Data security risk assessment method based on model construction

Abstract

The invention relates to the technical field of data security, and discloses a data security risk assessment method based on model construction, and the method comprises the steps: firstly collecting historical data security events and related system configuration, network architecture and other multi-dimensional data, and carrying out the preprocessing to form a standardized data set; and then, constructing a data security risk prediction model, and predicting future possible data security events and potential influences thereof in combination with multi-dimensional factors. And obtaining a risk prediction result by obtaining data such as a system state and network flow in real time and inputting the data into the prediction model. Meanwhile, a risk influence assessment framework is established, the severity, occurrence frequency and business influence of the risk are comprehensively considered, and a risk comprehensive score is calculated. And finally, sorting and classifying the risks according to the scores, and formulating and implementing corresponding risk relief measures and emergency response plans for high-risk and medium-risk data assets. According to the invention, the accuracy and timeliness of data security risk assessment are improved.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and in particular to a data security risk assessment method based on model construction. Background Art

[0002] In the information age, data has become a key factor driving the development of enterprises, and its importance is self-evident. However, with the explosive growth of data volume and the significant increase in data mobility, data security risks have also risen sharply, becoming an important factor restricting the stable operation and sustainable development of enterprises. Frequent security incidents such as data leakage, unauthorized access, and malicious attacks may not only cause huge economic losses, but also seriously damage the reputation of enterprises, and even trigger legal proceedings and trust crises, posing a serious threat to the survival and development of enterprises.

[0003] At present, data security management methods, such as firewalls and intrusion detection systems (IDS), mainly rely on static security policies and rules to resist external threats. Although these methods have played a role to a certain extent, their limitations and shortcomings are gradually revealed in the face of internal threats, new attack methods and increasingly complex and changing business environments. Specifically, when dealing with data security risks, the combined impact of multi-dimensional factors such as system configuration, network architecture, data classification and access control policies is usually not fully considered, resulting in incomplete and inaccurate risk assessment. At the same time, the lack of a scientific and systematic risk impact assessment framework makes it difficult for enterprises to quickly and effectively assess the severity and potential impact of data security incidents, making it impossible to take targeted risk mitigation measures and emergency response plans in a timely manner. Summary of the invention

[0004] The purpose of the present invention is to provide a data security risk assessment method based on model construction to solve the problems raised in the above background technology.

[0005] To achieve the above object, the present invention provides the following technical solution: a data security risk assessment method based on model construction, the method comprising: Step 1: Collect data on various data security incidents in the organization's historical operations, as well as the corresponding system configuration, network architecture, data classification and access control strategy; the data security incident data includes event type, occurrence time, impact scope and impact degree; the system configuration includes hardware specifications, software version, and security patch status; the network architecture includes network topology, protocol type, and firewall rules; the data classification includes data sensitivity, data format, and data storage location; the access control strategy includes user permissions, access records, and audit logs; Step 2: Preprocess the data collected in step 1 to form a normalized data set; Step 3: Based on the normalized data set, a data security risk prediction model is constructed. The model combines system configuration, network architecture, data classification, and access control strategy to predict the types of possible data security incidents in the future and their potential impacts. Step 4: Obtain the real-time status data, network traffic data, access logs and audit records of the current system; Step 5: Input the data obtained in step 4 into the data security risk prediction model, and receive the predicted risk type and potential impact output by the model; Step 6: Based on historical data security incident data, establish a risk impact assessment framework, which includes three dimensions: risk severity, frequency of occurrence, and business impact; Step 7: Combine the risk type and potential impact predicted in Step 5 with the risk impact assessment framework established in Step 6 to calculate a comprehensive score for each risk; Step 8: Sort and classify the risks based on the calculated comprehensive risk score, and divide the data assets into high-risk, medium-risk, and low-risk ones; Step 9: Define and implement risk mitigation measures and emergency response plans for high-risk and medium-risk data assets, including access restrictions, encryption measures, enhanced monitoring, and disaster recovery plans.

[0006] Preferably, in step 2, the data preprocessing method includes: For missing values, linear interpolation algorithm is used to fill them; For outliers, the threshold judgment method is used to regard data points that exceed the preset threshold range as outliers and replace them with the mean of their neighboring points; Using the Z-score standardization method, each feature value is subtracted from its mean and divided by its standard deviation, so that the processed data conforms to the standard normal distribution. The formula for standardization is: ,in, is the original data, is the mean of the original data, is the standard deviation of the original data, is the standardized data.

