Data security protection supervision system

Abstract

The invention relates to the technical field of data supervision, in particular to a data security protection supervision system, which comprises an access monitoring module, a behavior abnormity monitoring module, a security configuration module and a data risk management module, and is characterized in that based on user access behavior data, access frequency and security level information are collected, and user behavior characteristics are automatically extracted; an access control snapshot is obtained. According to the method, through dynamic permission configuration and real-time abnormal activity monitoring, data access safety is remarkably improved, user behavior characteristics are automatically extracted, behavior deviation is analyzed, quick response to potential risks is ensured, and through the continuously-updated safety strategy and risk assessment, the safety of data access is greatly improved. The security measures are allowed to timely adapt to the constantly changing threat environment, and through detailed risk management, the processing speed and accuracy are improved, so that the data supervision is more efficient, the possibility of data leakage and abuse is reduced, and the flexibility and reliability of the system in the aspect of protecting data privacy and integrity are ensured.

Description

Technical Field

[0001] The present invention relates to the technical field of data supervision, and in particular to a data security protection supervision system. Background Art

[0002] Data governance technology focuses on managing and supervising the use, storage, and transmission of data to ensure information security, privacy protection, and data compliance. It covers everything from basic data encryption and secure storage technology to complex data access control, auditing, and strategies for complying with various domestic and international privacy protection regulations. The purpose is to protect sensitive information of individuals and enterprises from unauthorized access and abuse, while also ensuring the integrity and availability of data.

[0003] Among them, the data security protection and supervision system is to achieve security protection and compliance supervision of data during storage and transmission. Its uses include preventing data leakage, ensuring the legality of data when accessing and processing, and monitoring and reporting data usage status, etc., in order to comply with regulatory requirements and industry standards. It usually includes multiple layers of security measures, such as identity authentication, permission management, data encryption and audit logs, in order to effectively manage its data assets, prevent security threats, and improve the transparency and reliability of data supervision.

[0004] Existing systems often use static security measures, such as simple data encryption and access control, which are ineffective when faced with complex or unforeseen security issues. The lack of dynamic and adaptive security management functions makes it impossible for the system to effectively respond to emerging threats, resulting in an increase in unauthorized access incidents. The monitoring and analysis of abnormal behavior is not sufficient to immediately detect or prevent the development of security incidents, resulting in an increase in the severity of the consequences of security incidents. The lack of effective risk assessment and real-time monitoring mechanisms has limited the adaptability and prevention capabilities of data security management. Summary of the invention

[0005] The purpose of the present invention is to solve the shortcomings in the prior art and to propose a data security protection supervision system.

[0006] In order to achieve the above-mentioned purpose, the present invention adopts the following technical solution: a data security protection and supervision system, the system comprising: The access monitoring module collects access frequency and security level information based on user access behavior data, automatically extracts user behavior characteristics, dynamically adjusts permission configuration according to abnormal activities monitored in real time, and continuously updates access control rules to obtain access control snapshots; The behavior anomaly monitoring module monitors user activities in real time based on the access control snapshot, extracts abnormal behavior features, analyzes the difference between abnormal behavior and normal access patterns, determines the degree of behavior deviation, and obtains behavior deviation analysis results; The security configuration module evaluates potential security risks based on the behavior deviation analysis results, adjusts security thresholds, updates response processes, and reconfigures security parameters according to user behavior and security settings to obtain security parameter update information; The data risk management module updates information based on the security parameters, analyzes security logs and real-time data, evaluates data security status, formulates risk mitigation strategies, and obtains an overview of data risk assessment.

[0007] The present invention is improved in that the automatic extraction step of the user behavior characteristics is specifically as follows: Based on user access behavior data, the time, frequency and security level of each access are collected to generate user activity records; Based on the user activity records, support vector machine is applied, using access frequency and security level as input features, using the formula:

[0008] Calculate the feature score for each user behavior , and obtain the behavior classification results, where and is the weight obtained through data training, Representative The access frequency of each user, Representative security level of each user; According to the behavior classification results, the features of normal and abnormal behaviors are automatically extracted and summarized into a user behavior feature set.

