Digital certificate expiration risk monitoring and evaluating method, system and device based on large model

Abstract

The invention provides a digital certificate expiration risk monitoring and evaluating method, system and device based on a large model, and relates to the technical field of digital certificate management.The method comprises the steps that a secure communication protocol digital certificate set is obtained through a management interface of a target server, and the attribute of each digital certificate is extracted; standardizing the attributes of the digital certificate to generate a structured certificate data set; and inputting the structured certificate data set into a pre-training large model based on a converter architecture, extracting feature representation of certificate expiration risks, and analyzing certificate risk features to obtain three risk indexes including a remaining period of validity, security strength and business criticality. The digital certificate expiration risk is accurately identified and efficiently processed, safe and stable operation of a service system is guaranteed, and certificate risk management efficiency and accuracy are improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of digital certificate management, in particular to a digital certificate expiration risk monitoring and evaluation method, system and device based on a large model. BACKGROUND

[0002] In current network communication security, the security communication protocol digital certificate is the key basis for guaranteeing the confidentiality and integrity of website service data transmission. Most of the existing monitoring technologies for the expiration risk of such certificates still rely on static threshold judgment of the certificate validity period. For example, the monitoring system of some enterprises only triggers an alarm when the remaining days of a certificate are less than 30 days, which is a fixed value. Such methods are prone to ignore the differences in security strength and the importance of business of the certificates in actual application. For example, the security communication protocol digital certificate (using a 2048-bit RSA key) used for the payment interface of an e-commerce platform and the certificate (using a 1024-bit RSA key) of an internal test system have the same remaining validity period, but the former carries core transaction business and has a higher key strength, so the impact of the expiration risk on the business is significantly different from that of the latter. However, the static threshold method cannot distinguish such differences, resulting in a relatively single risk assessment result that cannot fully and accurately reflect the actual risk level of certificate expiration.

[0003] In addition, some existing technologies lack a deep fusion of multi-dimensional risk characteristics and a dynamic weight adjustment mechanism, which may cause evaluation deviation in complex and variable business environments. For example, when an enterprise runs multiple types of businesses such as e-commerce transactions, user login, and internal file transmission, the existing technologies cannot adjust the risk assessment weights according to the real-time load and security requirements of different businesses, which may lead to underestimation of the potential risk of security communication protocol digital certificates associated with core businesses or excessive triggering of alarms for non-critical business certificates, making it difficult to meet the needs of modern infrastructure for intelligent management of certificate life cycle. SUMMARY

[0004] The technical problem to be solved by the present application is to provide a digital certificate expiration risk monitoring and evaluation method, system and device based on a large model, which automatically processes certificate data evaluation, risk level division and update task sorting, reduces manual intervention processes, and improves certificate management efficiency.

[0005] To solve the above technical problems, the technical solution of the present application is as follows: In a first aspect, a digital certificate expiration risk monitoring and evaluation method based on a large model is provided, the method comprising: Step S1: obtaining a set of security communication protocol digital certificates through a management interface of a target server and extracting attributes of each digital certificate; performing standardization processing on the digital certificate attributes to generate a structured certificate data set; Step S2, input the structured certificate dataset into the pre-trained large model based on the transformer architecture, extract the feature representation of the certificate expiration risk, and analyze the certificate risk features to obtain three risk indicators including the remaining validity period, security strength and business criticality; Step S3, reconstruct the three risk indicators in spatial dimensions to establish a risk assessment framework including three evaluation dimensions, each evaluation dimension corresponding to a risk indicator, and determine the core area of the feature distribution in the three evaluation dimensions, including the feature extreme value area and the feature density concentration area; Step S4, map the feature representation of the certificate expiration risk to each evaluation dimension, and generate risk weight adjustment parameters according to the aggregation degree and dispersion degree of the feature representation; Step S5, use the core area data and risk weight adjustment parameters to perform weighted optimization calculation on the three risk indicators to obtain the optimized risk assessment result; Step S6, according to the optimized risk assessment result, identify the digital certificate that will expire within a preset time range, and perform multi-level risk classification according to the remaining validity time and business importance to generate an evaluation report with risk level identification; Step S7, according to the evaluation report, trigger the certificate update mechanism, generate new certificates according to the risk level priority order and distribute them to the target server.

[0006] The second aspect is a digital certificate expiration risk monitoring and evaluation system based on a large model, comprising: A data acquisition module is configured to obtain a set of secure communication protocol digital certificates through a target server management interface, extract attributes of each digital certificate, and perform standardized processing on the attributes to generate a structured certificate dataset; An indicator generation module is configured to input the structured certificate dataset into a pre-trained large model based on a transformer architecture, extract the feature representation of the certificate expiration risk, and analyze the certificate risk features to obtain three risk indicators including the remaining validity period, security strength and business criticality; A framework building module is configured to reconstruct the three risk indicators in spatial dimensions to establish a risk assessment framework including three evaluation dimensions, each evaluation dimension corresponding to a risk indicator, and determine the core area of the feature distribution in the three evaluation dimensions, including the feature extreme value area and the feature density concentration area; A parameter generation module is configured to map the feature representation of the certificate expiration risk to each evaluation dimension, and generate risk weight adjustment parameters according to the aggregation degree and dispersion degree of the feature representation; An optimization calculation module is configured to use the core area data and risk weight adjustment parameters to perform weighted optimization calculation on the three risk indicators to obtain the optimized risk assessment result; The report generation module is configured to identify digital certificates that are about to expire within a preset time range according to the optimized risk assessment result, perform multi-level risk classification according to the remaining valid time and business importance, and generate an assessment report with risk level identification. The certificate update module is configured to trigger a certificate update mechanism according to the assessment report, generate new certificates according to the risk level priority order, and distribute the new certificates to target servers.