[0007] Preferably, a random forest algorithm is used to construct a data security risk prediction model.

[0008] Preferably, the steps of constructing a data security risk prediction model include: Step 3.1: Use a normalized dataset as input, which includes historical security events, system configuration information, network activity records, and data access patterns; The normalized dataset is divided into a training set and a validation set. The training set is used for model training, and the validation set is used for model tuning and performance evaluation. Step 3.2: Configure the random forest model parameters, including the number of decision trees, maximum depth, minimum sample split number, and minimum sample leaf node number; Step 3.3: Use the training set to train the random forest model, and improve the generalization ability and prediction accuracy of the model by integrating the prediction results of multiple decision trees; Step 3.4: Use the validation set to evaluate the performance of the model and optimize the prediction accuracy and recall of the model by adjusting the model parameters until the predetermined performance indicators are reached.

[0009] Preferably, during the model evaluation process, the F1 score is used as the evaluation indicator, and the precision and recall of the model are calculated at the same time. The F1 score is defined as the harmonic mean of the precision and the recall, and the calculation formula is: F1 = 2 * (Precision* Recall) / (Precision + Recall), where Precision is the precision and Recall is the recall.

[0010] Preferably, in step 6, the specific steps of establishing a risk impact assessment framework include: Step 6.1: Identify and categorize the types of data security risks; Step 6.2: For each risk type, set assessment criteria and levels based on severity, frequency and business impact; Step 6.3: Construct a risk impact matrix and multiply the three-dimensional scores of each risk type to obtain the comprehensive score range of the risk; Step 6.4: Regularly update the risk impact assessment framework.

[0011] Preferably, in step 7, the method for calculating the comprehensive risk score includes: Step 7.1: Use the analytic hierarchy process (AHP) to determine the weights of the three dimensions of severity, frequency of occurrence, and business impact; Step 7.2: Multiply the score of each risk type in each dimension by the corresponding weight to obtain the weighted score; Step 7.3: Add the weighted scores to get a comprehensive risk score.

[0012] Preferably, in step 8, the risk ranking and classification criteria include: Step 8.1: Set the threshold of the comprehensive score: high risk > 70 points, medium risk 30-70 points, low risk < 30 points; Step 8.2: Generate a risk priority list by sorting the risks from high to low based on the comprehensive scores and labeling the category to which each risk belongs.

[0013] Preferably, in step 9, the steps of defining and implementing risk mitigation measures and emergency response plans include: Step 9.1: For each risk type, analyze its root causes and triggering conditions and develop specific mitigation measures; Step 9.2: Prioritize mitigation measures for high and medium risks based on their combined risk scores and business impact. Step 9.3: Develop a detailed emergency response plan, including incident reporting procedures, emergency response steps, recovery measures, and follow-up audits; Step 9.4: Regularly test and exercise risk mitigation measures and emergency response plans.

[0014] Preferably, a data security risk assessment system based on model construction comprises: The data collection module is used to collect data on various data security events in the organization's historical operations, as well as the corresponding system configuration, network architecture, data classification and access control strategy; the data security event data includes event type, occurrence time, impact scope and impact degree; the system configuration includes hardware specifications, software version, and security patch status; the network architecture includes network topology, protocol type, and firewall rules; the data classification includes data sensitivity, data format, and data storage location; the access control strategy includes user permissions, access records, and audit logs; A data preprocessing module, connected to the data collection module, for preprocessing the collected data to form a normalized data set; A model building module, connected to the data preprocessing module, is used to build a data security risk prediction model based on a normalized data set, which can combine system configuration, network architecture, data classification and access control strategy to predict possible future data security event types and their potential impacts; Real-time data acquisition module, used to obtain the real-time status data, network traffic data, access logs and audit records of the current system; A risk prediction module, connected to the model building module and the real-time data acquisition module, for inputting the real-time acquired data into the data security risk prediction model, and receiving the predicted risk type and potential impact output by the model; The risk assessment framework establishment module is used to establish a risk impact assessment framework based on historical data security incident data. The framework includes three dimensions: risk severity, frequency of occurrence, and business impact; A risk score calculation module, connected to the risk prediction module and the risk assessment framework establishment module, is used to combine the predicted risk type and potential impact with the risk impact assessment framework to calculate a comprehensive score for each risk; A risk ranking and classification module, connected to the risk score calculation module, is used to rank and classify risks according to the calculated comprehensive risk scores, and divide data assets into high-risk, medium-risk and low-risk; A risk response module, connected to the risk ranking and classification module, is used to define and implement risk mitigation measures and emergency response plans for high-risk and medium-risk data assets, including access restrictions, encryption measures, enhanced monitoring and disaster recovery plans.

