A data storage and visualization processing system

Abstract

The application belongs to the technical field of data processing, and particularly relates to a data storage and visual processing system. The system comprises: a heterogeneous data acquisition component for multi-source data preprocessing and feature extraction; a secure distributed storage component for maintaining data integrity and synchronously resisting antigen information by using a hash linked list and a redundancy mechanism; an immune clone detection and analysis device for simulating an immune mechanism to recognize abnormalities through affinity matching and perform clone variation to accurately lock tampering areas; an adversarial generation evolution device for constructing a game defense mechanism to improve the detection accuracy and early warning capability for unknown attacks; and a dynamic defense visual rendering engine for assigning different visual coding parameters to different security level data areas according to the detection results. The application realizes the transformation from passive data display to active defense display by deeply coupling the immune adaptive mechanism and the adversarial generation network, and enhances the detection efficiency and visual feedback capability of the system for complex and dynamic variation attacks.

Description

Technical Field

[0001] This invention belongs to the field of data processing technology, specifically relating to a data storage and visualization processing system. Background Technology

[0002] With the rapid development of information technology, data storage and visualization systems have become core infrastructure for decision-making and status monitoring in fields such as industrial control, cybersecurity, and financial supervision. Traditional data processing frameworks reduce the cognitive load on operators by structuring and storing large-scale heterogeneous data and presenting it intuitively using graphical interfaces. In complex information ecosystems, the integrity of data and the credibility of the presentation layer directly affect the accuracy of decision-making and the operational security of the system, which places higher technical demands on the robustness and security of the system.

[0003] Dynamic visualization technology, which integrates security defense mechanisms, has become an important research direction. This type of technology aims to monitor the data status of the storage layer in real time by introducing advanced algorithmic models, and to transform potential security threats into identifiable visual feedback. Through continuous semantic analysis and feature extraction of the data stream, the system strives to build a security barrier from the storage backend to the display frontend while maintaining the efficiency of visualization interaction, in order to cope with increasingly complex network attacks and data tampering risks.

[0004] Existing data visualization systems exhibit significant lag and blind conformity when faced with precise data contamination attacks. Traditional systems mostly follow a linear storage-to-display mapping logic, which prevents the display layer from identifying and filtering the tampered data at the underlying level, resulting in a false WYSIWYG (What You See Is What You Get) phenomenon and inducing serious decision-making errors.

[0005] Existing security detection algorithms struggle to cope with frequently changing attack patterns, lack adaptive feature recognition and evolution capabilities, and are unable to accurately capture subtle anomalies in massive datasets. Furthermore, the lack of deep coupling between the visualization rendering engine and the security detection logic prevents the system from providing real-time warnings through differentiated visual encoding when encountering malicious attacks, hindering dynamic suppression and alerting of risky areas. Summary of the Invention

[0006] The purpose of this invention is to provide a data storage and visualization processing system that can solve the problems in the visualization system described in the background art, such as the tendency to make misjudgments, the inability to identify tampered data at the underlying level, and the blind obedience of the display layer when subjected to data pollution attacks.

[0007] To achieve the above objectives, the technical solution adopted by the present invention is as follows: A data storage and visualization processing system includes a heterogeneous data acquisition component, a secure distributed storage component, an immune clone detection and analysis device, an adversary generation and evolution device, and a dynamic defense visualization rendering engine, wherein: The heterogeneous data acquisition component is used to acquire multi-source heterogeneous raw data from industrial control sites, network communication links, and financial transaction terminals in real time. It transforms the multi-source heterogeneous raw data into a unified format dataset to be processed through a predefined semantic parsing protocol, and performs noise filtering, missing value compensation, and feature normalization on the dataset to be processed. It extracts feature vectors that can characterize the system's operating status and transmits the processed data stream to the secure distributed storage component in real time.

[0008] The secure distributed storage component is used to establish a highly reliable logical storage architecture, divide the received data stream into multiple data blocks, generate a unique integrity verification identifier for each data block using hash linked list technology, and distribute the data blocks to different physical storage units using a multi-replica redundancy mechanism or erasure coding mechanism. The secure distributed storage component is also responsible for maintaining a metadata index table, recording the storage location, timestamp, and current security status label of each data block, and synchronizing the stored data status as antigen information to be identified to the immune clone detection and analysis device.

[0009] The immune clone detection and analysis device is used to simulate the adaptive recognition mechanism of the biological immune system. It matches the antigen information with an initial antibody library composed of pre-stored normal data patterns. By calculating the affinity between the antigen and the antibody, it identifies potential abnormal data patterns. When the affinity is lower than a preset threshold, it triggers an immune response program to perform clonal proliferation and high-frequency mutation operations on the identified abnormal patterns to generate new antibodies with higher specificity, so as to accurately locate the tampered data region.

[0010] The adversarial generative evolution device is used to construct a game-theoretic defense mechanism based on a generative model and a discriminative model. It uses known data attack samples to train the generative model to simulate various high-frequency mutation malicious tampering patterns, and at the same time trains the discriminative model to distinguish between real stored data and generated simulated attack data. Through the continuous adversarial evolution of the two, the antibody library in the immune clone detection and analysis device is continuously updated, thereby improving the system's detection accuracy and forward-looking early warning capability against novel and unknown data contamination attacks.

[0011] The dynamic defense visualization rendering engine serves as the final visual expression layer. It performs logical coordinate mapping and geometric reconstruction on the data content in the secure distributed storage component. Based on the detection results output by the immune clone detection and analysis device, it assigns differentiated visual encoding parameters to data areas with different security levels. For data determined to be secure, it performs conventional transparency rendering and color mapping. For data areas determined to be abnormal or attacked, it generates dynamic masking films or specific highlighting styles, thereby realizing the transformation from passive data display to active defense display.

