Safety early warning system based on big data

Abstract

The invention relates to the technical field of safety early warning, in particular to a safety early warning system based on big data, which comprises a sequence behavior analysis module, a frequency fluctuation identification module, an event number generation module, a sensitive grading judgment module and a notification content push module. According to the method, potential abnormal signals in access behaviors are identified through real-time dynamic analysis of the user access sequence and fusion of access interval change and category difference characteristics, risk behaviors are further screened based on a sudden change rule of access frequency, and accurate classification of abnormal events is realized by using unique identification and a mapping mechanism. According to the method, sensitive assets are finely graded by integrating multi-dimensional parameters, a hierarchical early warning basis is generated by adopting a weight quantification mode, push contents are directionally generated by combining different role permissions and identity information, a safety early warning process of data driving, parameter linkage and hierarchical perception is constructed, and the sensitivity of risk monitoring and the accuracy of hierarchical response are improved.

Description

Technical Field

[0001] The present invention relates to the field of security early warning technology, and in particular to a security early warning system based on big data. Background Art

[0002] Security early warning involves the perception, identification, and pre-warning of various risks and threats, including risk data collection, abnormal behavior analysis, threat information identification, and early warning notifications. Through real-time monitoring and comprehensive analysis of security-related data, it ensures the safe and stable operation of personnel, property, and information systems. Traditional security early warning refers to the identification and early warning of potential security risks in an enterprise's digital assets through manual inspections, scheduled monitoring, and static rule setting. These methods typically utilize fixed-point control, fixed-point information collection, preset threshold triggering alarms, and manual analysis of alarm information to provide early warnings and risk notifications for digital assets.

[0003] Existing technologies rely heavily on fixed monitoring points and manual rule settings, making it impossible to dynamically track changes in user behavior throughout the entire process. The monitoring process lacks multi-parameter synchronous analysis, the alarm method is single, and the information notification channels are limited. When faced with high-frequency business access scenarios, it is impossible to capture key risk nodes in the behavior sequence. Static rules and manual inspections are difficult to adapt to complex asset access patterns, making it easy for some risky behaviors to be missed, the risk notification flow is slow, and it is unable to adapt to the changing digital asset security management needs. Summary of the Invention

[0004] The purpose of the present invention is to solve the shortcomings of the existing technology and propose a safety early warning system based on big data.

[0005] In order to achieve the above objectives, the present invention adopts the following technical solution: a safety early warning system based on big data, the system comprising:

[0006] The sequence behavior analysis module compares the access sequence and operation interval of enterprise digital assets based on the user's current access behavior sequence, identifies changes in operation intervals when accessing assets, screens interval fluctuations in continuous access to assets of the same category, determines whether there are anomalies, and obtains offset sequence feature signals;

[0007] The frequency fluctuation identification module counts the number of times the subject accesses the same type of asset in each period based on the offset sequence characteristic signal, analyzes the change between the number and the behavior baseline, determines the mutation trend of the access frequency in a short period of time, and obtains the frequency mutation characteristic value;

[0008] The event number generation module filters the mutation behavior data based on the frequency mutation feature, analyzes the event attributes and identifies abnormal access based on the behavior subject, asset category and access time, adjusts the parameter combination to generate a unique event number, and obtains an abnormal event mapping set;

[0009] The sensitivity grading determination module compares the asset access frequency, asset value, risk level and abnormal status based on the abnormal event mapping set, analyzes the performance of each parameter under the sensitive asset category, screens assets with grading characteristics, calculates parameter contribution, and obtains the graded sensitivity weight.

[0010] The present invention has improvements in that the offset sequence characteristic signal includes a sequence anomaly identifier, an interval change category, and behavior sequence distribution information; the frequency mutation characteristic quantity includes an access high-frequency area identifier, a frequency change level, and frequency information within a cycle; the abnormal event mapping set includes an event identification number, an associated asset code, and event label information; and the graded sensitivity weight quantity includes a sensitive asset level, a risk weight allocation, and a graded quantitative parameter.

[0011] The present invention is improved in that the sequence behavior analysis module includes:

[0012] The access sequence extraction submodule analyzes the order of each user's access to the enterprise's digital assets based on the user's current access behavior sequence, arranges the access data in order of occurrence, optimizes the order relationship between assets of different categories, and filters the fragments of continuous access to assets of the same category to generate an access sequence structure sequence;

[0013] The operation interval identification submodule analyzes the continuous access behavior based on the access sequence structure sequence, compares the time interval distribution between access operations of the same type of assets, determines which intervals in the continuous access process have key changes, identifies the location of the operation intervals with key fluctuations, and obtains the access interval fluctuation distribution;

[0014] The sequential offset determination submodule compares the access interval fluctuation distribution with the sequential structure of historical access behavior, determines the differences in access category and sequence between the current access path and the historical path, analyzes the fragments of abnormal order in the access path, and organizes the occurrence order or jump position to obtain the offset sequence characteristic signal.

[0015] The present invention is improved in that the frequency fluctuation identification module includes:

[0016] The statistical period extraction submodule analyzes the access time series of the subject to the same category of assets based on the offset sequence feature signal, compares the frequency changes of access operations in each time period, records the operation distribution characteristics of the subject in consecutive time periods, and obtains the amplitude of the access frequency change;

[0017] The frequency baseline deviation submodule calculates the degree of deviation from the reference group of access frequencies of each category of assets in the historical period based on the amplitude of the access frequency fluctuation, analyzes the direction of the deviation in the continuous time period, determines the changing pattern of the operation frequency, and obtains the frequency fluctuation trend level;

[0018] The burst frequency identification submodule compares the synchronization of the operating frequency offset amplitude and the change amplitude within the cycle based on the frequency fluctuation trend level, calculates the operating frequency fluctuation within the cycle, and obtains the frequency mutation feature.

[0019] The present invention is improved in that the event number generation module includes:

[0020] The behavior surge screening submodule analyzes the changes in the frequency of access to the same type of assets by the subject within different periods based on the frequency mutation feature, compares the access data with the historical baseline, screens the key periodic behavior data of frequent access phenomena, determines whether the access pattern has fluctuated significantly, and obtains the access frequency surge segment;

[0021] The access association construction submodule optimizes the time sequence of the periodic behavior data based on the access frequency surge segment, calculates the interaction path between the behavior subject and the accessed asset, analyzes the corresponding relationship between the subject, asset and time in the continuous access process, and establishes an access mapping path structure;

[0022] The number mapping arrangement submodule compares the actual sequence and the historical sequence in the access link information based on the access mapping path structure, calculates the sequence deviation between the two, obtains the event judgment index, and sorts the matching strength of the event combination to obtain the abnormal event mapping set.