[0015] Compared with the prior art, the present invention has the following beneficial effects: This method takes into account multiple factors such as system configuration, network architecture, data classification and access control strategy to ensure the comprehensiveness of risk assessment. By collecting and analyzing historical data security event data and combining it with real-time system status data, potential security risks can be identified more accurately.

[0016] The data security risk prediction model built can predict the types of possible data security incidents and their potential impacts in the future based on historical data and real-time data. This prediction capability enables enterprises to perceive risks in advance, gaining a valuable time window for risk prevention and response.

[0017] The present invention establishes a risk impact assessment framework including three dimensions: risk severity, frequency of occurrence, and business impact, providing a scientific basis for the quantitative assessment of risks. By calculating the comprehensive score of each risk, enterprises can more clearly understand the relative importance and urgency of each risk point. The risk assessment model and risk impact assessment framework in the method can be dynamically adjusted and optimized according to actual conditions, ensuring that the accuracy and effectiveness of risk assessment always keep pace with the business development and security needs of the enterprise.

[0018] Efficient risk response mechanism: For high-risk and medium-risk data assets, the present invention provides specific risk mitigation measures and emergency response plans, such as access restrictions, encryption measures, enhanced monitoring, and disaster recovery plans, etc. The implementation of these measures can significantly reduce the probability and potential impact of data security incidents, and ensure the business continuity and data security of enterprises. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 A step diagram of the data security risk assessment method based on model building according to the present invention; Figure 2 This is a training flowchart for the data security risk prediction model; Figure 3 A step-by-step diagram for establishing a risk impact assessment framework; Figure 4 A diagram of the steps for defining and implementing risk mitigation measures and emergency response plans. DETAILED DESCRIPTION

[0020] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0021] See also Figure 1-4 The present invention provides a data security risk assessment method based on model construction, the method comprising: Step 1: Collect data on various data security incidents that occurred during the organization's historical operations. This data includes but is not limited to the type of incident, time of occurrence, scope of impact, and degree of impact. At the same time, it is also necessary to collect system configuration information related to these incidents, such as hardware specifications, software versions, and security patch status; network architecture information, including network topology, protocol types, and firewall rules; data classification information, covering data sensitivity, data format, and data storage location; and access control policies, such as user permissions, access records, and audit logs.

[0022] Step 2: Preprocess the data collected in step 1. This step includes data cleaning, data conversion, and data standardization to ensure the accuracy and consistency of the data, thereby forming a standardized data set. Data preprocessing methods include: For missing values, linear interpolation algorithm is used to fill them.

[0023] For outliers, the threshold judgment method is used to regard data points that exceed the preset threshold range as outliers and replace them with the mean of their neighboring points.

[0024] Using the Z-score standardization method, each feature value is subtracted from its mean and divided by its standard deviation, so that the processed data conforms to the standard normal distribution. The formula for standardization is: ,in, is the original data, is the mean of the original data, is the standard deviation of the original data, is the standardized data.

[0025] Step 3: Based on the normalized data set, a data security risk prediction model is constructed. This model comprehensively considers multi-dimensional factors such as system configuration, network architecture, data classification, and access control strategy, and uses machine learning or deep learning algorithms such as logistic regression, support vector machine, or neural network to predict the types of possible data security incidents in the future and their potential impact.

[0026] Step 4: Obtain the real-time status data, network traffic data, access logs, and audit records of the current system. These data will be used as real-time data input to the model to assess the data security risks of the current system.

[0027] Step 5: Input the data obtained in step 4 into the data security risk prediction model, and receive the predicted risk type and potential impact output by the model. These prediction results will provide an important basis for subsequent risk assessment.

[0028] Step 6: Establish a risk impact assessment framework based on historical data security incident data. This framework includes three dimensions: risk severity, frequency of occurrence, and business impact, and is used to comprehensively assess the impact of data security incidents on enterprise operations.

[0029] Step 7: Combine the risk types and potential impacts predicted in step 5 with the risk impact assessment framework established in step 6, and use a weighted average or other appropriate algorithm to calculate a comprehensive score for each risk. This score will reflect the overall severity and potential threat of the risk.

