An information data security system and method based on semantic detection

Abstract

The application discloses a kind of information data security systems and methods based on semantic detection, belong to computer data security technical field, to solve the problem of sensitive data hidden leakage under high concurrency network environment, information data security method based on semantic detection includes: intercepting the network data packet to be detected reaching network communication interface;Extract the load byte sequence in the network data packet to be detected;Extract the message sequence number of network data packet to be detected;Sequence feature coding matrix corresponding initial word vector tensor is generated based on message sequence number;High-dimensional representation in multi-head self-attention network layer is extracted to fusion feature tensor;Risk classification activation value is output by dimension reduction to high-dimensional representation;When risk classification activation value is greater than preset safety threshold;Intercept instruction containing physical discard action is generated;Network communication interface is truncated network data packet to be detected using intercept instruction;The application improves the transmission efficiency of sensitive data.

Description

Technical Field

[0001] This invention relates to the field of computer data security technology, specifically to an information data security system and method based on semantic detection. Background Technology

[0002] As enterprises continue to advance their informatization process, data leakage prevention technology at the network boundary plays a crucial role in ensuring the security of business data and preventing the leakage of core information. Especially against the backdrop of deepening digital transformation, the normalization of cross-regional collaborative work, and the increasingly frequent interaction of various business data, enterprises are constantly raising their requirements for the security and compliance of data transmission at the network boundary. Deep packet inspection (DPI) methods in related technologies typically involve deploying auditing devices in series at network gateway nodes. This involves capturing network data packets from the network protocol stack and extracting their payload content. The payload content is then subjected to string pattern matching based on a pre-defined regular expression rule base or keyword feature dictionary. When a specific keyword combination is matched within the payload content, a pre-defined alarm or blocking action is executed. However, because these technologies heavily rely on static lexical features and continuous string matching mechanisms, they cannot effectively perform contextual semantic reorganization and dimensionality reduction feature extraction on fragmented data across multiple network packets within the limited buffer period of the network communication protocol stack. This leads to missed detections when dealing with sensitive data transmissions with deep semantic camouflage, resulting in the concealed leakage of sensitive data in high-concurrency network environments.

[0003] To address the above issues, a semantic detection-based information data security system and method are proposed. Summary of the Invention

[0004] The purpose of this invention is to provide an information data security system and method based on semantic detection. By using this device, the problem of missed detection of sensitive data transmission and the hidden leakage of sensitive data in high-concurrency network environments mentioned above can be solved.

[0005] To achieve the above objectives, the present invention provides the following technical solution: an information data security method based on semantic detection, the method comprising: Intercept incoming network data packets to be detected at the network communication interface; extract the payload byte sequence from the network data packets to be detected; Map the payload byte sequence to an initial word vector tensor; extract the message sequence number of the network data packet to be detected; generate a sequence feature encoding matrix corresponding to the initial word vector tensor based on the message sequence number; The initial word vector tensor is added to the sequence feature encoding matrix to obtain a fused feature tensor; the fused feature tensor is input into a pre-trained multi-head self-attention network layer; and the high-dimensional representation of the fused feature tensor in the multi-head self-attention network layer is extracted. The high-dimensional representation is reduced in dimensionality and output as a risk classification activation value; when the risk classification activation value is greater than a preset security threshold, an interception instruction containing a physical discard action is generated; the interception instruction is used to trigger the network communication interface to truncate the network data packet to be detected.

[0006] Further, mapping the payload byte sequence to an initial word vector tensor includes: The payload byte sequence is sliced ​​according to a preset word segmentation step size to obtain multiple sub-byte sequences; Query the preset word vector hash table; convert each of the subbyte sequences into a fixed-dimensional real-number floating-point vector; According to the physical bias order of the subbyte sequence in the payload byte sequence, all the real floating-point vectors are concatenated into the initial word vector tensor.

[0007] Further, the extraction of the high-dimensional representation of the fused feature tensor in the multi-head self-attention network layer includes: The fused feature tensor is multiplied by the first weight matrix, the second weight matrix, and the third weight matrix, respectively, to generate a query tensor, a key tensor, and a value tensor. Multiply the query tensor by the transpose of the key tensor; divide by a preset dimension scaling factor; and obtain the attention weight matrix by normalizing the exponential function. Multiply the attention weight matrix by the value tensor; output a local semantic tensor; perform a nonlinear mapping on the local semantic tensor through a feedforward neural network; output the high-dimensional representation.

[0008] Furthermore, the pre-trained multi-head self-attention network layer is trained in the following manner: Obtain a training sample set containing secure packet sequences and sensitive packet sequences; The training sample set is input into the initial neural network; the corresponding sample prediction activation values ​​are output. Calculate the binary cross-entropy loss between the predicted activation value of the sample and the real label data; extract the structured entity fragments from the sensitive data packet sequence; calculate the local attention weight penalty term corresponding to the structured entity fragments; The binary cross-entropy loss is added to the local attention weight penalty term to obtain a custom loss function; the network weight parameters of the initial neural network are updated using the backpropagation algorithm based on the custom loss function; thus, the multi-head self-attention network layer is obtained.

[0009] Furthermore, after extracting the payload byte sequence from the network data packet to be detected, and before mapping the payload byte sequence to the initial word vector tensor, the method further includes: The payload byte sequence is input into a pre-configured Bloom filter for hash mapping; When a zero value exists in the mapping bit set of the Bloom filter; the network data packet to be detected is determined to be a regular message; a hardware allow level signal is generated for the regular message; the step of mapping the payload byte sequence to the initial word vector tensor is terminated; When all the mapping bits of the Bloom filter are non-zero, the step of mapping the payload byte sequence to the initial word vector tensor is triggered.

[0010] Furthermore, the step of triggering the network communication interface to intercept the network data packet to be detected using the interception command includes: Parse the network interface card (NIC) register control address carried by the interception command; write a reset byte to the NIC register control address; Clear the hardware transmission ring buffer associated with the message sequence number; block the electrical signal transmission of the network data packet to be detected to the physical medium.