[0023] The present invention is improved in that the sensitivity classification determination module includes:

[0024] The access attribute extraction submodule compares the change trends of the associated assets in terms of access frequency, asset criticality, risk level, and abnormal status parameters based on the abnormal event mapping set, calculates the differences between the parameters in the same time series, filters the key items that show abnormalities, and obtains the access behavior fluctuation amount;

[0025] The collaborative feature analysis submodule determines the distribution of sensitive asset categories and asset criticality based on the fluctuation of access behavior, compares the synchronization performance of access frequency and asset criticality within each sensitive category, identifies parameters with prominent joint features, and obtains the collaborative magnitude of similar features;

[0026] The weight parameter calculation submodule calculates the collaborative performance of access frequency, asset criticality, risk level and abnormal status under sensitive categories based on the collaborative amplitude of the same type of features, adjusts the weight distribution of each parameter in the performance, and obtains the graded sensitivity weight.

[0027] The present invention is improved in that the system further comprises:

[0028] The notification content push module determines the warning push scenario based on the hierarchical sensitivity weight, analyzes the authority and identity of the push object, identifies the object to be notified, organizes the push content structure, optimizes the expression method and information hierarchy, and obtains the role warning push information;

[0029] The role warning push information includes a notification type identifier, a push role tag, and associated response content.

[0030] The present invention is improved in that the notification content push module includes:

[0031] The push object identification submodule analyzes the access frequency, asset value, risk level, and abnormal status of the asset associated with the event number based on the hierarchical sensitivity weight, compares the role authority and identity category of the actor, determines whether the push conditions match the current parameter combination, identifies the object with the receiving authority, and obtains the target role identification set;

[0032] The information structure arrangement submodule, based on the target role identification set, screens the content type of the target role in historical notifications, analyzes the order of field appearance and expression, optimizes the field classification and sorting structure, compares the coverage and intersection of each field in different roles, and obtains a role field structure template;

[0033] The information hierarchy optimization submodule determines the field receiving hierarchy based on the role field structure template, analyzes the distribution of permissions, functions and task scopes among roles, adjusts the arrangement of fields in the content structure of different roles, optimizes the hierarchical attribution and display of information, and obtains role warning push information.

[0034] Compared with the prior art, the advantages and positive effects of the present invention are:

[0035] In the present invention, through real-time dynamic analysis of user access sequences, the changes in access intervals and category differences are integrated to identify potential abnormal signals in access behaviors, further screen risk behaviors based on the mutation patterns of access frequencies, utilize unique identification and mapping mechanisms to accurately classify abnormal events, comprehensively classify sensitive assets based on multi-dimensional parameters, use weighted quantification to generate hierarchical warning basis, combine different role permissions and identity information to generate push content in a targeted manner, and construct a data-driven, parameter-linked, hierarchically perceived security warning process to enhance the sensitivity of risk monitoring and the accuracy of hierarchical response. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 is a system flow chart of the present invention;

[0037] Figure 2 This is a flow chart of the sequence behavior analysis module in the present invention;

[0038] Figure 3This is a flow chart of the frequency fluctuation identification module in the present invention;

[0039] Figure 4 This is a flow chart of the event number generation module in the present invention;

[0040] Figure 5 This is a flow chart of the sensitivity classification determination module in the present invention;

[0041] Figure 6 This is a flowchart of the notification content push module in the present invention. DETAILED DESCRIPTION

[0042] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0043] In the description of the present invention, it should be understood that the terms "length", "width", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside", etc., indicating directions or positional relationships, are based on the directions or positional relationships shown in the accompanying drawings and are only for the convenience of describing the present invention and simplifying the description. They do not indicate or imply that the devices or elements referred to must have a specific direction, be constructed and operate in a specific direction, and therefore should not be understood as limiting the present invention. In addition, in the description of the present invention, the meaning of "plurality" is two or more, unless otherwise clearly and specifically defined.

[0044] Example

[0045] See also Figure 1 The present invention provides a technical solution: a security early warning system based on big data includes:

[0046] The Sequential Behavior Analysis module analyzes changes in the historical behavior sequence based on the user's current access behavior sequence. By comparing the access sequence and operation interval of the enterprise's digital assets, it identifies the changing trend of the operation interval when accessing different types of assets. It screens the key fluctuations in the operation interval during continuous access to assets of the same category. Combined with the order of behavior occurrence, it determines whether the access sequence has undergone unconventional adjustments and obtains the offset sequence feature signal.

[0047] The frequency fluctuation identification module calculates the number of times the subject accesses the same type of asset in each statistical period based on the offset sequence characteristic signal, analyzes the change process between this number and the behavioral baseline, determines whether the access frequency shows a sudden increase trend in a short period of time, and compares the distribution characteristics of the access frequency in each statistical period to obtain the frequency mutation characteristic value;

[0048] The event number generation module, based on frequency mutation characteristics, screens behavioral data showing sudden increases in access frequency. Combining the correspondence between the behavior subject, asset category, and access time, it analyzes event characteristics and determines whether it is abnormal access behavior. It then adjusts the parameter combination sequence to generate a unique event number and organizes the pairing relationship between the event number and the actual asset identifier to obtain an abnormal event mapping set.

[0049] The sensitivity classification determination module compares the access frequency, asset value, risk level, and abnormal status parameters of assets associated with event numbers based on the abnormal event mapping set. It analyzes the synergistic performance of each parameter under the sensitive asset category, selects sensitive assets with hierarchical management characteristics, and calculates the contribution of each parameter to the overall performance to obtain the hierarchical sensitivity weight.

[0050] The notification content push module determines the scenario of the warning push standard based on the hierarchical sensitivity weight, analyzes the role permissions and identity characteristics of the push object, identifies the object to be notified, organizes the push content structure of each role, optimizes the notification expression and information hierarchy, and obtains the role warning push information.

[0051] The offset sequence feature signal includes the sequence anomaly identification, interval change category, and behavior sequence distribution information. The frequency mutation feature includes the access high-frequency area identification, frequency change level, and frequency information within the cycle. The abnormal event mapping set includes the event identification number, associated asset code, and event label information. The hierarchical sensitivity weight includes the sensitive asset level, risk weight allocation, and hierarchical quantitative parameters. The role warning push information includes the notification type identification, push role tag, and associated response content.

[0052] In the sequential behavior analysis module, historical behavior sequence refers to the time series composed of all previous access behaviors generated by the same user on the enterprise digital asset platform, which is often used to compare with current access behavior; access sequence refers to the order in which users continuously access different digital assets, and the operation interval refers to the time difference between two consecutive visits; the change trend refers to the numerical increase or decrease or fluctuation directional characteristics of the operation interval as the access sequence evolves in multiple access behavior records; assets of the same category refer to data or system resources with the same attributes and belonging to the same category, such as digital assets belonging to the same category of "contract documents" or "personnel files"; critical fluctuation situations refer to the moments when the operation interval shows significant abnormalities or fluctuations that are significantly different from the usual level in continuous access to assets of the same category, and these moments often indicate potential risks; unconventional adjustments refer to the current access behavior sequence and the historical average behavior sequence. There are obvious differences, manifested as disordered sequence, skipped steps or access that does not follow the usual path, and are associated with abnormal access behavior.