[0030] Step 8: Sort and classify risks based on the calculated comprehensive risk score. Data assets are divided into three categories: high risk, medium risk, and low risk according to the score, so that enterprises can take different management measures for data assets of different risk levels.

[0031] Step 9: Define and implement risk mitigation measures and emergency response plans for high-risk and medium-risk data assets. These measures include but are not limited to access restrictions, encryption measures, enhanced monitoring, and disaster recovery plans to ensure that data security incidents can be responded to quickly and effectively to minimize losses and impacts.

[0032] The present invention will be further described below in conjunction with Examples 1 to 3:

[0033] Example 1: To build a data security risk prediction model, a random forest algorithm is used to process and predict data. The specific implementation steps are as follows: Step 3.1: Data preparation and division First, historical security event data, system configuration information, network activity records, and data access patterns are collected and integrated to form an original data set. Missing values ​​in the original data set are filled, and outliers are detected and processed to ensure data quality. Subsequently, the data is normalized, including but not limited to normalization of numerical data and unique hot encoding of categorical data, to eliminate the impact of different dimensions and types of data on model training.

[0034] The normalized data set is randomly divided into a training set and a validation set in a ratio of 8:2. The training set is used for model training to learn the underlying rules in the data; the validation set is used for subsequent model tuning and performance evaluation to ensure the reliability of the model in practical applications.

[0035] Step 3.2: Model parameter configuration In the process of building a random forest model, key parameters need to be reasonably configured. The specific parameter settings are as follows: The number of decision trees is set to 100 to ensure that the model has sufficient integration effect while avoiding excessive consumption of computing resources due to too many trees.

[0036] Maximum depth: The maximum depth of the decision tree is limited to 10 to prevent overfitting of the model and maintain the generalization ability of the model.

[0037] Minimum number of sample splits: set to 10, that is, when a node splits, at least 10 samples are required to continue splitting to ensure that the split node is sufficiently representative.

[0038] Minimum number of sample leaf nodes: set to 5, that is, the leaf node contains at least 5 samples, further controlling the complexity of the model and improving the stability of the model.

[0039] Step 3.3: Model training The model is trained using the configured random forest model and training set data. During the training process, each decision tree independently learns the training data and forms its own decision rules. By integrating the prediction results of multiple decision trees and using a voting mechanism to determine the final prediction category, the generalization ability and prediction accuracy of the model are improved.

[0040] During the training process, Out-Of-Bag Error is used as an internal evaluation indicator to monitor the training process of the model and ensure the stable improvement of model performance.

[0041] Step 3.4: Model performance evaluation and optimization The performance of the trained random forest model is evaluated using the validation set. Evaluation indicators include prediction accuracy, recall rate, F1 score, etc. to comprehensively measure the performance of the model.

[0042] According to the evaluation results, if the model performance does not meet the predetermined indicators, the model parameters need to be adjusted. For example, if the prediction accuracy is low, you can consider increasing the number of decision trees or adjusting the maximum depth; if the recall rate is low, you can try to reduce the minimum number of sample splits or the minimum number of sample leaf nodes to increase the model's ability to identify minority classes.

[0043] Through repeated iterative training and evaluation, the model parameters are continuously adjusted until the model's performance indicators such as prediction accuracy and recall rate meet the predetermined requirements, thus completing the construction of the data security risk prediction model.

[0044] In the evaluation process of the data security risk prediction model, the F1 score is used as the core evaluation indicator to comprehensively measure the performance of the model. The F1 score is the harmonic mean of precision and recall, and its calculation formula is: F1 = 2 * (Precision * Recall) / (Precision + Recall). To elaborate on the implementation of this evaluation indicator, the specific steps are as follows: According to the prediction results of the model on the validation set, the prediction results are compared with the actual labels, and the number of true positives (TP), false positives (FP), and false negatives (FN) is counted.

[0045] True Positives (TP): The number of samples that the model predicts to be positive and are actually positive.

[0046] False Positives (FP): The number of samples that the model predicts to be positive but are actually negative.

[0047] False Negatives (FN): The number of samples that the model predicts to be negative but are actually positive.

[0048] Based on the above statistics, calculate the precision and recall: Precision: The ratio of samples predicted by the model to samples that are actually positive, that is, Precision = TP / (TP + FP).