[0011] Furthermore, before multiplying the query tensor with the transpose matrix of the key tensor, the process further includes: Read the sliding window buffer in memory space; Real-time monitoring of the current network buffer throughput of the network communication interface; When the current network buffer throughput is greater than a preset throughput threshold; reduce the window capacity (in bytes) of the sliding window buffer according to a preset decay step value; discard the farthest previous key tensor from the current time. Obtain the preceding key tensor and preceding value tensor corresponding to the preceding historical data packets; The preceding key tensor and the key tensor are concatenated in the time dimension; the preceding value tensor and the value tensor are concatenated in the time dimension.

[0012] Furthermore, before obtaining the training sample set containing secure data packet sequences and sensitive data packet sequences, the method further includes: Obtain initial plaintext sample data; Based on a preset synonym replacement rule base and character disorder rule base, the initial plaintext sample data is subjected to character replacement and position perturbation; a sensitive data packet sequence with anti-obfuscation features is generated.

[0013] Furthermore, after triggering the network communication interface to intercept the network data packet to be detected using the interception command, the method further includes: Obtain the target payload byte sequence that causes the risk classification activation value to be greater than the preset security threshold; The target payload byte sequence is de-identified by byte replacement using a preset one-way hash algorithm; a de-identified log byte stream is generated. The de-identified log byte stream is written to an independent isolated sector of the solid-state storage using an asynchronous direct memory access mechanism.

[0014] This invention also discloses another technical solution: an information data security system based on semantic detection, the system comprising: The packet interception and payload extraction module intercepts network packets to be detected arriving at the network communication interface; and extracts the payload byte sequence from the network packets to be detected. The feature fusion module maps the payload byte sequence to an initial word vector tensor; extracts the message sequence number of the network data packet to be detected; and generates a sequence feature encoding matrix corresponding to the initial word vector tensor based on the message sequence number. The semantic detection and risk assessment module adds the initial word vector tensor to the sequence feature encoding matrix to obtain a fused feature tensor; inputs the fused feature tensor into a pre-trained multi-head self-attention network layer; and extracts the high-dimensional representation of the fused feature tensor in the multi-head self-attention network layer. The risk interception execution module reduces the dimensionality of the high-dimensional representation and outputs it as a risk classification activation value; when the risk classification activation value is greater than a preset security threshold, it generates an interception instruction containing a physical discard action; and uses the interception instruction to trigger the network communication interface to truncate the network data packet to be detected.

[0015] Compared with the prior art, the beneficial effects of the present invention are as follows: 1. This invention maps the payload byte sequence to an initial word vector tensor, generates a sequence feature encoding matrix by combining the message sequence number, and achieves feature fusion. It uses a pre-trained multi-head self-attention network layer to extract high-dimensional representations, thereby obtaining deep semantic information of the data packet payload. This enables the system to overcome the limitations of traditional deep packet detection that relies on static lexical features and continuous string matching. It can accurately identify sensitive data that has undergone semantic confusion such as synonym replacement and sentence structure reorganization, thereby achieving the effect of reducing the false negative rate of sensitive data transmission and improving the accuracy of sensitive data identification. 2. This invention obtains the complete contextual semantic features of cross-packet fragmented load by reading the memory sliding window cache, monitoring the network buffer throughput in real time and dynamically adjusting the window capacity, and combining the key tensor and value tensor of the preceding historical data packets for time dimension splicing. This enables the system to complete the semantic reorganization and dimensionality reduction extraction of fragmented data within the limited buffer period of the network protocol stack, thereby achieving the effect of solving the cross-packet data detection problem and avoiding the hidden leakage of sensitive data in high-concurrency network environments. 3. This invention achieves a comprehensive protection mechanism by setting a Bloom filter before mapping the payload byte sequence for pre-hash mapping screening, generating hardware-level interception instructions after risk detection and triggering network communication interface to truncate data packets, and simultaneously desensitizing the risk payload byte sequence and storing logs independently. This allows the system to improve detection efficiency while ensuring security reliability and data privacy protection, thus meeting the needs of enterprise-level network boundary data leakage prevention and can be widely applied in industries with high confidentiality requirements. Attached Figure Description

[0016] Figure 1 This is a flowchart illustrating the steps of the present invention. Figure 2 This is a system architecture diagram of the present invention. Detailed Implementation

[0017] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0018] Example 1: As Figure 1 As shown, this embodiment provides an information data security method based on semantic detection, including: Step 101: Intercept the network data packets to be detected arriving at the network communication interface; extract the payload byte sequence from the network data packets to be detected; specifically, the network communication interface monitors the network data transmission link in real time, and captures all arriving network data packets to be detected through a hook function interception mechanism based on the network protocol stack; the network communication interface can be a gigabit Ethernet interface; parse the Ethernet header, IP header, and transport layer header of the data packets, strip off the protocol control information, and extract the payload byte sequence containing the actual data content of the data packets; the network data packets to be detected cover various types of network data such as internal business data transmission packets, external access request packets, and cross-regional collaborative office data messages. The length of the payload byte sequence changes dynamically according to the actual amount of transmitted data and is the core object of subsequent semantic detection, which can intuitively reflect the actual data content of the data packets; Step 102: Map the payload byte sequence to an initial word vector tensor; extract the message sequence number of the network data packet to be detected; generate a sequence feature encoding matrix corresponding to the initial word vector tensor based on the message sequence number; specifically, a preset word vector mapping algorithm is used to convert the payload byte sequence into a computer-recognizable initial word vector tensor, realizing the conversion from byte data to semantic feature vectors; simultaneously, the message sequence number is extracted from the transport layer header of the data packet. The message sequence number is assigned by the network protocol stack when the data packet is generated and is used to uniquely identify the data packet and track the data transmission trajectory. Through a one-hot encoding algorithm, a sequence feature encoding matrix that perfectly matches the dimension of the initial word vector tensor is generated based on the message sequence number; the sequence feature encoding matrix is ​​a matrix that integrates the temporal features and unique identification features of the data packet, which can supplement the semantic features of the payload byte sequence, ensuring that the features of different data packets are distinguishable and traceable, and providing more comprehensive feature support for subsequent semantic detection; Step 103: Add the initial word vector tensor to the sequence feature encoding matrix to obtain a fused feature tensor; input the fused feature tensor into a pre-trained multi-head self-attention network layer; extract the high-dimensional representation of the fused feature tensor in the multi-head self-attention network layer; specifically, perform element-wise addition operations on the initial word vector tensor and the sequence feature encoding matrix to obtain the fused feature tensor; this fusion process can completely preserve the semantic features of the payload byte sequence and the temporal and identification features of the data packet, solving the problem of incomplete representation by a single feature. The fused feature tensor is input into a pre-trained multi-head self-attention network layer, which, through parallel computation by multiple attention heads, deeply mines the semantic relationships in the fused features and extracts the high-dimensional representation of the fused feature tensor; the high-dimensional representation refers to a high-order feature vector that integrates semantic features, temporal features, and identification features, which can accurately capture the deep semantic information of the data packet and provide a reliable basis for subsequent risk assessment; Step 104: Reduce the dimensionality of the high-dimensional representation and output it as a risk classification activation value; when the risk classification activation value is greater than a preset security threshold; generate an interception command containing a physical discard action; use the interception command to trigger the network communication interface to truncate the network data packet to be detected; specifically, the high-dimensional representation is reduced in dimensionality using principal component analysis algorithm to remove redundant features and output a risk classification activation value used to quantify the risk level of the data packet. The risk classification activation value ranges from 0 to 1, and the closer the value is to 1, the higher the risk of the data packet; the preset security threshold can be dynamically adjusted according to the actual application scenario, with a preset value of 0.6 for high-security scenarios and 0.8 for ordinary scenarios; compare the risk classification activation value with the preset security threshold, and when the risk classification activation value is greater than the preset security threshold, determine that the network data packet to be detected is a sensitive risk data packet, generate an interception command containing a physical discard action; trigger the network communication interface to perform a truncation operation through the command parsing module to prevent the risk data packet from continuing to be transmitted.