[0007] In a third aspect, a large model-based digital certificate expiration risk monitoring and assessment device is provided, comprising: one or more processors; a storage device configured to store one or more programs, when the one or more programs are executed by the one or more processors, the one or more processors implement the method.

[0008] The above-mentioned scheme of the present application at least includes the following beneficial effects: By extracting multiple attributes such as issuing authority, validity period, and key configuration and standardizing them, combined with three risk indicators of remaining validity period, security strength, and business criticality, the risk differences of core business high-security strength certificates and non-critical business low-security strength certificates can be covered, and the evaluation one-sidedness can be avoided; a three-dimensional evaluation framework is constructed and a core area is determined, dynamic weight adjustment parameters are generated according to the feature aggregation and dispersion degree, the problem of lack of dynamic weight adjustment is solved, the index weight can be adjusted in real time according to the business state, such as increasing the weight of core certificates during the peak period, to avoid underestimating core risks or excessive non-critical alarms, and to improve the evaluation accuracy in complex environments; by performing multi-level risk classification on the certificates that are about to expire and generating a report with level identification, high-risk certificates can be accurately identified, core service interruptions caused by certificate expiration can be reduced, non-critical certificate alarm interference can be avoided, and management efficiency can be improved. BRIEF DESCRIPTION OF DRAWINGS

[0009] Figure 1 is a flowchart of a large model-based digital certificate expiration risk monitoring and assessment method provided by an embodiment of the present application.

[0010] Figure 2 is a schematic diagram of a large model-based digital certificate expiration risk monitoring and assessment system provided by an embodiment of the present application. DETAILED DESCRIPTION

[0011] Exemplary embodiments of the present disclosure will be described in greater detail below with reference to the accompanying drawings. While exemplary embodiments of the present disclosure are shown in the drawings, it is understood that the present disclosure can be embodied in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided so that the present disclosure can be more thoroughly understood, and so that the scope of the present disclosure can be completely conveyed to those skilled in the art.

[0012] As Figure 1 shown, an embodiment of the present application proposes a large model-based digital certificate expiration risk monitoring and evaluation method, which comprises the following steps: Step S1, obtain a set of secure communication protocol digital certificates through the management interface of the target server, and extract the attributes of each digital certificate; standardize the digital certificate attributes to generate a structured certificate dataset; Step S2, input the structured certificate dataset into a pre-trained large model based on a transformer architecture, extract the feature representation of the certificate expiration risk, and analyze the certificate risk features to obtain three risk indicators including the remaining validity period, security strength and business criticality; Step S3, reconstruct the spatial dimensions of the three risk indicators to establish a risk evaluation framework containing three evaluation dimensions, each evaluation dimension corresponding to a risk indicator, and determine the core area of the feature distribution in the three evaluation dimensions, including the feature extreme value area and the feature density concentration area; Step S4, map the feature representation of the certificate expiration risk to each evaluation dimension, and generate risk weight adjustment parameters according to the aggregation degree and dispersion degree of the feature representation; Step S5, use the core area data and risk weight adjustment parameters to perform weighted optimization calculation on the three risk indicators to obtain the optimized risk evaluation result; Step S6, according to the optimized risk evaluation result, identify the digital certificates that will expire within a preset time range, and perform multi-level risk classification according to the remaining validity time and business importance to generate an evaluation report with risk level identification; Step S7, trigger the certificate update mechanism according to the evaluation report, generate new certificates according to the risk level priority order and distribute them to the target server.

[0013] In the embodiment of the present application, by extracting multiple attributes such as issuing authority, validity period, key configuration and standardizing, combined with three risk indicators of remaining validity period, security strength and business criticality, the risk differences of core business high security strength certificate and non-critical business low security strength certificate can be distinguished, and the one-sidedness of evaluation can be avoided; a three-dimensional evaluation framework is constructed and a core area is determined, dynamic weight adjustment parameters are generated according to the degree of feature aggregation and dispersion, and the index weight can be adjusted in real time according to the business state, such as increasing the weight of core certificate during the peak period of business, so as to avoid underestimation of core risk or excessive alarm of non-critical certificate, and improve the evaluation accuracy in complex environment; by classifying the certificates about to expire into multiple levels and generating a report with level identification, high-risk certificates can be accurately identified, core service interruption caused by certificate expiration can be reduced, and non-critical certificate alarm interference can be avoided, thereby improving management efficiency.