[0053] In the frequency fluctuation identification module, the behavioral subject refers to the user or account that performs the access operation, and is the core identity identification object for analyzing access behavior; the behavioral baseline refers to the access frequency reference standard set based on historical statistical data, which usually reflects the range of times users access a certain type of asset under normal circumstances; the change process refers to the entire process of gradual deviation or approach between the access frequency and the behavioral baseline within the current statistical period, reflecting the dynamics of behavioral frequency; the sudden increase trend refers to the phenomenon that the number of visits per unit time suddenly increases and exceeds the normal fluctuation range in a short period of time, which usually reflects abnormal or risky activities; the distribution characteristics refer to the specific distribution status of the access frequency in a series of statistical periods, including attributes such as average value, fluctuation range, and concentration interval.

[0054] In the event number generation module, the mutual correspondence refers to the one-to-one pairing and time series relationship between the subject, asset category and access time in the access behavior record, which is used to accurately describe and locate events; event characteristics refer to the uniqueness or specificity indicators formed by the combination of access behavior attributes, including information such as the type, timing and abnormal performance of the behavior; abnormal access behavior refers to access operations that are beyond the normal range and pose security risks identified in data comparison and analysis, which are common in frequency mutation or sequence abnormality scenarios; parameter combination sequence refers to the combination of parameters such as the subject, asset category, access time, etc. in a fixed order when generating the event number to ensure uniqueness; the pairing relationship refers to the binding or association between the event number and the unique identifier of the accessed digital asset, which facilitates subsequent traceability and response.

[0055] In the sensitive grading determination module, sensitive asset categories refer to asset types divided according to enterprise security policies, among which assets with high risks, strong confidentiality or outstanding importance are marked as sensitive categories; collaborative performance refers to the comprehensive effect of parameters such as access frequency, asset value, risk level and abnormal status in sensitive asset analysis; hierarchical management characteristics refer to the fact that certain sensitive assets exhibit different management levels and security control requirements based on the results of parameter analysis, which can support differentiated response measures; contribution refers to the proportion or weight of the influence of each parameter on the sensitive asset grade determination result, reflecting the role of each parameter in the grading decision.

[0056] In the notification content push module, the scenario of the warning push standard refers to the conditions and background that need to be met when triggering the security warning notification, such as the scenario description when the risk level is reached or specific behavioral characteristics appear; the push object refers to the user, role or department that needs to receive the security warning notification, common objects include administrators, asset managers, etc.; the push content structure refers to the organization and arrangement of warning notification information, including structured content such as notification title, event details, and handling suggestions; the notification expression method refers to the display method used when pushing messages, including text, charts, lists or hierarchical summaries; the information hierarchy refers to the detailed classification of push content between different receiving objects based on factors such as authority and response responsibilities, such as the different scope and level of detail of information received by senior management and ordinary users.

[0057] See also Figure 2 , the sequence behavior analysis module includes:

[0058] The access sequence extraction submodule analyzes the order of each user's access to the enterprise's digital assets based on the user's current access behavior sequence, arranges the access data in order of occurrence, optimizes the order relationship between assets of different categories, and filters the fragments of continuous access to assets of the same category to generate an access sequence structure sequence;

[0059] Extract all access records generated by user U123 in the past 30 minutes from the system log, where each record contains four fields: access time (such as 08:00:03), access asset ID (such as D001), asset category (such as "personnel file"), and operation type (such as "read". After extraction, sort the access time field in ascending order to obtain a series of behavior records arranged in chronological order, such as access to D001 (personnel file), D002 (financial data), D003 (personnel file), and D004 (contract text). Then call the asset category field of each record and classify the three categories of "personnel file", "financial data", and "contract text" into different category pools. Then compare the category fields of the access records before and after each behavior. If the categories are different, mark it as a switching point, such as between D001 and D002. Mark a category switch during the process, count the number of category switches in the entire behavior chain as 2, and organize all continuous access behaviors of the same category into access segments. For example, the "personnel file" segment contains D001 and D003, the "financial data" segment only contains D002, and the "contract text" segment is D004. For each segment, its start behavior time and end behavior time are recorded. For example, the personnel file segment starts at 08:00:03 and ends at 08:05:27. At the same time, the asset ID sequence [D001, D003] accessed by this segment is recorded. The access sequence structure sequence item is constructed. The structure contains user ID, asset category, access sequence number, access time interval and asset access list. The combination of all structure items constitutes the final access sequence structure sequence, which will be used to identify the time pattern and structure path in the access behavior of assets of the same category.

[0060] The operation interval identification submodule analyzes continuous access behaviors based on the access sequence structure sequence, compares the time interval distribution between access operations of the same type of assets, determines which intervals have key changes during the continuous access process, identifies the location of the operation intervals with key fluctuations, and obtains the access interval fluctuation distribution;

[0061] Read the adjacent behavior pairs in each access segment in turn, extract their time fields, and calculate the operation interval between two adjacent accesses. For example, in the "Personnel File" segment, the access time of D001 is 08:00:03, and the access time of D003 is 08:05:27. The time interval between the two accesses is 324 seconds, which is recorded as the operation interval value of the segment. If there are multiple behavior pairs in the segment, calculate each interval one by one. For example, if the access sequence is five assets, the interval is 4 values. After constructing the interval sequence of the entire segment, perform normalized statistics on all interval values. For example, the maximum interval is 430 seconds, the minimum interval is 3 seconds, and the average is 160 seconds. Then compare each interval with the average value to identify Whether there are intervals with large deviations, the judgment criteria is set as deviations from the average value exceeding ±100 seconds, which is a critical fluctuation interval. In this example, 324 seconds is much larger than the average of 160 seconds and the deviation is 164 seconds, so it is identified as a critical interval. Its position in the behavior pair and the asset ID combination [D001-D003] are marked. This judgment standard can be adjusted according to the system policy. In some high-frequency access scenarios, the threshold can also be adjusted to ±30 seconds to identify more subtle changes. After identification, all access pairs containing critical intervals are numbered, classified, and recorded, and the results are written into the access interval fluctuation distribution set, which contains the key interval position index, access behavior asset combination, asset category, and interval value information.

