Information security risk management method and management system

Abstract

The invention provides an information security risk management method and management system. The system is composed of four core modules: a multi-modal data acquisition layer: probes deployed at a terminal and a server support heterogeneous data acquisition of network traffic, operation logs and an API (Application Program Interface) call chain; according to the block chain log storage layer, a private chain is constructed based on an improved BFT consensus algorithm, and each block comprises a timestamp hash value and a preorder block fingerprint; the dynamic risk assessment engine adopts an LSTM-Transform hybrid neural network, and input dimensions comprise a user behavior baseline, a vulnerability library version and threat intelligence feed; and the intelligent response decision module is used for integrating a reinforcement learning algorithm, automatically generating a disposal strategy and triggering the SDN controller to execute network isolation. According to the method, a local chain-alliance chain-audit chain three-level structure is applied to data island treatment and data integration in organization, the problem of internal data fragmentation is solved through the local chain structure, unified storage and rapid source tracing of heterogeneous logs are achieved, and data authenticity and time sequence integrity are ensured.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to an information security risk management method and management system. Background Art

[0002] Traditional information security management systems face significant bottlenecks in responding to modern complex threats.

[0003] First, the problem of data silos is widespread: data across departments and organizations is difficult to communicate due to heterogeneous formats and dispersed jurisdiction. Fragmented log storage leads to inefficient threat tracing, making attack incidents difficult to analyze globally.

[0004] Secondly, risk assessment is static: it relies on a predefined rule base and a regularly updated vulnerability library, making it unable to identify new attacks (such as zero-day vulnerabilities and APT attacks) in real time, and lacks the ability to dynamically adapt to rapidly evolving attack methods.

[0005] Third, the response mechanism is lagging behind: risk management relies on manual analysis and manual operations, and there are delays of minutes or even hours from threat discovery to execution blocking, which extends the attack window.

[0006] In addition, compliance is insufficient: traditional log storage is easily tampered with, and there is a lack of a legally binding evidence storage mechanism. The cost of providing evidence during judicial collection is high and the acceptance rate is low.

[0007] While existing solutions attempt to integrate single blockchain or machine learning technologies, they fail to systematically address the collaborative challenges of data governance, dynamic analysis, and compliant evidence storage. In particular, cross-organizational collaboration scenarios remain plagued by the risks of privacy breaches and a lack of trust in collaboration. These issues severely constrain the risk prevention and control capabilities of key industries (such as finance and healthcare), necessitating the development of a next-generation management architecture that balances real-time performance, reliability, and compliance. To address these technical challenges, information security risk management methods and management systems are being introduced. Summary of the Invention

[0008] (1) Technical problems solved

[0009] In response to the deficiencies of the existing technology, the present invention provides an information security risk management method and management system to solve the technical problem of breaking data silos.

[0010] (2) Technical solution

[0011] To achieve the above objectives, the present invention is implemented through the following technical solutions:

[0012] Information security risk management method and management system, the system consists of four core modules:

[0013] Multimodal data collection layer: Probes deployed on terminals and servers support heterogeneous data collection of network traffic, operation logs, and API call chains.

[0014] Blockchain log storage layer: A private chain is built based on an improved BFT consensus algorithm. Each block contains a timestamp hash value and the fingerprint of the previous block.

[0015] Dynamic risk assessment engine: uses an LSTM-Transformer hybrid neural network, with input dimensions including user behavior baseline, vulnerability library version, and threat intelligence feed.

[0016] Intelligent response decision module: Integrates reinforcement learning algorithms to automatically generate disposal strategies and trigger the SDN controller to perform network isolation.

[0017] Optimally, a hierarchical blockchain storage architecture is designed with a three-level chain structure to achieve hierarchical data governance:

[0018] Local chain: Eliminate data fragmentation within the organization and improve data governance efficiency.

[0019] Dynamic Raft consensus optimization: Using an improved Raft algorithm (dynamic adjustment of election timeout), the consensus latency of the local chain in a 10-node cluster is reduced from 2.5s to 0.8s, and the log synchronization efficiency within a single organization is increased by 300%.