[0014] In a preferred embodiment of the present application, the step S1 comprises: In the embodiment of the present application, in step 100, the set of security communication protocol digital certificates deployed in the target server is collected through a management interface, and the issuing authority attribute, validity period attribute and key configuration attribute of each digital certificate are extracted, which specifically includes: determining the range of target servers that need to be collected, which should cover all servers in the enterprise that deploy security communication protocol digital certificates, including servers for core business such as e-commerce transactions and user payments, and servers for non-core business such as internal testing and file transfer, initiating a certificate collection request through the management interface of the target server, the management interface needs to be pre-authenticated to ensure the security and legality of the collection operation, the authentication method can use account password verification or key verification, and after verification, the interface access permission is obtained, then all security communication protocol digital certificates deployed in the target server are read through the management interface in batches to form a certificate set, and then the attributes of each digital certificate in the certificate set are extracted one by one, the extraction process needs to traverse the metadata information of each certificate, for the issuing authority attribute, the issuing authority name, unique identification code of the issuing authority and qualification level information of the issuing authority need to be obtained; for the validity period attribute, the starting effective time and the termination invalidation time of the certificate need to be obtained, the starting effective time is the time when the certificate begins to have legal effect, and the termination invalidation time is the time when the certificate loses legal effect; for the key configuration attribute, the key algorithm type used by the certificate needs to be obtained, such as RSA algorithm, ECC algorithm, key length, such as 1024 bits, 2048 bits, and signature algorithm type of the key, such as SHA256withRSA, SHA384withECC, to ensure that the three types of attributes of each certificate are completely extracted without omission or loss.

[0015] Step 101, standardize the digital certificate attributes, including converting the certificate validity period into a unified time format, converting the key configuration attributes into a standardized parameter representation, obtaining the standardized digital certificate attributes, specifically including: processing the standardization conversion of the validity period attribute, first collecting all the extracted certificate validity period information, counting the types of time formats existing in these information, the time formats including year-month-day-hour-minute-second format, year / month / day / hour / minute / second format and timestamp format, etc., determining the unified target time format, the target time format selects the year-month-day-hour-minute-second 24-hour format, which needs to contain four-digit year number, two-digit month number, two-digit date number, two-digit hour number, two-digit minute number and two-digit second number; for the validity period originally in the year / month / day / hour / minute / second format, replace the slash with the horizontal bar to convert it into the year-month-day-hour-minute-second format; for the validity period originally in the timestamp format, first determine the reference time of the timestamp, such as January 1, 1970, 0:00:00, then calculate the specific year, month, day, hour, minute and second values corresponding to the timestamp, and then combine them according to the year-month-day-hour-minute-second format to complete the unified format conversion of the validity period, then process the standardized parameter representation of the key configuration attribute, for the key algorithm type, unify the naming of different expressions but essentially the same algorithm type, for example, unify RSA algorithm, RSA encryption algorithm as RSA, unify ECC algorithm, elliptic curve encryption algorithm as ECC; for the key length, directly keep the combination of numbers and "bits", ensure that all key lengths are presented in the format of "number+bit", such as 1024 bits, 2048 bits; for the signature algorithm type, also perform unified naming processing, unify SHA256withRSA algorithm, SHA256-RSA signature algorithm as SHA256withRSA, unify SHA384withECC algorithm, SHA384-ECC signature algorithm as SHA384withECC, through the above processing, the validity period attribute and the key configuration attribute of all digital certificates conform to the unified standard.

[0016] Step 102, the standardized digital certificate attributes are organized according to a predefined data structure to generate a structured certificate data set containing all standardized digital certificate attributes, specifically including: determining a predefined data structure, which needs to contain fields corresponding to digital certificate attributes, each field corresponding to a type of standardized attribute, and the specific fields are certificate unique identifier field, issuing authority name field, issuing authority identification code field, issuing authority qualification level field, certificate start validity time field, certificate termination invalidation time field, key algorithm type field, key length field, signature algorithm type field, wherein the certificate unique identifier field is used to distinguish different digital certificates, and the serial number of the certificate can be used as the unique identification content, then, for each standardized digital certificate, the corresponding attributes are filled in the corresponding fields of the predefined data structure one by one: the serial number of the certificate is filled in the certificate unique identifier field, the standardized issuing authority name is filled in the issuing authority name field, the standardized issuing authority unique identification code is filled in the issuing authority identification code field, the standardized issuing authority qualification level is filled in the issuing authority qualification level field, the uniform format start validity time is filled in the certificate start validity time field, the uniform format termination invalidation time is filled in the certificate termination invalidation time field, the uniform naming key algorithm type is filled in the key algorithm type field, the uniform format key length is filled in the key length field, and the uniform naming signature algorithm type is filled in the signature algorithm type field, in the filling process, the correspondence between the content of each field and the certificate attribute needs to be checked one by one to ensure that there is no error filling or missing filling, when the attributes of all digital certificates are completed, the data structures with complete filling are sorted according to the order of the certificate unique identifier field, and the sorting method can be ascending sorting, and finally a structured certificate data set containing all standardized digital certificate attributes is formed.

[0017] In this embodiment, the three types of core attributes of issuing authority, validity period and key configuration are extracted to completely cover the certificate's own security-related information and identity attribution information, avoiding incomplete risk feature analysis due to missing attributes; the validity period is converted into a unified time format and the key configuration attribute is converted into a standardized parameter representation through standardized processing, ensuring consistency of certificate attributes of different sources and different formats; the standardized attributes are organized according to a predefined data structure, so that the originally scattered certificate information becomes orderly and regular, providing a clear data form for operation and maintenance personnel to view and manage certificate information, and improving the convenience of certificate management; the collected attributes cover the certificate security strength, i.e., key configuration, and the time limit, i.e., the validity period related information, and the standardized structured data can be directly used to extract the remaining validity period, security strength and other risk indicators.

