Disclosure of Invention
Based on this, the present invention provides a method and a system for enhancing computer data security, so as to solve at least one of the above technical problems.
To achieve the above object, a method for enhancing computer data security includes the steps of:
Step S1, detecting equipment environment by using computer terminal equipment to generate equipment environment detection data, carrying out dynamic safety environment assessment processing according to the equipment environment detection data to generate dynamic safety environment assessment data, carrying out periodic characteristic analysis on an application program by the dynamic safety environment assessment data to generate multi-mode program execution characteristic data;
S2, performing discrete feature coding processing on multi-mode program execution feature data to generate multi-mode feature vector matrix data, performing dynamic data stream processing according to the multi-mode feature vector matrix data to generate a program dynamic data flow graph, performing dynamic privacy data stream tracking according to the program dynamic data flow graph to generate dynamic privacy data stream path data, and constructing a trusted execution environment for the dynamic privacy data stream path data by utilizing computer terminal equipment to generate a privacy trusted execution environment;
Step S3, submitting the private data through the application program to obtain user private data, and carrying out dynamic security access processing on the user private data by utilizing a privacy trusted execution environment to obtain a security data access strategy;
and S4, carrying out security situation awareness on the user by utilizing computer terminal equipment based on a security data access strategy to obtain security situation risk assessment data, and carrying out self-adaptive security monitoring processing according to the security situation risk assessment data to obtain self-adaptive security control data.
By means of deep detection of the computer terminal equipment, real-time equipment running state information including hardware performance, operating system stability, network connection conditions and the like can be obtained, and the process is helpful for identifying potential hardware faults, software conflicts or network potential safety hazards, so that equipment faults are prevented in advance, and equipment running efficiency is improved. Based on real-time equipment environment data, the safety condition of the system is comprehensively evaluated to evaluate whether the system environment of the current computer equipment is a high-risk or low-risk environment, and the high-risk environment can give an alarm in real time to solve the risks, so that the application program is tested in the low-risk environment. The execution cycle characteristic analysis is performed on the application program through the dynamic security environment evaluation data, so that the key of program performance is deeply understood and improved. They cover multiple dimensions of program execution, such as time, space, resource consumption, etc., and provide detailed basis for program optimization, performance tuning and troubleshooting. Discrete feature coding is performed on the multi-mode program execution feature data, and a complex data structure can be converted into a matrix form which is convenient to process, so that the efficiency and the accuracy of data analysis are improved. In this way, the mode and behavior of program operation can be better understood. And generating a program dynamic data flow graph by utilizing the feature vector matrix, intuitively describing a data flow path when the program runs, effectively analyzing an internal working mechanism of the program, searching and repairing errors in data processing, detecting a data leakage path and enhancing data security. The flow of sensitive information can be known in real time by carrying out dynamic privacy data flow tracking through the data flow graph. The terminal equipment is used for constructing the trusted execution environment of the dynamic privacy data flow path data, so that an isolated and safe execution environment can be created, and the integrity and confidentiality of the privacy data in the processing process are ensured. The user privacy data is processed in the privacy trusted execution environment, so that the access and the use of the data can be strictly controlled, and unauthorized access and disclosure are prevented. The environment provides a high level of protection for the data, ensures the security of the private data even if other parts of the system are attacked, and improves the overall security level of the system. The dynamic security access processing can adjust the data access control strategy in real time according to the change of the running condition of the system, so that the data security is improved, and meanwhile, the legal user can access the required data smoothly. The safety situation awareness is carried out on the user, and the safety condition of the user in the process of using the equipment can be monitored and estimated in real time. This includes identifying potential threats, vulnerabilities, and abnormal behaviors, and evaluating the impact of these risks on user data and system security. The data provides quantitative analysis of the current safety condition of the user, is helpful for the user to understand the severity and urgency of the potential risks, and ensures the information security of the user in various use situations. The method for enhancing the security of the computer data comprises the steps of carrying out risk environment assessment on the computer equipment in advance to ensure that the computer equipment is in a security state when an application program is tested, obtaining the characteristic condition of execution data of the application program through the application program test, constructing a program dynamic data flow diagram according to the characteristic data, carrying out dynamic privacy data flow tracking based on the program dynamic data flow diagram, constructing a privacy executable environment, and ensuring the integrity and confidentiality of the privacy data in the processing process. And the security situation awareness is carried out on the computer equipment, the data protection capability is improved in all directions, and the risk of loss or theft of private data is effectively reduced.
Preferably, step S1 comprises the steps of:
Step S11, performing equipment identity authentication by using computer terminal equipment to generate equipment identity authentication data;
Step S12, performing equipment environment detection according to the equipment identity authentication data to generate equipment environment detection data, wherein the equipment environment detection data comprises operating system state analysis data, network environment detection data and equipment hardware data;
S13, carrying out dynamic security environment assessment processing according to the equipment environment detection data to generate dynamic security environment assessment data;
S14, carrying out environment risk judgment on the dynamic safety environment assessment data by utilizing a preset environment risk threshold value, and marking the computer terminal equipment as low-risk operation environment data when the dynamic safety environment assessment data is lower than the environment risk threshold value;
Step S15, when the dynamic security environment assessment data is higher than or equal to an environment risk threshold value, marking the computer terminal equipment as high-risk operation environment data, carrying out risk environment alarm processing according to the high-risk operation environment data to generate risk environment alarm data;
And S16, performing execution cycle characteristic analysis on the application program through the risk environment feedback data and the low-risk running environment data to generate multi-mode program execution characteristic data.
The invention uses the computer terminal equipment to carry out equipment identity authentication, ensures the true and reliable identity of the equipment, and avoids the access risk of unauthorized equipment or illegal users, thereby improving the overall security of the system. And detecting the equipment environment according to the equipment identity authentication data, comprehensively analyzing the operating system, network and hardware conditions of the equipment, and helping to comprehensively know the operating environment of the equipment. The dynamic security environment evaluation processing is carried out according to the equipment environment detection data, so that potential security threats in the equipment environment can be timely identified and evaluated, and the security management is more flexible and real-time. The dynamic security environment assessment data is subjected to environment risk judgment by utilizing the preset environment risk threshold value, a timely risk early warning and response mechanism is provided, the high-risk environment can be rapidly identified and processed, the influence of potential security threat is reduced, and the environment with low risk is ensured. By analyzing the execution characteristics of the application program, the execution mode of the program can be identified and optimized, and the safety and performance of the system are further improved.
Preferably, step S16 comprises the steps of:
Step 161, performing security environment credential processing according to the risk environment feedback data and the low risk operation environment data to generate security environment credential data;
step S162, performing program periodic execution test design on the application program based on the security environment credential data to generate program execution test event data;
Step S163, collecting user operation behavior logs according to program execution test event data to generate user operation behavior data;
Step S164, user network request monitoring is carried out according to user operation behavior data to obtain user request interaction data, system resource tracking is carried out according to the user operation behavior data to generate system resource tracking data, file operation audit is carried out according to the user operation behavior data to generate file operation audit data;
step S165, performing context correlation analysis on the user request interaction data, the system resource tracking data and the file operation audit data to generate context detection correlation data;
Step S166, performing time sequence feature processing according to the context detection associated data to generate time sequence detection associated data;
step S167, multi-mode data fusion processing is carried out according to the time sequence detection associated data, so as to obtain multi-mode program execution characteristic data.
According to the invention, the security environment certificate is processed according to the risk environment feedback data and the low-risk operation environment data, so that the generated certificate can accurately reflect the security condition of the current environment. And comprehensively testing the performance of the application program in different operation scenes, and the stability and the safety of the application program in actual operation. The user operation behavior log is collected according to the program execution test event data, the operation behaviors of the user are recorded in detail, the network requests, the system resource use and the file operation conditions of the user are comprehensively monitored, and all aspects of the user behaviors are comprehensively covered, so that a more comprehensive safety analysis view is provided. By association analysis of different types of data, potential security threats and abnormal behaviors can be identified, so that the accuracy and the comprehensiveness of detection are improved. And identifying the characteristics of the user behavior and the system state changing along with time by using a time sequence analysis technology, thereby discovering potential trends and laws. By fusing the data of different modes, comprehensive characteristic data is formed, so that the running state and the security risk of the application program are estimated more accurately, and the overall security monitoring and management level is improved.