[0012] Preferably, the heterogeneous data acquisition component introduces a spatiotemporal context correlation analysis mechanism when processing data. It not only extracts the static features of individual data points, but also extracts the rate of change features of data on the time axis and the correlation strength features in the spatial topology through a sliding window, forming a high-dimensional feature matrix.

[0013] Furthermore, the secure distributed storage component includes a dynamic verification module, which periodically recalculates the hash value of the data blocks stored in the physical unit and compares it with the initial verification identifier in the metadata index table. If a consistency offset is found, the relevant storage sector is immediately locked, and an early warning command is sent to the immune clone detection and analysis device to prevent the spread of contamination.

[0014] Furthermore, when performing affinity calculation, the immune clone detection and analysis device employs a multidimensional semantic space vector cosine similarity algorithm, which projects the antigen feature vector and the antibody feature vector into a high-dimensional semantic space. The cosine value of the angle between the two is calculated to quantitatively describe their similarity. When the cosine value of the angle is less than a certain threshold, it is determined that there is an abnormal antigen.

[0015] Furthermore, the clonal proliferation process of the immune clone detection and analysis device follows a positive feedback regulation logic, and the number of clones is directly proportional to the affinity. That is, the higher the affinity and the more accurate the identification of the antibody, the larger the clone scale will be. The high-frequency mutation operation adopts a non-uniform mutation strategy, which assigns a higher mutation probability to the key dimensions in the feature vector in order to quickly explore the potential abnormal mutation space.

[0016] Preferably, the generative model in the adversarial generative evolution device includes multiple convolutional transpose layers to progressively upscale low-dimensional noise signals into a fake data stream with complex statistical properties; the discriminative model includes multiple fully connected layers with specific activation functions to enhance its sensitivity to fake and tampered data by minimizing the classification error function.

[0017] Furthermore, the dynamic defense visualization rendering engine includes a visual conflict processing module. When normal data and contaminated data exist simultaneously in the display area, this module sets the rendering weight of the attacked area to the highest according to the priority configuration, ensuring that the visual feedback layer of abnormal information is superimposed on all regular display layers, and preventing abnormal signals from being submerged by background information.

[0018] Furthermore, the dynamic masking film generated by the dynamic defense visualization rendering engine has a semi-transparent grid texture. Its color saturation and flashing frequency are determined by the risk coefficient calculated by the immune clone detection and analysis device. The higher the risk coefficient, the more the color of the masking film tends to be a warning color, and the faster the flashing frequency, creating a strong warning effect visually.

[0019] Preferably, the dynamic defense visualization rendering engine also has an immune fluorescence rendering mode, in which all data that has undergone integrity verification is presented in normal grayscale or natural color, while any data marked as potentially tampered or of unknown origin is given a simulated biological fluorescence effect, with the emission range covering the geometric boundary of the data and its neighboring areas with strong logical correlation.

[0020] Furthermore, the system also includes a global resource scheduling center, which is used to monitor the computing load and memory usage of each of the above components in real time, and dynamically adjust the iteration number of the immune clone detection and analysis device and the training frequency of the adversarial generation and evolution device according to the fluctuation of the scale of the data to be processed, so as to ensure that the core defense logic can still maintain real-time performance when the system suffers high-intensity data impact.

[0021] Furthermore, when the secure distributed storage component detects serious data corruption, it will automatically initiate a recovery mechanism based on multi-version concurrency control, extract historical snapshots from the secure copy before the tampering, perform overwrite reconstruction, and feed back the reconstructed data path to the visualization rendering engine, which will then display a progress bar for data recovery and a mark indicating that the consistency verification has passed on the screen.

[0022] Preferably, the heterogeneous data acquisition component also integrates a protocol adaptive learning subunit. When undefined non-standard protocol data is accessed, this subunit identifies the structural features of the data packet through cluster analysis, automatically infers its field definitions and semantic associations, expands the system's compatibility with unknown device access, and provides a standardized data foundation for subsequent storage and visualization.

[0023] Furthermore, the immune clone detection and analysis device has a memory mechanism that stores each successfully identified and suppressed abnormal pattern in a long-term memory unit. When a similar antigen is introduced in the future, the system can directly call up the antibodies in the memory, skip the complex cloning mutation process, and achieve a defense response at the second or even sub-second level.

[0024] Furthermore, the dynamic defense visualization rendering engine supports multi-window linkage display. While the main view displays the global data situation, a sub-view automatically pops up to display the original data slices of abnormal areas, the detected mutation feature curves, and the attack evolution simulation animation generated by the adversarial generation and evolution device, assisting operators in conducting a comprehensive risk assessment.

[0025] Preferably, the system runs in a hard-isolated secure operating system environment, and all communication between components adopts an encrypted internal bus protocol to ensure that the detection logic and rendering logic themselves are not penetrated or hijacked by malicious code, thus building a closed-loop trust chain from the underlying hardware, storage layer, algorithm layer to the display layer.

[0026] Furthermore, when generating the masking film, the visualization rendering engine dynamically adjusts according to the operator's visual focus. By using eye-tracking data or interactive heatmaps, defensive visual information is prioritized to be presented in the center area of ​​the operator's current line of sight, thereby improving the effectiveness of information transmission.

[0027] Furthermore, the adversarial generation and evolution device can switch between preset attack mode libraries for different industry application scenarios. For example, in the power control scenario, it focuses on simulating fake instruction injection attacks, and in the financial monitoring scenario, it focuses on simulating account tampering attacks, making the system's defense capabilities highly industry-specific.

[0028] Compared with the prior art, the present invention has the following beneficial effects: 1. This invention breaks away from the blind logic of traditional visualization systems that store and display data simultaneously. By introducing an immune clone selection algorithm, it deeply couples data security protection into the visualization process, enabling the system to proactively identify and defend against underlying data contamination.