[0018] In a preferred embodiment of the application, S2 includes: In the embodiment of the present application, step 200, input the structured certificate data set into the pre-trained large model based on the transformer architecture, encode the digital certificate attributes through the multi-layer self-attention mechanism, and generate a high-dimensional feature representation vector of each digital certificate. Specifically, it includes: vector conversion is performed on each digital certificate attribute in the structured certificate data set, such as the serial number of the certificate unique identification field. If the serial number is a string composed of numbers and letters, it is converted into numbers in sequence according to the ASCII code values corresponding to the characters, and then the numbers are arranged in sequence to form a numerical vector corresponding to the serial number; the text information of the issuing agency name field is first converted into corresponding pinyin, and then the pinyin is split into single letters, each letter is converted into a number according to the ASCII code value, and arranged in sequence to form a word vector; the certificate start effective time and the certificate end invalid time are first converted into numbers, such as 2024, 5, 20, 14, 30, and 00, which are converted into six numbers, and then the numbers are arranged in sequence to form a time vector; the key algorithm type field is assigned a value of 1 if it is an ECC algorithm, and a value of 2 if it is an RSA algorithm to form an algorithm type vector; the key length field is directly represented by a number, such as 2048, which is used as a vector value to form a key length vector; the signature algorithm type field is assigned a value of 3 if it is SHA256withRSA, and a value of 4 if it is SHA384withECC to form a signature algorithm vector; all attribute vectors of each digital certificate are combined into an initial feature vector, such as a certificate serial number value vector with 10 dimensions, an issuing agency word vector with 8 dimensions, a time vector with 6 dimensions, an algorithm type vector with 1 dimension, a key length vector with 1 dimension, and a signature algorithm vector with 1 dimension. These sub-vectors are spliced in the order of serial number, issuing agency, time, algorithm type, key length, and signature algorithm to form a 27-dimensional initial feature vector.

[0019] Before the initial feature vector is input, the construction and pre-training of the transformer architecture pre-trained model are completed. First, the overall structure of the model encoder is determined, and a 6-layer processing structure is set. Each layer includes a multi-head self-attention layer and a feedforward neural network layer. The multi-head self-attention layer sets 8 attention heads, which can simultaneously capture the correlation between different dimensions of the feature vector from different angles, avoiding missing key correlation information from a single perspective. Each attention head is responsible for capturing the correlation information of different dimensions of the feature vector. The feedforward neural network layer sets two linear transformation layers. The first layer has an input dimension consistent with the dimension of the initial feature vector. Here, 27 dimensions are taken as an example. 27 dimensions refer to the total dimension of the vector formed by splicing all attribute sub-vectors of each certificate, such as 27 dimensions of attribute sub-vectors such as serial number, issuing authority, and time, which can completely carry the core information of the certificate to the 512-dimensional hidden layer. The 512-dimensional hidden layer is the intermediate dimension of linear transformation. By increasing the dimension, the model can accommodate more feature correlation information and enhance the feature expression ability. The second layer maps the 512-dimensional input dimension back to the 27-dimensional input dimension. The activation function uses the ReLU function, i.e., f(z) = max(0, z), where z represents the input value of the ReLU function, which is the specific value of each dimension of the 108-dimensional hidden layer vector obtained after the first linear transformation of the feedforward neural network layer, such as the value 21 of a certain dimension and the value -3 of a certain dimension. max(0, z) represents the calculation logic of the function, which compares the size of the input value z and 0, and takes the larger value as the function output. If z is greater than 0, the output is z itself. If z is less than or equal to 0, the output is 0. The function introduces non-linear capabilities to the model, allowing the model to learn complex correlations between features and avoid non-linear relationships that cannot be captured by linear transformation. At the same time, it filters out meaningless negative values in the vector and retains positive information valuable to risk features.

[0020] A structured dataset of large-scale secure communication protocol digital certificates is collected, covering different issuing agencies such as well-known CA agencies, enterprise self-built CA agencies, different validity periods from 1 month to 3 years, different key configurations such as RSA 1024-bit, RSA 2048-bit, and ECC 256-bit certificate data, and risk-related labels are labeled for each data. For the actual expiration of the certificate, label whether the certificate will actually expire within 90 days in the future, where expired is labeled as 1 and not expired is labeled as 0, which is the true label for the subsequent certificate expiration risk binary classification task; For the security level of the key, label the actual security level corresponding to the key configuration of the certificate, i.e. high level is labeled as 3, medium level is labeled as 2, and low level is labeled as 1; For the importance of business association, label the actual importance of the business carried by the certificate, i.e. core business is labeled as 3, general business is labeled as 2, and secondary business is labeled as 1, and the latter two labels are combined with the actual value of the hidden attribute as the true label for the subsequent certificate attribute association prediction task. Divide these labeled data into training set and validation set in the ratio of 7 to 3 to monitor whether the model over-learns the characteristics of the training set (i.e. overfitting).