[0062] The sequence offset determination submodule compares the access interval fluctuation distribution with the sequence structure of historical access behavior, determines the differences in access category and sequence between the current access path and the historical path, analyzes the fragments with abnormal order in the access path, and sorts out the occurrence order or jump position to obtain the offset sequence feature signal;

[0063] Extract the asset access path from the current access structure and convert it into a category sequence. For example, if the access sequence is "personnel file → financial data → contract text", it is extracted as the category sequence [C1, C2, C3]. Then call the user's past 30 access records to generate a historical category path. For example, in most cases, it is "personnel file → contract text → financial data". Compare the access categories at each position in the current and historical paths. It is found that the second category is "financial data" and the corresponding position in history is "contract text". There is an obvious order dislocation, which is determined to be a sequence offset item. A total of 2 offsets are compared in the entire sequence. Continue to analyze whether there is a path combination in the category switching path that has not appeared in the history. For example, there is a "contract text → budget system" switching path this time, but in the historical data, it is not found. Since there is no record in the data indicating that this path has appeared before, it is marked as a path jump item. At the same time, the records in the access interval fluctuation distribution are called to confirm whether the key interval coincides with the position where the offset occurs. For example, the access operation interval of the offset point "financial data" is 312 seconds, which is much higher than its normal level of 87 seconds. It meets the definition of key fluctuation outside the set deviation range of ±120 seconds. It is regarded as a path offset with key fluctuation behavior. Finally, all offset points, jump positions, and interval fluctuation positions are integrated to generate a structured offset sequence feature signal. The assets, behavior positions, category jump relationships and time offsets involved in each abnormal behavior segment are recorded. This is used as a preliminary path anomaly input signal in the subsequent high-frequency mutation detection and abnormal event identification logic.

[0064] See also Figure 3 , the frequency fluctuation identification module includes:

[0065] The statistical cycle extraction submodule analyzes the time series of the subject's access to the same category of assets based on the offset sequence feature signal, compares the frequency changes of access operations in each time period, records the distribution characteristics of the subject's operations in consecutive time periods, and obtains the amplitude of the access frequency changes;

[0066] First, the access records are divided according to the subject of behavior. For each user, the offset sequence feature items involved in their access to the system are extracted separately. The access time field in the feature items is read to construct a continuous access time series. Then, a fixed-length time period is used as the unit statistical period to divide the entire time axis into multiple continuous time period segments. The default statistical period is set to 5 minutes, which can be adjusted to 1 minute or 10 minutes. When divided by 5 minutes, the access time from 09:00 to 09:30 is divided into 6 time periods, namely [09:00-09:05], [09:05-09:10], and so on. In each segment, the number of times the current user accesses the same category of assets within the period is counted to generate an access frequency record table for the category of assets. For example, if a contract asset is accessed 3 times in [09:00-09:05], 1 time in [09:05-09:10], and 1 time in [09:10- 09:15] is 7 times, then the frequency sequence is [3, 1, 7]. Then the difference between the frequencies of each adjacent time period is calculated, which is -2 and +6 respectively, and the frequency change pattern is obtained as one decrease and one increase. Then the change amplitude is written into the access frequency change list in sequence, and the change direction is counted. For example, in the previous example, "-2" is classified as a decrease and "+6" is classified as an increase. Finally, a continuous period access change trend sequence table is established for each behavior subject. The table records the increasing and decreasing trends of the user's access frequency in each continuous time period, records the change value of each section and the corresponding time period number, and summarizes the statistical results into an operation distribution feature file. The time period with a change amplitude exceeding the set amplitude threshold is marked in the feature file. For example, if the change threshold is set to ±5 times, if the frequency change value of a section is +6, then the time period is recorded as a high amplitude change section, and the access frequency change amplitude is obtained.

[0067] The frequency baseline deviation submodule calculates the degree of deviation from the reference group of access frequencies of each asset category within the historical period based on the amplitude of access frequency fluctuations. It analyzes the direction of deviation within a continuous time period, determines the changing pattern of operation frequency, and obtains the frequency fluctuation trend level.

[0068] Read the historical cycle access records of each type of asset and construct an access frequency reference group. The reference group is established based on the periodic access behavior of the same behavior subject under the same asset category in the past 30 days. The average number of accesses is recorded in each 5-minute time period to form a standard benchmark sequence. For example, historically, the number of accesses of the user to "contract assets" in five cycles is [2, 3, 3, 4, 2], and the benchmark average is 2.8 times / cycle. Then, the frequency change amplitude in the current cycle is compared with the average. For example, if the current frequency is 6 times and the difference is +3.2, it is determined that the degree of deviation of the cycle is high. The deviation level is defined as three levels: mild deviation is within ±1, moderate deviation is ±1 to ±3, and severe deviation is above ±3. The current value is classified as severe deviation. Then, the deviation direction of multiple cycles is counted in order of time periods. For example, the deviation values ​​of three consecutive cycles are +3 respectively. .2, +2.7, +4.1, the direction is consistent as "positive offset", which is classified as a unidirectional upward trend. If the value of the next cycle becomes -2.5, it indicates that the offset direction has reversed. The offset inflection point is recorded and the trend paragraph is rewritten. Then, the consistency of the offset direction in the continuous time period is counted. The consistent direction segment is marked as a single trend segment, and the segment with an inflection point is classified as a multi-segment trend combination. All segments are classified into trend levels, and the fluctuation trend level is judged based on the number of offsets, the average offset amplitude and the continuous length of the trend. For example, if an actor has an offset value greater than 3 in 6 consecutive cycles out of 10 cycles and the direction is consistent, it is judged as a "high volatility trend". On the contrary, if the fluctuation value is ±1 in only 2 cycles and the direction changes frequently, it is classified as a "low volatility trend". According to the set trend classification rules, the change in the frequency of access to the current category of assets of the actor is classified as the corresponding frequency fluctuation trend level.

[0069] The burst frequency identification submodule compares the synchronization of the operating frequency offset amplitude and the change amplitude within the period based on the frequency fluctuation trend level, using the formula:

[0070]

[0071] Calculate the fluctuation of operation frequency within the cycle and obtain the frequency mutation characteristic ΔF, where f i represents the access frequency of the subject in the i-th statistical period, B i represents the access frequency reference data of the asset category in the i-th statistical period, n represents the total number of statistical periods, f1 represents the access frequency in the first period, f n Indicates the access frequency at the end of the cycle.

[0072] Frequency mutation feature refers to a data feature that comprehensively reflects whether access behavior has experienced abnormal and drastic fluctuations in the short term by analyzing the deviation between the frequency of access to the same type of assets by the subject in multiple consecutive statistical periods and the reference group (i.e., the frequency of access to the same type of assets in the historical period), as well as the cumulative frequency changes between the first and last weeks. This feature is used to identify whether the access frequency has increased synchronously and significantly or fluctuated violently, and to help determine whether there is a sudden, abnormal or risk-related trend in the access activities of a certain subject.