Preferably, step S2 comprises the steps of:
step S21, performing feature dimension reduction processing on the multi-mode program execution feature data to generate dimension reduction multi-mode execution feature data;
S22, performing discrete feature coding processing according to the dimension-reduction multi-mode execution feature data to generate multi-mode feature vector matrix data;
s23, performing dynamic data flow processing according to the multi-mode feature vector matrix data to generate a program dynamic data flow graph;
Step S24, node importance score calculation is carried out according to the program dynamic data flow graph to generate node importance score data;
step S25, carrying out dynamic privacy data flow tracking on key node data through a program dynamic data flow graph to generate dynamic privacy data flow path data;
and S26, constructing a trusted execution environment for the dynamic privacy data flow path data by using the computer terminal equipment to generate a privacy trusted execution environment.
According to the method, the feature dimension reduction processing is carried out on the multi-mode program execution feature data, so that the dimension of the feature data is effectively reduced, and the calculation complexity is reduced. By converting continuous feature data into discrete features and generating a unified feature vector matrix, the data is more suitable for processing of various machine learning and data mining algorithms, and the operability of data analysis is improved. Through dynamic data flow processing, the data flow and interaction relation in the program execution process are comprehensively displayed. By calculating the importance scores of the nodes, the key nodes in the program execution process are identified, and the potential safety risk points and performance bottlenecks are helped to be positioned, so that the safety and efficiency of the program are improved. By tracking the data flow path of the key node, the transmission and use condition of the privacy data in the program is identified, the sensitive data is identified and protected, and privacy disclosure is prevented. By constructing the trusted execution environment, the private data is ensured to be processed in a controlled and safe environment, so that the safety and the credibility of the data processing are greatly improved.
Preferably, step S23 comprises the steps of:
step S231, carrying out data entity analysis on the multi-mode feature vector matrix data to generate entity analysis feature data;
S232, performing atomic operation flow deconstructing according to the entity analysis characteristic data to obtain operation flow deconstructing data;
Step S233, performing program dynamic execution logic analysis by using the operation flow deconstructed data to generate program dynamic execution behavior data;
Step S234, performing entity clustering processing according to the entity analysis characteristic data, and performing data dependency mapping processing through the program dynamic execution behavior data to generate a dynamic data flow dependency graph;
Step S235, extracting data flow nodes according to the dynamic data flow dependency graph to generate data flow node data;
Step S236, constructing a directed data flow graph through data flow node data and data flow edge data;
and step 237, performing redundant node optimization processing on the directed data flow graph to obtain a program dynamic data flow graph.
According to the invention, the multi-mode feature vector matrix data is subjected to data entity analysis, and the original feature data is analyzed into the data representation form with entity meaning, so that the internal structure and meaning of the data are better understood. And (3) performing atomic operation flow deconstructing according to the entity analysis characteristic data, deconstructing the entity analysis characteristic data according to the sequence and flow of atomic operations, and disassembling the complex operation flow into an independent atomic operation sequence, so that the execution logic and behavior characteristics of the program can be understood more finely. The dynamic execution logic analysis of the program by using the operation flow deconstructed data can help understand the execution logic of the program, identify potential abnormal behaviors and optimize the execution efficiency. Clustering the data entities according to the entity analysis characteristic data, and then analyzing the dependency relationship among the data through dynamic execution behavior data to construct a dynamic data flow dependency graph, so that the relationship and influence among all the data entities in the procedure can be cleared. Nodes and edges in the data stream are extracted according to the dynamic data stream dependency graph, and further analysis of the structure and characteristics of the data stream is facilitated. And constructing a directed data flow graph through the data flow node data and the data flow edge data. The extracted data flow nodes and edges are organized into a directed graph form, so that the direction and the association relation of the data flow are clearly shown, and the data flow dynamics and interaction modes of the program are facilitated to be understood in depth. Through the optimization processing, redundant nodes in the graph are removed, the structure of the data flow graph is simplified, and the readability and comprehensiveness of the graph are improved.
Preferably, step S25 comprises the steps of:
step S251, privacy data source positioning is carried out on the key node data, and privacy data source data is generated;
Step S252, carrying out privacy data marking processing by utilizing privacy data source data based on preset privacy sample tag data to generate marked privacy data;
step 253, performing dynamic taint propagation simulation according to the marked privacy data to generate dynamic privacy propagation data;
And step S254, carrying out propagation path analysis on the dynamic privacy propagation data through the program dynamic data flow graph to obtain dynamic privacy data flow path data.
The invention performs privacy data source positioning on the key node data, determines the privacy data source in the data stream, namely identifies the nodes related to the privacy information in the data stream, thereby performing privacy protection and control on the nodes in a targeted manner and ensuring the security and privacy protection of the sensitive information. And marking the privacy data source according to the existing privacy sample tag data to identify the privacy data therein, thereby being beneficial to classifying and managing the privacy data. The dynamic taint propagation simulation is carried out according to the marked privacy data, so that the dynamic taint propagation process of the data in the program execution process can be simulated, namely, the flow path and propagation condition of the privacy data in the program can be tracked. And carrying out propagation path analysis on the dynamic privacy propagation data through a program dynamic data flow graph, and analyzing the propagation path and the flow track of the privacy data in the program execution process.
Preferably, step S3 comprises the steps of:
Step S31, carrying out identity authentication processing on a user through an application program to generate identity token data;
step S32, submitting privacy data through an application program based on the dynamic identity token data to obtain user privacy data;
step S33, performing data encryption processing on the user privacy data by using an AES-256 encryption algorithm to respectively generate user privacy encryption data and encryption key data;
Step S34, generating random seeds according to the identity token data to obtain random sequence data, generating key verification codes for the encryption key data through the identity token data to obtain the key verification codes, and carrying out dynamic encryption key packaging treatment on the encryption key data, the random sequence data and the key verification codes to generate dynamic encryption key data;
Step S35, carrying out dynamic data segmentation processing on the user privacy encryption data through dynamic encryption key data to respectively generate dynamic privacy encryption fragment data and dynamic fragment verification data;
Step S36, carrying out distributed storage processing on the dynamic privacy encryption fragment data by using computer terminal equipment based on the privacy trusted execution environment to obtain distributed storage mapping data;
And step S37, when the user accesses the user privacy data, identity token data is utilized to perform identity access control, and data decryption and recombination processing is performed through dynamic encryption key data, dynamic fragmentation verification data and distributed storage mapping data, so that a security data access strategy is obtained.
The invention carries out identity authentication processing on the user through the application program, ensures the validity and the credibility of the user identity, and only the user passing the identity authentication can acquire the subsequent privacy data, thereby effectively preventing unauthorized access and ensuring the safety and the privacy protection of the data. The privacy data is submitted through the application program based on the dynamic identity token data, so that the user can submit the privacy data only through the effective identity token. The user privacy data is subjected to strong encryption processing, so that confidentiality and security of the data are ensured, and the data cannot be acquired by unauthorized persons in the transmission and storage processes. And the generated secret key is subjected to dynamic encapsulation, so that risks of secret key leakage and cracking are effectively prevented. The user privacy encryption data is subjected to dynamic data segmentation processing through the dynamic encryption key data, so that the integrity and the reliability of the privacy data in the transmission and storage processes are ensured, and the safety and the efficiency of data transmission are improved. The encrypted private data is stored on a plurality of terminal devices in a scattered mode by using a distributed storage technology, so that the safety and reliability of the data are improved, and the risks of single-point faults and data loss are prevented. The identity token data is utilized to carry out identity access control, so that the user can only access the data with the authority, the safety and privacy protection of the data are ensured, and safe and reliable data access service is provided for the user.