[0021] Verify whether the performance of the model during training meets the standard; Set two pre-training tasks, the first is the certificate expiration risk binary classification task, the task goal is to let the model predict whether the certificate will expire within 90 days in the future according to the input certificate attribute vector, the model outputs the prediction result as the probability of the certificate expiring within 90 days in the future, the probability value is between 0 and 1, the closer to 1 indicates the higher the possibility of the model judging the certificate expiration; The second is the certificate attribute association prediction task, the task goal is to let the model predict the actual value of the hidden attribute according to the input part of the certificate attribute vector, i.e. randomly masking one attribute such as key length, the model outputs the prediction result of the hidden attribute as the prediction value, the prediction value needs to be consistent with the type of the true value of the hidden attribute, such as masking the key length, the prediction value is the specific bit number, such as 1024, 2048; During training, first convert the attributes of each certificate data in the training set to a 27-dimensional vector to keep consistent with the initial feature vector dimension for subsequent processing, then input these 27-dimensional vectors into the model encoder one by one, calculate the prediction result of each data on the two tasks through forward propagation of the model, and then calculate the loss value of the prediction result and the corresponding true label, specifically, for the certificate expiration risk binary classification task, cross-entropy loss is used to calculate the loss value, i.e. let the model output the probability of the certificate expiring within 90 days in the future as p (0≤p≤1).

[0022] The real label annotated in the pre-training data is y, where y=1 when it is expired and y=0 when it is not expired; during calculation, first, the natural logarithm of the prediction probability p of each certificate sample in the training set is multiplied by the real label y of the sample to obtain a first product result; then, the natural logarithm of (1 minus the real label y of the sample) is multiplied by (1 minus the prediction probability p of the sample) to obtain a second product result; the sum of the two product results is taken as a negative number, that is, the cross-entropy of the sample is obtained; wherein, the value 1 in the above (1 minus the real label y of the sample) and (1 minus the prediction probability p of the sample) represents the real probability of the sample belonging to a certain category (the not expired category), which is used to compare with the model prediction probability and quantify the prediction deviation in the not expired scenario; specifically, in the certificate expiration risk binary classification task, the value of the real label y has only two values, when the certificate is expired, y=1 (representing that the sample belongs to the expired category, and the real probability of belonging to the category is 1; when the certificate is not expired, y=0 (representing that the sample belongs to the not expired category, and the real probability of belonging to the category is 1; the cross-entropy is used to measure the gap between the prediction probability and the real label, and the smaller the value is, the more accurate the prediction is, after the cross-entropy of all samples is calculated, assuming that there are N certificate samples in the training set, the cross-entropy of the i-th sample is , and the classification loss of the task is ; for the certificate attribute association prediction task, the mean square error loss is used to calculate the loss value, that is, assuming that the prediction value of the hidden attribute output by the model is , and the actual value of the hidden attribute in the pre-training data is x, such as the actual value 1024 or 2048 of the key length.

[0023] During calculation, first, the real value x is subtracted from the prediction value to obtain a difference value, and then the difference value is squared to obtain the square error of the sample, which is used to measure the deviation between the prediction value and the real value, and the smaller the value is, the more accurate the prediction is, after the square error of all samples is calculated, assuming that the square error of the i-th sample is , then the prediction loss of the task is , the classification loss and the prediction loss are added to obtain the total loss value of the model training, the total loss value = classification loss + prediction loss, and the total loss value comprehensively reflects the prediction deviation of the two tasks and is the core basis for adjusting the model parameters.

[0024] In the model training process, the total loss value is determined according to the gradient of the total loss to all parameters of the model through the back propagation algorithm, including the query weight matrix, the key weight matrix and the value weight matrix in the multi-head self-attention layer (these three matrices are the core parameters learned by the model, used to convert the input vector into query, key and value vectors to capture the correlation between attributes, each of which is 27 rows and 27 columns, the number of rows and columns is consistent with the dimension of the input vector), the two linear transformation weight matrices in the feedforward neural network layer (the function is to realize the promotion and recovery of the dimension of the vector, the first one is 27 rows and 108 columns, and the second one is 108 rows and 27 columns), and all bias value vectors (used to adjust the overall offset of the vector, the dimension of each bias value vector is consistent with the corresponding vector dimension, such as the query bias value vector with 27 dimensions), after determining the gradient, the Adam optimizer is used to adjust the model parameters according to the learning rate of 0.001, the specific adjustment method is that the current value of a parameter is w2, the gradient of the parameter is g calculated through back propagation, the gradient reflects the trend of the total loss value changing with the parameter, the negative gradient direction is the optimal adjustment direction to reduce the total loss value, then the adjusted parameter value is w1=w2-0.001×g, wherein the learning rate of 0.001 is used to control the amplitude of parameter adjustment each time, after completing the parameter adjustment each time, the certificate data in the verification set is converted into a 27-dimensional vector in the same way as the training set, input into the model and calculate the total loss value of the model on the verification set, if the total loss value of the verification set does not decrease for 10 consecutive training rounds, i.e. each round refers to that all samples in the training set are completely processed by the model, the performance of the model has tended to be stable, at this time, the training is stopped, after the training is stopped, the query weight matrix, the key weight matrix and the value weight matrix in the model, i.e. the three matrices are 27 rows and 27 columns, the number of rows and columns is consistent with the dimension of the input vector, and the corresponding three bias value vectors, i.e. each vector is 27-dimensional, the specific values of each dimension are fixed at the time of training stop, and are determined as fixed parameters.

