on asynchronous processing, used to implement the method as described in any one of claims 1-5, characterized in that, include: The fingerprint construction unit is used to calculate multi-granularity content fingerprints of the electronic documents to be archived, fuse the multi-granularity content fingerprints with the document metadata to construct a four-property detection context object, and generate a globally unique detection serial number; The asynchronous detection unit is used to deliver the four-property detection context object to the asynchronous detection bus, activate the four detection nodes of authenticity, integrity, availability and security driven by the detection conclusion event, and publish the detection conclusion after each detection node completes the detection to trigger the subsequent node, and write the detection intermediate state snapshot into the time-series evidence log. The conclusion aggregation unit is used to aggregate all node detection conclusions from the asynchronous detection bus based on the detection serial number by the termination detection node, and to attach the multi-granularity content fingerprint to the aggregation result to form a four-property detection conclusion set; The archiving binding unit is used to embed the multi-granularity content fingerprint and the time-series evidence log together into the archiving index record when writing the electronic file to be archived into the archiving storage location, and bind it to the hash value chain of the four-property detection conclusion set to form an immutable distributed archiving traceability chain. The rule tuning unit is used to perform predictive dynamic weighting of the node activation rules of the asynchronous detection bus based on historical anomaly patterns, based on the historical accumulation of the distributed archive tracing chain and time-series evidence log, and to collaboratively update the archive index structure.

7. An electronic device, characterized in that, include: processor; Memory used to store processor-executable instructions; The processor is configured to invoke instructions stored in the memory to execute the method according to any one of claims 1 to 5.

8. A computer-readable storage medium having computer program instructions stored thereon, characterized in that, When the computer program instructions are executed by the processor, they implement the method described in any one of claims 1 to 5.

Images