[0029] 2. This invention introduces the adaptive learning mechanism of biological immunology into the field of data security, enabling the system to cope with complex, high-frequency mutated unknown attack patterns. By continuously evolving the antibody library through cloning, proliferation, and high-frequency mutation, it improves the detection efficiency for zero-day vulnerabilities or advanced persistent threats.

[0030] 3. This invention achieves self-evolution of attack and defense through adversarial generative networks, and continuously refines the discrimination capability by using simulated attack samples, thus solving the drawbacks of traditional security systems that rely on static feature libraries and cannot cope with dynamic environmental changes.

[0031] 4. This invention achieves defensive expression at the visualization level. By generating differential visual codes such as masking films and immunofluorescence, it transforms the profound underlying security status into intuitive and definite visual signals, reducing the cognitive load on operators in complex situations and preventing decision-making biases caused by misleading information.

[0032] 5. This invention constructs a complete closed loop from acquisition, storage, detection to rendering. The components work closely together through antigen-antibody logic, which not only improves the system's detection rate of abnormal data, but also achieves closed-loop risk management through multi-copy recovery, visual suppression and other means, thereby enhancing the data resilience of critical information infrastructure.

[0033] 6. This invention ensures operational efficiency in large-scale heterogeneous data environments through decentralized distributed storage and global resource scheduling. By setting textual logical thresholds and adjusting adaptive parameters, the system achieves a balance between security and real-time performance, making it highly valuable for engineering applications. Attached Figure Description

[0034] Figure 1 This is a schematic diagram of the overall technical solution architecture of the present invention; Figure 2 This is a schematic diagram of the core principle framework of the immune clone detection and analysis device in this invention; Figure 3 This is a logical flowchart of the multi-source heterogeneous data acquisition and secure distributed storage in this invention; Figure 4 This is a schematic diagram of the multi-level interaction relationship and data flow between the adversarial generation and evolution device and the immune clonal detection and analysis device in this invention; Figure 5 This is a logical flow diagram of the dynamic defense visualization rendering engine in this invention. Detailed Implementation

[0035] Example 1: Please refer to Figures 1 to 5. To make the objectives, technical solutions, and advantages of the present invention clearer, the present invention will be further described in detail below with reference to specific embodiments.

[0036] A data storage and visualization processing system includes a heterogeneous data acquisition component, a secure distributed storage component, an immune clone detection and analysis device, an adversary generation and evolution device, and a dynamic defense visualization rendering engine. The heterogeneous data acquisition component is used to acquire multi-source heterogeneous raw data from industrial control sites, network communication links, and financial transaction terminals in real time. It transforms the multi-source heterogeneous raw data into a unified format dataset to be processed through a predefined semantic parsing protocol, and performs noise filtering, missing value compensation, and feature normalization on the dataset to be processed. It extracts feature vectors that can characterize the system's operating status and transmits the processed data stream to the secure distributed storage component in real time.

[0037] The heterogeneous data acquisition component relies on a high-performance data acquisition gateway or embedded communication server at the hardware level. Its physical interface integrates multiple physical link layers, including Ethernet interfaces, serial communication interfaces, and wireless communication modules. Internally, the heterogeneous data acquisition component integrates an automatic protocol identification engine, which pre-stores a protocol feature library including Modbus, OPC UA, FIX, HTTP, and various dedicated industrial bus protocols. When processing sensor data from industrial control sites, the heterogeneous data acquisition component uses deep packet inspection technology to parse the packet header, payload, and checksum of the data packets, extracting the physical quantity information.

[0038] A spatiotemporal context correlation analysis mechanism is introduced into the internal logic of the heterogeneous data acquisition component. This mechanism not only extracts the static numerical features of a single data point at a given instant, but also performs time-domain analysis on the data sequence within the window by configuring a sliding window with a preset step size, extracting the rate of change, first derivative, and second derivative features of the data on the time axis. Simultaneously, combined with the system's topology information, this mechanism calculates the correlation strength features between the current data point and its spatially adjacent measurement points. These temporal and spatial features are concatenated into a high-dimensional feature matrix, comprehensively outlining the system's operational status within that time slice.

[0039] To address the potential for non-standard or proprietary protocols in industrial settings, the heterogeneous data acquisition component integrates a protocol adaptive learning subunit. When undefined, non-standard protocol data is received, this subunit does not discard the message directly but instead initiates a structured inference mode based on cluster analysis. By performing byte-level distribution feature statistics on a large number of continuously captured messages, it identifies fixed and variable fields within the messages, automatically inferring the positions of the message header, length field, function code, and cyclic redundancy check (CRC) code. Unsupervised learning algorithms are used to model the evolution patterns of these fields, automatically generating a semantic parsing template for the unknown protocol. This mechanism significantly expands the system's compatibility with new IoT devices or customized terminals, providing a standardized data foundation for subsequent storage and security testing.

[0040] The secure distributed storage component is used to establish a highly reliable logical storage architecture, divide the received data stream into multiple data blocks, generate a unique integrity verification identifier for each data block using hash linked list technology, and distribute the data blocks to different physical storage units using a multi-replica redundancy mechanism or erasure coding mechanism. The secure distributed storage component is also responsible for maintaining a metadata index table, recording the storage location, timestamp, and current security status label of each data block, and synchronizing the stored data status as antigen information to be identified to the immune clone detection and analysis device.

[0041] The physical deployment of the secure distributed storage component typically consists of a cluster of interconnected storage servers, internally interconnected via high-speed Fibre Channel or 10 Gigabit Ethernet. The core file system of this component employs a decentralized architecture to avoid data loss due to single points of failure. Upon receiving the data stream transmitted by the heterogeneous data acquisition component, the system first initiates a block-segmentation strategy, dividing the continuous data stream into data blocks of preset sizes of 64 megabytes or 128 megabytes. For each data block, the system calls a high-performance hardware acceleration chip to calculate its secure hash value, and uses this hash value as the digital fingerprint of the data block.