[0009] The present invention is improved in that the steps of obtaining the access control snapshot are specifically as follows: Based on the automatically extracted user behavior features, analyzing the statistical data of access patterns, including access time and abnormal behavior frequency, to obtain a behavior analysis record; Based on the behavior analysis record, the permission configuration is dynamically adjusted, the access control rule base is updated, the current behavior pattern is matched, and an access control snapshot is obtained.

[0010] The present invention is improved in that the step of extracting the abnormal behavior features is specifically as follows: Based on the access control snapshot, monitor and mark user activities that differ from normal behavior patterns to obtain a potential abnormal behavior candidate list; The potential abnormal behavior candidate list is classified using the formula:

[0011] Calculate the cohesion of each group, determine the abnormal behavior group, and obtain the classified abnormal feature set, where: is the total number of features, It is The cohesion index of abnormal behavior, It is The abnormal behavior is The performance of the characteristics, The corresponding abnormal behavior group The average value of the features; Based on the classified abnormal feature set, statistically critical abnormal patterns are extracted to obtain abnormal behavior features.

[0012] The present invention is improved in that the steps of obtaining the behavior deviation analysis results are specifically as follows: Select behavior data from the extracted abnormal behavior features, and calculate the difference between each behavior and normal behavior using the formula:

[0013] Get the behavior deviation value ,in, Indicates The behavior in The performance of the characteristics, It is The average performance of the features, is the total number of features; The behavior deviation value is analyzed and compared with the behavior deviation threshold to determine the degree of behavior deviation and obtain a behavior deviation analysis result.

[0014] The present invention is improved in that the steps of the update response process are specifically as follows: Based on the behavioral deviation analysis results, determine the severity and frequency pattern of behavioral deviations, identify potential high-risk behaviors, and obtain risk behavior analysis records; Based on the risk behavior analysis records, the security risk of each behavior is evaluated using the formula:

[0015] The security risk assessment results are obtained, among which, Representative The risk value of a behavior, It is The behavior in The frequency of occurrence in the scenario, is the potential severity score of the corresponding behavior, is the number of scenarios evaluated, It's a scene The weight coefficient of Based on the security risk assessment results, the security thresholds are adjusted according to the different risk levels, and the response process is updated.

[0016] The present invention is improved in that the step of obtaining the security parameter update information is specifically as follows: Analyze the current user behavior and security settings, identify the security parameters that need to be adjusted, and obtain a preliminary adjustment list; Based on the preliminary adjustment list, reconfigure the security parameters using the formula:

[0017] Get security parameter update information, where: is the adjusted parameter value, is the original parameter value, is the optimal parameter change based on risk assessment, It is the sensitivity coefficient adjusted according to safety requirements and is used to control the amplitude of parameter adjustment.

[0018] The present invention is improved in that the steps of obtaining the data risk assessment overview are specifically as follows: Based on the security parameter update information, existing security logs and real-time data are collected and sorted to obtain preliminary data review information; Based on the preliminary data review information, evaluate the data security status using the formula:

[0019] The risk analysis results are obtained, among which, is the risk level, It is The weight of the risk factors, It is The severity score of each risk factor, is the number of risk factors; Based on the risk analysis results, key data are integrated, corresponding risk mitigation strategies are formulated, and an overview of data risk assessment is obtained.

[0020] Compared with the prior art, the advantages and positive effects of the present invention are: In the present invention, through dynamic permission configuration and real-time abnormal activity monitoring, a significant improvement in data access security is achieved, user behavior characteristics are automatically extracted and behavioral deviations are analyzed, ensuring a rapid response to potential risks. This continuously updated security strategy and risk assessment allows security measures to adapt to the ever-changing threat environment in a timely manner. Through refined risk management, processing speed and accuracy are improved, data supervision is made more efficient, the possibility of data leakage and abuse is reduced, and the flexibility and reliability of the system in protecting data privacy and integrity are ensured. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 is a system flow chart of the present invention; Figure 2 This is a flowchart for automatically extracting user behavior features in the present invention; Figure 3 A flowchart of obtaining an access control snapshot in the present invention; Figure 4 is a flow chart for extracting abnormal behavior features in the present invention; Figure 5 A flowchart for obtaining the behavior deviation analysis results in the present invention; Figure 6 A flowchart of an update response process in the present invention; Figure 7 A flowchart for obtaining security parameter update information in the present invention; Figure 8 The flowchart for obtaining the overview of data risk assessment in the present invention is shown in FIG. DETAILED DESCRIPTION

[0022] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0023] In the description of the present invention, it should be understood that the terms "length", "width", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside", etc., indicating positions or positional relationships, are based on the positions or positional relationships shown in the accompanying drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as limiting the present invention. In addition, in the description of the present invention, the meaning of "multiple" is two or more, unless otherwise clearly and specifically defined.