[0025] After the model construction and pre-training are completed, the previously spliced 27-dimensional initial feature vector, i.e., the sub-vector corresponding to the attributes such as the serial number, the issuing authority, the validity period, the key algorithm type, the key length, the signature algorithm type, etc. of the certificate are sequentially spliced to input the encoder of the pre-trained large model of the transformer architecture. The encoder processes the vector in turn according to the 6-layer processing structure. First, enter the first layer of self-attention layer. In the first layer of self-attention layer, a corresponding query vector, key vector and value vector are generated for each dimension of the initial feature vector. The specific process is as follows. Each dimension of the initial feature vector has a specific value. Taking the first dimension as an example, the value is 5. When generating the dimension value of the query vector corresponding to this dimension, the value 5 of the first dimension of the initial feature vector is multiplied by the value 2 of the first row and first column of the query weight matrix. The value of the first row and first column of the query weight matrix is a fixed parameter of the pre-trained model, which is used to convert the value of the first dimension of the initial vector to the value of the corresponding dimension of the query vector. The product result is 10. Then 10 is added to the value 1 of the first dimension of the query bias value vector. The value of the first dimension of the query bias value vector is used to fine-tune the value of the dimension of the query vector to avoid the expression deviation caused by matrix multiplication, and the value of the first dimension of the query vector is obtained. 11.

[0026] When generating the dimension value of the key vector corresponding to this dimension, the value 5 of the first dimension of the initial feature vector is multiplied by the value 3 of the first row and first column of the key weight matrix to obtain the product result 15. Then 15 is added to the value 2 of the first dimension of the key bias value vector to obtain the value 17 of the first dimension of the key vector. When generating the dimension value of the value vector corresponding to this dimension, the value 5 of the first dimension of the initial feature vector is multiplied by the value 4 of the first row and first column of the value weight matrix to obtain the product result 20. Then 20 is added to the value 3 of the first dimension of the value bias value vector to obtain the value 23 of the first dimension of the value vector. In the same way, for the second dimension to the 27th dimension of the initial feature vector, the specific value of each dimension is multiplied by the corresponding row and column value of the query weight matrix, the key weight matrix and the value weight matrix, respectively, and then added to the corresponding dimension value of the query bias value vector, the key bias value vector and the value bias value vector, respectively. Finally, the query vector, the key vector and the value vector corresponding to each dimension are obtained, and the initial vector generation step of the first layer of self-attention layer is completed.

[0027] After that, the similarity of each query vector and all key vectors is calculated. Taking one of the query vectors, such as the query vector corresponding to the first dimension of the initial feature vector, as an example, the query vector contains 27-dimensional values. When calculating the similarity between the query vector and the first key vector, the value 11 in the first dimension of the query vector is multiplied by the value 17 in the first dimension of the first key vector to obtain the product 187. Then, the value 8 in the second dimension of the query vector is multiplied by the value 9 in the second dimension of the first key vector to obtain the product 72. Similarly, the values in the 27 dimensions of the query vector are multiplied by the values in the 27 dimensions of the first key vector one by one to obtain 27 product results. Adding these 27 product results together gives the preliminary similarity score between the query vector and the first key vector. The larger the preliminary similarity score, the closer the association between the query vector and the attribute dimension corresponding to the key vector. In the same way, the preliminary similarity scores between the query vector and the second key vector, the third key vector, and the 27th key vector are calculated. Finally, the preliminary similarity scores between the query vector and all 27 key vectors are obtained.

[0028] After calculating all the preliminary similarity scores, each preliminary score is scaled by dividing it by the square root of the key vector dimension. Since the key vector is 27-dimensional, each preliminary score is divided by to obtain the scaled similarity score. All scaled similarity scores are input into the softmax function, and the result is the attention weight corresponding to the key vector. The attention weight represents the importance of the corresponding key vector in calculating the value vector. The larger the weight, the greater the influence of the corresponding value vector. For example, if the sum of the 27 scaled similarity scores is 100, and one of the scaled scores is 20, then the attention weight corresponding to this scaled score is 20 divided by 100, which is 0.2. If another scaled score is 5, the corresponding attention weight is 5 divided by 100, which is 0.05. According to the characteristics of the softmax function, the sum of all 27 attention weights is equal to 1, which ensures that the weights are reasonably distributed and there is no overestimation or underestimation of the total weight.

[0029] Then, a weighted sum calculation is performed, that is, each dimension value of each value vector is multiplied by the corresponding attention weight to obtain a weighted result of the dimension value. Taking the first dimension of the value vector as an example, the value of the first dimension of the first value vector is 23, and the corresponding attention weight is 0.2. The weighted result is obtained by multiplying 23 by 0.2, that is, 4.6. The value of the first dimension of the second value vector is 25, and the corresponding attention weight is 0.05. The weighted result is obtained by multiplying 25 by 0.05, that is, 1.25. In this way, the values of the first dimension of all 27 value vectors are multiplied by the corresponding attention weights to obtain 27 weighted results. The sum of the 27 weighted results is the value of the first dimension of the feature vector after self-attention processing. In the same way, the values of the second dimension to the 27th dimension of the feature vector after self-attention processing are calculated. Finally, a 27-dimensional self-attention layer output vector is formed. The self-attention layer output vector is input into the feedforward neural network layer. First, a first linear transformation is performed. The weight matrix of the first linear transformation of the first layer of the feedforward neural network layer is 27 rows and 108 columns, and the bias value vector is 108 dimensions.