[0042] The hash chaining technology concatenates the hash value of the current data block with the hash value of the previous data block, forming an immutable chain structure. If any link in the chain is maliciously modified, the hash verification of all subsequent nodes will fail, achieving second-level detection of data tampering. Regarding redundancy backup, the secure distributed storage component selects to replicate the data block to three different physical racks based on a preset reliability level, or uses erasure coding technology to encode the original data block into multiple fragments containing verification components. As long as the number of surviving fragments reaches a preset reconstruction threshold, the original data can be fully recovered. This mechanism improves storage space utilization while ensuring data security.

[0043] Furthermore, the secure distributed storage component includes a dynamic verification module. This module runs in an independent background process, recalculating the hash values ​​of data blocks silently stored on each physical disk according to a preset inspection cycle, and comparing them with the initial verification identifier in the metadata index table stored in the encrypted trusted environment. Once an inconsistency offset is detected in the comparison result, the module immediately determines that the storage area has suffered physical media damage or logical silent tampering, and then issues a locking command to block the relevant storage sectors to prevent contaminated data from being read by upper-layer applications. Simultaneously, it sends a security warning to the immune clone detection and analysis device, triggering subsequent immune response and data recovery logic.

[0044] The immune clone detection and analysis device is used to simulate the adaptive recognition mechanism of the biological immune system. It matches the antigen information with an initial antibody library composed of pre-stored normal data patterns. By calculating the affinity between the antigen and the antibody, it identifies potential abnormal data patterns. When the affinity is lower than a preset threshold, it triggers an immune response program to perform clonal proliferation and high-frequency mutation operations on the identified abnormal patterns to generate new antibodies with higher specificity, so as to accurately locate the tampered data region.

[0045] The device is logically divided into an antigen processing unit, an antibody memory library, an affinity evaluation engine, and a clonal mutation regulator. The antigen information is a vector representation with specific feature dimensions extracted from the storage component, representing a slice of the system's current real-time data. The initial antibody library is a set of baseline patterns formed by clustering and extracting historical data from the system under long-term normal operation.

[0046] During the affinity calculation process, the affinity evaluation engine employs an algorithm based on the cosine similarity of vectors in a multidimensional semantic space. This algorithm projects the antigen feature vector to be detected and the feature vectors of each antibody in the antibody library into an abstract, high-dimensional biomimetic semantic space.

[0047] ; in, The cosine similarity score ranges from -1 to 1. Let n be the 1, 2, ..., n-dimensional components of the feature vector of the antigen to be detected. Let n be the 1, 2, ..., n-dimensional components of the antibody feature vector in the antibody library. The dot product of the antigen feature vector and the antibody feature vector. Let be the magnitude of the antigen feature vector. Let be the magnitude of the antibody feature vector. This represents the dimension of the high-dimensional biomimetic semantic space. The closer this cosine value is to 1, the better the antigen and antibody match, and the data is within the normal range. When this cosine value is less than the preset security defense threshold, the system determines that there are abnormal components in the current data, that is, it has identified an aggressive antigen.

[0048] Once an anomaly is detected, the clonal mutation regulator immediately initiates an immune response. The clonal proliferation process follows a positive feedback regulation logic: antibodies that exhibit a certain affinity for the abnormal antigen and can initially identify the attack pattern are assigned a higher clonal scale coefficient. The system rapidly replicates tens of thousands of candidate copies of the antibody in memory. Subsequently, the system performs non-uniform mutation operations on these clone copies. Unlike ordinary random mutation, the non-uniform mutation strategy, based on the distribution of historical attack characteristics, assigns higher mutation probabilities and larger mutation amplitudes to dimensions in the feature vector that are more sensitive to security (such as control instruction domains, account balance domains, etc.). Through this high-frequency, targeted mutation, the system can quickly identify specific antibodies that can generate high affinity for the novel abnormal antigen, achieving precise boundary delineation and type identification of tampered data regions.

[0049] Furthermore, the immune clonal detection and analysis device also possesses a memory mechanism. This mechanism consists of a long-term memory unit used to store high-quality antibodies that have proven lethal in past successful defense operations. When the system encounters a similar or identical attack pattern again, the memory mechanism quickly retrieves these antibodies stored in the immune memory region, skipping the time-consuming clonal mutation evolution stage, and directly identifying and locking onto the input data. This improves the overall defense response time of the system from the second level to the sub-second level, constructing a robust secondary immune barrier.

[0050] The adversarial generative evolution device is used to construct a game-theoretic defense mechanism based on a generative model and a discriminative model. It uses known data attack samples to train the generative model to simulate various high-frequency mutation malicious tampering patterns, and at the same time trains the discriminative model to distinguish between real stored data and generated simulated attack data. Through the continuous adversarial evolution of the two, the antibody library in the immune clone detection and analysis device is continuously updated, thereby improving the system's detection accuracy and forward-looking early warning capability against novel and unknown data contamination attacks.

[0051] The core idea of ​​this device is to promote defense upgrades through attack simulation. The generative model structurally comprises multiple layers of convolutional transpose layers. It receives random noise vectors as input and, through layer-by-layer upsampling and convolution operations, progressively upscales the low-dimensional noise signal, mapping it into a forged data stream with complex statistical properties and logically deceptive characteristics. These forged data streams are designed to simulate various advanced persistent threats that hackers might implement, such as slowly drifting numerical manipulation and injection attacks targeting specific logical vulnerabilities.

[0052] The discriminative model comprises multiple layers of fully connected and convolutional layers with specific activation functions. Its task is to act as a rigorous auditor, continuously attempting to distinguish between genuine data from the storage component and fabricated attack data from the generative model. During training, the system forces the discriminative model to improve its sensitivity by minimizing a specific classification error function. A dynamic game balance is formed between the generative and discriminative models in this process: the generative model strives to create more realistic and destructive virtual antigens, while the discriminative model hones its ability to identify subtle anomalies.