Preferably, step S35 includes the steps of:
Step S351, binary conversion processing is carried out according to random sequence data in the dynamic encryption key data to obtain segmentation reference sequence data;
Step S352, calculating the segmentation quantity according to the optimal segmentation factor data, and processing the segmentation offset through the key verification code to obtain a data segmentation offset;
step S353, carrying out dynamic segmentation mapping processing on the user privacy encryption data through segmentation reference sequence data, data segmentation offset and optimal segmentation factor data to respectively obtain dynamic privacy encryption segmentation data and a data segmentation mapping table;
Step S354, performing fragment verification code processing on the privacy encryption fragment data to generate fragment verification code data;
Step S355, performing fragment integrity certification generation on the user privacy encryption data based on the fragment verification code data to obtain fragment integrity certification data;
And step 356, performing verification hash packaging processing on the data segmentation mapping table and the segment integrity proving data to obtain dynamic segment verification data.
According to the method, binary conversion processing is carried out according to the random sequence data in the dynamic encryption key data, and the random sequence data is converted into a binary form, so that the accuracy and the controllability of data segmentation are ensured. The user privacy encryption data is subjected to optimal division factor calculation by dividing the reference sequence data, which ensures the efficiency and accuracy of data division. And determining the number of data segmentation according to the optimal segmentation factor, and calculating the segmentation offset by combining the key verification code, so that the accuracy and the safety of data segmentation are ensured. And carrying out slicing processing on the user privacy encryption data according to predetermined slicing parameters, and generating a data slicing mapping table at the same time, so that subsequent data recombination and verification are facilitated. And each data fragment is subjected to verification code calculation, so that the integrity and the accuracy of the data fragments are ensured, and the data fragments are helpful to detect any change or damage of the data in the transmission and storage processes. And generating the integrity certification of the fragments by using the verification code data, combining the segmentation mapping table with the fragment integrity certification data, and ensuring the safety and the credibility of the data fragments by checking the hash encapsulation.
Preferably, step S4 comprises the steps of:
S41, acquiring operation behavior logs of a user by using computer terminal equipment based on a security data access strategy to obtain real-time user behavior data;
Step S42, performing user behavior cluster analysis on the real-time user behavior data through a preset cluster analysis period to obtain user behavior cluster events;
S43, extracting abnormal behavior characteristic indexes according to the user behavior clustering event to obtain abnormal behavior characteristic index data;
Step S44, standard index deviation degree calculation is carried out on the abnormal behavior characteristic index data, comprehensive weighting scoring processing is carried out, and abnormal behavior scoring data are obtained;
Step S45, carrying out security situation risk assessment according to the abnormal behavior scoring data to generate security situation risk assessment data;
And step S46, performing self-adaptive security monitoring processing according to the security situation risk assessment data to obtain self-adaptive security control data.
The invention is helpful for discovering potential security threats and abnormal behaviors by recording the operation behaviors of users in the system, including login, browsing, operation and the like. And carrying out cluster analysis on the user behavior data, classifying the similar behaviors into one type, and helping to find out the patterns and rules of the user behaviors so as to identify potential abnormal behaviors or safety events. And carrying out cluster analysis on the user behavior data, classifying the similar behaviors into one type, and helping to find out the patterns and rules of the user behaviors so as to identify potential abnormal behaviors or safety events. By calculating the deviation degree between the characteristic index and the standard index of the abnormal behavior and comprehensively considering the importance and influence degree of each index, the comprehensive score for the abnormal behavior is generated, and a quantized basis is provided for security situation risk assessment. And evaluating and analyzing the safety condition of the system according to the abnormal behavior scoring data, identifying potential safety risks and threats, and facilitating timely measures to prevent safety events. According to the evaluation result of the security situation, the security policy and control measures of the system are dynamically adjusted to adapt to the constantly changing security environment and threat, the security and the handling capacity of the system are improved, and the stable operation of the system is ensured.
The present invention also provides an enhanced computer data security system, performing the enhanced computer data security method as described above, the enhanced computer data security system comprising:
The device environment evaluation module is used for detecting the device environment by using the computer terminal device to generate device environment detection data, carrying out dynamic safety environment evaluation processing according to the device environment detection data to generate dynamic safety environment evaluation data, carrying out periodic characteristic analysis on the application program by the dynamic safety environment evaluation data to generate multi-mode program execution characteristic data;
The privacy data flow analysis module is used for carrying out discrete feature coding processing on the multi-mode program execution feature data to generate multi-mode feature vector matrix data, carrying out dynamic data flow processing according to the multi-mode feature vector matrix data to generate a program dynamic data flow graph, carrying out dynamic privacy data flow tracking according to the program dynamic data flow graph to generate dynamic privacy data flow path data, and constructing a trusted execution environment for the dynamic privacy data flow path data by utilizing a computer terminal device to generate a privacy trusted execution environment;
The dynamic security access module is used for submitting the private data through the application program to obtain the private data of the user, and carrying out dynamic security access processing on the private data of the user by utilizing the privacy trusted execution environment to obtain a security data access strategy;
The security situation monitoring module is used for sensing the security situation of the user by using the computer terminal equipment based on the security data access strategy to obtain security situation risk assessment data, and performing self-adaptive security monitoring processing according to the security situation risk assessment data to obtain self-adaptive security control data.
Detailed Description
The following is a clear and complete description of the technical method of the present patent in conjunction with the accompanying drawings, and it is evident that the described embodiments are some, but not all, embodiments of the present invention. All other embodiments, which can be made by those skilled in the art based on the embodiments of the present invention without making any inventive effort, are intended to fall within the scope of the present invention.
Furthermore, the drawings are merely schematic illustrations of the present invention and are not necessarily drawn to scale. The same reference numerals in the drawings denote the same or similar parts, and thus a repetitive description thereof will be omitted. Some of the block diagrams shown in the figures are functional entities and do not necessarily correspond to physically or logically separate entities. The functional entities may be implemented in software or in one or more hardware modules or integrated circuits or in different networks and/or processor methods and/or microcontroller methods.
It will be understood that, although the terms "first," "second," etc. may be used herein to describe various elements, these elements should not be limited by these terms. These terms are only used to distinguish one element from another element. For example, a first element could be termed a second element, and, similarly, a second element could be termed a first element, without departing from the scope of example embodiments. The term "and/or" as used herein includes any and all combinations of one or more of the associated listed items.
In order to achieve the above objective, referring to fig. 1 to 3, the present invention provides a method for enhancing computer data security, comprising the following steps:
Step S1, detecting equipment environment by using computer terminal equipment to generate equipment environment detection data, carrying out dynamic safety environment assessment processing according to the equipment environment detection data to generate dynamic safety environment assessment data, carrying out periodic characteristic analysis on an application program by the dynamic safety environment assessment data to generate multi-mode program execution characteristic data;
S2, performing discrete feature coding processing on multi-mode program execution feature data to generate multi-mode feature vector matrix data, performing dynamic data stream processing according to the multi-mode feature vector matrix data to generate a program dynamic data flow graph, performing dynamic privacy data stream tracking according to the program dynamic data flow graph to generate dynamic privacy data stream path data, and constructing a trusted execution environment for the dynamic privacy data stream path data by utilizing computer terminal equipment to generate a privacy trusted execution environment;
Step S3, submitting the private data through the application program to obtain user private data, and carrying out dynamic security access processing on the user private data by utilizing a privacy trusted execution environment to obtain a security data access strategy;
and S4, carrying out security situation awareness on the user by utilizing computer terminal equipment based on a security data access strategy to obtain security situation risk assessment data, and carrying out self-adaptive security monitoring processing according to the security situation risk assessment data to obtain self-adaptive security control data.