[0019] In one alternative, the network communication interface adopts a gigabit Ethernet interface, supporting 1000Mbps bandwidth transmission, ensuring that the packet interception and detection process does not affect the efficiency of normal network communication; the preset security threshold can be obtained by training with historical risk data, and dynamically adjusted in combination with the importance of sensitive data, such as core business data and privacy data, to improve the accuracy of risk judgment.

[0020] In another implementation, after intercepting the network data packets to be detected in step 101, an invalid data packet filtering step can be added to initially remove empty packets, packets with incorrect format, and packets with failed verification, thereby reducing the computational overhead of subsequent detection and further improving detection efficiency.

[0021] In another implementation, dimensionality reduction of high-dimensional representations can be achieved using linear discriminant analysis (LDA), which, compared to principal component analysis (PCA), can better preserve the discriminative power of risk features and improve the accuracy of risk classification activation values.

[0022] Through the above technical solution, the fusion feature tensor, which integrates semantic features, temporal features, and identification features, can accurately represent the core features of the network data packets to be detected, making the high-dimensional representation output by the multi-head self-attention network layer closer to the actual semantic distribution. By comparing the risk classification activation value with the preset security threshold, the accurate identification of risky data packets is achieved, avoiding the false negative problem caused by relying on static string matching and being unable to handle semantically confused data in the existing technology, thus improving the accuracy and reliability of network data security protection.

[0023] In some embodiments, the process of mapping the payload byte sequence to an initial word vector tensor includes: Step 201: Slice the load byte sequence according to a preset segmentation step size to obtain multiple sub-byte sequences. Specifically, the preset segmentation step size is set according to the length of the load byte sequence and the semantic integrity requirements, typically 8 bytes per step or 16 bytes per step. A sliding slicing method is used, starting from the beginning of the load byte sequence and cutting it segment by segment according to the preset step size to obtain multiple sub-byte sequences of the same length. The sub-byte sequence is the basic semantic unit of the load byte sequence. Each sub-byte sequence corresponds to a continuous segment of byte data and can independently reflect part of the semantic information, avoiding the problem of semantic ambiguity due to excessively long slices and semantic fragmentation due to excessively short slices, thus ensuring the accuracy of subsequent word vector mapping.

[0024] Step 202: Query the preset word vector hash table; convert each subbyte sequence into a fixed-dimensional real floating-point vector; specifically, the word vector hash table is pre-trained and generated, storing a large number of mapping relationships between subbyte sequences and corresponding real floating-point vectors, and is stored in a high-speed cache, which can achieve fast query with O(1) time complexity; for each subbyte sequence, calculate its unique hash value through a hash function, and find the corresponding real floating-point vector in the word vector hash table according to the hash value. The dimension of the vector is fixed, usually 32-dimensional or 64-dimensional. The numerical value of the vector corresponds to the semantic weight of the subbyte sequence. The larger the value, the more critical the corresponding semantic.

[0025] Step 203: According to the physical bias order of the subbyte sequences in the payload byte sequence, concatenate all the real floating-point vectors into the initial word vector tensor. Specifically, the physical bias order refers to the order of the subbyte sequences in the original payload byte sequence, ensuring that the concatenated initial word vector tensor can completely retain the semantic order of the original payload and avoid semantic information disorder. The concatenation process adopts a vector concatenation method, concatenating the real floating-point vectors corresponding to each subbyte sequence in sequence to form an initial word vector tensor with a dimension of the number of subbyte sequences multiplied by a fixed vector dimension. This tensor can be directly used as the input for subsequent feature fusion, providing basic feature support for semantic detection.

[0026] In one alternative approach, the preset segmentation step size can be adaptively adjusted, dynamically optimized based on the length and semantic complexity of the payload byte sequence. For semantically dense payload byte sequences, such as data packets containing core sensitive information, a smaller segmentation step size of 8 bytes per step is used to ensure that semantic information is not lost. For semantically simple payload byte sequences, such as regular notification data, a larger segmentation step size of 16 bytes per step is used to improve processing efficiency.

[0027] In another implementation, the word vector hash table can be updated periodically, combining newly emerging subbyte sequences and semantic features to supplement new mapping relationships, while deleting outdated mapping entries, thereby improving the accuracy of word vector mapping and adapting to different types and scenarios of network data packets.

[0028] The above technical solution achieves a precise mapping from the payload byte sequence to the initial word vector tensor, converting byte data that cannot be directly used for semantic detection into vector features that can be recognized and processed by computers. This solves the problem that traditional deep packet inspection cannot effectively process byte-level semantic information, and provides a reliable input basis for subsequent feature fusion and risk assessment.