[0049] Recall: The proportion of samples that are actually positive that are predicted as positive by the model, that is, Recall = TP / (TP + FN).

[0050] Calculate using the F1 score formula: F1 = 2 * (Precision * Recall) / (Precision + Recall) The F1 score takes into account both precision and recall, and can more comprehensively reflect the performance of the model. When both precision and recall are high, the F1 score will also be high; conversely, if one of them is low, the F1 score will also be affected.

[0051] Taking a model evaluation as an example, suppose that on the validation set, the model predicts 50 true positives, 10 false positives, and 5 false negatives. Then: Precision = 50 / (50 + 10) = 0.8333 Recall = 50 / (50 + 5) = 0.9091 F1 score = 2 * (0.8333 * 0.9091) / (0.8333 + 0.9091) = 0.8704 Through the above calculation, the F1 score of the model is 0.8704, which is a high value, indicating that the model has achieved good performance in both precision and recall, and has a high performance level.

[0052] Example 2: In the process of data security risk management, building a risk impact assessment framework and calculating a comprehensive risk score are crucial steps. The specific implementation methods of these two steps will be described in detail below.

[0053] ① The implementation steps for establishing a risk impact assessment framework include: Step 6.1: Identify and categorize types of data security risks By analyzing historical security incidents, referring to industry standards and drawing on expert experience, we identify the main types of data security risks. These types may include but are not limited to data leakage, data tampering, data loss, unauthorized access, etc. Subsequently, we classify these risk types scientifically and reasonably to ensure that each risk type can be accurately identified and classified.

[0054] Step 6.2: Set evaluation criteria and grades For each identified risk type, specific assessment criteria and levels are set based on the three dimensions of severity, frequency of occurrence, and business impact. For example, the severity dimension can be divided into five levels: very low, low, medium, high, and very high, corresponding to different score ranges; the frequency dimension can be set to levels such as rare, occasional, sometimes, regular, and frequent based on historical data or expert predictions; the business impact dimension considers the impact of risks on business processes, customer satisfaction, financial losses, etc., and is also divided into different levels.

[0055] Step 6.3: Construct the risk impact matrix Based on the assessment criteria and levels set in step 6.2, construct a risk impact matrix. The horizontal axis of the matrix represents the risk type, and the vertical axis represents the three assessment dimensions (severity, frequency of occurrence, and business impact). For each risk type, give a score on each of the three corresponding dimensions, and multiply the three scores together to get the comprehensive score range for the risk type. This range can be used to intuitively represent the size and severity of the risk.

[0056] Step 6.4: Regularly update the risk impact assessment framework Since data security risks are dynamic, the risk impact assessment framework also needs to be updated regularly. This includes adjusting the classification of risk types, assessment standards and levels, and the construction of the risk impact matrix according to new security threats, technological developments, and business needs. Regular updates ensure that the assessment framework can accurately reflect the current data security risk situation.

[0057] ② The steps to calculate the comprehensive risk score include: Step 7.1: Determine dimension weights The analytic hierarchy process (AHP) is used to determine the weights of the three dimensions of severity, frequency of occurrence, and business impact. First, a hierarchical model is constructed, with the target layer set as the comprehensive risk score and the criterion layer set as the three evaluation dimensions. Then, through expert surveys or questionnaires, judgment information about the relative importance of each dimension is collected to construct a judgment matrix. Finally, the judgment matrix is ​​solved using the eigenvector method or square root method to obtain the weights of each dimension.

[0058] Step 7.2: Calculate weighted scores For each risk type, scores are given on the three corresponding dimensions, and these scores are multiplied by the weights obtained in step 7.1 to obtain a weighted score. The weighted score reflects the relative importance and contribution of each dimension in the comprehensive risk assessment.

[0059] Step 7.3: Obtain a comprehensive risk score The weighted scores of each risk type are added together to obtain the comprehensive score of the risk type. The higher the comprehensive score, the greater the impact of the risk type on data security, and more stringent prevention and control measures are needed to reduce the risk.

[0060] Taking data leakage risk as an example, assume that the weights of severity, frequency and business impact obtained by the hierarchical analysis method are 0.5, 0.3 and 0.2 respectively. For data leakage risk, the severity dimension score is 4 (high), the frequency dimension score is 3 (sometimes), and the business impact dimension score is 5 (extremely high). Then the weighted scores of data leakage risk are 40.5=2, 30.3=0.9 and 5*0.2=1 respectively. Adding these weighted scores, the comprehensive score of data leakage risk is 2+0.9+1=3.9. According to the preset risk level classification standard, it can be judged that the data leakage risk belongs to a higher risk level, and corresponding prevention and control measures need to be taken to reduce the risk.