[0024] Example See also Figure 1 The present invention provides a technical solution: a data security protection and supervision system includes: The access monitoring module collects access frequency and security level information based on user access behavior data, automatically extracts user behavior characteristics, dynamically adjusts permission configuration according to abnormal activities monitored in real time, and continuously updates access control rules to obtain access control snapshots; The access control rules are as follows: Adjust access permissions based on risk level. If the system detects a sudden change in a user's behavior pattern, such as frequent attempts to access sensitive data at atypical times, the system will automatically increase the user's risk level and restrict their access to sensitive data until further verification is performed; Time and location-based access restrictions. Access control rules can include provisions to restrict access to sensitive data from specific geographic locations or during non-working hours. For example, if a user attempts to access the internal network late at night or from an overseas IP address, the system can automatically block such access or require additional authentication. The principle of least privilege dynamically adjusts the data access rights of users according to their job responsibilities and needs, ensuring that each user can only access the information necessary to complete their work. For example, a financial analyst can only access financial-related data sets but not human resources data. Segmented access control, classify and manage data, set different access permissions based on the sensitivity level of the data. Sensitive data (such as personal identity information, financial data, etc.) requires a higher level of verification, such as multi-factor authentication or encrypted access paths.

[0025] The behavior anomaly monitoring module monitors user activities in real time based on access control snapshots, extracts abnormal behavior features, analyzes the difference between abnormal behavior and normal access patterns, determines the degree of behavior deviation, and obtains behavior deviation analysis results; The security configuration module evaluates potential security risks based on the behavior deviation analysis results, adjusts security thresholds, updates response processes, and reconfigures security parameters based on user behavior and security settings to obtain security parameter update information; The data risk management module updates information based on security parameters, analyzes security logs and real-time data, evaluates data security status, including the effectiveness of data access control, abnormal behavior detection rate, risk mitigation efficiency, data integrity and availability, etc., formulates risk mitigation strategies, and obtains an overview of data risk assessment.

[0026] The specific risk mitigation strategies are: Data backup and recovery strategy: Implement regular data backup processes to prevent data loss or damage. If data is found to be damaged or lost due to an attack, it can be quickly restored to the most recent backup state. For example, daily incremental backups and weekly full backups of critical data are performed. Multi-factor authentication: For users accessing sensitive data or critical infrastructure, implement multi-factor authentication to add a layer of security. This may include a combination of passwords, biometric authentication (such as fingerprint or facial recognition), and tokens to ensure that only authorized users can access sensitive information. Intrusion detection and prevention, which monitors network and system activity and automatically identifies and responds to suspicious or malicious behavior through intrusion detection and intrusion prevention, for example, using signature-based detection to identify known malware or attack patterns; Access control lists strictly control user access rights based on roles and responsibilities, ensuring that users can only access data necessary to perform their job duties, helping to implement the principle of least privilege and reduce potential internal threats; The access control snapshot includes the permission level, activity timestamp, and control rule status. The behavioral deviation analysis results include the deviation type and frequency of occurrence. The security parameter update information includes threshold setting information, adjustment process, and execution time point. The data risk assessment overview includes risk level, security indicators, and effect evaluation results.

[0027] See also Figure 2 ,The steps for automatically extracting user behavior features are as follows: Based on user access behavior data, the time, frequency and security level of each access are collected to generate user activity records; Collection of real-time monitoring data based on user access behavior, including the time, frequency and security level of each visit, by automatically recording the activities of each user, using timestamps to record the access time, and frequency counters to accumulate the number of visits for each user. At the same time, the risk level of each visit is evaluated and a security level is assigned for subsequent data analysis and behavioral pattern recognition. The recorded data allows tracking of user behavior trends and identification of abnormal or risky behaviors. The system regularly updates data records to keep the information current and accurate, and generates user activity records.