[0029] In some embodiments, the process of extracting the high-dimensional representation of the fused feature tensor in the multi-head self-attention network layer includes: Step 301: Multiply the fused feature tensor by the first weight matrix, the second weight matrix, and the third weight matrix respectively; to generate a query tensor, a key tensor, and a value tensor respectively. Specifically, the first weight matrix, the second weight matrix, and the third weight matrix are pre-trained network parameters, corresponding to the feature mapping weights of the query, key, and value, respectively, and the matrix dimensions perfectly match the dimensions of the fused feature tensor. Assuming the fused feature tensor has a dimension of N×D, where N is the number of subbyte sequences and D is the vector dimension, then the dimensions of the three weight matrices are all D×D; through matrix multiplication, the fused feature tensor is mapped to three different feature spaces, generating query tensors, key tensors, and value tensors with consistent dimensions. The query tensor is used for subsequent calculation of attention weights, the key tensor is used for matching semantic relationships, and the value tensor is used to output local semantic features.

[0030] Step 302: Multiply the query tensor by the transpose of the key tensor; divide by a preset dimension scaling factor; and obtain the attention weight matrix after processing with a normalized exponential function. Specifically, first, perform matrix multiplication by multiplying the query tensor by the transpose of the key tensor. The resulting matrix elements reflect the semantic association between the query tensor and the key tensor; the larger the element value, the stronger the corresponding semantic association. The preset dimension scaling factor is the square root of the key tensor dimension, i.e., √D. The purpose of setting this scaling factor is to avoid the normalized exponential function from saturating due to excessively large matrix element values, ensuring a reasonable distribution of attention weights. After dividing the multiplied matrix by the dimension scaling factor, input it into the normalized exponential function for normalization processing to obtain the attention weight matrix. The attention weight matrix has a dimension of N×N, and the matrix elements range from 0 to 1. The element values ​​represent the semantic importance weight of the corresponding subbyte sequence.

[0031] Step 303: Multiply the attention weight matrix with the value tensor; output a local semantic tensor; perform a nonlinear mapping on the local semantic tensor through a feedforward neural network; output the high-dimensional representation; specifically, firstly, perform matrix multiplication, multiplying the attention weight matrix with the value tensor. This operation can highlight high-weight semantic features and suppress low-weight redundant features, obtaining a local semantic tensor focused on key semantic information. The dimension of the local semantic tensor is N×D. The feedforward neural network includes an input layer, a hidden layer, and an output layer. The hidden layer uses the ReLU nonlinear activation function to perform a nonlinear transformation on the local semantic tensor, extracting more abstract and discriminative high-order features layer by layer. Finally, the output layer outputs a high-dimensional representation with a dimension of 1×M, where M is the dimension of the high-dimensional features, typically 256 or 512 dimensions. This high-dimensional representation can accurately reflect the deep semantic information of the fused feature tensor.

[0032] In one alternative approach, the number of hidden layers in the feedforward neural network can be adjusted according to the actual detection accuracy requirements. When high detection accuracy is required, 3 to 4 hidden layers are set to improve feature extraction capabilities. When high detection speed is required, 1 to 2 hidden layers are set to reduce computational overhead and adapt to high-concurrency network scenarios.

[0033] In another implementation, the dimension scaling factor can be dynamically adjusted according to the dimension of the fused feature tensor. When the dimension of the fused feature tensor changes, it is automatically updated to the square root of the new dimension, ensuring that the attention weight matrix is ​​evenly distributed and improving the accuracy of semantic detection.

[0034] By utilizing the above technical solution, the semantic relationships in the fused features are deeply mined through the multi-head self-attention mechanism. The extracted high-dimensional representation can accurately capture the deep semantic features of the data packets, solving the problems of insufficient semantic feature extraction and weak ability to identify semantically confused data in traditional detection. This provides reliable feature support for subsequent risk assessment and interception execution.

[0035] In another implementation, the dimension scaling factor can be dynamically adjusted according to the dimension of the fused feature tensor. When the dimension of the fused feature tensor changes, it is automatically updated to the square root of the new dimension, ensuring that the attention weight matrix is ​​evenly distributed and improving the accuracy of semantic detection.

[0036] By utilizing the above technical solution, the semantic relationships in the fused features are deeply mined through the multi-head self-attention mechanism. The extracted high-dimensional representation can accurately capture the deep semantic features of the data packets, solving the problems of insufficient semantic feature extraction and weak ability to identify semantically confused data in traditional detection. This provides reliable feature support for subsequent risk assessment and interception execution.

[0037] In some embodiments, the pre-trained multi-head self-attention network layer is trained in the following manner: Step 401: Obtain a training sample set containing secure data packet sequences and sensitive data packet sequences. Specifically, secure data packet sequences refer to network data packets that do not contain any sensitive information and are risk-free, such as routine notifications and ordinary file transfer packets; sensitive data packet sequences refer to network data packets that contain sensitive information, such as core business data, personal privacy data, and classified information. The training sample set should contain no fewer than 1000 sets, with a 1:1 ratio of secure data packet sequences to sensitive data packet sequences to ensure that the model can fully learn the semantic features of different types of data packets and avoid model overfitting.

[0038] Step 402: Input the training sample set into the initial neural network; output the corresponding sample prediction activation value; specifically, the topology of the initial neural network is consistent with the multi-head self-attention network layer after training, including a multi-head self-attention mechanism and a feedforward neural network. Process the security data packet sequence and sensitive data packet sequence in the training sample set according to the method described in claims 1, 2, and 3 respectively to obtain the corresponding fused feature tensor, and input it into the initial neural network; the initial neural network outputs the sample prediction activation value corresponding to each sample through preliminary feature extraction and semantic mapping. The value range of the sample prediction activation value is 0 to 1, which is used to characterize the risk level prediction result of the sample.

[0039] Step 403: Calculate the binary cross-entropy loss between the predicted activation value and the true label data; extract the structured entity fragments from the sensitive data packet sequence; calculate the local attention weight penalty term corresponding to the structured entity fragments. Specifically, the true label data is pre-labeled, the safe data packet sequence corresponds to label 0, and the sensitive data packet sequence corresponds to label 1; the binary cross-entropy loss is used to measure the deviation between the predicted activation value and the true label. The larger the deviation, the higher the loss value. Its calculation formula is L. _mse =-[y·log(p)+(1-y)·log(1-p)], where y is the true label and p is the sample predicted activation value; in the calculation, first calculate the product of y and log(p), then calculate the product of (1-y) and log(1-p), add the two products and take the negative number, the result is the binary cross-entropy loss value; structured entity fragments refer to the core parts of sensitive data packet sequences containing sensitive information, such as sensitive key fields and core semantic fragments, which are extracted by entity recognition algorithms; the local attention weight penalty term is used to strengthen the model's attention to sensitive fragments and avoid the model ignoring key sensitive information. Its value is positively correlated with the semantic importance of the structured entity fragment. The more critical the structured entity fragment, the larger the penalty term.