[0061] Example 3: In the process of data security risk management, risk ranking and classification as well as the formulation and implementation of risk mitigation measures and emergency response plans are the core links. The following will elaborate on the specific implementation methods of these two steps and illustrate them with specific examples.

[0062] ① The implementation steps of risk ranking and classification include: Step 8.1: Set the threshold for the composite score In order to scientifically and reasonably sort and classify the identified data security risks, we first set the threshold of the comprehensive score. Specifically, the comprehensive score of high risk is greater than 70 points, indicating that the risk poses a serious threat to data security and requires immediate attention and processing; the comprehensive score of medium risk is between 30 and 70 points, indicating that the risk has a certain potential threat and needs to be monitored regularly and measures taken in a timely manner; the comprehensive score of low risk is less than 30 points, indicating that the risk has a small impact on data security and can be temporarily ignored or subject to regular monitoring.

[0063] Step 8.2: Generate a risk priority list According to the comprehensive score of each risk, the risks are sorted from high to low to generate a risk priority list. In the list, each risk is marked with its risk category (high risk, medium risk or low risk), so that managers can intuitively understand the severity and priority of each risk and formulate risk handling strategies in a targeted manner.

[0064] For example, in a data security risk assessment, risks such as data leakage, data tampering, and data loss were identified. After comprehensive scoring calculation, the comprehensive score of data leakage risk was 85 points, which is a high risk; the comprehensive score of data tampering risk was 60 points, which is a medium risk; and the comprehensive score of data loss risk was 25 points, which is a low risk. Based on these scores, a risk priority list is generated and the category of each risk is marked.

[0065] ② The steps to define and implement risk mitigation measures and emergency response plans include: Step 9.1: Develop specific mitigation measures For each risk type, we conduct an in-depth analysis of its root causes and triggering conditions, and formulate specific mitigation measures. For example, for data leakage risk, we can take measures such as strengthening data encryption, limiting data access rights, and conducting regular security audits to reduce the risk; for data tampering risk, we can establish a data integrity verification mechanism, implement access control policies, and other measures to prevent it.

[0066] Step 9.2: Prioritize high- and medium-risk mitigation measures Based on the comprehensive risk score and business impact, high-risk and medium-risk mitigation measures are implemented first. For high-risk, immediate action is needed to reduce the risk as soon as possible; for medium-risk, a detailed implementation plan needs to be developed and a dedicated person is assigned to follow up. At the same time, for low-risk, regular monitoring can be carried out and measures can be taken in a timely manner according to the actual situation.

[0067] Step 9.3: Develop a detailed emergency response plan In order to deal with possible data security incidents, a detailed emergency response plan should be developed. The plan includes the incident reporting process, emergency response steps, recovery measures and follow-up audits. For example, when a data breach occurs, the emergency response plan should be activated immediately, and the incident should be reported to the relevant departments according to the predetermined process. At the same time, emergency response steps such as isolating the infected system and recovering data should be taken. After the incident is handled, a follow-up audit is required to summarize the experience and lessons learned and improve the risk management strategy.

[0068] Step 9.4: Testing and rehearsal In order to ensure the effectiveness of risk mitigation measures and emergency response plans, regular testing and drills are required. By simulating the occurrence and handling of data security incidents, the feasibility and effectiveness of mitigation measures and emergency response plans can be tested. At the same time, mitigation measures and emergency response plans can also be revised and improved based on the results of testing and drills.

[0069] For example, data security emergency drills can be organized regularly to simulate different types of data security incidents and handle them according to the predetermined emergency response plan. Through drills, the emergency response capabilities and collaboration efficiency of relevant personnel can be tested, and existing problems can be discovered and resolved in a timely manner.