[0020] Data fingerprint chain storage: The original log is processed by SM3 hashing to generate a data fingerprint, which is then chain-stored in timestamp order to form a tamper-proof time-series evidence chain.

[0021] Metadata standardization: Mandatory definition of the XDM-Log metadata specification (including CWE / SANS event classification codes) increases the parsing compatibility of logs from different systems from 60% to 98%, solving the problem of format fragmentation.

[0022] Preferably, consortium chain: build cross-organizational trust and collaboration, and break through the bottleneck of data sharing.

[0023] Zero-knowledge cross-domain verification: A verification protocol based on zk-SNARKs enables privacy-preserving computing where “data remains static but the model remains active”.

[0024] Hierarchical BFT-SMaRt consensus: Divides nodes into consensus groups by region, reducing cross-group communication by 72%, and supports consortium chains with 100+ nodes to achieve 1500+ TPS (traditional PBFT only supports 30 nodes / 300 TPS).

[0025] Smart contract incentive ecosystem:

[0026] A token reward mechanism was designed, whereby companies receive 10 points (1 point = 1 data query right) for each piece of effective threat intelligence they contribute. After six months of operation, a certain automotive manufacturing alliance chain saw a 400% increase in members' willingness to share data.

[0027] Cross-domain analysis efficiency

[0028] Spatiotemporal correlation engine: Through Geohash encoding (12-bit precision) and a time sliding window (dynamically adjusted from 1 to 60 minutes), the accuracy of attack event correlation analysis has been increased from 75% to 93%.

[0029] Threat Map Visualization:

[0030] An interactive graph based on a GraphQL interface supports building cross-organizational attack chains in minutes. In an APT attack incident at a multinational enterprise, tracing the source was reduced from two weeks to four hours.

[0031] Optimized audit chain: achieve judicial-level compliance closed loop and build a legal moat.

[0032] It connects to judicial evidence storage institutions, is built based on the Fabric framework, and solidifies key operation evidence through the national secret SM2 signature chain to meet the compliance requirements of the "Electronic Signature Law".

[0033] The audit chain's judicial evidence storage and compliance audit meet the requirements of the legal evidence chain, connect with authoritative agency nodes such as the notary office and the Cyberspace Administration of China, and solidify key operation records.

[0034] Preferably, a layered authentication mechanism

[0035] Local chain → consortium chain: Data association is achieved through dual-chain anchoring technology. Every 100 blocks generated by the local chain, a Merkle Root snapshot is submitted to the consortium chain. The consortium chain verification node confirms the authenticity of the data through SPV (Simplified Payment Verification).

[0036] Consortium chain → Audit chain: adopts event-triggered evidence storage. When the consortium chain detects a high-risk event (such as abnormal capital flow), it automatically calls the audit chain smart contract. The evidence storage content includes: event hash, digital signature of relevant parties, and timestamp triplet.

[0037] Preferably, the feedback loop is the core mechanism for achieving dynamic risk self-optimization. The response results (such as blocking success rate and false alarm rate) are stored in a trusted manner on the blockchain and fed back to the online learning module of the risk assessment engine to drive dynamic tuning of model parameters (incremental learning). At the same time, the blockchain consensus parameters (such as node election weight and timeout threshold) are adjusted to form a closed loop of "perception-decision-verification-optimization". Its operation process can be divided into three stages:

[0038] Preferably, respond to effect evaluation feedback

[0039] After the intelligent response module executes the disposal strategy (such as network isolation and transaction rollback), it collects the operation result data (blocking success rate, business impact duration, etc.) in real time, and encapsulates the feedback data into a feedback transaction (Feedback TX) through the trusted evidence channel of the blockchain storage layer, using the timestamp hash chain to ensure that the data cannot be tampered with. The feedback data packet structure includes:

[0040] Preferably, model parameters are dynamically tuned

[0041] The online learning module of the risk assessment engine reads feedback data from the blockchain and uses an incremental transfer learning algorithm to update the weights of the LSTM-Transformer hybrid model:

[0042] For successful cases, the corresponding feature weights are enhanced. For false positives / missing negatives, adversarial samples are generated and injected into the training set. The model drift is monitored through KL divergence, and full retraining is initiated when the trigger threshold exceeds 0.15.