[0040] Step 404: Add the binary cross-entropy loss to the local attention weight penalty term to obtain a custom loss function; update the network weight parameters of the initial neural network based on the custom loss function using the backpropagation algorithm; thus obtaining the multi-head self-attention network layer; specifically, the expression for the custom loss function is L=L _mse +α·L_ pen Where α is the penalty coefficient, ranging from 0.1 to 0.3, L _pen This is a penalty term for local attention weights. During calculation, α and L are calculated first. _pen The product of these two factors is then multiplied by the binary cross-entropy loss L. _mse The values ​​are summed to obtain the final value of the customized loss function. Based on the customized loss function, the gradient of the loss function with respect to each network weight parameter is calculated using a backpropagation algorithm, such as gradient descent. The weight parameters are then gradually adjusted according to the gradient direction to reduce the loss value. The convergence criterion for the model is that the fluctuation of the loss value in 100 consecutive training rounds does not exceed 0.001. When calculating the fluctuation, the loss value of each round in 100 consecutive training rounds is taken, and the difference between the loss values ​​of adjacent rounds is calculated. If the absolute value of all differences does not exceed 0.001, the model is considered to have converged. At this point, the model can stably identify the semantic features of secure data packets and sensitive data packets, training stops, and the trained multi-head self-attention network layer is obtained.

[0041] In one alternative approach, the training sample set can be augmented using data augmentation techniques, such as slight byte perturbation, synonym replacement, and sentence structure reorganization of sensitive data packet sequences to simulate semantic confusion scenarios, improve the model's generalization ability, avoid model overfitting, and ensure that the model can cope with various semantically confused sensitive data.

[0042] In another implementation, the penalty coefficient α can be dynamically adjusted according to the loss changes during the training phase. When the local attention weight penalty term is too small and the model does not pay enough attention to sensitive segments, α is increased; when the penalty term is too large and causes the model to overfit, α is decreased to ensure the detection accuracy and generalization ability of the model.

[0043] Through the above technical solution, the trained multi-head self-attention network layer can accurately identify the semantic features of different types of data packets, especially for semantically obfuscated sensitive data packets, which has high recognition accuracy. This solves the problem of weak recognition ability of existing models for semantically obfuscated data, and provides reliable model support for subsequent risk detection and interception.

[0044] In some embodiments, after extracting the payload byte sequence from the network data packet to be detected and before mapping the payload byte sequence to an initial word vector tensor, the method further includes: Step 501: Input the payload byte sequence into a pre-configured Bloom filter for hash mapping. Specifically, a Bloom filter is a space-efficient and fast probabilistic data structure. The pre-configured Bloom filter contains 3 to 5 independent hash functions, which can perform multiple rounds of hash mapping on the input payload byte sequence. Each round of hash mapping generates a hash value, and each hash value corresponds to a mapping bit in the Bloom filter. The initial value of each mapping bit is 0. The number of mapping bits in the Bloom filter is set according to the length of the payload byte sequence and the required false positive rate, usually 10 to 20 times the maximum length of the payload byte sequence, to ensure that the false positive rate is less than 0.01%. When calculating the false positive rate, it is calculated using the Bloom filter false positive rate formula based on the number of mapping bits, the number of hash functions, and the length of the payload byte sequence, ensuring that the calculation result is less than 0.01%.

[0045] Step 502: When there are zero-value bits in the mapping bit set of the Bloom filter; determine that the network data packet to be detected is a regular message; generate a hardware pass-through level signal for the regular message; terminate the step of mapping the payload byte sequence to the initial word vector tensor; specifically, the mapping rule of the Bloom filter is that if the payload byte sequence does not contain sensitive information, after multiple rounds of hash mapping, some mapping bits will still remain 0, that is, zero-value bits; at this time, the network data packet to be detected is determined to be a regular message, that is, a risk-free message, and a hardware pass-through level signal is generated. The hardware pass-through level signal adopts a 3.3V high level, and this level signal is sent to the network communication interface, and the control interface directly passes the data packet; at the same time, the subsequent payload byte sequence mapping, semantic detection and other steps are terminated to reduce computational overhead and improve network communication efficiency.

[0046] Step 503: When all the mapping bits of the Bloom filter are non-zero, the step of mapping the payload byte sequence to the initial word vector tensor is triggered. Specifically, if the payload byte sequence contains sensitive information, after multiple rounds of hash mapping, all mapping bits will be set to non-zero values, i.e., 1. At this time, it is determined that the network data packet to be detected may contain sensitive information, and subsequent steps such as payload byte sequence mapping, feature fusion, and semantic detection are triggered to ensure that sensitive data is not missed.

[0047] In one alternative approach, the number of hash functions in the Bloom filter can be adjusted according to the length of the payload byte sequence. The longer the payload byte sequence, the more hash functions there are, up to a maximum of 5, reducing the probability of false positives. At the same time, the number of mapping bits in the Bloom filter can be dynamically adjusted to adapt to payload byte sequences of different lengths, ensuring that the false positive rate is always below a preset threshold.

[0048] In another implementation, the Bloom filter can be updated periodically, combining the byte sequence corresponding to newly emerging sensitive information to update the hash mapping rules, avoiding misjudgments caused by updates to sensitive information, and improving the accuracy of pre-screening.

[0049] The above technical solution enables rapid differentiation between regular and risky packets. Regular packets can be allowed to pass directly without undergoing complex semantic detection, which greatly improves network communication efficiency. Risky packets enter the subsequent detection process to ensure that sensitive data is not leaked. This solves the problem of low efficiency in traditional detection where all data packets need to undergo complex detection, and achieves dual protection of rapid screening and accurate detection.