[0030] During calculation, the value of each dimension of the self-attention layer output vector is multiplied by the value of the corresponding row and column in the first layer linear transformation weight matrix, and then the value of the corresponding dimension in the first layer bias value vector is added. For example, the value of the first dimension of the self-attention layer output vector is 10, which is multiplied by the value of the first row and the first column of the first layer linear transformation weight matrix, that is, 2, to obtain the product 20. Then, the value of the first dimension of the first layer bias value vector is added, that is, 1, to obtain the result 21, which is used as the value of the first dimension of the 108-dimensional hidden layer vector. In the same way, the values of all dimensions of the 108-dimensional hidden layer vector are calculated to complete the first linear transformation. Then, according to the ReLU function formula, z in the formula is the specific value of each dimension of the 108-dimensional hidden layer vector at this time, such as 21, -3, etc. According to the logic of max(0, z), if the dimension value is greater than 0 (such as 21), the value is kept unchanged, that is, 21. If the dimension value is less than 0 (such as -3), the value is changed to 0. Through such processing, meaningless negative values in the vector are filtered out, and valuable positive information for risk feature extraction is retained. At the same time, the model is introduced with nonlinear capability, and the learning ability of the model for complex feature correlation is enhanced. Finally, the 108-dimensional vector after activation processing is obtained.

[0031] After that, the second linear transformation is performed, that is, the weight matrix of the second layer of the feedforward neural network layer is 108 rows and 27 columns, and the bias value vector is 27 dimensions. During calculation, the numerical value of each dimension of the 108-dimensional vector after activation processing is multiplied by the numerical value of the corresponding row and column in the second layer linear transformation weight matrix, and then the numerical value of the corresponding dimension in the second layer bias value vector is added. For example, the numerical value of the first dimension of the activated vector is 21, which is multiplied by the numerical value of the first row and the first column of the second layer linear transformation weight matrix, that is, 0.5, to obtain the product 10.5, and then the numerical value of the first dimension of the second layer bias value vector, that is, 0.5, is added to obtain the result 11, which is used as the numerical value of the first dimension of the 27-dimensional vector. In the same way, the numerical values of all dimensions of the 27-dimensional vector are calculated to obtain the output vector of the feedforward neural network layer. The output vector of the feedforward neural network layer is input into the next self-attention layer, and the above complete process of generating a query vector, a key vector, a value vector, calculating the similarity between the query vector and all key vectors, scaling the similarity score and calculating the attention weight, weighted summation to obtain the output vector of the self-attention layer, and the linear transformation and ReLU activation processing of the feedforward neural network layer are repeated. When the 6-layer processing structure is completed, each digital certificate will obtain a 27-dimensional high-dimensional feature representation vector, which contains deep association information between the attributes of the certificate.

[0032] In step 201, deep semantic analysis is performed on the high-dimensional feature representation vector to identify potential patterns related to the expiration risk of the certificate. The time sequence feature for representing the remaining validity period, the configuration feature for representing the key security strength, and the context association feature for representing the business criticality are separated from the potential patterns. Specifically, the high-dimensional feature representation vector (27 dimensions) of each digital certificate is split into three 8-dimensional sub-vector segments and one 3-dimensional sub-vector segment according to the dimension function. The first 8-dimensional sub-vector segment corresponds to time-related information, the second 8-dimensional sub-vector segment corresponds to key configuration-related information, the third 8-dimensional sub-vector segment corresponds to business scenario-related information, and the 3-dimensional sub-vector segment corresponds to basic identification information, which is excluded from risk analysis. Then, the numerical value variation of each sub-vector segment is analyzed to determine the semantic content. For the first 8-dimensional sub-vector segment, the numerical values at different time points are extracted, such as recording a numerical value every day, and the trend is observed. If the numerical value of the sub-vector segment decreases by a fixed amplitude every day as the certificate termination invalidation time approaches, such as decreasing by 0.02 every day, and the smaller the numerical value, the shorter the remaining validity period, it is determined that this sub-vector segment carries time-related semantics. If the numerical value of a certain dimension starts to decrease rapidly 30 days before the termination invalidation time, it is determined that this dimension is the core dimension of the time semantics.

[0033] For the second 8-dimensional sub-vector segment, compared with the sub-vector segment values of different key configuration certificates, if the certificate adopts ECC algorithm, the value of a certain dimension of the sub-vector segment is 0.3 higher than that of the certificate adopting RSA algorithm; the value of a certain dimension of the certificate with a key length of 2048 bits is 0.2 higher than that of the certificate with a key length of 1024 bits; the value of a certain dimension of the certificate adopting SHA384withECC signature algorithm is 0.15 higher than that of the certificate adopting SHA256withRSA, it is judged that this sub-vector segment carries key configuration related semantics, and these dimensions are the core dimensions of the key configuration semantics; for the third 8-dimensional sub-vector segment, compared with the sub-vector segment values of different business server certificates, if the certificate of the payment interface server, the value of a certain dimension of the sub-vector segment is 0.4 higher than that of the internal test server; the value of a certain dimension of the certificate of the server with a daily access of 1 million is 0.25 higher than that of the server with a daily access of 100,000; the value of a certain dimension of the certificate of the server affecting 10,000 users is 0.3 higher than that of the server affecting 1,000 users, it is judged that this sub-vector segment carries business scenario related semantics, and these dimensions are the core dimensions of the business scenario semantics.