[0043] Optimally, consensus strategy is adaptively adjusted

[0044] The feedback data is also fed into the consensus optimizer at the blockchain layer to dynamically adjust the key parameters of the BFT algorithm:

[0045] The view switching timeout threshold is reset based on the median network latency, the master node election weight is adjusted based on the node response success rate, and the topology division strategy of the hierarchical consensus group is automatically switched when feedback data shows regional network fluctuations.

[0046] This closed-loop feedback mechanism realizes the complete iterative cycle of "detection-response-verification-optimization", enabling the system to continuously improve the risk identification accuracy without human intervention (experimental data shows an average F1-score improvement of 1.2% per iteration) and reduce the error operation rate (from the initial 15% to within 3% during the stable period).

[0047] (3) Beneficial effects

[0048] The three-level structure of local chain-alliance chain-audit chain is applied to data island governance, taking into account both efficiency and compliance.

[0049] Efficient data governance and integrity assurance

[0050] Data integration within the organization: Solve the problem of internal data fragmentation through local chain structure, realize unified storage and rapid traceability of heterogeneous logs, ensure data authenticity and time integrity, and tamper-proof evidence chain: Use chain hash storage technology to build an unalterable data fingerprint chain, support full life cycle auditing, and significantly improve data credibility.

[0051] Cross-organization trusted collaboration and privacy protection

[0052] Secure data sharing: cross-domain data collaborative analysis is achieved based on the alliance chain, and sensitive data is ensured to be "available but invisible" through zero-knowledge verification technology, breaking down the barriers of data silos. Threat intelligence linkage: builds a cross-organizational attack map, supports rapid positioning of complex attack chains, and improves threat tracing and response efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention and implement it according to the contents of the specification, the following is a detailed description of the preferred embodiments of the present invention with reference to the accompanying drawings.

[0054] Figure 1 This is a flow chart of the information security risk management method and management system of the present invention;

[0055] Figure 2 This is a diagram of the structure of the blockchain log storage layer in the information security risk management method and management system of the present invention. DETAILED DESCRIPTION

[0056] The embodiments of the present application solve the problem of data silos in the prior art by providing an information security risk management method and management system, and apply the three-level structure of local chain-alliance chain-audit chain to data island governance, taking into account both efficiency and compliance.

[0057] Example 1

[0058] The technical solution in the embodiments of this application is to solve the above-mentioned data island problem. The overall idea is as follows:

[0059] like Figure 1 As shown, in response to the problems existing in the prior art, the present invention provides an information security risk management method and management system, which consists of four core modules:

[0060] Multimodal data collection layer: Probes deployed on terminals and servers support heterogeneous data collection of network traffic, operation logs, and API call chains.

[0061] Blockchain log storage layer: A private chain is built based on an improved BFT consensus algorithm. Each block contains a timestamp hash value and the fingerprint of the previous block.

[0062] Dynamic risk assessment engine: uses an LSTM-Transformer hybrid neural network, with input dimensions including user behavior baseline, vulnerability library version, and threat intelligence feed.

[0063] Intelligent response decision module: Integrates reinforcement learning algorithms to automatically generate disposal strategies and trigger the SDN controller to perform network isolation.

[0064] like Figure 2As shown in the figure, the hierarchical blockchain storage architecture designs a three-level chain structure to achieve hierarchical data governance:

[0065] 1. Local chain: Eliminate data fragmentation within the organization and improve data governance efficiency.

[0066] Dynamic Raft consensus optimization: Using an improved Raft algorithm (dynamic adjustment of election timeout), the consensus latency of the local chain in a 10-node cluster is reduced from 2.5s to 0.8s, and the log synchronization efficiency within a single organization is increased by 300%.