[0050] In some embodiments, triggering the network communication interface to intercept the network data packet to be detected using the interception command includes: Step 601: Parse the network card register control address carried in the interception command; write a reset byte to the network card register control address; specifically, the interception command contains the packet sequence number of the network data packet to be detected and the network card register control address. The network card register control address is the hardware control address of the network card in the network communication interface, used to receive control commands and execute corresponding operations; parse the interception command through the command parsing module to extract the network card register control address; write a preset reset byte to the control address. The reset byte can be set to 0x00. After the reset byte is written, the normal data transmission function of the network card can be temporarily interrupted, so that the network card enters the standby state and stops the forwarding operation of the data packet to be detected.

[0051] Step 602: Clear the hardware transmission ring buffer associated with the message sequence number; block the electrical signal transmission of the network data packet to be detected to the physical medium; specifically, the hardware transmission ring buffer is a buffer area used by the network card to temporarily store data packets to be sent, and the buffer position of each data packet corresponds one-to-one with the message sequence number; according to the message sequence number of the network data packet to be detected, locate its buffer position in the hardware transmission ring buffer, clear all data at that position, and prevent the data packet from being forwarded; at the same time, through the network card control signal, block the electrical signal transmission of the data packet to be detected to the physical medium, the physical medium including network cable and optical fiber, to completely intercept risky data packets and prevent sensitive data leakage.

[0052] In one alternative, the reset byte can be dynamically adjusted according to the network card model to adapt to different brands and models of network communication interfaces, ensuring the effectiveness of the reset operation and avoiding interception failures due to network card model incompatibility.

[0053] In another implementation, after clearing the hardware transmit ring buffer, an interception log can be generated, recording information such as interception time, packet sequence number, network card control status, and risk classification activation value. This log is then sent to the security management platform via asynchronous communication for subsequent security auditing and troubleshooting.

[0054] The above technical solution enables rapid hardware-level interception of risky data packets. It can not only completely block the transmission of risky data packets, but also avoid the leakage of sensitive data due to software-level interception delays. It solves the problems of slow interception response speed and incomplete interception in existing technologies, and improves the timeliness and reliability of data security protection.

[0055] In some embodiments, before multiplying the query tensor with the transpose matrix of the key tensor, the method further includes: Step 701: Read the sliding window buffer in the memory space; specifically, a sliding window buffer is pre-configured in the memory space to store the key tensors and value tensors corresponding to previous historical data packets. The initial window capacity of the sliding window buffer is preset to 1024 bytes, which can be dynamically adjusted according to the network operating status; the sliding window buffer adopts a first-in-first-out mechanism to ensure that the stored information is always the tensor information of previous historical data packets within the most recent period.

[0056] Step 702: Monitor the current network buffer throughput of the network communication interface in real time. Specifically, the data packet transmission rate of the network communication interface is collected in real time through the network traffic monitoring module, and the current network buffer throughput is calculated. The unit of network buffer throughput is Mbps. This throughput reflects the current network load. The higher the throughput, the greater the network load and the greater the data transmission pressure. When calculating the throughput, the total number of bytes of data packets transmitted by the network communication interface per unit time is counted. After converting the total number of bytes into bits, it is divided by the time, with the time unit being seconds. The result is the current network buffer throughput.

[0057] Step 703: When the current network buffer throughput is greater than a preset throughput threshold; reduce the window capacity (in bytes) of the sliding window buffer according to a preset decay step value; discard the farthest preorder key tensor from the current time. Specifically, the preset throughput threshold is set according to the bandwidth of the network communication interface, for example, 800Mbps for a gigabit Ethernet interface. When the current network buffer throughput is greater than the preset throughput threshold, it indicates that the current network load is large. In order to reduce memory usage and improve processing efficiency, reduce the window capacity (in bytes) of the sliding window buffer according to a preset decay step value. The decay step value can be set to 128 bytes per step. During reduction, subtract the decay step value from the current window capacity (in bytes) to obtain the new window capacity (in bytes). At the same time, according to the first-in-first-out (FIFO) mechanism, discard the farthest preorder key tensor from the current time to release memory space and ensure that the capacity of the sliding window buffer matches the current network load.

[0058] Step 704: Obtain the preceding key tensor and preceding value tensor corresponding to the preceding historical data packets; specifically, read the preceding key tensor and preceding value tensor corresponding to all currently stored preceding historical data packets from the sliding window buffer. These tensors contain the semantic and temporal features of the preceding data packets, which can be used to supplement the contextual semantic information of the current data packets and solve the semantic reorganization problem of cross-packet fragmented data.

[0059] Step 705: Concatenate the preceding key tensor with the key tensor in the time dimension; concatenate the preceding value tensor with the value tensor in the time dimension; specifically, using tensor concatenation, concatenate the preceding key tensor with the key tensor of the current data packet in the time dimension to obtain the concatenated key tensor; concatenate the preceding value tensor with the value tensor of the current data packet in the time dimension to obtain the concatenated value tensor; the concatenated key tensor and value tensor contain the semantic features of the current data packet and the preceding historical data packets, enabling contextual semantic reorganization of cross-packet fragmented data and ensuring the accuracy of semantic detection.

[0060] In one alternative approach, the preset throughput threshold can be adaptively adjusted according to the network operating status. The threshold can be appropriately lowered during peak network load periods and appropriately raised during off-peak network load periods to ensure that the capacity of the sliding window buffer always matches the current network load, thus balancing detection accuracy and processing efficiency.

[0061] In another implementation, the decay step value can be dynamically adjusted according to memory usage. When memory usage exceeds 80%, the decay step value is increased, for example, by 256 bytes per increment, to quickly release memory. When calculating memory usage, the number of currently used memory bytes is divided by the total number of memory bytes, and then multiplied by 100% to obtain the memory usage. When memory usage is below 50%, the decay step value is decreased, for example, by 64 bytes per increment, to retain more preceding historical data and improve the accuracy of cross-packet semantic reassembly.

[0062] The above technical solution achieves contextual semantic reorganization of cross-packet fragmented payloads through dynamic adjustment of the sliding window buffer and concatenation of cross-packet tensors. This solves the problem that existing technologies cannot process cross-packet fragmented data within the limited buffer period of the network protocol stack, ensuring that even if data packets are split into multiple fragmented payloads, their semantic features can be accurately identified, further reducing the false negative rate of sensitive data.