[0073] Taking the behavior of a user accessing the "position document" asset in a personnel management platform for five consecutive working days as the object, the access frequencies are f1=18, f2=23, f3=21, f4=26, and f5=30, and the reference data is unified as B i =20, and after normalizing the original data, the normalized access frequencies are f1=0.60, f2=0.77, f3=0.70, and f4

[0074] =0.87, f5=1.00, the corresponding reference data is normalized to B i =0.67, we can get:

[0075]

[0076] The first mean shift is The normalized difference between the first and last visit frequencies is |1.00-0.60|=0.40, so the second item is Calculation yields:

[0077] ΔF = 0.146 + 0.08 = 0.226;

[0078] The first item represents the degree of aggregation of the behavior subject's periodic deviations within the analysis period. A larger value indicates a greater degree of difference between the behavior's access behavior and the reference benchmark's daily access. The second item emphasizes the cumulative deviation trend of access behavior in the temporal dimension, which is an important supplement to the continuity of the behavioral trajectory. ΔF = 0.226 indicates that the behavior subject's access frequency continuously deviates from the normal reference state within five periods, and there is a strong transition in the access trend between the previous and next weeks. Combined with the frequency fluctuation trend level obtained in the previous module, it can be used to determine the continuity risk change of its access behavior and obtain the frequency mutation characteristic.

[0079] See also Figure 4 , the event number generation module includes:

[0080] The behavior surge screening submodule analyzes the changes in the frequency of access to the same type of assets by the subject within different periods based on frequency mutation characteristics. It compares the access data with the historical baseline, screens the key periodic behavior data of frequent access phenomena, determines whether the access pattern has fluctuated significantly, and identifies the access frequency surge segments.

[0081] Read the mutation cycle number, access asset category, and behavior subject ID marked in the frequency mutation feature record, build a period access frequency comparison list with "user-asset category" as the dimension, then sort all access records of the same subject under the same category of assets in ascending order by cycle number, extract the access frequency of the subject in the current observation period, the previous period, and the next period, form a comparison window for three consecutive periods, slide the change value of the number of accesses within the comparison period in turn, and calculate the difference with the historical average benchmark value. For example, when user U321 accesses the "Contract Information" asset, the current period is 8 times, the previous period is 3 times, and the next period is 9 times. The historical average is 3.6 times / period. This period is 5 times more than the previous value, 4.4 times more than the benchmark value, and 1 time less than the next value. Set the sudden increase judgment threshold to ≥3 times compared with the benchmark, and trigger a behavior sudden increase when the absolute value of the fluctuation value before and after the period is ≥4 times. The current period meets all the conditions, so the behavior records of this period are filtered as a sudden increase period. Then, each access record in the sudden increase period is analyzed, and its access time and access operation type are extracted. It is counted whether they are concentrated in a certain sub-time period. For example, if 6 accesses within 5 minutes are concentrated between the 2nd and 3rd minutes, it is recorded as "concentrated access". If the access operation is "read" for more than 80%, and the rest is "download", the operation mode is marked as heavy. Then, the operation type distribution of the current sudden increase period is normalized and compared with that of the adjacent periods. If the proportion of a certain type of operation in this period increases by more than 30%, it is recorded as a change in the behavior operation composition. Combined with the sudden increase value, concentrated access index, and the number of changes in operation composition, it is determined whether the current access pattern has shifted from a regular rhythm to a high-density, high-frequency operation mode. If any two of the above changes are met at the same time, the periodic behavior is identified as a "sudden increase in access frequency segment".

[0082] The access association construction submodule optimizes the time sequence of periodic behavior data based on the access frequency surge segments, calculates the interaction path between the behavior subject and the accessed asset, analyzes the corresponding relationship between the subject, asset and time during the continuous access process, and establishes the access mapping path structure;

[0083] Extract all access records in the burst segment and sort them in chronological order. Extract the subject, asset unique identifier, access timestamp and operation type from each record. Build an access action list by sorting by timestamp. Then perform subject consistency check on any two consecutive records in the time list to confirm whether they are the same user behavior. If they are consistent, build a chain mapping pair. Then read the asset number accessed by the user. For example, if user U321 accesses A101, A102, A103, and A107 in the order of access, build a path node string [U321→A101→A102→A103→A107]. Then extract the start time and duration fields of each access record and calculate the interaction time span between the user and each asset. For example, if A101 accesses from 10:01:22 to 10 :01:49, the interaction duration is 27 seconds. This time is marked on the edge of the path, and then the access chain is compared with the recorded asset relationship network to confirm whether the current behavior involves a logically continuous asset group. If A101 and A102 are both adjacent nodes in the contract approval process, the path is marked as "approval process access chain". If A103 is a cross-system access path, such as jumping to the budget query platform, the recorded path label is "cross-platform access". Then the path structure is hierarchically recorded according to the "asset ID-time point" pair to construct an access mapping path structure map. Each node corresponds to the access asset, and each side corresponds to the access sequence and time. All sudden increase fragments are converted into path records with associated node sequences, access rhythm attributes and system boundary crossing marks, and the complete access mapping path structure is output.

[0084] The number mapping submodule compares the actual order of the access link information with the historical order based on the access mapping path structure and calculates the sequence deviation between the two using the formula:

[0085]

[0086] Obtain event judgment indicators and sort the matching strength of event combinations to obtain abnormal event mapping sets, where EQ v Indicates the event judgment index corresponding to the vth group of access behavior, AQ v,k represents the actual access sequence code of the vth group in the kth access, CQ v,k Denotes the historical access sequence code of the vth group in the kth access, DQ v,k PQ represents the interval parameter of continuous operations of group v in the kth visit. v,k SQ represents the abnormal identification parameter of the vth group in the kth visit, v,k Indicates the access category offset parameter of the vth group in the kth access, n EQ Indicates the total number of access records.

[0087] Event judgment indicators refer to quantitative reference parameters used to comprehensively judge and distinguish each group of access behavior combinations in security warnings. They reflect the overall deviation and degree of abnormality between a group of access behaviors and historical access patterns in terms of sequence, interval, and abnormal performance. They are used to assist in determining whether the access combination has abnormal characteristics and whether a unique event number needs to be generated and included in the abnormal event mapping set.