[0053] Through this continuous adversarial evolution, the adversarial generation and evolution device can discover potential system vulnerabilities before real attackers. The high-quality attack samples it evolves are used as training material, fed back into the immune clone detection and analysis device for pre-training and updating the antibody library. This means that before suffering an actual attack, the system has already developed immunity against thousands of potential attack variants in a virtual training ground. To enhance targeting, the device also supports industry-specific scenario switching logic. In power control scenarios, the evolution logic focuses on simulating the injection of false power commands; in financial regulatory scenarios, it focuses on simulating the covert alteration of accounting features, ensuring a high degree of alignment between defense strategies and business logic.

[0054] The dynamic defense visualization rendering engine serves as the final visual expression layer. It performs logical coordinate mapping and geometric reconstruction on the data content in the secure distributed storage component. Based on the detection results output by the immune clone detection and analysis device, it assigns differentiated visual encoding parameters to data areas with different security levels. For data determined to be secure, it performs conventional transparency rendering and color mapping. For data areas determined to be abnormal or attacked, it generates dynamic masking films or specific highlighting styles, thereby realizing the transformation from passive data display to active defense display.

[0055] The dynamic defense visualization rendering engine calls upon the computing resources of the graphics processing unit on the hardware level, and implements rendering through the underlying graphics application programming interface. It first obtains the verified data stream from the storage component and converts it into logical coordinates in the 3D scene. Each data point or data block is abstracted as a geometric entity. The engine internally includes a visual conflict processing module, which receives security scores from the immune detection device in real time.

[0056] When both normal and contaminated data exist simultaneously within the display area, the visual conflict handling module prioritizes the attacked area, setting its rendering weight to the highest. For data areas deemed abnormal, the engine no longer renders them according to their original declared values ​​but instead overlays them with a masking layer featuring dynamic visual characteristics. Mathematically, this masking layer is a semi-transparent shader effect with a periodically fluctuating mesh texture. Its color saturation, flicker frequency, and transparency are not fixed values ​​but are dynamically driven by a real-time risk coefficient calculated by the immune clone detection and analysis device. The higher the risk coefficient, the more the masking layer's color tends towards a highly saturated warning color (such as deep red), and the faster the flicker frequency, creating a strong psychological warning and forcibly guiding the operator's attention.

[0057] Furthermore, the engine also has an immunofluorescence rendering mode. In this mode, all normal data that passes the integrity check and is marked as "family" is presented in low-saturation grayscale or natural colors as background information. Any abnormal data marked as potentially tampered, of unknown origin, or in the process of immune attack is given a glowing effect that simulates biological fluorescence. This glowing effect is achieved by performing Gaussian blur and color overlay in the pixel shader. The glowing range not only covers the geometric boundary of the abnormal data but also propagates through logical association to cover the neighboring data regions that have a strong causal relationship with it, visually demonstrating the scope of data infection on the screen and enabling the operator to identify the attack path and affected range at a glance.

[0058] The dynamic defense visualization rendering engine also supports multi-window linked display. While the main large-screen view shows the overall data security situation, when a severe attack is detected, the system will automatically pop up a sub-view window in the sidebar. The sub-view will carefully display the original 16 - hexadecimal data slices of the abnormal area, the mutation feature curves extracted by the immune algorithm, and the simulated animation of the future path that the attack may evolve into, which is synchronously generated by the adversarial generation and evolution device. This multi-dimensional visual presentation provides the operator with a comprehensive decision-making basis from the underlying raw data to the high-level defense logic.

[0059] The system also includes a global resource scheduling center for real-time monitoring of the computing load and memory occupancy of each of the above components. Since the immune cloning algorithm and the adversarial generation network consume a large amount of computing resources, the scheduling center adjusts the iteration times of the immune cloning detection and analysis device and the training frequency of the adversarial generation and evolution device in real time according to the fluctuation of the scale of the data to be processed through a preset dynamic balancing algorithm. When the system suffers from high-intensity data impacts or network traffic peaks, the scheduling center will prioritize ensuring the real-time performance of the acquisition component and the rendering engine and appropriately reduce the background weight of the adversarial training to ensure that the core defense logic does not get blocked and maintain the dynamic robustness of the system.

[0060] When the secure distributed storage component detects an irreversible data destruction behavior, it will automatically start a recovery mechanism based on multi-version concurrent control. By maintaining a version snapshot list, this mechanism can quickly locate the previous safe time point before the data was tampered with. The system extracts historical snapshots from the secure copies distributed on different physical nodes and performs an overwriting logical reconstruction. The reconstruction process occurs quietly in the background, and the visualization rendering engine will display a progress bar corresponding to the physical storage location on the screen, accompanied by a text prompt indicating that the reconstruction is being performed through the immune copy. Once the reconstruction is completed, the mark passing the consistency verification will immediately replace the previous alarm style and resume normal display, building a complete security closed-loop from discovery, alarm, suppression to repair.

[0061] The system operates within a hard-isolated secure operating system environment. In this environment, all system components, including kernel drivers, communication buses, and application-layer algorithm modules, are digitally signed and verified. Communication between components does not use common open protocols, but rather an encrypted internal bus protocol with strict access control lists. This means that even if an attacker manages to penetrate an external network, they cannot hijack the rendering logic or forge detection results through conventional means. From the lowest-level hardware data stream acquisition to the middle-layer immune analysis evolution, and finally to the top-level defensive visual presentation, the system forms an encrypted and verified closed-loop trust chain, ensuring the infallibility of the security defense system itself.