[0063] In some embodiments, before obtaining the training sample set containing secure packet sequences and sensitive packet sequences, the method further includes: Step 801: Obtain initial plaintext sample data. Specifically, the initial plaintext sample data includes various sensitive plaintext data such as core business data of the enterprise, personal privacy data, and classified information, as well as various non-sensitive plaintext data such as routine notices, ordinary documents, and public information; the number of initial plaintext sample data sets shall not be less than 500 sets to ensure that a sufficient number of training samples can be generated to provide sufficient data support for model training.

[0064] Step 802: Based on a preset synonym replacement rule library and character disorder rule library, perform character replacement and position perturbation on the initial plaintext sample data; generate the sensitive data packet sequence with anti-obfuscation features; specifically, the preset synonym replacement rule library stores a large number of sensitive keywords and their corresponding synonyms, such as core data corresponding to key data and core information; the character disorder rule library stores rules for character position perturbation, such as swapping adjacent characters and disordering intervening characters; for the sensitive plaintext data in the initial plaintext sample data, perform character replacement according to the synonym replacement rule library, replacing some sensitive keywords with their synonyms, and at the same time, perform character position perturbation according to the character disorder rule library, scrambling the order of some characters; after character replacement and position perturbation, generate a sensitive data packet sequence with anti-obfuscation features, which is consistent with the semantically obfuscated sensitive data packets in the actual scenario, and can improve the model's ability to recognize semantically obfuscated data.

[0065] In one alternative approach, the synonym replacement rule base can be updated periodically, incorporating newly emerging sensitive keywords and synonyms to supplement new replacement rules, ensuring that the generated adversarial obfuscation sensitive data packet sequences fit the actual application scenario and improve the model's generalization ability.

[0066] In another implementation, the perturbation level of character scrambling can be dynamically adjusted, with the perturbation level set from 30% to 50%. When calculating the perturbation level, the number of characters in the scrambled positions is divided by the total number of characters, and then multiplied by 100% to obtain the perturbation level. This perturbation level ensures both the semantic obfuscation effect of sensitive data packets and that the model can identify their sensitive attributes through deep semantic features, avoiding the inability of the model to recognize them due to excessive perturbation.

[0067] The above technical solution generates sensitive data packet sequences with anti-obfuscation features, which can simulate semantically obfuscated sensitive data in real-world scenarios. This enables the trained multi-head self-attention network layer to adapt to various semantic obfuscation scenarios, solving the problems of weak model recognition ability and high false negative rate in existing technologies, and further improving the detection accuracy and practicality of the model.

[0068] In some embodiments, after triggering the network communication interface to intercept the network data packet to be detected using the interception command, the method further includes: Step 901: Obtain the target load byte sequence that causes the risk classification activation value to exceed the preset security threshold; specifically, locate the corresponding load byte sequence according to the message sequence number of the network data packet to be detected. This load byte sequence is the target load byte sequence that causes the risk classification activation value to exceed the threshold, which is the load byte sequence containing sensitive information; extract the target load byte sequence for subsequent de-identification processing and log recording, providing a basis for security auditing.

[0069] Step 902: Perform byte replacement desensitization on the target payload byte sequence using a preset one-way hash algorithm; generate a desensitized log byte stream; specifically, the preset one-way hash algorithm adopts the SHA-256 algorithm, which is irreversible and can convert the target payload byte sequence into a fixed-length hash value of 256 bits; during processing, the target payload byte sequence is input into the SHA-256 algorithm, a 256-bit hash value is generated through the algorithm, and then the hash value is used to replace the sensitive bytes in the target payload byte sequence to achieve desensitization. The desensitized payload byte sequence does not contain any sensitive information, while retaining its characteristics for log recording; the desensitized payload byte sequence, interception time, risk classification activation value, and other information are concatenated to generate a desensitized log byte stream.

[0070] Step 903: Write the de-identified log byte stream to an independent isolated sector of the solid-state storage using an asynchronous direct memory access mechanism. Specifically, the asynchronous direct memory access mechanism allows the de-identified log byte stream to be written directly to an independent isolated sector of the solid-state storage without CPU intervention. This sector is isolated from other sectors of the system and is used only for storing de-identified logs, providing high security and preventing log tampering or leakage. The asynchronous direct memory access mechanism can improve log writing efficiency, avoid occupying CPU resources, and does not affect the normal operation of the system.

[0071] In one alternative, the one-way hash algorithm can be adjusted according to security requirements. Higher security hash algorithms such as SHA-384 and SHA-512 can be used to further improve the security of the de-identification process and ensure that sensitive information is not restored.

[0072] In another implementation, the independent isolated sectors of the solid-state storage can be configured with access control, allowing only the security management platform to read them and prohibiting other programs from accessing them, thereby further enhancing the security of log storage and preventing log leakage or tampering.

[0073] The above technical solution enables the de-identified logging and secure storage of risk data packets. It retains the characteristics of risk data for security auditing while avoiding secondary leakage of sensitive information. It solves the problems of insecure risk log storage and easy leakage of sensitive information in existing technologies, and balances security auditing and data privacy protection.

[0074] Example 2: Please refer to Figure 2 Based on Example 1, this embodiment also provides an information data security system based on semantic detection, including: The packet interception and payload extraction module intercepts network packets to be detected arriving at the network communication interface; and extracts the payload byte sequence from the network packets to be detected. The feature fusion module maps the payload byte sequence to an initial word vector tensor; extracts the message sequence number of the network data packet to be detected; and generates a sequence feature encoding matrix corresponding to the initial word vector tensor based on the message sequence number. The semantic detection and risk assessment module adds the initial word vector tensor to the sequence feature encoding matrix to obtain a fused feature tensor; inputs the fused feature tensor into a pre-trained multi-head self-attention network layer; and extracts the high-dimensional representation of the fused feature tensor in the multi-head self-attention network layer. The risk interception execution module reduces the dimensionality of the high-dimensional representation and outputs it as a risk classification activation value; when the risk classification activation value is greater than a preset security threshold, it generates an interception instruction containing a physical discard action; and uses the interception instruction to trigger the network communication interface to truncate the network data packet to be detected.

[0075] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus.