By means of deep detection of the computer terminal equipment, real-time equipment running state information including hardware performance, operating system stability, network connection conditions and the like can be obtained, and the process is helpful for identifying potential hardware faults, software conflicts or network potential safety hazards, so that equipment faults are prevented in advance, and equipment running efficiency is improved. Based on real-time equipment environment data, the safety condition of the system is comprehensively evaluated to evaluate whether the system environment of the current computer equipment is a high-risk or low-risk environment, and the high-risk environment can give an alarm in real time to solve the risks, so that the application program is tested in the low-risk environment. The execution cycle characteristic analysis is performed on the application program through the dynamic security environment evaluation data, so that the key of program performance is deeply understood and improved. They cover multiple dimensions of program execution, such as time, space, resource consumption, etc., and provide detailed basis for program optimization, performance tuning and troubleshooting. Discrete feature coding is performed on the multi-mode program execution feature data, and a complex data structure can be converted into a matrix form which is convenient to process, so that the efficiency and the accuracy of data analysis are improved. In this way, the mode and behavior of program operation can be better understood. And generating a program dynamic data flow graph by utilizing the feature vector matrix, intuitively describing a data flow path when the program runs, effectively analyzing an internal working mechanism of the program, searching and repairing errors in data processing, detecting a data leakage path and enhancing data security. The flow of sensitive information can be known in real time by carrying out dynamic privacy data flow tracking through the data flow graph. The terminal equipment is used for constructing the trusted execution environment of the dynamic privacy data flow path data, so that an isolated and safe execution environment can be created, and the integrity and confidentiality of the privacy data in the processing process are ensured. The user privacy data is processed in the privacy trusted execution environment, so that the access and the use of the data can be strictly controlled, and unauthorized access and disclosure are prevented. The environment provides a high level of protection for the data, ensures the security of the private data even if other parts of the system are attacked, and improves the overall security level of the system. The dynamic security access processing can adjust the data access control strategy in real time according to the change of the running condition of the system, so that the data security is improved, and meanwhile, the legal user can access the required data smoothly. The safety situation awareness is carried out on the user, and the safety condition of the user in the process of using the equipment can be monitored and estimated in real time. This includes identifying potential threats, vulnerabilities, and abnormal behaviors, and evaluating the impact of these risks on user data and system security. The data provides quantitative analysis of the current safety condition of the user, is helpful for the user to understand the severity and urgency of the potential risks, and ensures the information security of the user in various use situations. The method for enhancing the security of the computer data comprises the steps of carrying out risk environment assessment on the computer equipment in advance to ensure that the computer equipment is in a security state when an application program is tested, obtaining the characteristic condition of execution data of the application program through the application program test, constructing a program dynamic data flow diagram according to the characteristic data, carrying out dynamic privacy data flow tracking based on the program dynamic data flow diagram, constructing a privacy executable environment, and ensuring the integrity and confidentiality of the privacy data in the processing process. And the security situation awareness is carried out on the computer equipment, the data protection capability is improved in all directions, and the risk of loss or theft of private data is effectively reduced.
In the embodiment of the present invention, as described with reference to fig. 1, a step flow diagram of a method for enhancing computer data security according to the present invention is provided, and in the embodiment, the method for enhancing computer data security includes the following steps:
Step S1, detecting equipment environment by using computer terminal equipment to generate equipment environment detection data, carrying out dynamic safety environment assessment processing according to the equipment environment detection data to generate dynamic safety environment assessment data, carrying out periodic characteristic analysis on an application program by the dynamic safety environment assessment data to generate multi-mode program execution characteristic data;
In the embodiment of the invention, an identity authentication program is started to verify the legitimacy of equipment, and a digital signature is generated and sent to an authentication server. And collecting equipment operating system information, network environment data, hardware parameters and the like to form detailed equipment environment detection data. And (5) establishing a safety condition, a risk level standard and an associated model, and inputting real-time detection data into an evaluation model. And according to a preset environmental risk threshold value, comparing and analyzing each safety index one by one, judging the low risk or high risk running state, triggering an alarm aiming at abnormality, and notifying related personnel to take action. Through the treatment measures, environmental changes are monitored, risk marks are adjusted timely, and feedback data are recorded. And integrating periodic logs to analyze resource consumption, error logs and the like, distinguishing program execution modes by utilizing data mining, and finally forming multi-mode program execution characteristic data.
S2, performing discrete feature coding processing on multi-mode program execution feature data to generate multi-mode feature vector matrix data, performing dynamic data stream processing according to the multi-mode feature vector matrix data to generate a program dynamic data flow graph, performing dynamic privacy data stream tracking according to the program dynamic data flow graph to generate dynamic privacy data stream path data, and constructing a trusted execution environment for the dynamic privacy data stream path data by utilizing computer terminal equipment to generate a privacy trusted execution environment;
In the embodiment of the invention, the redundant information in the multi-mode characteristic data is removed by adopting the dimension reduction technology such as PCA, t-SNE or a self-encoder, and the key characteristics are reserved. The non-numerical features are unithermally coded or ordinal coded, which are converted into numerical vectors. All feature vectors are combined into a multi-modal feature vector matrix data. And constructing a dynamic data flow graph model for describing data flow in the program execution process. And calculating node importance scores by using PageRank or a graph neural network model, and identifying key data processing nodes. And implementing dynamic privacy data stream tracking, and recording data transmission paths among key nodes to form privacy data stream data. Finally, according to the path data, a TEE such as Intel SGX or ARM TrustZone is deployed in the terminal equipment, and an isolated security zone is created for sensitive data processing, so that effective execution of privacy protection is ensured.
Step S3, submitting the private data through the application program to obtain user private data, and carrying out dynamic security access processing on the user private data by utilizing a privacy trusted execution environment to obtain a security data access strategy;
In the embodiment of the invention, a user inputs a user name and a password through an application program login interface, and an application program adopts a salt hash technology to encrypt the password. The application program sends the user name and the encryption password to the server for identity verification, and the server generates identity token data containing user information. The application uses the dynamic identity token data as authorization credentials, allowing the user to submit the private data to the server. The server encrypts the received user privacy data using the AES-256 encryption algorithm to generate encrypted data and an encryption key. And generating a random seed and a key verification code based on the identity token data, and constructing a dynamic encryption key data packet. The encrypted data is partitioned into a plurality of fragments according to the random indicator, and a unique check code is calculated for each fragment. And carrying out distributed storage management on the fragment data by utilizing the privacy trusted execution environment to generate distributed storage mapping data. When a user requests to access data, the system verifies the identity token and calls related data to restore the private data, so that the data security is ensured.
And S4, carrying out security situation awareness on the user by utilizing computer terminal equipment based on a security data access strategy to obtain security situation risk assessment data, and carrying out self-adaptive security monitoring processing according to the security situation risk assessment data to obtain self-adaptive security control data.
In the embodiment of the invention, under the guarantee of a safety data access strategy, the system automatically monitors and records user operations, including login, file access and the like, and the data is collected in real time through an API or a system hook, and key information is reserved through cleaning, so that real-time behavior data is formed. And (3) starting cluster analysis according to a preset period, extracting features from the behavior data, classifying the feature vectors by using an unsupervised learning algorithm such as K-means, and identifying similar behavior modes. And carrying out statistical analysis on the clustering result, detecting abnormal behaviors, such as identifying isolated examples through LOF, and marking abnormal features such as operation of abnormal time. And calculating and weighting the feature deviation degree, and comprehensively obtaining the abnormal behavior score, thereby dividing the user risk level. And triggering a response strategy according to the score, such as low risk reinforcement monitoring, and isolating resources and responding emergently when the risk is high. The system dynamically analyzes the risk assessment trend, and adaptively adjusts the monitoring strategy and the alarm threshold value to cope with the security situation change, so as to realize intelligent security monitoring and control.
Preferably, step S1 comprises the steps of:
Step S11, performing equipment identity authentication by using computer terminal equipment to generate equipment identity authentication data;
Step S12, performing equipment environment detection according to the equipment identity authentication data to generate equipment environment detection data, wherein the equipment environment detection data comprises operating system state analysis data, network environment detection data and equipment hardware data;
S13, carrying out dynamic security environment assessment processing according to the equipment environment detection data to generate dynamic security environment assessment data;
S14, carrying out environment risk judgment on the dynamic safety environment assessment data by utilizing a preset environment risk threshold value, and marking the computer terminal equipment as low-risk operation environment data when the dynamic safety environment assessment data is lower than the environment risk threshold value;
Step S15, when the dynamic security environment assessment data is higher than or equal to an environment risk threshold value, marking the computer terminal equipment as high-risk operation environment data, carrying out risk environment alarm processing according to the high-risk operation environment data to generate risk environment alarm data;
And S16, performing execution cycle characteristic analysis on the application program through the risk environment feedback data and the low-risk running environment data to generate multi-mode program execution characteristic data.