[0028] Based on user activity records, support vector machine is applied, using access frequency and security level as input features, using the formula:

[0029] Calculate the feature score for each user behavior , and obtain the behavior classification results, where and It is the weight obtained through data training, which is used to adjust the influence of frequency and security level in user behavior scoring. Representative The access frequency of a user, that is, the number of times a user is active within a specific period of time. Representative The security level of a user, which is usually a numerical value based on the security or compliance of the user's activities; The following data was collected: there is a user whose access frequency 120 times, safety level is 80, and through historical data analysis, the weight is obtained is 0.5, weight is 0.3, substitute the value into the formula:

[0030] Based on the currently set weights and user behavior data, the user's behavioral characteristic score is 84, which is used for subsequent behavior classification to determine whether the monitoring strategy needs to be adjusted or intervention is required.

[0031] According to the behavior classification results, the features of normal and abnormal behaviors are automatically extracted and summarized into user behavior feature sets; First, the stored user activity records are processed. Based on the user's access frequency and security level, a behavioral model is applied to distinguish between normal and abnormal behaviors. The model is built based on common behavioral patterns in historical data. The automatic identification of abnormal behavior relies on anomaly detection algorithms, which compare real-time data with historical behavior patterns to identify behaviors that deviate from the norm. Normal and abnormal behaviors are marked and recorded in a user behavior feature set, which is then used for security alerts to trigger necessary security responses and ensure system security.

[0032] See also Figure 3 , the specific steps for obtaining access control snapshots are: Based on the automatically extracted user behavior features, the statistical data of access patterns are analyzed, including access time and abnormal behavior frequency, to obtain behavior analysis records; Based on user behavior characteristics, by collecting and analyzing user access patterns, including access time and frequency of abnormal behavior, real-time behavior analysis records can be dynamically generated. The records are achieved by continuously monitoring user activity patterns, including identifying regular access times and frequently occurring abnormal behaviors. Each user's data is analyzed individually to ensure accuracy. In this way, not only can the regular patterns of user behavior be analyzed, but also activities that deviate from the norm can be detected. The analysis records reflect the real-time dynamics of user behavior, providing a basis for further security measures, and also helping to analyze and prevent potential security risks.

[0033] Based on the behavior analysis records, dynamically adjust the permission configuration, update the access control rule base, match the current behavior pattern, and obtain the access control snapshot; Based on the generated behavior analysis records, the permission configuration can be dynamically adjusted. The process involves analyzing the user behavior analysis records and updating the access control rule base accordingly to match the current behavior pattern. During the update process, each rule is re-evaluated and adjusted based on the behavior analysis results to ensure that each rule can effectively reflect the user's latest behavior trends. In addition, it will automatically identify and implement necessary permission updates based on statistical data to respond to new or changing security threats. Through the adaptive update mechanism, access control always maintains the highest efficiency and security, and obtains access control snapshots.

[0034] See also Figure 4 ,The specific steps of extracting abnormal behavior features are: Based on the access control snapshot, monitor and mark user activities that differ from normal behavior patterns to obtain a list of potential abnormal behavior candidates; Based on access control snapshots, user activities are monitored in real time, behaviors that differ from standard behavior patterns are identified, and behaviors are marked as potential abnormal behavior candidates. During this process, complex event processing technology is used to continuously evaluate every detail of user behavior and compare it with historical behavior data in order to timely discover small deviations in behavior. Through real-time data processing and pattern recognition algorithms, any potential security threats or unusual behavior patterns can be responded to and recorded immediately to obtain a list of potential abnormal behavior candidates.

[0035] Classify the potential abnormal behavior candidate table using the formula:

[0036] Calculate the cohesion of each group, determine the abnormal behavior group, and obtain the classified abnormal feature set, where: is the total number of features, It is The cohesion index of abnormal behavior, It is The abnormal behavior is The performance of the characteristics, The corresponding abnormal behavior group The average value of the features; There is a feature group, where , a characteristic performance value of abnormal behavior , , , the corresponding group average , , , substitute the value into the formula to calculate:

[0037]

[0038] The results show that there is a significant deviation between the behavior and the average behavior of the group, thus confirming its abnormal state, and confirming its criteria as a significant abnormality through calculation, and obtaining a classified abnormal feature set.