[0076] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A method for information data security based on semantic detection, characterized in that, The method includes: Intercept incoming network data packets to be detected at the network communication interface; extract the payload byte sequence from the network data packets to be detected; Map the payload byte sequence to an initial word vector tensor; extract the message sequence number of the network data packet to be detected; generate a sequence feature encoding matrix corresponding to the initial word vector tensor based on the message sequence number; The initial word vector tensor is added to the sequence feature encoding matrix to obtain a fused feature tensor; the fused feature tensor is input into a pre-trained multi-head self-attention network layer; and the high-dimensional representation of the fused feature tensor in the multi-head self-attention network layer is extracted. The high-dimensional representation is reduced in dimensionality and output as a risk classification activation value; when the risk classification activation value is greater than a preset security threshold, an interception instruction containing a physical discard action is generated; the interception instruction is used to trigger the network communication interface to truncate the network data packet to be detected.

2. The information data security method based on semantic detection according to claim 1, characterized in that, The step of mapping the payload byte sequence to an initial word vector tensor includes: The payload byte sequence is sliced ​​according to a preset word segmentation step size to obtain multiple sub-byte sequences; Query the preset word vector hash table; convert each of the subbyte sequences into a fixed-dimensional real-number floating-point vector; According to the physical bias order of the subbyte sequence in the payload byte sequence, all the real floating-point vectors are concatenated into the initial word vector tensor.

3. The information data security method based on semantic detection according to claim 2, characterized in that, The extraction of the high-dimensional representation of the fused feature tensor in the multi-head self-attention network layer includes: The fused feature tensor is multiplied by the first weight matrix, the second weight matrix, and the third weight matrix, respectively, to generate a query tensor, a key tensor, and a value tensor. Multiply the query tensor by the transpose of the key tensor; divide by a preset dimension scaling factor; and obtain the attention weight matrix by normalizing the exponential function. Multiply the attention weight matrix by the value tensor; output a local semantic tensor; perform a nonlinear mapping on the local semantic tensor through a feedforward neural network; output the high-dimensional representation.

4. The information data security method based on semantic detection according to claim 3, characterized in that, The pre-trained multi-head self-attention network layer is trained in the following way: Obtain a training sample set containing secure packet sequences and sensitive packet sequences; The training sample set is input into the initial neural network; Output the corresponding predicted activation value for the sample; Calculate the binary cross-entropy loss between the predicted activation value of the sample and the actual label data; Extract structured entity fragments from the sensitive data packet sequence; Calculate the local attention weight penalty term corresponding to the structured entity fragment; The binary cross-entropy loss is added to the local attention weight penalty term to obtain a custom loss function; the network weight parameters of the initial neural network are updated using the backpropagation algorithm based on the custom loss function; thus, the multi-head self-attention network layer is obtained.

5. The information data security method based on semantic detection according to claim 1, characterized in that, After extracting the payload byte sequence from the network data packet to be detected, and before mapping the payload byte sequence to the initial word vector tensor, the method further includes: The payload byte sequence is input into a pre-configured Bloom filter for hash mapping; When a zero value exists in the mapping bit set of the Bloom filter; the network data packet to be detected is determined to be a regular packet; a hardware allow level signal is generated for the regular packet; the step of mapping the payload byte sequence to the initial word vector tensor is terminated; When all the mapping bits of the Bloom filter are non-zero, the step of mapping the payload byte sequence to the initial word vector tensor is triggered.

6. The information data security method based on semantic detection according to claim 1, characterized in that, The step of triggering the network communication interface to intercept the network data packet to be detected using the interception command includes: Parse the network interface card (NIC) register control address carried by the interception command; write a reset byte to the NIC register control address; Clear the hardware transmission ring buffer associated with the message sequence number; block the electrical signal transmission of the network data packet to be detected to the physical medium.

7. The information data security method based on semantic detection according to claim 3, characterized in that, Before multiplying the query tensor with the transpose of the key tensor, the process further includes: Read the sliding window buffer in memory space; Real-time monitoring of the current network buffer throughput of the network communication interface; When the current network buffer throughput is greater than a preset throughput threshold; reduce the window capacity (in bytes) of the sliding window buffer according to a preset decay step value; discard the farthest previous key tensor from the current time. Obtain the preceding key tensor and preceding value tensor corresponding to the preceding historical data packets; The preceding key tensor and the key tensor are concatenated in the time dimension; the preceding value tensor and the value tensor are concatenated in the time dimension.

8. The information data security method based on semantic detection according to claim 4, characterized in that, Before obtaining the training sample set containing secure data packet sequences and sensitive data packet sequences, the process also includes: Obtain initial plaintext sample data; Based on a preset synonym replacement rule base and character disorder rule base, the initial plaintext sample data is subjected to character replacement and position perturbation; a sensitive data packet sequence with anti-obfuscation features is generated.

9. The information data security method based on semantic detection according to claim 1, characterized in that, After triggering the network communication interface to intercept the network data packet to be detected using the interception command, the method further includes: Obtain the target payload byte sequence that causes the risk classification activation value to be greater than the preset security threshold; The target payload byte sequence is de-identified by byte replacement using a preset one-way hash algorithm; a de-identified log byte stream is generated. The de-identified log byte stream is written to an independent isolated sector of the solid-state storage using an asynchronous direct memory access mechanism.

10. An information data security system based on semantic detection, used to implement the information data security method based on semantic detection as described in any one of claims 1-9, characterized in that, The system includes: The packet interception and payload extraction module intercepts network packets to be detected arriving at the network communication interface; and extracts the payload byte sequence from the network packets to be detected. The feature fusion module maps the payload byte sequence to an initial word vector tensor; extracts the message sequence number of the network data packet to be detected; and generates a sequence feature encoding matrix corresponding to the initial word vector tensor based on the message sequence number. The semantic detection and risk assessment module adds the initial word vector tensor to the sequence feature encoding matrix to obtain a fused feature tensor; inputs the fused feature tensor into a pre-trained multi-head self-attention network layer; and extracts the high-dimensional representation of the fused feature tensor in the multi-head self-attention network layer. The risk interception execution module reduces the dimensionality of the high-dimensional representation and outputs it as a risk classification activation value; when the risk classification activation value is greater than a preset security threshold, it generates an interception instruction containing a physical discard action; and uses the interception instruction to trigger the network communication interface to truncate the network data packet to be detected.

Images