As an example of the present invention, referring to fig. 2, a detailed implementation step flow diagram of step S1 in fig. 1 is shown, where step S1 includes:
Step S11, performing equipment identity authentication by using computer terminal equipment to generate equipment identity authentication data;
In the embodiment of the invention, the identity authentication program is started through the computer terminal equipment. The program may be a pre-installed application or a script that is manually initiated by the user. After the program is started, the user is required to input identity information related to the device, such as a device number, a serial number and the like. The program generates a unique digital signature based on the entered identity information. The program will send the generated digital signature to the authentication server. The authentication server verifies whether the received digital signature matches the expected signature of the device. If the matching is successful, the authentication server issues a digital certificate to the equipment to prove that the identity of the equipment is legal, so that equipment identity authentication data is generated. Such data includes, but is not limited to, a unique identifier (MAC address, serial number) of the device, a timestamp, an authentication status, etc.
Step S12, performing equipment environment detection according to the equipment identity authentication data to generate equipment environment detection data, wherein the equipment environment detection data comprises operating system state analysis data, network environment detection data and equipment hardware data;
In the embodiment of the invention, the computer terminal sends an instruction to the equipment by utilizing the safety channel established in the equipment identity authentication process to request the related information of the operating system. These instructions include querying operating system version numbers, patch installation, system logs, running service and process lists, etc. For example, for a Linux system, kernel versions may be obtained by executing uname-a, checking the installed software package and its version using dpkg-l or rpm-qa, and checking the system log by journalctl command. Data is collected about the network environment in which the device is located through a network diagnostic tool or script on the device. This includes, but is not limited to, IP address, subnet mask, default gateway, DNS server configuration, active network connection status, open port scanning, and network traffic analysis. Instructions are sent to the device to obtain hardware information including, but not limited to, CPU model, memory capacity, hard disk space, network card information, and other peripheral status. For example, in a Linux environment, the relevant hardware information can be obtained by reading/proc/cpuinfo,/proc/meminfo, df-h commands. The results are consolidated into device environment detection data, forming a detailed report document or structured data package.
S13, carrying out dynamic security environment assessment processing according to the equipment environment detection data to generate dynamic security environment assessment data;
In the embodiment of the invention, according to the historical environmental data and the security event records, an environmental security condition, a preset risk level standard and a correlation model among all environmental factors, such as a decision tree model, a neural network model and the like, are constructed. The input of real-time environment detection data into the assessment model for security risk assessment, for example, when network traffic suddenly increases with a large number of unauthorized access attempts, will be marked as a high risk factor, as it may represent a potential DDoS attack. And calculating the security evaluation score or grade of the equipment environment in real time, and outputting a comprehensive security evaluation score to reflect the instant security health state including the security index, the risk level and the like.
S14, carrying out environment risk judgment on the dynamic safety environment assessment data by utilizing a preset environment risk threshold value, and marking the computer terminal equipment as low-risk operation environment data when the dynamic safety environment assessment data is lower than the environment risk threshold value;
In the embodiment of the invention, environmental risk thresholds with different dimensions are preset according to industry standards, historical data analysis and security policy requirements. These thresholds cover device performance metrics (e.g., CPU usage is no more than 80% safe), network behavior (e.g., no more than 10 abnormal login attempts per second), etc. And comparing each evaluation index with a preset risk threshold value one by one. For example, the detected CPU average usage rate 35% is compared with a set threshold value 80%, and whether the CPU average usage rate is within a safety range is confirmed, and a clear risk threshold value is set for different safety evaluation indexes. The threshold system aims to distinguish security levels, such as green (low risk) and red (high risk), ensuring standardization and objectivity of risk judgment. The system automatically compares the dynamic security assessment data with a preset environmental risk threshold. And when the evaluation results of all the key indexes are lower than the corresponding low-risk thresholds, the triggering mechanism marks the computer terminal equipment as a low-risk running environment.
Step S15, when the dynamic security environment assessment data is higher than or equal to an environment risk threshold value, marking the computer terminal equipment as high-risk operation environment data, carrying out risk environment alarm processing according to the high-risk operation environment data to generate risk environment alarm data;
In the embodiment of the invention, if any one or more indexes reach or exceed the corresponding threshold value, the system instantly marks the computer terminal equipment as a high-risk running environment. For example, when it is detected that the hard disk failure rate of a certain server exceeds a preset 1% threshold for two consecutive days, the system issues a high risk alarm and marks. For devices marked as high risk, the system automatically generates risk environment alarm data. Alarm data includes, but is not limited to, device ID, specific anomaly metrics, degree of superscalar, alarm time, recommended emergency treatment measures, and the like. The information is rapidly pushed to a security operation and maintenance team and designated responsible persons through various channels such as mail, short messages, instant communication tools and the like, so that instant response is ensured. Upon receipt of the alarm information, the user (security operator) takes action based on the risk environment alarm data, which involves remotely logging in to the faulty device for diagnosis, executing security protocols, isolating the affected network area, or dispatching a field engineer for physical inspection and maintenance. The system continuously monitors the change of the dynamic safety environment evaluation data and updates the evaluation result in real time. When measures are taken to cause the dynamic security environment assessment data to revert back to or below the environment risk threshold, the system automatically deasserts the "high risk" flag, changes to a "low risk" or "normal" state, and records this transition, while generating "risk environment feedback data".
And S16, performing execution cycle characteristic analysis on the application program through the risk environment feedback data and the low-risk running environment data to generate multi-mode program execution characteristic data.
In the embodiment of the invention, the generated risk environment feedback data and the low risk operation environment data are integrated, the risk environment feedback data comprises information such as an abnormal processing process, a time stamp, a recovery state and the like, and the low risk operation environment data reflects the performance of the equipment in a stable state. Data related to the execution cycle is extracted from log files of devices and applications, including, but not limited to, program start-up time, run time, resource consumption (e.g., CPU, memory usage), error log, and interaction records with external systems. And carrying out fusion analysis on the characteristic data (such as resource use, error frequency, execution time and the like) with different dimensions to form a multi-mode program execution characteristic data set. In this process, the execution mode difference of different application programs under different risk environments is identified by using a data mining technology such as cluster analysis. And (3) sorting the feature data set obtained through processing and analysis into structured multi-mode program execution feature data.
Preferably, step S16 comprises the steps of:
Step 161, performing security environment credential processing according to the risk environment feedback data and the low risk operation environment data to generate security environment credential data;
step S162, performing program periodic execution test design on the application program based on the security environment credential data to generate program execution test event data;
Step S163, collecting user operation behavior logs according to program execution test event data to generate user operation behavior data;
Step S164, user network request monitoring is carried out according to user operation behavior data to obtain user request interaction data, system resource tracking is carried out according to the user operation behavior data to generate system resource tracking data, file operation audit is carried out according to the user operation behavior data to generate file operation audit data;
step S165, performing context correlation analysis on the user request interaction data, the system resource tracking data and the file operation audit data to generate context detection correlation data;
Step S166, performing time sequence feature processing according to the context detection associated data to generate time sequence detection associated data;
step S167, multi-mode data fusion processing is carried out according to the time sequence detection associated data, so as to obtain multi-mode program execution characteristic data.