[0062] Furthermore, the visualization rendering engine intelligently optimizes the generation of visual feedback by incorporating human-computer interaction logic. It can access operator eye-tracking data or interaction heatmap data. If the engine detects a severely vulnerable area, but the operator's gaze or focus is on another unrelated area, the engine dynamically adjusts the presentation position of defensive visual information. Utilizing edge vision perception principles, it generates guiding defensive beacons near the operator's line of sight, forcibly directing their attention to the risk area, thus improving the efficiency of transmitting critical security information in emergency situations.

[0063] Example 2: As an alternative to Example 1, Example 2 describes a data storage and visualization processing system based on an edge computing architecture. In this architecture, the various components of the system exhibit distributed collaborative characteristics of edge defense and cloud evolution in their physical deployment, adapting to large-scale industrial internet application scenarios with geographically dispersed locations.

[0064] In this embodiment, the heterogeneous data acquisition component is deployed on edge computing nodes close to the data source. Each edge node is equipped with a lightweight instruction parser. Unlike Embodiment 1, the acquisition component here adds a data pre-judgment function. Before transmitting data to the storage component, the edge node first performs a preliminary screening of the raw signal using a built-in simplified immune feature detection model. If the temporal characteristics of the data conform to a preset whitelist pattern, it is marked as a safe stream and compressed before uploading; if abnormal fluctuations are detected, an emergency defense mode is immediately activated locally.

[0065] In Embodiment 2, the secure distributed storage component evolves into a two-tier storage architecture. The first-tier storage, located at the edge nodes, employs a circular buffer based on non-volatile memory to store high-frequency raw data from the past 24 hours. The second-tier storage, located in the central cloud, uses a large-scale object storage cluster to store long-term historical data that has undergone anonymization processing. This architecture reduces bandwidth consumption while ensuring complete data backtracking capabilities at the edge even when network links are interrupted.

[0066] The immune clone detection and analysis device in Example 2 adopts a distributed operation strategy. Edge nodes are responsible for performing tasks with high real-time requirements, such as antigen recognition and antibody matching. Due to limited computing resources on the edge side, the number of iterations for clonal proliferation and high-frequency mutation is limited to a low range, mainly used to identify known attack patterns. The adversarial generation and evolution device, on the other hand, is deployed entirely in a central cloud with a powerful computing cluster. The cloud system aggregates anonymized anomalous samples from tens of thousands of edge nodes and uses a deep learning computing platform for large-scale game training, continuously evolving super antibodies capable of dealing with complex variants.

[0067] These superior antibodies, evolved in the cloud, are regularly distributed and synchronized to the immune databases of various edge nodes via a dedicated secure downlink channel. This mechanism enables single-point detection and network-wide immunity. Once an edge site suffers a new type of data contamination attack, the system can complete cloud-based modeling of attack characteristics and network-wide antibody updates within minutes, enabling other unaffected sites to have preemptive defensive capabilities.

[0068] At the visualization level, the dynamic defense visualization rendering engine in Embodiment 2 supports cross-terminal collaborative display. In addition to displaying the global defense posture on the large screen in the central monitoring room, it is also configured to push lightweight augmented reality views to the mobile terminals of on-site maintenance personnel. When on-site personnel wear AR smart glasses to view the equipment, the rendering engine uses spatial coordinate alignment technology to directly overlay the immunofluorescence rendering effect onto the surface of the physical equipment. If the underlying storage data of a device is tampered with, personnel will see the device enveloped in a flashing red defense shielding film in their glasses, accompanied by detailed fault diagnosis suggestions. This combined virtual and real defense display enhances the intuitiveness of on-site handling.

[0069] The secure distributed storage component in Example 2 introduces a blockchain consensus mechanism to manage the metadata index table. The hash verification identifier for each data block is no longer stored locally, but is recorded in a distributed ledger via a consensus algorithm. This means that even if an attacker simultaneously controls the storage server and the immune detection device, they cannot forge data integrity proofs unless they control more than half of the consensus nodes across the network. This architecture further enhances the system's survivability in the face of extreme threats such as the hijacking of internal privileged accounts.

[0070] Regarding communication security, Example 2 employs quantum encryption distribution technology or an improved asymmetric encryption protocol to ensure the secure distribution of antibodies between the edge and the cloud. All transmitted antibody feature vectors are obfuscated before packaging, ensuring that even if intercepted on the transmission link, attackers cannot reverse engineer the system's defense vulnerabilities.

[0071] Example 3: In Example 3, the present invention provides a hardware-accelerated version of the system implementation for high bandwidth and low latency requirements (such as national backbone network traffic monitoring or ultra-large-scale power real-time dispatch).

[0072] In this embodiment, the core logic of the immune clone detection and analysis device and the adversary generation and evolution device is embedded in a set of customized field-programmable gate arrays (FPGAs) or application-specific integrated circuits (ASICs). Unlike the software-defined logic in Embodiment 1, affinity calculation, clone selection, and mutation operators are all implemented in parallel through hardware logic circuits.

[0073] The affinity evaluation engine consists of thousands of parallel multiplication and accumulation units at the hardware level, capable of calculating the cosine similarity of thousands of feature vectors within a single clock cycle. This hardware-level parallel processing capability enables the system to perform real-time antigen extraction and immune scanning on each data packet even when faced with tens of millions of data updates per second, eliminating the performance bottleneck caused by software processing.

[0074] In embodiment 3, the secure distributed storage component employs a high-speed storage medium based on storage class memory (SCM). Its hash list generation module is directly integrated into the hardware pipeline of the storage controller. During the process of writing data from the bus to the storage medium, the hardware logic synchronously completes the hash calculation and integrity verification identifier generation, achieving zero-latency coupling between storage and security hardening.

[0075] Meanwhile, to cope with data recovery under extremely high bandwidth, this embodiment uses a hardware-accelerated erasure coding engine, which improves the reconstruction speed by more than two orders of magnitude compared to traditional software implementations.