[0039] Based on the classified abnormal feature set, the statistically critical abnormal patterns are extracted. The abnormal patterns are characterized by the smallest intra-class variation and the largest inter-class variation, and the abnormal behavior characteristics are obtained. Based on the classified abnormal feature set, the statistical data is further analyzed to identify the key abnormal patterns. The process involves in-depth statistical analysis of the classified data. By calculating the variation between classes and within classes, the behavior patterns with the smallest variation within classes and the largest variation between classes can be determined. The key abnormal patterns usually indicate potential security risks or operational deviations. In this way, the behavior patterns that have the greatest impact on system security can be accurately extracted, so that corresponding security measures can be taken to obtain abnormal behavior characteristics.

[0040] See also Figure 5 , the specific steps for obtaining the behavior deviation analysis results are: Select behavior data from the extracted abnormal behavior features and calculate the difference between each behavior and normal behavior using the formula:

[0041] Get the behavior deviation value ,in, Indicates The behavior in The performance of the characteristics, It is The average performance of the features, is the total number of features; There are three characteristics, corresponding to the behavioral data , , , the average performance of standard behavior is , , , the total number of features , calculation process:

[0042]

[0043]

[0044] The calculation process shows the calculation process of the behavior deviation value, revealing the specific numerical difference between the behavior and the normal pattern, thus providing a quantitative basis for judging whether the behavior is abnormal.

[0045] Analyze the behavior deviation value, compare it with the behavior deviation threshold, determine the degree of behavior deviation, and obtain the behavior deviation analysis result; During the analysis process, the behavior deviation value is used to measure the deviation between each behavior and the established behavior standard. Through data analysis technology, the behavior deviation value is compared with the preset threshold value to determine the degree of deviation of each behavior. If the current threshold value is 15, and If 8.66 is lower than 15, it is considered normal, while a deviation value greater than 15 is considered abnormal. The deviation value of each behavior is obtained through real-time data collection and processing to ensure the real-time and accuracy of the analysis. In addition, continuous monitoring is carried out to ensure that every abnormal behavior is captured in real time, which can not only identify key abnormal behaviors that require immediate response, but also provide early warning of potential risks, providing data support for security management.

[0046] See also Figure 6 , the steps of the update response process are as follows: Based on the results of behavioral deviation analysis, determine the severity and frequency pattern of behavioral deviations, identify potential high-risk behaviors, and obtain risk behavior analysis records; During the implementation process, it is necessary to compare the behavioral deviation data with the preset standard values ​​item by item, extract and classify the behaviors with significant deviations, calculate the frequency and duration of each behavior based on the classification results, and combine the historical data of the behavior to analyze whether it has repetitive or stage-specific characteristics. Behaviors with high deviations and high frequencies are marked as high-risk behaviors, and the marking results are organized into a record table, which includes behavior descriptions, deviation amplitudes, frequency data, and potential risk characteristics to obtain risk behavior analysis records.

[0047] Based on the risk behavior analysis records, the security risk of each behavior is evaluated using the formula:

[0048] The security risk assessment results are obtained, among which, Representative The risk value of a behavior, It is The behavior in The frequency of occurrence in the scenario, is the potential severity score of the corresponding behavior, is the number of scenarios evaluated, It's a scene The weight coefficient of There are three scenarios and corresponding behavioral data , , , the potential severity score of the standard behavior is , , , total number of scenes , the scene weights are , , , the calculation process is:

[0049]

[0050]

[0051] This result shows that the behavioral deviation value obtained Significant differences compared to normal patterns are shown, providing a basis for further analysis and decision-making.

[0052] Based on the security risk assessment results, adjust the security threshold according to the different risk levels and update the response process, including emergency intervention and post-event handling processes; During the implementation process, it is necessary to distinguish risk levels according to the risk values ​​in the risk assessment results, set a threshold range for each risk level, and arrange risk behaviors within the threshold range according to severity. An immediate response mechanism should be set for behaviors that exceed the highest risk level, including triggering emergency procedures and sending alarms. A progressive intervention plan should be set for behaviors that are lower than the highest risk level but exceed the safety tolerance range, including restricting and closely monitoring risk sources. At the same time, the existing response process should be updated according to the adjusted thresholds, and the adjusted thresholds and updated processes should be archived as operational guidance documents for subsequent security incident responses.