In the embodiment of the invention, after receiving the risk environment feedback data and confirming that the computer terminal is in the low risk running environment, the system enters a security credential processing stage. This includes verifying the digital signature of all applications, checking whether the entitlement configuration meets the minimum entitlement rules, and confirming that the most recently installed or updated software source is reliable and malicious free. Based on the verification results, the system creates or updates a security environment credential data packet containing information such as the application trust level, rights allocation details, and the timestamp of the most recent security check. The system designs and deploys a periodic execution test plan for each application. For example, daily timing opening and basic function testing, such as document opening, editing and saving, are set for office software, so that software stability and compatibility are ensured. The specific parameters and expected results of these test designs are encoded into program execution test event data that is stored in a database for use in directing the execution of automated test tools. The system begins performing the test and synchronously collecting user operational behavior data. During the test, not only logs of test script execution, such as test start time, test end time and test step execution results, but also any interactive data generated by a real user in the test process, such as click rate, page access sequence, specific function use frequency and the like, are recorded. And capturing and analyzing the network request triggered in the user operation behavior data in real time through a network monitoring module. For example, URL of HTTP/HTTPs request sent by the user browser, request method (GET, POST, etc.), response status code, transmitted data amount, etc. are recorded to form user request interactive data. Meanwhile, the system resource manager continuously tracks the use condition of resources such as CPU, memory, disk I/O and the like, is associated with the operation behaviors of a specific user, records detailed logs of the change of the resources before and after the operation, and generates system resource tracking data. In addition, the file system audit tool monitors file creation, modification, deletion and access events, and records related information such as users, time stamps, file paths and the like, thereby constructing file operation audit data. For example, the resource consumption immediately following a particular network request increases, or the association of a file access pattern with a particular network behavior, etc., thereby generating context detection association data. Modeling the data according to the time sequence by adopting a time sequence analysis method, and identifying the trend, periodicity and abnormal points of the data along with the time change. For example, by analyzing peaks and troughs in the use of system resources throughout the day, or periodic changes in file access frequency, the system can more accurately predict future resource bottlenecks or abnormal behavior patterns. The data processed by the time sequence features are time sequence detection associated data. And (5) fusing the time sequence detection associated data with other multi-source data (such as historical security event records, user role information and the like). And adopting a multi-modal fusion algorithm, such as a multi-layer perceptron in deep learning, performing cross-modal mapping and feature extraction on the data, and outputting more comprehensive and fine multi-modal program execution feature data.
Preferably, step S2 comprises the steps of:
step S21, performing feature dimension reduction processing on the multi-mode program execution feature data to generate dimension reduction multi-mode execution feature data;
S22, performing discrete feature coding processing according to the dimension-reduction multi-mode execution feature data to generate multi-mode feature vector matrix data;
s23, performing dynamic data flow processing according to the multi-mode feature vector matrix data to generate a program dynamic data flow graph;
Step S24, node importance score calculation is carried out according to the program dynamic data flow graph to generate node importance score data;
step S25, carrying out dynamic privacy data flow tracking on key node data through a program dynamic data flow graph to generate dynamic privacy data flow path data;
and S26, constructing a trusted execution environment for the dynamic privacy data flow path data by using the computer terminal equipment to generate a privacy trusted execution environment.
In the embodiment of the invention, redundant information in multi-mode program execution characteristic data is removed by adopting a dimension reduction technology such as Principal Component Analysis (PCA), t-distribution neighborhood embedding (t-SNE) or a self-encoder (Autoencoder), and the like, so that the most representative characteristic is reserved. Finally, a multi-mode execution characteristic data set with reduced dimension is obtained, and each characteristic can clearly reflect the key mode of program execution. For non-numeric features, such as class labels, the system converts them into numeric vectors using One-Hot Encoding (One-Hot Encoding) or ordinal Encoding (Ordinal Encoding). All feature vectors are combined into a large multi-modal feature vector matrix data, and each row vector represents a feature representation of a sample in multiple dimensions. The system builds a dynamic data flow graph of the program using the multimodal feature vector matrix data. This graph model depicts the path of data flow during program execution, including the source, process, and endpoint of the data. Each node represents a data processing operation or data storage location and the edges represent the direction of data flow. And calculating importance scores for each node in the dynamic data flow graph by adopting a PageRank algorithm or a node importance scoring model based on a graph neural network. The score reflects how critical the node is in the data stream, and nodes with high scores often involve sensitive operations or data. The node importance score data generated therefrom is used to identify those critical nodes that are critical to program security or privacy protection. For identified critical nodes, the system performs dynamic privacy data flow tracking, recording the exact path of data flow between these nodes. This includes a complete track of when data starts from a certain node, which intermediate nodes to route through, and finally how to reach the destination. These path information are compiled into dynamic privacy data flow path data that provides accurate positioning for privacy preserving measures. Based on the dynamic private data stream data, the system deploys a Trusted Execution Environment (TEE), such as Intel SGX or ARM trust zone, on the computer terminal device. The TEE provides an isolated secure execution area for critical data nodes, ensuring that private data is not affected by an external untrusted environment when processing.
Preferably, step S23 comprises the steps of:
step S231, carrying out data entity analysis on the multi-mode feature vector matrix data to generate entity analysis feature data;
S232, performing atomic operation flow deconstructing according to the entity analysis characteristic data to obtain operation flow deconstructing data;
Step S233, performing program dynamic execution logic analysis by using the operation flow deconstructed data to generate program dynamic execution behavior data;
Step S234, performing entity clustering processing according to the entity analysis characteristic data, and performing data dependency mapping processing through the program dynamic execution behavior data to generate a dynamic data flow dependency graph;
Step S235, extracting data flow nodes according to the dynamic data flow dependency graph to generate data flow node data;
Step S236, constructing a directed data flow graph through data flow node data and data flow edge data;
and step 237, performing redundant node optimization processing on the directed data flow graph to obtain a program dynamic data flow graph.
In the embodiment of the invention, on the basis of multi-mode feature vector matrix data, the system identifies and marks key entities in the data, such as specific function calls, variable names, API interfaces and the like, through an entity analysis algorithm to form entity analysis feature data. The underlying atomic operations, such as reads, writes, computations, etc. associated with each data entity are further deconstructed to generate operation flow deconstructed data. The system utilizes static analysis and dynamic tracking technology to comprehensively analyze the behavior patterns of the program in different execution stages, and identify the changes of control flow and data flow to form dynamic execution behavior data of the program. Under the support of entity analysis characteristic data, the system classifies similar data entities through a clustering algorithm to form entity clusters. Meanwhile, the dynamic execution behavior data of the program are combined, mapping of the data dependency relationship is carried out, and a dynamic data flow dependency graph is constructed. The diagram shows the calling, transferring and dependency relationship among the data entities, and intuitively reflects the flow path of the data in the program. From the dynamic data flow dependency graph, the system extracts each node which independently processes data, such as a function call point, a conditional branch and the like, to form data flow node data. Meanwhile, the data flow direction between each pair of nodes is identified and recorded, data flow edge data is generated, and the transmission path of the data between the nodes is defined. By integrating the data stream node data and the data stream edge data, the system builds a directed data flow graph. The graph uses nodes to represent data processing units, edges to represent data flow directions, and clearly shows flow logic and control structures of data in the process of program execution. And optimizing the directed data flow graph, removing redundant nodes which do not contribute additional information, simplifying complex connection, and ensuring simplicity and high efficiency of the graph.
Preferably, step S25 comprises the steps of:
step S251, privacy data source positioning is carried out on the key node data, and privacy data source data is generated;
Step S252, carrying out privacy data marking processing by utilizing privacy data source data based on preset privacy sample tag data to generate marked privacy data;
step 253, performing dynamic taint propagation simulation according to the marked privacy data to generate dynamic privacy propagation data;
And step S254, carrying out propagation path analysis on the dynamic privacy propagation data through the program dynamic data flow graph to obtain dynamic privacy data flow path data.
In the embodiment of the invention, aiming at the deep analysis of the identified key node data, the system identifies the variable, function parameter or return value containing the privacy data through regular expression matching, keyword searching or pattern recognition algorithm. And tracing the data sources processed by the nodes, identifying the original data storage positions containing sensitive information such as personal identity information, financial records, health conditions and the like, and generating private data source data. The flow of marked privacy data in the running process of the program is tracked by establishing a simulated execution environment based on a predefined set of privacy sample tags (such as personal information, financial data, medical records, etc.). The system injects virtual "smudge" marks into the marked private data, which are propagated as they are read, assigned to new variables, or passed as function parameters. By control flow and data flow analysis, the system records the flow path and state changes of these markers in real time, generating detailed dynamic privacy-preserving data. The method comprises the steps of using a program dynamic data flow graph as an analysis framework, deeply analyzing propagation paths of private data through a graph traversal algorithm, evaluating nodes and edges on the paths by a system for each propagation path, and identifying potential security weak points, such as unencrypted data transmission, exposure of sensitive information to an external interface and the like. The system draws the paths, marks the key nodes and the risk points, and finally generates dynamic privacy data flow path data.