[0067] Data fingerprint chain storage: The original log is processed by SM3 hash to generate a data fingerprint, which is then chain-stored in timestamp order to form a tamper-proof time-series evidence chain.

[0068] Metadata standardization: Mandatory definition of the XDM-Log metadata specification (including CWE / SANS event classification codes) increases the parsing compatibility of logs from different systems from 60% to 98%, solving the problem of format fragmentation.

[0069] 2. Alliance chain: Build cross-organizational trust and collaboration to break through data sharing bottlenecks.

[0070] Zero-knowledge cross-domain verification: A verification protocol based on zk-SNARKs enables privacy-preserving computing where “data remains static but the model remains active”.

[0071] Hierarchical BFT-SMaRt consensus: Divides nodes into consensus groups by region, reducing cross-group communication by 72%, and supports consortium chains with 100+ nodes to achieve 1500+ TPS (traditional PBFT only supports 30 nodes / 300 TPS).

[0072] Smart contract incentive ecosystem:

[0073] A token reward mechanism was designed, whereby companies receive 10 points (1 point = 1 data query right) for each piece of effective threat intelligence they contribute. After six months of operation, a certain automotive manufacturing alliance chain saw a 400% increase in members' willingness to share data.

[0074] Cross-domain analysis efficiency

[0075] Spatiotemporal correlation engine: Through Geohash encoding (12-bit precision) and a time sliding window (dynamically adjusted from 1 to 60 minutes), the accuracy of attack event correlation analysis has been increased from 75% to 93%.

[0076] Threat Map Visualization:

[0077] An interactive graph based on a GraphQL interface supports building cross-organizational attack chains in minutes. In an APT attack incident at a multinational enterprise, tracing the source was reduced from two weeks to four hours.

[0078] 3 Audit chain: Achieve a judicial-level compliance closed loop and build a legal moat.

[0079] It connects to judicial evidence storage institutions, is built based on the Fabric framework, and solidifies key operation evidence through the national secret SM2 signature chain to meet the compliance requirements of the "Electronic Signature Law".

[0080] The audit chain's judicial evidence storage and compliance audit meet the requirements of the legal evidence chain, connect with authoritative agency nodes such as the notary office and the Cyberspace Administration of China, and solidify key operation records.

[0081] Layered authentication mechanism

[0082] Local chain → consortium chain: Data association is achieved through dual-chain anchoring technology. Every 100 blocks generated by the local chain, a Merkle Root snapshot is submitted to the consortium chain. The consortium chain verification node confirms the authenticity of the data through SPV (Simplified Payment Verification).

[0083] Consortium chain → Audit chain: adopts event-triggered evidence storage. When the consortium chain detects a high-risk event (such as abnormal capital flow), it automatically calls the audit chain smart contract. The evidence storage content includes: event hash, digital signature of relevant parties, and timestamp triplet.

[0084] exist Figure 1 In the system framework, the feedback loop is the core mechanism for achieving dynamic risk self-optimization. Response results (such as blocking success rate and false alarm rate) are stored in a trusted manner on the blockchain and fed back to the online learning module of the risk assessment engine to drive dynamic tuning of model parameters (incremental learning). At the same time, blockchain consensus parameters (such as node election weights and timeout thresholds) are adjusted to form a closed loop of "perception-decision-verification-optimization." Its operation process can be divided into three stages:

[0085] 1. Response effect evaluation feedback

[0086] After the intelligent response module executes the disposal strategy (such as network isolation and transaction rollback), it collects the operation result data (blocking success rate, business impact duration, etc.) in real time, and encapsulates the feedback data into a feedback transaction (Feedback TX) through the trusted evidence channel of the blockchain storage layer, using the timestamp hash chain to ensure that the data cannot be tampered with. The feedback data packet structure includes:

[0087] Original risk event hash

[0088] Response action execution timestamp

[0089] Quantitative indicators of treatment effect (MTTR, false alarm rate, etc.)