[0053] See also Figure 7 , the specific steps for obtaining security parameter update information are: Analyze current user behavior and security settings, identify security parameters that need to be adjusted, and obtain a preliminary adjustment list; Analyze current user behavior and security settings, and identify security parameters that need to be adjusted. First, classify and organize user behavior data, extract abnormal or high-frequency behaviors, and determine the specific security settings involved in each behavior by analyzing each behavior. Then, combine existing security policy documents and configuration information to compare the degree of adaptation between each setting and user behavior, calculate the adaptation difference value to quantify the adjustment requirements of each security setting, then use the preset threshold to filter the adaptation difference value, and add the filtered parameters that need to be adjusted to the adjustment requirements list. Finally, sort the parameters in the adjustment requirements list according to priority to generate a preliminary adjustment list.

[0054] Based on the preliminary adjustment list, reconfigure the security parameters using the formula:

[0055] Get security parameter update information, where: is the adjusted parameter value, is the original parameter value, is the optimal parameter change based on risk assessment, It is the sensitivity coefficient adjusted according to safety requirements and is used to control the amplitude of parameter adjustment; By dynamically adjusting the old parameter values ​​and considering the optimal parameter change amount for risk assessment, the safety parameter adjustment is made more accurate and purposeful. is 100, the recommended parameter change is 20, the sensitivity coefficient Set to 0.5 to adjust the parameter responsiveness, the calculation process is as follows:

[0056]

[0057]

[0058] The results show that the adjustment range of safety parameters can be controlled by adjusting the coefficient, ensuring that parameter updates can reflect the results of risk assessment without excessive adjustment causing system instability, and obtaining safety parameter update information.

[0059] See also Figure 8 , the steps to obtain the data risk assessment overview are as follows: Based on the security parameter update information, collect and organize existing security logs and real-time data, including access records, error reports, and system warnings, to obtain preliminary data review information; Access records for the past 30 days are extracted from the system storage log, and the data is sorted by time and compared with real-time monitoring data. Potential abnormal operations are marked by analyzing the source address, access rights and operation type of each record. After further eliminating redundant information, core data that can reflect user behavior and system status is retained. At the same time, error reports and warning information are classified by error code and trigger time, and the frequency of each type of error and related events are calculated. Through the above sorting and classification, preliminary data review information is generated.

[0060] Based on the preliminary data review information, evaluate the data security status using the formula:

[0061] The risk analysis results are obtained, among which, is the risk level, It is The weight of the risk factors, It is The severity score of each risk factor is the number of risk factors; There are three risk factors, with corresponding weights: The severity scores are , total number of risk factors , substitute into the formula to calculate:

[0062]

[0063]

[0064] The result shows that the risk level after comprehensive consideration of various factors is 1.23, which reflects the current safety status and guides subsequent risk management strategies.

[0065] Based on the risk analysis results, key data is integrated and corresponding risk mitigation strategies are formulated, including data backup and recovery strategies, multi-factor authentication, intrusion detection and prevention, and access control lists, etc., to obtain an overview of data risk assessment; Filter out high-risk projects from the risk analysis results, extract specific data features related to potential threats in each high-risk project, including sources, impact scope and trigger conditions, match data features with existing security policies, identify policy content that needs to be supplemented or optimized, formulate plans based on data backup and recovery strategies, determine the specific implementation steps of multi-factor authentication, design dynamic intrusion detection rules, and optimize the allocation strategy of key permissions in the access control list. Through the above process, a complete risk mitigation strategy framework is formed, and an overview of data risk assessment is obtained.

[0066] The above are only preferred embodiments of the present invention and are not intended to limit the present invention in other forms. Any technician familiar with the profession may use the technical contents disclosed above to change or modify them into equivalent embodiments with equivalent changes and apply them to other fields. However, any simple modification, equivalent change and modification made to the above embodiments based on the technical essence of the present invention without departing from the technical solution of the present invention still falls within the protection scope of the technical solution of the present invention.

Claims

1. A data security protection and supervision system, characterized in that: The system comprises: The access monitoring module collects access frequency and security level information based on user access behavior data, automatically extracts user behavior characteristics, dynamically adjusts permission configuration according to abnormal activities monitored in real time, and continuously updates access control rules to obtain access control snapshots; The behavior anomaly monitoring module monitors user activities in real time based on the access control snapshot, extracts abnormal behavior features, analyzes the difference between abnormal behavior and normal access patterns, determines the degree of behavior deviation, and obtains behavior deviation analysis results; A security configuration module, based on the behavior deviation analysis results, evaluates potential security risks, adjusts security thresholds, updates response processes, and reconfigures security parameters according to user behavior and security settings to obtain security parameter update information; The data risk management module updates the security parameters, analyzes security logs and real-time data, evaluates data security status, formulates risk mitigation strategies, and obtains an overview of data risk assessment.