[0070] The present invention also includes a data security risk assessment system based on model construction, the system comprising: The data collection module is used to collect data on various data security events in the organization's historical operations, as well as the corresponding system configuration, network architecture, data classification and access control strategy; the data security event data includes event type, occurrence time, impact scope and impact degree; the system configuration includes hardware specifications, software version, and security patch status; the network architecture includes network topology, protocol type, and firewall rules; the data classification includes data sensitivity, data format, and data storage location; the access control strategy includes user permissions, access records, and audit logs; A data preprocessing module, connected to the data collection module, for preprocessing the collected data to form a normalized data set; A model building module, connected to the data preprocessing module, is used to build a data security risk prediction model based on a normalized data set, which can combine system configuration, network architecture, data classification and access control strategy to predict possible future data security event types and their potential impacts; Real-time data acquisition module, used to obtain the real-time status data, network traffic data, access logs and audit records of the current system; A risk prediction module, connected to the model building module and the real-time data acquisition module, for inputting the real-time acquired data into the data security risk prediction model, and receiving the predicted risk type and potential impact output by the model; The risk assessment framework establishment module is used to establish a risk impact assessment framework based on historical data security incident data. The framework includes three dimensions: risk severity, frequency of occurrence, and business impact; A risk score calculation module, connected to the risk prediction module and the risk assessment framework establishment module, is used to combine the predicted risk type and potential impact with the risk impact assessment framework to calculate a comprehensive score for each risk; A risk ranking and classification module, connected to the risk score calculation module, is used to rank and classify risks according to the calculated comprehensive risk scores, and divide data assets into high-risk, medium-risk and low-risk; A risk response module, connected to the risk ranking and classification module, is used to define and implement risk mitigation measures and emergency response plans for high-risk and medium-risk data assets, including access restrictions, encryption measures, enhanced monitoring and disaster recovery plans.

[0071] The implementation of the system refers to the above-mentioned embodiment and will not be described in detail in the specification.

[0072] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

[0073] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A data security risk assessment method based on model construction, characterized in that: The method comprises: Step 1: Collect data on various data security incidents in the organization's historical operations, as well as the corresponding system configuration, network architecture, data classification and access control strategy; the data security incident data includes event type, occurrence time, impact scope and impact degree; the system configuration includes hardware specifications, software version, and security patch status; the network architecture includes network topology, protocol type, and firewall rules; the data classification includes data sensitivity, data format, and data storage location; the access control strategy includes user permissions, access records, and audit logs; Step 2: Preprocess the data collected in step 1 to form a normalized data set; Step 3: Based on the normalized data set, a data security risk prediction model is constructed. The model combines system configuration, network architecture, data classification, and access control strategy to predict the types of possible data security incidents in the future and their potential impacts. Step 4: Obtain the real-time status data, network traffic data, access logs and audit records of the current system; Step 5: Input the data obtained in step 4 into the data security risk prediction model, and receive the predicted risk type and potential impact output by the model; Step 6: Based on historical data security incident data, establish a risk impact assessment framework, which includes three dimensions: risk severity, frequency of occurrence, and business impact; Step 7: Combine the risk type and potential impact predicted in Step 5 with the risk impact assessment framework established in Step 6 to calculate a comprehensive score for each risk; Step 8: Sort and classify the risks based on the calculated comprehensive risk score, and divide the data assets into high-risk, medium-risk, and low-risk ones; Step 9: Define and implement risk mitigation measures and emergency response plans for high-risk and medium-risk data assets, including access restrictions, encryption measures, enhanced monitoring, and disaster recovery plans.

2. The data security risk assessment method based on model building according to claim 1 is characterized in that: In step 2, the data preprocessing method includes: For missing values, linear interpolation algorithm is used to fill them; For outliers, the threshold judgment method is used to regard data points that exceed the preset threshold range as outliers and replace them with the mean of their neighboring points; Using the Z-score standardization method, each feature value is subtracted from its mean and divided by its standard deviation, so that the processed data conforms to the standard normal distribution. The formula for standardization is: ,in, is the original data, is the mean of the original data, is the standard deviation of the original data, is the standardized data.

3. The data security risk assessment method based on model building according to claim 2 is characterized in that: The random forest algorithm is used to build a data security risk prediction model.

4. The data security risk assessment method based on model building according to claim 3 is characterized in that: The steps to build a data security risk prediction model include: Step 3.1: Use a normalized dataset as input, which includes historical security events, system configuration information, network activity records, and data access patterns; The normalized dataset is divided into a training set and a validation set. The training set is used for model training, and the validation set is used for model tuning and performance evaluation. Step 3.2: Configure the random forest model parameters, including the number of decision trees, maximum depth, minimum sample split number, and minimum sample leaf node number; Step 3.3: Use the training set to train the random forest model, and improve the generalization ability and prediction accuracy of the model by integrating the prediction results of multiple decision trees; Step 3.4: Use the validation set to evaluate the performance of the model and optimize the prediction accuracy and recall of the model by adjusting the model parameters until the predetermined performance indicators are reached.