[0090] 2. Dynamic tuning of model parameters

[0091] The online learning module of the risk assessment engine reads feedback data from the blockchain and uses an incremental transfer learning algorithm to update the weights of the LSTM-Transformer hybrid model:

[0092] For successful cases, the corresponding feature weights are enhanced. For false positives / missing negatives, adversarial samples are generated and injected into the training set. The model drift is monitored through KL divergence, and full retraining is initiated when the trigger threshold exceeds 0.15.

[0093] 3. Adaptive adjustment of consensus strategy

[0094] The feedback data is also fed into the consensus optimizer at the blockchain layer to dynamically adjust the key parameters of the BFT algorithm:

[0095] The view switching timeout threshold is reset based on the median network latency, the master node election weight is adjusted based on the node response success rate, and the topology division strategy of the hierarchical consensus group is automatically switched when feedback data shows regional network fluctuations.

[0096] This closed-loop feedback mechanism realizes the complete iterative cycle of "detection-response-verification-optimization", enabling the system to continuously improve the risk identification accuracy without human intervention (experimental data shows an average F1-score improvement of 1.2% per iteration) and reduce the error operation rate (from the initial 15% to within 3% during the stable period).

[0097] Beneficial effects:

[0098] Efficient data governance and integrity assurance

[0099] Data integration within the organization: Solve the problem of internal data fragmentation through the local chain structure, realize the unified storage and rapid traceability of heterogeneous logs, and ensure data authenticity and time series integrity.

[0100] Tamper-proof evidence chain: Using chain hash storage technology, we build an unalterable data fingerprint chain, support full life cycle auditing, and significantly improve data credibility.

[0101] Cross-organization trusted collaboration and privacy protection

[0102] Secure data sharing: Cross-domain data collaborative analysis is achieved based on the alliance chain, and zero-knowledge verification technology is used to ensure that sensitive data is "available but invisible", breaking down the barriers of data silos.

[0103] Threat intelligence linkage: Build cross-organizational attack maps to support rapid location of complex attack chains and improve threat tracing and response efficiency.

[0104] Judicial compliance and automated evidence storage

[0105] Closed-loop legal evidence: The audit chain connects with authoritative institutions, solidifies key operation records and electronic signatures, meets judicial evidence collection requirements, and achieves compliance throughout the risk management process.

[0106] Real-time evidence generation: Automatically generate standardized electronic evidence packages, replacing the traditional manual evidence collection process and significantly reducing the cost of handling legal disputes.

[0107] Dynamic self-optimization and real-time response

[0108] Intelligent risk assessment: Integrates deep learning models with real-time threat intelligence to dynamically identify new attack patterns and improve the accuracy of risk prediction.

[0109] Closed-loop feedback mechanism: Continuously optimize models and system strategies through response effect feedback to achieve self-evolution capabilities, reduce error rates, and enhance system adaptability.

[0110] Millisecond-level automated response: Combining reinforcement learning and SDN technologies, this technology enables end-to-end automated response from attack detection to network isolation, effectively curbing the spread of risks.

[0111] System scalability and stability

[0112] Layered elastic architecture: supports large-scale node deployment and regional network fluctuations, ensures high availability through dynamic consensus algorithms, and adapts to complex business scenarios.

[0113] Efficient resource utilization: Optimize data storage and computing resource allocation, reduce system operating load, and improve overall operation and maintenance efficiency.

[0114] Core Values

[0115] This invention integrates a multi-level blockchain architecture with intelligent algorithms to build an information security risk management system with trustworthy data, efficient collaboration, closed-loop compliance, and autonomous evolution. It solves the pain points of traditional solutions such as data silos, delayed responses, and difficulty in judicial evidence collection, and provides all-round and sustainable security protection capabilities for key areas such as finance, medical care, and industry.

[0116] Finally, it should be noted that the above embodiments are merely examples for the purpose of illustrating the present invention and are not intended to limit the embodiments. Those skilled in the art will readily appreciate that other variations or modifications based on the above description are possible. It is not necessary and impossible to provide an exhaustive list of all embodiments. However, obvious variations or modifications arising therefrom remain within the scope of protection of the present invention.