[0088] Call the sequential encoding data in the access mapping path structure, denoted as AQ v,k With CQ v,k , expand it by position, calculate the item-by-item difference between the two and perform square processing to measure the consistency of the sequence structure, and collect the operation interval sequence DQ between two adjacent accesses v,k As a factor reflecting the change of access rhythm, this factor will participate in the overall denominator weighted calculation process to further identify whether there is a jumping or unstable rhythm pattern in the access behavior, and then introduce the abnormal identification quantity PQ v,k Access category offset factor SQ v,k , respectively reflecting the number of offset points and category level changes that have not appeared in the historical path of the current behavior. By integrating the above four groups of indicators: difference, interval, mark and category, the event judgment index EQ is calculated. v For example, for user A, let his set of behavior sequence parameters be:

[0089] AQ v,k =[1,2,3], CQ v,k =[1,3,2], DQ v,k =[3,5], PQ v,k =[0.0,0.6,0.9], SQ v,k =

[0090] [0.8,0.2,0.9];

[0091] Among them PQ v,k With SQ v,k The parameters are normalized, and the event indicators for this group are calculated as follows:

[0092]

[0093]

[0094] For example, user C, if the parameters are:

[0095] AQ v,k =[1,3,2], CQ v,k =[1,2,3], DQ v,k =[2,6], PQ v,k=[0.7,0.1,0.8], SQ v,k =

[0096] [0.2, 0.6, 0.9], also normalized, then:

[0097]

[0098] EQ v They are 1.18 and 1.17 respectively. If both exceed the median level of the set event identification reference interval and are far away from the identification baseline, the two groups of access behaviors will be classified into the abnormal event mapping set. Their corresponding event numbers will be used for the unique generation and tracking management of subsequent response tasks. The formula establishes a unified cross-dimensional indicator measurement method by integrating the degree of behavior sequence deviation, the degree of continuous operation closeness and the intensity of abnormal category participation, thereby improving the discrimination resolution of complex access combinations.

[0099] See also Figure 5 , the sensitivity classification determination module includes:

[0100] The access attribute extraction submodule compares the changing trends of the associated assets in terms of access frequency, asset criticality, risk level, and abnormal status parameters based on the abnormal event mapping set. It calculates the differences between the parameters in the same time series, filters out key items that show abnormalities, and obtains the access behavior fluctuation.

[0101] First, read the behavior subject identifier, asset code and event number corresponding to each abnormal event from the mapping set, extract the access frequency data, asset criticality rating, risk level identifier and abnormal status mark of the asset in the two periods before and after the abnormal event, and organize them in chronological order to form a property change sequence. The access frequency is recorded on the time axis in the period dimension, and the number of visits in the current period and the previous period are subtracted. For example, the access frequency in period T1 is 9 times and in period T0 is 3 times, then the frequency change value is +6 times. The difference is used as the access frequency change value. Then, a horizontal comparison is performed on the asset criticality parameters, and the criticality score set in the asset basic information is read. For example, the score of asset A301 is 4.5 points and the historical average is 3.2 points. The criticality score offset is calculated as +1.3. Then the risk level identifier of the asset is taken out. If the current level is level 3 and the historical level is level 1, the level offset is calculated as +2. The offset values ​​are merged to form attribute change groups of four dimensions: access frequency change value, criticality change value, risk level offset, and abnormal status change value. Then, for these four parameters of the same asset in adjacent time series, the difference values ​​between adjacent periods are compared one by one, and the fluctuation amplitude is calculated for each item. Then, the fluctuation amplitude is judged against the preset fluctuation threshold. The access frequency fluctuation is set to 3 times as the judgment benchmark, the criticality score fluctuation threshold is set to 1.0 points, and the risk level change is set to level 1 as the judgment baseline. If the change amplitude of any parameter in a certain period is greater than its threshold, the attribute is marked as an abnormal item. For example, the access frequency +6, criticality +1.3, and risk level +2 mentioned above all exceed the threshold and are therefore screened as key attribute items. Finally, the combination of marked items is organized into the access behavior attribute fluctuation volume of a single behavior subject. The abnormal value category, change amplitude, corresponding asset, and occurrence period number are recorded to form the access behavior fluctuation volume result.

[0102] The collaborative feature analysis submodule determines the distribution of sensitive asset categories and asset criticality based on access behavior fluctuations, compares the synchronization of access frequency and asset criticality within each sensitive category, identifies parameters with prominent joint features, and obtains the collaborative magnitude of similar features.

[0103] Classify all records in the access behavior fluctuation volume by asset category, and assign all assets belonging to the fluctuation items to their sensitive asset category set. For example, assets A301 and A302 both belong to the "Contract Information" category, and assets B201 and B202 belong to the "Budget System" category. Construct a sensitive category fluctuation data set based on category. Next, extract the criticality score for each asset category, and statistically analyze the distribution of this score within its sensitive category to generate a criticality score interval distribution table. For example, there are 30 assets in the "Contract Information" category, and 70% of them have a criticality score between 3.5 and 4.8. Define this score interval as the criticality concentration zone. Then, perform segmented statistics on access frequency, classifying behaviors with more than 5 accesses per period as high-frequency behaviors. Then, perform matching judgments based on assets. That is, if an asset has an access frequency ≥ 5 times and a criticality score ≥ 3.5, it is considered a joint indicator hit. Then, extract the abnormal status identification and risk level deviation records of the asset to determine whether it also has change deviations. If all three parameters fluctuate synchronously and in the same direction, such as an increase in access frequency, criticality, or risk level, the item is labeled "highly synergistic behavior." A "synergistic" behavior is assigned if at least two of these synchronous changes occur, and "highly synergistic" behavior is assigned if three occur. For example, if the access frequency of asset A301 increases from 4 to 10, the criticality score increases from 3.8 to 4.5, and the risk level increases from 2 to 3, the item is identified as highly synergistic. The frequency of occurrence of such synergistic items within sensitive categories is then counted, and the proportion of such items is proportionally converted to the total number of items within the category. For example, if the "Contract Information" category has 40 assets, 12 of which are highly synergistic, the synergy margin is 30%. The synergy margin is categorized as "weak" (less than 20%), "medium" (20% to 50%), and "strong" (more than 50%). Finally, the combined results of the criticality and access frequency distribution patterns for each sensitive asset category are written into the synergy feature structure table, recording the synergy hit rate and magnitude between similar parameters, and outputting the synergy margin for similar features.

[0104] The weight parameter calculation submodule calculates the collaborative performance of access frequency, asset criticality, risk level, and abnormal status under sensitive categories based on the collaborative amplitude of similar features, using the formula:

[0105]

[0106] Adjust the weight distribution of each parameter in the performance to obtain the graded sensitivity weight, WB z Indicates the hierarchical sensitivity weight of the z-th parameter, Bs zs represents the synergistic performance of the z-th parameter under the s-th asset, represents the mean value of the synergistic performance of the z-th parameter among all participating assets, Bv zs represents the access fluctuation of the z-th parameter in the s-th asset, Br zsIndicates the risk status of the z-th parameter in the s-th asset, Bd zs Indicates the abnormal state of the z-th parameter in the s-th asset, n WB Indicates the total number of assets.

[0107] The hierarchical sensitivity weight refers to the comprehensive sensitivity index obtained by analyzing, calculating, screening and grading the coordinated performance of multiple parameters such as access frequency, asset importance, risk level, abnormal status, etc. for each type of sensitive asset in the security early warning process. It can reflect the comprehensive risk characteristics and security management needs of this type of sensitive assets under different abnormal behavior events, and provide a basis for subsequent early warning notifications, hierarchical management and the formulation of response measures.