5. The data security risk assessment method based on model building according to claim 4 is characterized in that: During the model evaluation process, the F1 score is used as the evaluation indicator, and the precision and recall of the model are calculated at the same time. The F1 score is defined as the harmonic mean of the precision and recall. The calculation formula is: F1 = 2 * (Precision * Recall) / (Precision + Recall), where Precision is the precision and Recall is the recall.

6. The data security risk assessment method based on model building according to claim 1 is characterized in that: In step 6, the specific steps of establishing a risk impact assessment framework include: Step 6.1: Identify and categorize the types of data security risks; Step 6.2: For each risk type, set assessment criteria and levels based on severity, frequency and business impact; Step 6.3: Construct a risk impact matrix and multiply the three-dimensional scores of each risk type to obtain the comprehensive score range of the risk; Step 6.4: Regularly update the risk impact assessment framework.

7. The data security risk assessment method based on model building according to claim 1 is characterized in that: In step 7, the method for calculating the comprehensive risk score includes: Step 7.1: Use the analytic hierarchy process (AHP) to determine the weights of the three dimensions of severity, frequency of occurrence, and business impact; Step 7.2: Multiply the score of each risk type in each dimension by the corresponding weight to obtain the weighted score; Step 7.3: Add the weighted scores to get a comprehensive risk score.

8. The data security risk assessment method based on model building according to claim 1 is characterized in that: In step 8, the criteria for risk ranking and classification include: Step 8.1: Set the threshold of the comprehensive score: high risk > 70 points, medium risk 30-70 points, low risk < 30 points; Step 8.2: Generate a risk priority list by sorting the risks from high to low based on the comprehensive scores and labeling the category to which each risk belongs.

9. The data security risk assessment method based on model building according to claim 1 is characterized in that: In step 9, the steps to define and implement risk mitigation measures and emergency response plans include: Step 9.1: For each risk type, analyze its root causes and triggering conditions and develop specific mitigation measures; Step 9.2: Prioritize mitigation measures for high and medium risks based on their combined risk scores and business impact. Step 9.3: Develop a detailed emergency response plan, including incident reporting procedures, emergency response steps, recovery measures, and follow-up audits; Step 9.4: Regularly test and exercise risk mitigation measures and emergency response plans.

10. A data security risk assessment system based on model construction, characterized in that: The system comprises: The data collection module is used to collect data on various data security events in the organization's historical operations, as well as the corresponding system configuration, network architecture, data classification and access control strategy; the data security event data includes event type, occurrence time, impact scope and impact degree; the system configuration includes hardware specifications, software version, and security patch status; the network architecture includes network topology, protocol type, and firewall rules; the data classification includes data sensitivity, data format, and data storage location; the access control strategy includes user permissions, access records, and audit logs; A data preprocessing module, connected to the data collection module, for preprocessing the collected data to form a normalized data set; A model building module, connected to the data preprocessing module, is used to build a data security risk prediction model based on a normalized data set, which can combine system configuration, network architecture, data classification and access control strategy to predict possible future data security event types and their potential impacts; Real-time data acquisition module, used to obtain the real-time status data, network traffic data, access logs and audit records of the current system; A risk prediction module, connected to the model building module and the real-time data acquisition module, for inputting the real-time acquired data into the data security risk prediction model, and receiving the predicted risk type and potential impact output by the model; The risk assessment framework establishment module is used to establish a risk impact assessment framework based on historical data security incident data. The framework includes three dimensions: risk severity, frequency of occurrence, and business impact; A risk score calculation module, connected to the risk prediction module and the risk assessment framework establishment module, is used to combine the predicted risk type and potential impact with the risk impact assessment framework to calculate a comprehensive score for each risk; A risk ranking and classification module, connected to the risk score calculation module, is used to rank and classify risks according to the calculated comprehensive risk scores, and divide data assets into high-risk, medium-risk and low-risk; A risk response module, connected to the risk ranking and classification module, is used to define and implement risk mitigation measures and emergency response plans for high-risk and medium-risk data assets, including access restrictions, encryption measures, enhanced monitoring and disaster recovery plans.

Images