2. The data security protection and supervision system according to claim 1, characterized in that: The automatic extraction steps of the user behavior features are specifically as follows: Based on user access behavior data, the time, frequency and security level of each access are collected to generate user activity records; Based on the user activity records, support vector machine is applied, using access frequency and security level as input features, using the formula: Calculate the feature score for each user behavior , and obtain the behavior classification results, where and is the weight obtained through data training, Representative The access frequency of each user, Representative security level of each user; According to the behavior classification results, the features of normal and abnormal behaviors are automatically extracted and summarized into a user behavior feature set.

3. The data security protection and supervision system according to claim 1, characterized in that: The steps for obtaining the access control snapshot are specifically as follows: Based on the automatically extracted user behavior features, analyzing the statistical data of access patterns, including access time and abnormal behavior frequency, to obtain a behavior analysis record; Based on the behavior analysis record, the permission configuration is dynamically adjusted, the access control rule base is updated, the current behavior pattern is matched, and an access control snapshot is obtained.

4. The data security protection and supervision system according to claim 1, characterized in that: The steps of extracting the abnormal behavior features are specifically as follows: Based on the access control snapshot, monitor and mark user activities that differ from normal behavior patterns to obtain a potential abnormal behavior candidate list; The potential abnormal behavior candidate list is classified using the formula: Calculate the cohesion of each group, determine the abnormal behavior group, and obtain the classified abnormal feature set, where: is the total number of features, It is The cohesion index of abnormal behavior, It is The abnormal behavior is The performance of the characteristics, The corresponding abnormal behavior group The average value of the features; Based on the classified abnormal feature set, statistically critical abnormal patterns are extracted to obtain abnormal behavior features.

5. The data security protection and supervision system according to claim 1, characterized in that: The steps for obtaining the behavior deviation analysis results are specifically as follows: Select behavior data from the extracted abnormal behavior features, and calculate the difference between each behavior and normal behavior using the formula: Get the behavior deviation value ,in, Indicates The behavior in The performance of the characteristics, It is The average performance of the features, is the total number of features; The behavior deviation value is analyzed and compared with the behavior deviation threshold to determine the degree of behavior deviation and obtain a behavior deviation analysis result.

6. The data security protection and supervision system according to claim 1, characterized in that: The steps of the update response process are specifically as follows: Based on the behavioral deviation analysis results, determine the severity and frequency pattern of behavioral deviations, identify potential high-risk behaviors, and obtain risk behavior analysis records; Based on the risk behavior analysis records, the security risk of each behavior is evaluated using the formula: The security risk assessment results are obtained, among which, Representative The risk value of a behavior, It is The behavior in The frequency of occurrence in the scenario, is the potential severity score of the corresponding behavior, is the number of scenarios evaluated, It's a scene The weight coefficient of Based on the security risk assessment results, the security thresholds are adjusted according to the different risk levels, and the response process is updated.

7. The data security protection and supervision system according to claim 1, characterized in that: The steps for obtaining the security parameter update information are specifically as follows: Analyze the current user behavior and security settings, identify security parameters that need to be adjusted, and obtain a preliminary adjustment list; Based on the preliminary adjustment list, reconfigure the security parameters using the formula: Get security parameter update information, where: is the adjusted parameter value, is the original parameter value, is the optimal parameter change based on risk assessment, It is the sensitivity coefficient adjusted according to safety requirements and is used to control the amplitude of parameter adjustment.

8. The data security protection and supervision system according to claim 1, characterized in that: The steps for obtaining the data risk assessment overview are as follows: Based on the security parameter update information, existing security logs and real-time data are collected and sorted to obtain preliminary data review information; Based on the preliminary data review information, evaluate the data security status using the formula: The risk analysis results are obtained, among which, is the risk level, It is The weight of the risk factors, It is The severity score of each risk factor, is the number of risk factors; Based on the risk analysis results, key data are integrated, corresponding risk mitigation strategies are formulated, and an overview of data risk assessment is obtained.

Images