[0108] Normalize each parameter type and directly substitute the normalized result into the formula for the next calculation. Set the key asset set currently being processed to 4 assets and set the parameters as follows:

[0109] The first asset has an access frequency of 22 times, a criticality level of 3, a risk level of 4 times, and an abnormal status of 3 times. The normalized access frequency is 0.85, the collaborative performance is 78, and the normalized value is 0.78.

[0110] The second asset has an access frequency of 15 times, a criticality level of 2, a risk level of 2, an abnormal state of 2, a normalized access frequency of 0.65, a collaborative performance of 43, and a normalized value of 0.43;

[0111] The third asset has an access frequency of 27 times, a criticality level of 3, a risk level of 5 times, an abnormal state of 4 times, a normalized access frequency of 0.95, a collaborative performance of 93, and a normalized value of 0.93;

[0112] The access frequency of the fourth asset is 19 times, the criticality level is 2, the risk level is 3 times, the abnormal state is 1 time, the normalized access frequency is 0.72, the collaborative performance is 55, and the normalization is 0.55. Set the total number of participating assets n WB =4, the average synergy performance is calculated as follows:

[0113]

[0114] Then the molecular part is calculated:

[0115]

[0116] We get:

[0117] 0.1075·0.85=0.091375;

[0118] 0.2425·0.65=0.157625;

[0119] 0.2575·0.95=0.244625;

[0120] 0.1225·0.72=0.0882;

[0121] The sum of the numerators of the four terms is:

[0122] 0.091375+0.157625+0.244625+0.0882=0.581825;

[0123] Then calculate the denominator:

[0124]

[0125] Multiply by the number of assets to get:

[0126]

[0127] Substituting into the formula:

[0128]

[0129] The results show that in this group of key asset samples, the hierarchical sensitivity weight of the z-th parameter is approximately 0.0297. This value is used to indicate the level of synergistic contribution of this type of parameter in the identification of sensitive assets. In the subsequent process of sensitive asset classification judgment and early warning push strategy matching, this weight will participate in the screening decision as a key parameter. The formula introduces the synergistic deviation between parameters and combines normalization processing to access volatility items and risk and abnormal comprehensive parameters. It can comprehensively identify the true synergistic strength of various parameters under sensitive categories, which helps to enhance the comprehensiveness and stability of risk identification.

[0130] See also Figure 6 , the notification content push module includes:

[0131] The push object identification submodule analyzes the access frequency, asset value, risk level, and abnormal status of the assets associated with the event number based on the hierarchical sensitivity weights. It compares the role permissions and identity category of the actor to determine whether the push conditions match the current parameter combination, identifies the objects with receiving permissions, and obtains the target role identification set.

[0132] Read the asset ID and subject ID corresponding to each event number, extract the access frequency score, asset value score, risk level label and current abnormal status value of the asset from the sensitivity weight table, and record them one by one in the asset characteristic structure according to the field. Then, match and analyze the role authority level and identity category field of the subject. For example, if the subject is an "external auditor", its authority level is 1 and its identity category is "external temporary user". Then read the set push permission benchmark table, judge the four parameters involved in the current event with the permission conditions respectively, and set the push judgment rules as follows: the access frequency score is greater than 7 points, the asset value score is not less than 8 points, and the risk level is level 3 and above. If any three of the above items are met, the push condition is triggered. The current asset frequency score is 8.3, the value score is 9.1, the risk level is level 3, and the abnormal status is "activated". All four items are met and the push condition is met. Then the identity of the behavior subject is matched with the push strategy. If the current subject is a "system administrator", it will be automatically included in the target push object. If it is an ordinary employee with an authority level of 1 and the behavior abnormality is triggered for the first time, it will be excluded from the target. The successfully matched subject ID, role code and push condition hit item are written into the target role identification set. The set uses the role as the index field and records all users who meet the receiving conditions and their corresponding trigger event numbers.

[0133] The information structure arrangement submodule, based on the target role identifier set, screens the content type of the target role in historical notifications, analyzes the order of field appearance and expression, optimizes the field classification and sorting structure, compares the coverage and intersection of each field in different roles, and obtains the role field structure template;

[0134] Read the field lists and content fragments received by each target role in historical notifications, extract the content type and display order of all fields by notification number, such as "asset code → event number → access time → recommended response", count the frequency of occurrence of each field in all historical notifications of the same role, mark the fields with a frequency greater than 80% as resident fields, compare the order of field appearance, record the number of times the previous and next fields are swapped, assign sorting priority to the fields that frequently appear in the first two positions, and then analyze whether the expression in the field is structured text, summary description or graphic display, and classify and archive the fields according to content form, such as "event number" is a text field, and "access path" is a structured diagram. "Response Suggestion" is a natural language paragraph, and then a cross-comparison of field types is performed for all target roles. If multiple roles receive the three fields of "Event Number", "Asset Value" and "Response Suggestion" in the notification, the fields are role intersection fields. If a field only appears in the administrator notification, such as "Permission Control Record", it is recorded as a role-specific field. Finally, the resident fields, intersection fields and exclusive fields of each role are marked, and the field classification method is optimized. Structured data is prioritized, and auxiliary fields are placed at the end. A role field structure template is comprehensively generated. The template is hierarchically labeled according to field priority, structural form and role distinction, and a complete field configuration structure is formed with role as the index.

[0135] The information hierarchy optimization submodule determines the field receiving hierarchy based on the role field structure template, analyzes the distribution of permissions, responsibilities, and task scopes among roles, adjusts the arrangement of fields in the content structure of different roles, optimizes the hierarchical attribution and display of information, and obtains role warning push information;

[0136] Read the field level tag, role permission level, and field type in the template, and divide the field display range for all fields according to the permission level of the receiving object. For example, a user with permission level 3 can receive a total of 10 fields, while a user with level 1 can only receive the contents of the first 4 fields. Then analyze the functional information and task scope bound to the role in the system. For example, if the role is "IT Director" and its functions include resource management and log auditing, then the "Abnormal Access Time", "Access Frequency Trend", and "Log Summary" in the field are marked as the main receiving fields. Continue to determine whether there are overlapping functional requirements for the field. For example, if the "Asset Code" field corresponds to both the asset owner and the security auditor, set the field level to general Fields are assigned to multiple role notification templates, and then the order of fields is adjusted, giving priority to fields with high criticality and wide role intersections. In the same notification template, "event number", "response level" and "access path" are ranked first, and "suggested operation" and "abnormal status description" are placed at the end. Then, each role template and its permission level are linked and adjusted. High-authority roles receive more fields and more specific information, while low-authority roles receive fewer and more streamlined fields. Finally, the order of arrangement, reception level and display method of fields between different roles are output as a structured field hierarchy set. This set is constructed with a four-layer structure of "role → field list → hierarchy level → display method" as the output basis for role warning push information.