Claims

1. An information security risk management method and management system, characterized by: The system consists of four core modules: Multimodal data collection layer: Probes deployed on terminals and servers support heterogeneous data collection including network traffic, operation logs, and API call chains; Blockchain log storage layer: A private chain is built based on an improved BFT consensus algorithm. Each block contains a timestamp hash value and the fingerprint of the previous block. Dynamic risk assessment engine: This uses an LSTM-Transformer hybrid neural network, with input dimensions including user behavior baselines, vulnerability library versions, and threat intelligence feeds. Intelligent response decision module: Integrates reinforcement learning algorithms to automatically generate disposal strategies and trigger the SDN controller to perform network isolation.

2. The information security risk management method and management system according to claim 1, characterized in that: The blockchain log storage layer adopts a layered blockchain storage architecture and designs a three-level chain structure to implement data layered governance, including a local chain, a consortium chain, and an audit chain.

3. The information security risk management method and management system according to claim 2, characterized in that: The local chain adopts the improved Raft algorithm, and the data fingerprint is stored in a chain. The original log is processed by SM3 hash to generate a data fingerprint, which is stored in a chain in the order of timestamps to form a tamper-proof time sequence evidence chain.

4. The information security risk management method and management system according to claim 3, characterized in that: The alliance chain adopts a layered BFT-SMaRt consensus: nodes are divided into consensus groups by region, supporting alliance chains with 100+ nodes to achieve 1500+ TPS, and threat map visualization: an interactive map based on the GraphQL interface supports the construction of cross-organizational attack chains in minutes.

5. The information security risk management method and management system according to claim 4, characterized in that: The alliance chain smart contract incentivizes the ecosystem and designs a token reward mechanism. Enterprises can obtain 10 points for each effective threat intelligence contribution, cross-domain analysis efficiency, spatiotemporal correlation engine, through Geohash encoding and time sliding window.

6. The information security risk management method and management system according to claim 5, characterized in that: The audit chain is connected to the judicial evidence storage agency, built based on the Fabric framework, and solidifies key operation evidence through the national secret SM2 signature chain.

7. The information security risk management method and management system according to claim 6, characterized in that: After the intelligent response module executes the disposal strategy, it collects the operation result data in real time, encapsulates the feedback data into a feedback transaction through the trusted evidence channel of the blockchain storage layer, and uses the timestamp hash chain to ensure that the data cannot be tampered with.

8. The information security risk management method and management system according to claim 6, characterized in that: The online learning module of the dynamic risk assessment engine reads feedback data from the blockchain and uses an incremental transfer learning algorithm to update the weights of the LSTM-Transformer hybrid model: it enhances the corresponding feature weights for successfully handled cases, generates adversarial samples for false positive / missed negative events and injects them into the training set, monitors model drift through KL divergence, and initiates full retraining when the trigger threshold exceeds 0.

15.

9. The information security risk management method and management system according to claim 1, characterized in that: The feedback data is simultaneously input into the consensus optimizer of the blockchain layer, which dynamically adjusts the key parameters of the BFT algorithm, resets the view switching timeout threshold based on the median network delay, adjusts the master node election weight based on the node response success rate, and automatically switches the topology partitioning strategy of the hierarchical consensus group when the feedback data shows regional network fluctuations.

10. The information security risk management method and management system according to claim 1, characterized in that: Layered verification mechanism, local chain → alliance chain: data association is achieved through dual-chain anchoring technology. Every 100 blocks generated by the local chain, the Merkle Root is submitted to the alliance chain as a snapshot. The alliance chain verification node confirms the authenticity of the data through SPV. Alliance chain → audit chain: event-triggered evidence storage is adopted. When the alliance chain detects a high-risk event, the audit chain smart contract is automatically called. The evidence content includes: event hash, digital signatures of relevant parties, and timestamp triples.

Images