Preferably, step S3 comprises the steps of:
Step S31, carrying out identity authentication processing on a user through an application program to generate identity token data;
step S32, submitting privacy data through an application program based on the dynamic identity token data to obtain user privacy data;
step S33, performing data encryption processing on the user privacy data by using an AES-256 encryption algorithm to respectively generate user privacy encryption data and encryption key data;
Step S34, generating random seeds according to the identity token data to obtain random sequence data, generating key verification codes for the encryption key data through the identity token data to obtain the key verification codes, and carrying out dynamic encryption key packaging treatment on the encryption key data, the random sequence data and the key verification codes to generate dynamic encryption key data;
Step S35, carrying out dynamic data segmentation processing on the user privacy encryption data through dynamic encryption key data to respectively generate dynamic privacy encryption fragment data and dynamic fragment verification data;
Step S36, carrying out distributed storage processing on the dynamic privacy encryption fragment data by using computer terminal equipment based on the privacy trusted execution environment to obtain distributed storage mapping data;
And step S37, when the user accesses the user privacy data, identity token data is utilized to perform identity access control, and data decryption and recombination processing is performed through dynamic encryption key data, dynamic fragmentation verification data and distributed storage mapping data, so that a security data access strategy is obtained.
In the embodiment of the invention, a user inputs a preregistered user name and a password through a login interface of an application program, the application program adopts a salt hash technology to encrypt the password, and the user name and the encrypted password are sent to a server for verification. The server confirms the authenticity of the user identity by comparing the user information stored in the database, and then generates identity token data containing the user identity information and the validity period, and the application program uses the dynamic identity token data as an authorization credential to allow the user to submit private data, such as personal bank account information or medical records. The data are uploaded to a server through an Application Program Interface (API), and after the server receives the data, the validity of the identity token is confirmed, so that the validity of the data submitting process is ensured. After receiving the user privacy data, the server immediately encrypts the user privacy data by using an AES-256 encryption algorithm. The algorithm uses 256-bit keys, providing extremely high security. The encryption process generates two parts of data, encrypted user privacy data and encryption key data for decryption. At the same time, to ensure secure storage and transmission of the key, the system also generates a separate key verification code to verify the integrity and authenticity of the key. Based on the specific information of the identity token data, the system generates a random seed for further data protection. The random seed together with the encryption key data generates a key verification code by a specific algorithm. Then, the encryption key data, the random sequence data and the key verification code are packaged in a specific format to form a dynamic encryption key data packet. A series of random numbers are generated as a fragmentation indicator based on dynamic encryption key data by a secure random algorithm. The user privacy encrypted data is then partitioned into multiple pieces of different sizes according to the indicators, each piece being randomly and unpredictably sized and positioned to increase the security of the data. Meanwhile, the system calculates a unique check code, namely dynamic fragment check data, for each fragment, and based on the constructed privacy trusted execution environment, the computer terminal equipment plays the role of a distributed storage manager. In this environment, each piece of dynamic privacy encryption fragment data is distributed to different physical storage nodes or cloud storage services according to a preset policy. The system ensures the safety of the fragments in the transmission process by utilizing the encryption communication channel, records the storage position information of each fragment and generates distributed storage mapping data. When a user requests access to his private data, authentication is first required. The system will verify the identity token data provided by the user, confirming the validity of the request and the correctness of the user identity. And after the verification is passed, the system calls dynamic encryption key data, dynamic fragment verification data and distributed storage mapping data according to the user information associated with the identity token. The dynamic encryption key data is used to decrypt the fragments and the fragment verification data is used to verify the integrity of each fragment after it is recalled, ensuring that it has not been tampered with. And finally, original user privacy data is restored, so that the privacy and data security of the user in the access process are ensured, and a complete security data access strategy is formed.
Preferably, step S35 includes the steps of:
Step S351, binary conversion processing is carried out according to random sequence data in the dynamic encryption key data to obtain segmentation reference sequence data;
Step S352, calculating the segmentation quantity according to the optimal segmentation factor data, and processing the segmentation offset through the key verification code to obtain a data segmentation offset;
step S353, carrying out dynamic segmentation mapping processing on the user privacy encryption data through segmentation reference sequence data, data segmentation offset and optimal segmentation factor data to respectively obtain dynamic privacy encryption segmentation data and a data segmentation mapping table;
Step S354, performing fragment verification code processing on the privacy encryption fragment data to generate fragment verification code data;
Step S355, performing fragment integrity certification generation on the user privacy encryption data based on the fragment verification code data to obtain fragment integrity certification data;
And step 356, performing verification hash packaging processing on the data segmentation mapping table and the segment integrity proving data to obtain dynamic segment verification data.
In the embodiment of the invention, random sequence data is extracted from dynamic encryption key data, and the sequence contains a series of randomly generated numbers or characters. These data are converted into a series of binary bit strings by a binary conversion algorithm, forming segmented reference sequence data. And analyzing the structure of the user privacy encryption data according to the segmentation reference sequence data, and calculating an optimal segmentation strategy, namely optimal segmentation factor data. The optimal segmentation factor data aims at finding an optimal data segmentation mode, so that the segmented data blocks can be ensured to keep information safety, and management and efficient storage can be facilitated. Based on the calculated optimal division factor data, the system determines the exact number of divisions, which is determined by the ideal size and storage efficiency of the data block. The key verification code is utilized to carry out further security enhancement, and the system calculates the offset during data segmentation through the operation processing of the key verification code. These offsets introduce randomness into the data splitting process, ensuring that different tile layouts are created even with the same raw data in different splitting operations. The system performs dynamic segmentation mapping on the user privacy encryption data. This means that the privacy-encrypted data is precisely cut into pieces, each of which is attached with specific identification information, according to the calculated division points and offsets, for subsequent management and recombination. Meanwhile, the system maintains a detailed data segmentation mapping table, records the storage position and related metadata of each segment, and generates dynamic privacy encryption segment data. A hashing algorithm is performed on each dynamic privacy encryption tile data to generate a unique tile verification code. The verification codes are fixed-length digital fingerprints calculated based on the sliced content, and any minor modification to the sliced content results in significant changes in the verification codes, so that the verification codes can be used for verifying the integrity and consistency of data to form sliced verification code data. Based on the fragment verification code data, the system further generates a fragment integrity certification. By means of mathematical proving, the integrity of the fragments in the process of segmentation and storage can be proved not to be damaged even if the original data are not directly displayed. Integrating the data segmentation mapping table and the segment integrity proving data generated before, and carrying out packaging processing through a verification hash algorithm. For example, the two pieces of key information are converted into a fixed-length digest, namely dynamic fragmentation verification data, through irreversible hash operation.
Preferably, step S4 comprises the steps of:
S41, acquiring operation behavior logs of a user by using computer terminal equipment based on a security data access strategy to obtain real-time user behavior data;
Step S42, performing user behavior cluster analysis on the real-time user behavior data through a preset cluster analysis period to obtain user behavior cluster events;
S43, extracting abnormal behavior characteristic indexes according to the user behavior clustering event to obtain abnormal behavior characteristic index data;
Step S44, standard index deviation degree calculation is carried out on the abnormal behavior characteristic index data, comprehensive weighting scoring processing is carried out, and abnormal behavior scoring data are obtained;
Step S45, carrying out security situation risk assessment according to the abnormal behavior scoring data to generate security situation risk assessment data;
And step S46, performing self-adaptive security monitoring processing according to the security situation risk assessment data to obtain self-adaptive security control data.