[0137] The above are merely preferred embodiments of the present invention and do not limit the present invention in any other form. Any technician familiar with the profession may use the technical content disclosed above to change or modify it into an equivalent embodiment with equivalent changes and apply it to other fields. However, any simple modification, equivalent change and modification made to the above embodiment based on the technical essence of the present invention without departing from the content of the technical solution of the present invention shall still fall within the scope of protection of the technical solution of the present invention.

Claims

1. A safety early warning system based on big data, characterized in that: The system comprises: The sequence behavior analysis module compares the access sequence and operation interval of enterprise digital assets based on the user's current access behavior sequence, identifies changes in operation intervals when accessing assets, screens interval fluctuations in continuous access to assets of the same category, determines whether there are anomalies, and obtains offset sequence feature signals; The frequency fluctuation identification module counts the number of times the subject accesses the same type of asset in each period based on the offset sequence characteristic signal, analyzes the change between the number and the behavior baseline, determines the mutation trend of the access frequency in a short period of time, and obtains the frequency mutation characteristic value; The event number generation module filters the mutation behavior data based on the frequency mutation feature, analyzes the event attributes and identifies abnormal access based on the behavior subject, asset category and access time, adjusts the parameter combination to generate a unique event number, and obtains an abnormal event mapping set; The sensitivity grading determination module compares the asset access frequency, asset value, risk level and abnormal status based on the abnormal event mapping set, analyzes the performance of each parameter under the sensitive asset category, screens assets with grading characteristics, calculates parameter contribution, and obtains the graded sensitivity weight.

2. The big data-based safety early warning system according to claim 1 is characterized in that: The offset sequence characteristic signal includes a sequence anomaly identifier, an interval change category, and behavior sequence distribution information; the frequency mutation characteristic includes an access high-frequency area identifier, a frequency change level, and frequency information within a cycle; the abnormal event mapping set includes an event identification number, an associated asset code, and event tag information; and the graded sensitivity weight includes a sensitive asset level, a risk weight allocation, and a graded quantitative parameter.

3. The big data-based safety early warning system according to claim 1 is characterized in that: The sequence behavior analysis module includes: The access sequence extraction submodule analyzes the order of each user's access to the enterprise's digital assets based on the user's current access behavior sequence, arranges the access data in order of occurrence, optimizes the order relationship between assets of different categories, and filters the fragments of continuous access to assets of the same category to generate an access sequence structure sequence; The operation interval identification submodule analyzes the continuous access behavior based on the access sequence structure sequence, compares the time interval distribution between access operations of the same type of assets, determines which intervals in the continuous access process have key changes, identifies the location of the operation intervals with key fluctuations, and obtains the access interval fluctuation distribution; The sequential offset determination submodule compares the access interval fluctuation distribution with the sequential structure of historical access behavior, determines the differences in access category and sequence between the current access path and the historical path, analyzes the fragments of abnormal order in the access path, and organizes the occurrence order or jump position to obtain the offset sequence characteristic signal.

4. The big data-based safety early warning system according to claim 1 is characterized in that: The frequency fluctuation identification module includes: The statistical period extraction submodule analyzes the access time series of the subject to the same category of assets based on the offset sequence feature signal, compares the frequency changes of access operations in each time period, records the operation distribution characteristics of the subject in consecutive time periods, and obtains the amplitude of the access frequency change; The frequency baseline deviation submodule calculates the degree of deviation from the reference group of access frequencies of each category of assets in the historical period based on the amplitude of the access frequency fluctuation, analyzes the direction of the deviation in the continuous time period, determines the changing pattern of the operation frequency, and obtains the frequency fluctuation trend level; The burst frequency identification submodule compares the synchronization of the operating frequency offset amplitude and the change amplitude within the cycle based on the frequency fluctuation trend level, calculates the operating frequency fluctuation within the cycle, and obtains the frequency mutation feature.

5. The big data-based safety early warning system according to claim 1 is characterized in that: The event number generation module includes: The behavior surge screening submodule analyzes the changes in the frequency of access to the same type of assets by the subject within different periods based on the frequency mutation feature, compares the access data with the historical baseline, screens the key periodic behavior data of frequent access phenomena, determines whether the access pattern has fluctuated significantly, and obtains the access frequency surge segment; The access association construction submodule optimizes the time sequence of the periodic behavior data based on the access frequency surge segment, calculates the interaction path between the behavior subject and the accessed asset, analyzes the corresponding relationship between the subject, asset and time in the continuous access process, and establishes an access mapping path structure; The number mapping arrangement submodule compares the actual sequence and the historical sequence in the access link information based on the access mapping path structure, calculates the sequence deviation between the two, obtains the event judgment index, and sorts the matching strength of the event combination to obtain the abnormal event mapping set.

6. The big data-based safety early warning system according to claim 1 is characterized in that: The sensitivity classification determination module includes: The access attribute extraction submodule compares the change trends of the associated assets in terms of access frequency, asset criticality, risk level, and abnormal status parameters based on the abnormal event mapping set, calculates the differences between the parameters in the same time series, filters the key items that show abnormalities, and obtains the access behavior fluctuation amount; The collaborative feature analysis submodule determines the distribution of sensitive asset categories and asset criticality based on the fluctuation of access behavior, compares the synchronization performance of access frequency and asset criticality within each sensitive category, identifies parameters with prominent joint features, and obtains the collaborative magnitude of similar features; The weight parameter calculation submodule calculates the collaborative performance of access frequency, asset criticality, risk level and abnormal status under sensitive categories based on the collaborative amplitude of the same type of features, adjusts the weight distribution of each parameter in the performance, and obtains the graded sensitivity weight.

7. The big data-based safety early warning system according to claim 1 is characterized in that: The system further comprises: The notification content push module determines the warning push scenario based on the hierarchical sensitivity weight, analyzes the authority and identity of the push object, identifies the object to be notified, organizes the push content structure, optimizes the expression method and information hierarchy, and obtains the role warning push information; The role warning push information includes a notification type identifier, a push role tag, and associated response content.

8. The big data-based safety early warning system according to claim 7 is characterized in that: The notification content push module includes: The push object identification submodule analyzes the access frequency, asset value, risk level, and abnormal status of the asset associated with the event number based on the hierarchical sensitivity weight, compares the role authority and identity category of the actor, determines whether the push conditions match the current parameter combination, identifies the object with the receiving authority, and obtains the target role identification set; The information structure arrangement submodule, based on the target role identification set, screens the content type of the target role in historical notifications, analyzes the order of field appearance and expression, optimizes the field classification and sorting structure, compares the coverage and intersection of each field in different roles, and obtains a role field structure template; The information hierarchy optimization submodule determines the field receiving hierarchy based on the role field structure template, analyzes the distribution of permissions, functions and task scopes among roles, adjusts the arrangement of fields in the content structure of different roles, optimizes the hierarchical attribution and display of information, and obtains role warning push information.

Images