[0076] In Embodiment 3, the dynamic defense visualization rendering engine is deeply integrated with the video memory controller. It employs a technique called defensive pixel stream insertion. Before the graphics frame buffer synthesizes the final image, the hardware engine directly intervenes in the pixel pipeline. For coordinate areas marked as contaminated by the immune device, the rendering engine bypasses the traditional rendering pipeline and instead injects a visual interference pattern with specific frequency characteristics (i.e., a hardware-level masking film) directly into the output signal. This approach ensures that even in the event of a display driver crash or malicious hijacking, the visual signal representing a security warning can still be forcibly presented on the physical screen through the underlying hardware.

[0077] Furthermore, the global resource scheduling center in Example 3 incorporates hardware predictive branching logic. It analyzes the load patterns of historical data streams to pre-adjust the allocation of logic gate resources within the FPGA. When a large-scale data fluctuation is predicted, the scheduling center dynamically shuts down some non-core statistical modules, concentrating all logic resources on the immune clone detection logic to ensure the absolute reliability of the system's defense function under extreme loads.

[0078] In terms of system environment, Example 3 employs a redundant architecture with physical layer isolation. The entire system consists of two identical hardware modules, operating in primary and backup modes respectively. The two hardware modules communicate via a physical optical gate for one-way heartbeat monitoring. Once the primary module's immune device detects a threat to its logical integrity, the system completes a circuit switch within nanoseconds, transferring control to the backup module and immediately physically severing all external links of the attacked module. This hardware-level disaster recovery switch provides the highest level of data resilience and defensive reliability for critical infrastructure.

[0079] Furthermore, Example 3 specifically adds a sandbox evolution environment for the adversarial generation and evolution device. All simulated attacks and antibody evolution processes are conducted in a hardware sandbox that is logically completely disconnected from the production environment. The sandbox simulates a full-stack operating environment from the physical layer to the protocol layer. Before entering the official library, the newly evolved antibodies must undergo rigorous autoimmune testing in the sandbox to ensure that the newly generated antibody logic will not cause false alarms or interference with the normal operation of the system itself, thus preventing system instability caused by excessive mutation of the immune algorithm.

[0080] This hardware acceleration architecture, designed for high-performance scenarios, organically combines the adaptive capabilities of biological immunity with the parallel processing advantages of integrated circuits, representing the highest technical form of this system when processing ultra-large-scale, high-real-time data streams.

[0081] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above descriptions are merely specific embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of the present invention should be included within the scope of protection of the present invention. Without departing from the concept of the present invention, those skilled in the art can make several variations and improvements, all of which fall within the scope of protection of the present invention. The scope of protection of the present invention is determined by the contents of the claims.

Claims

1. A data storage and visualization processing system, characterized in that, include: Heterogeneous data acquisition component, used to acquire multi-source heterogeneous raw data in real time; A secure distributed storage component, connected to the heterogeneous data acquisition component, is used to establish a logical storage architecture, divide the received data stream into multiple data blocks and generate integrity verification identifiers using hash chain list technology, distribute the data blocks to physical storage units using a multi-replica redundancy mechanism or erasure coding mechanism, and maintain a metadata index table that records the storage location, timestamp, and security status label of the data blocks. An immune clone detection and analysis device, connected to the secure distributed storage component, is used to treat the stored data state as antigen information and match it with an initial antibody library of pre-stored normal data patterns. Abnormal data patterns are identified by calculating the affinity between antigen and antibody. When the affinity is lower than a threshold, an immune response program is triggered to clone and proliferate and perform high-frequency mutation on the identified abnormal patterns to lock the tampered data area. The adversarial generation and evolution device is connected to the immune clone detection and analysis device to construct a game-theoretic defense mechanism based on a generation model and a discriminant model. It uses data attack samples to train the generation model to simulate malicious tampering patterns and trains the discriminant model to distinguish between real data and simulated attack data. The antibody library is updated through adversarial evolution. The dynamic defense visualization rendering engine is connected to the secure distributed storage component and the immune clone detection and analysis device, respectively. It is used to perform logical coordinate mapping and geometric reconstruction on the stored data content, and to assign differentiated visual encoding parameters to data areas with different security levels according to the detection results. For data that is determined to be safe, regular rendering is performed, and for data areas that are determined to be abnormal, a dynamic masking film or highlighting style is generated.

2. The data storage and visualization processing system according to claim 1, characterized in that, The multi-source heterogeneous raw data is transformed into a unified format dataset by using a predefined semantic parsing protocol. The dataset is then subjected to noise filtering, missing value compensation, and feature normalization to extract feature vectors that characterize the system's operating state.

3. The data storage and visualization processing system according to claim 2, characterized in that, The heterogeneous data acquisition component includes a protocol adaptive learning subunit, which is used to perform byte-level distribution feature statistics on continuously captured messages through cluster analysis when accessing undefined non-standard protocol data, identify fixed and variable fields in the messages, automatically infer the positions of the message's frame header, length field, function code, and cyclic redundancy check code, and use unsupervised learning algorithms to model the field evolution rules and automatically generate semantic parsing templates for unknown protocols. The heterogeneous data acquisition component also introduces a spatiotemporal context correlation analysis mechanism when processing data. This mechanism performs time-domain analysis on the data sequence within the window through a sliding window with a preset step size, extracts the rate of change features, first derivative features, and second derivative features of the data on the time axis, and calculates the correlation strength features between the current data point and each of its adjacent measurement points in spatial physical location in combination with the system's topology information, so as to form a high-dimensional feature matrix.