As an example of the present invention, referring to fig. 3, a detailed implementation step flow diagram of step S4 in fig. 1 is shown, where step S4 includes:
S41, acquiring operation behavior logs of a user by using computer terminal equipment based on a security data access strategy to obtain real-time user behavior data;
In the embodiment of the invention, under the execution of the security data access strategy, the system continuously monitors and records all operation activities of the user on the terminal. This includes, but is not limited to, user login and logout, file access, application use, network request, system setting change, and the like. The system captures the behavior data in real time through an API interface or a system hook (hook) technology on the premise of ensuring that the privacy policy of the user is complied with, and manual intervention is not needed. The collected original data is subjected to preliminary cleaning and formatting treatment, irrelevant information is removed, only core elements such as a time stamp, a user ID, an operation type and related parameters of key actions are reserved, and finally real-time user behavior data is formed.
Step S42, performing user behavior cluster analysis on the real-time user behavior data through a preset cluster analysis period to obtain user behavior cluster events;
In the embodiment of the invention, the system automatically triggers the clustering analysis process according to a preset periodic plan (such as hourly, daily or weekly). This process first extracts features from the real-time user behavior data, including but not limited to operating frequency, operating type, operating time distribution, operating objects (e.g., files, applications), etc. Next, the system analyzes the extracted feature vectors using an unsupervised learning algorithm, such as K-means, DBSCAN, hierarchical clustering, or the like. Taking K-means as an example, the system first randomly selects a number of initial cluster centers (centroids) and then assigns each user behavior instance to the nearest cluster based on a distance metric (e.g., euclidean distance). Next, the average value of each cluster is recalculated to update the centroid, and this assignment-update process is repeated until the centroid no longer changes significantly or reaches a preset maximum number of iterations. Through such iterative optimization, user behavior is grouped into different clusters, each cluster representing a class of patterns with similar behavior.
S43, extracting abnormal behavior characteristic indexes according to the user behavior clustering event to obtain abnormal behavior characteristic index data;
In the embodiment of the invention, statistical analysis is performed on the behavior data in each cluster, such as statistics of operation frequency, mean value, median, standard deviation and the like of time distribution. Statistical methods (e.g., Z-score or IQR methods) are used to detect the degree of deviation of each behavior instance from the statistical characteristics of the cluster in which it resides. For example, if a user's access frequency during non-working hours is far beyond the average level of co-clustered users plus a few standard deviations, this needs to be considered as an anomaly. The local anomaly factor (LOF) is used for marking an instance with isolation or low density in the behavior space, and the characteristic indexes of the anomaly behavior are extracted, such as 'late night high frequency file downloading', 'system setting change in irregular time', 'database query volume beyond normal range', and the like. These features are not only quantitative (e.g. frequency, time stamp) but also qualitative (e.g. type of operation, object sensitivity).
Step S44, standard index deviation degree calculation is carried out on the abnormal behavior characteristic index data, comprehensive weighting scoring processing is carried out, and abnormal behavior scoring data are obtained;
In the embodiment of the invention, for each abnormal behavior feature index, the application program calculates the degree of deviation from the normal user group. For example, if a user's night login time is much higher than a normal user, the degree of deviation of the index may be high. The degree of deviation may be calculated using a Z-score, percentile, or the like method. The system can give different weight coefficients according to the importance degree of each abnormal behavior characteristic index. For example, for the "read privacy data in large amounts" behavior, a higher weight may be given, as it represents a more serious anomaly. The weight coefficient can be set by a security expert according to actual conditions. Multiplying the deviation degree of each index by the weight, and then summing to obtain the final abnormal behavior comprehensive score.
Step S45, carrying out security situation risk assessment according to the abnormal behavior scoring data to generate security situation risk assessment data;
In the embodiment of the invention, the abnormal behaviors of the user are classified into different risk levels, such as low risk, medium risk and high risk, according to the abnormal behavior scoring data. The division is based on a generally preset scoring threshold, for example, a score between 0 and 30 points is a low risk, a score between 31 and 70 points is a medium risk, and a score exceeding 70 points is a high risk. Such partitioning helps to quickly identify the most urgent problem. For each user, the system will compare its abnormal behavior score to a risk threshold. If the score exceeds the threshold, the user is deemed to be at a higher security risk. If the score does not exceed the threshold, a lower security risk is deemed. And counting risk assessment results of all users, and calculating the overall security situation risk level. For example, the number of users exceeding the risk threshold may be counted as a percentage of the overall risk.
And step S46, performing self-adaptive security monitoring processing according to the security situation risk assessment data to obtain self-adaptive security control data.
In the embodiment of the invention, the system matches a preset response strategy library according to the risk level in the security situation risk assessment data. A series of predefined control measures for different risk classes are stored in the policy repository, for example, only logging and auditing need to be enhanced at low risk, access control and warning notification are added at medium risk, and affected resources are immediately isolated at high risk and an emergency response flow is started. And adjusting the monitoring strategy in real time according to the evaluation result. The system analyzes the change trend in the risk assessment data and automatically adjusts the frequency, depth and key points of monitoring. And dynamically adjusting an alarm threshold according to the evaluation data to ensure that an alarm is triggered in time before the security situation is deteriorated. For example, if abnormal behaviors of a certain type are found to be increased gradually, the system can lower the threshold value of the behavior triggering the alarm, so that early warning is achieved.
The present invention also provides an enhanced computer data security system, performing the enhanced computer data security method as described above, the enhanced computer data security system comprising:
The device environment evaluation module is used for detecting the device environment by using the computer terminal device to generate device environment detection data, carrying out dynamic safety environment evaluation processing according to the device environment detection data to generate dynamic safety environment evaluation data, carrying out periodic characteristic analysis on the application program by the dynamic safety environment evaluation data to generate multi-mode program execution characteristic data;
The privacy data flow analysis module is used for carrying out discrete feature coding processing on the multi-mode program execution feature data to generate multi-mode feature vector matrix data, carrying out dynamic data flow processing according to the multi-mode feature vector matrix data to generate a program dynamic data flow graph, carrying out dynamic privacy data flow tracking according to the program dynamic data flow graph to generate dynamic privacy data flow path data, and constructing a trusted execution environment for the dynamic privacy data flow path data by utilizing a computer terminal device to generate a privacy trusted execution environment;
The dynamic security access module is used for submitting the private data through the application program to obtain the private data of the user, and carrying out dynamic security access processing on the private data of the user by utilizing the privacy trusted execution environment to obtain a security data access strategy;
The security situation monitoring module is used for sensing the security situation of the user by using the computer terminal equipment based on the security data access strategy to obtain security situation risk assessment data, and performing self-adaptive security monitoring processing according to the security situation risk assessment data to obtain self-adaptive security control data.
The method has the advantages that the running state of the equipment is monitored in real time, and hardware faults, software conflicts or potential network safety hazards are found and prevented in time. Based on the real-time equipment environment data, the system safety condition is comprehensively evaluated, the application program is ensured to be tested in a low-risk environment, and the application program safety is improved. And deeply analyzing the execution characteristics of the application program, including time, space, resource consumption and the like, providing basis for program optimization, performance tuning and fault investigation, and helping to better understand the running mode and behavior of the program. And generating a program dynamic data flow graph by using the feature vector matrix, so as to strengthen the data security. An isolated and safe privacy data processing execution environment is constructed, data access and use are strictly controlled, the integrity and confidentiality of privacy data in the processing process are ensured, and the overall safety level of the system is improved. The data access control strategy is dynamically adjusted according to the running condition of the system, so that the security of the data is improved, meanwhile, the legal user is ensured to smoothly access the required data, and the harmony and unity of security, convenience and quickness are realized. In addition, the security situation awareness function enables the user to master the security state in real time, the system adopts more accurate protection measures according to the security situation awareness function, the intelligent level of security management is improved, and the security of privacy information of the user in different scenes is comprehensively guarded.
The present embodiments are, therefore, to be considered in all respects as illustrative and not restrictive, the scope of the invention being indicated by the appended claims rather than by the foregoing description, and all changes which come within the meaning and range of equivalency of the claims are therefore intended to be embraced therein.
The foregoing is only a specific embodiment of the invention to enable those skilled in the art to understand or practice the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the generic principles defined herein may be applied to other embodiments without departing from the spirit or scope of the invention. Thus, the present invention is not intended to be limited to the embodiments shown herein but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.