4. The data storage and visualization processing system according to claim 3, characterized in that, The secure distributed storage component includes a dynamic verification module, which runs in an independent background process. It recalculates the hash value of data blocks silently stored on each physical disk according to a preset inspection cycle and compares it with the initial verification identifier in the metadata index table stored in the encrypted trusted environment. If there is an inconsistency offset in the comparison result, it is determined that the storage area has suffered physical media damage or logical silent tampering. It immediately issues a locking command to block the relevant storage sectors and sends a security warning command to the immune clone detection and analysis device. The secure distributed storage component also has a recovery mechanism based on multi-version concurrency control. When data corruption is detected, it locates the pre-secure time point before the data was tampered with by maintaining a version snapshot chain, extracts historical snapshots from secure copies distributed on different physical nodes for overlay-style logical reconstruction, and feeds back the reconstructed data path to the dynamic defense visualization rendering engine.

5. The data storage and visualization processing system according to claim 4, characterized in that, The immune clone detection and analysis device includes an affinity evaluation engine, which uses a multidimensional semantic space vector cosine similarity algorithm to project the antigen feature vector to be detected and the feature vectors of each antibody in the antibody library into a high-dimensional biomimetic semantic space. During the calculation process, the affinity evaluation engine multiplies each dimension of the antigen vector with the corresponding dimension of the antibody vector, sums all the product results to obtain the vector dot product, and then divides the vector dot product by the product of the magnitude of the antigen vector and the magnitude of the antibody vector to obtain the cosine value that reflects the similarity between the two. When the cosine value is less than the preset security defense threshold, the immune clone detection and analysis device determines that there are abnormal components in the current data.

6. The data storage and visualization processing system according to claim 5, characterized in that, The immune clone detection and analysis device includes a clonal variation regulator and a long-lasting memory unit; The clonal mutation regulator is used to execute a clonal proliferation process that follows positive feedback regulation logic, so that antibodies with affinity for abnormal antigens obtain a higher clonal size coefficient and replicate multiple antibody candidate copies in memory space. The clonal mutation regulator is also used to perform non-uniform mutation operations on the clone copy, and to allocate higher mutation probabilities and larger mutation amplitudes to the security-sensitive dimensions in the feature vector according to the distribution of historical attack characteristics, so as to explore specific antibodies that generate high affinity with abnormal antigens. The long-term memory unit is used to store antibodies that are deemed excellent during the defense operation. When the system encounters an attack mode again, the antibodies in the long-term memory unit are directly called to identify and lock the input data, thereby shortening the overall defense response time of the system.

7. The data storage and visualization processing system according to claim 6, characterized in that, The generative model in the adversarial generative evolution device includes multiple convolutional transpose layers, which are used to receive random noise vectors as input and map low-dimensional noise signals into fake data streams with complex statistical properties through layer-by-layer upsampling and convolution operations. The discriminative model in the adversarial generative evolution device includes multiple fully connected layers and convolutional layers with activation functions, which are used to distinguish between real stored data and fake data streams by minimizing the classification error function; The adversarial generation and evolution device is also equipped with industry scenario switching logic, which is used to switch the preset attack mode library for different industry application scenarios. In the power control scenario, it focuses on simulating fake instruction injection attacks, and in the financial monitoring scenario, it focuses on simulating account tampering attacks. The evolved high-quality attack samples are fed back to the immune clone detection and analysis device for pre-training and updating the initial antibody library.

8. The data storage and visualization processing system according to claim 7, characterized in that, The dynamic defense visualization rendering engine includes a visual conflict processing module, which is used to set the rendering weight of the attacked area to the highest according to the priority configuration when normal data and contaminated data exist in the display area at the same time, so as to ensure that the visual feedback layer of abnormal information is superimposed on the normal display layer. The dynamic masking film generated by the rendering engine is a semi-transparent shader effect with a periodically fluctuating mesh texture. Its color saturation, flicker frequency, and transparency are dynamically driven by the real-time risk coefficient calculated by the immune clone detection and analysis device. The higher the risk coefficient, the closer the color of the masking film is to the warning color, and the faster the flicker frequency. The rendering engine also features an immunofluorescence rendering mode, which renders normal data that has passed integrity checks as low-saturation grayscale or natural colors, while imbuing anomalous data marked as potentially tampered or of unknown origin with a simulated biological fluorescence effect. This effect is achieved by performing Gaussian blur and color overlay in the pixel shader, and the emission range covers the geometric boundaries of the anomalous data and its logically related neighboring regions.

9. The data storage and visualization processing system according to claim 8, characterized in that, The dynamic defense visualization rendering engine supports multi-window linkage display, which allows the main view to display the global data situation while popping up a sub-view to display the original hexadecimal data slices of the abnormal area, the detected mutation feature curves, and the attack evolution simulation animation generated by the adversarial generation evolution device. The rendering engine is also used to access the operator's eye-tracking data or interactive heatmap data, and dynamically adjust according to the operator's visual focus. When a serious attack area is detected and the operator's line of sight is in a non-risk area, a guiding defense beacon is generated near the center of the operator's line of sight to guide the operator's attention to the risk area. When the secure distributed storage component performs an overlay reconstruction, the rendering engine is used to display a progress bar on the screen corresponding to the physical storage location, and to display the data recovery progress and the markers indicating that the consistency verification has passed.

10. The data storage and visualization processing system according to claim 9, characterized in that, It also includes a global resource scheduling center, which is used to monitor the computational load and memory usage of the heterogeneous data acquisition component, secure distributed storage component, immune clone detection and analysis device, adversary generation and evolution device and dynamic defense visualization rendering engine in real time. The global resource scheduling center uses a preset dynamic balancing algorithm to adjust the number of iterations of the immune clone detection and analysis device and the training frequency of the adversarial generation and evolution device in real time according to the fluctuation of the scale of the data to be processed. When the system is subjected to high-intensity data surges or network traffic peaks, the global resource scheduling center prioritizes the computing resources of the heterogeneous data acquisition components and the dynamic defense visualization rendering engine, and reduces the background training weight of the adversarial generation and evolution device to ensure the real-time performance of the core defense logic.

Images