[0034] The three sub-vector segments related to time, key configuration and business scenario are screened out as a risk related sub-vector segment set. In the time sub-vector segment, those with the same value change trend, such as linearly decreasing with the shortening of the remaining validity period, are classified into a category to form a potential pattern of remaining validity period change; those with the value increasing with the improvement of key security level in the key configuration sub-vector segment are classified into a category to form a potential pattern of key security strength change; those with the value increasing with the improvement of business importance in the business scenario sub-vector segment are classified into a category to form a potential pattern of “business criticality change”; for the “remaining validity period change” pattern, the values of all core dimensions in the time sub-vector segment are extracted, which can reflect the length of the remaining validity period, such as the value 0.8 corresponding to 90 days of remaining validity, 0.5 corresponding to 60 days of remaining validity, and 0.2 corresponding to 30 days of remaining validity, and the change trend, such as decreasing from 0.5 to 0.2 in 30 days, decreasing by 0.01 per day, combining these values to form a time sequence feature; for the “key security strength change” pattern, the values of the core dimensions in the key configuration sub-vector segment are extracted, which can reflect the security of the key algorithm, i.e. ECC corresponds to 0.8, RSA corresponds to 0.5, the security of the key length, i.e. 2048 bits corresponds to 0.9, 1024 bits corresponds to 0.6, the security of the signature algorithm, i.e. SHA384withECC corresponds to 0.85, SHA256withRSA corresponds to 0.7, combining these values to form a configuration feature.

[0035] For the business criticality change mode, the numerical values of the core dimensions in the business scenario sub-vector segment are extracted, which can reflect the importance of the business type, i.e. payment corresponds to 0.9, test corresponds to 0.3, the importance of business load, i.e. 1 million access corresponds to 0.8, 100,000 corresponds to 0.5, the importance of interruption, i.e. 100,000 users correspond to 0.85, 10,000 correspond to 0.4, combine these numerical values to form context-related features, and check the source of each numerical value one by one when separating, ensure that the time-related numerical value of the time sequence feature, the key-related numerical value of the configuration feature, and the business-related numerical value of the context-related feature are not mixed with other types of information.

[0036] In step 202, the time sequence feature, the configuration feature and the context-related feature are normalized and quantized respectively to obtain the continuous value of the remaining validity period index, the security strength index and the business criticality index, which together constitute three risk indexes, including: first, calculate the original value of the remaining validity period of each certificate, that is, first determine the current system time and the certificate termination time, for example, the current time is May 20, 2024, and the certificate termination time is August 20, 2024. Subtract the year of the termination time from the year of the current time, if the years are the same, subtract the month of the termination time from the month of the current time, get 3 months, and then add the number of days in each month, i.e. 11 days in May, 30 days in June, 31 days in July, and 20 days in August, 11+30+31+20=92 days, which is the original value of the remaining validity period of the certificate; if the years are different, first calculate the number of days in a whole year, and then add the number of days in the remaining months to get the original value; second, count the maximum and minimum values of the original values of the remaining validity period of all certificates, assuming that the maximum value is 180 days and the minimum value is 10 days after statistics; third, do normalization, that is, for the original value of each certificate, subtract the minimum value from the original value to get the first difference, for example, the original value of a certain certificate is 92 days, 92-10=82; subtract the minimum value from the maximum value to get the second difference, 180-10=170; then divide the first difference by the second difference, 82 divided by 170 is approximately equal to 0.48, which is the normalized time sequence feature value; fourth, do quantization, that is, keep two decimal places of the normalized value, if the third decimal place is greater than or equal to 5, round up to the next place, otherwise, round down, for example, 0.483 is kept as 0.48, and 0.486 is kept as 0.49, to get the continuous value of the remaining validity period index.

[0037] Then the configuration characteristics are processed to generate the security strength index, that is, the security level of each item of information in the configuration characteristics is quantitatively mapped in the first step, according to the cryptographic security strength of the key algorithm, the ECC algorithm has higher security due to the elliptic curve cryptography system, and the corresponding quantized value is 10; the RSA algorithm has relatively lower security than the ECC algorithm, and the corresponding quantized value is 8; according to the ability of the key length to resist brute force cracking, the 2048-bit key has higher cracking difficulty, and the corresponding quantized value is 10, and the 1024-bit key has lower cracking difficulty, and the corresponding quantized value is 6; according to the hash strength and collision resistance of the signature algorithm, the SHA384withECC signature algorithm has longer hash length and higher security, and the corresponding quantized value is 10, the SHA256withRSA signature algorithm has a hash length, and the corresponding quantized value is 8, and the SHA1withRSA signature algorithm has a security vulnerability, and the corresponding quantized value is 4.

[0038] In the second step, the original total score of the configuration characteristics is calculated, that is, the quantized values of a certain certificate in the key algorithm, the key length and the signature algorithm are added up to obtain the original total score of the configuration characteristics of the certificate, for example, a certain certificate uses the ECC algorithm, the corresponding quantized value is 10, the 2048-bit key, the corresponding quantized value is 10, the SHA384withECC signature algorithm, and the corresponding quantized value is 10. The sum of the three quantized values is 30, which is the original total score of the configuration characteristics of the certificate. If a certain certificate uses the RSA algorithm, the corresponding quantized value is 8, the 1024-bit key, the corresponding quantized value is 6, and the SHA256withRSA signature algorithm, the corresponding quantized value is 8. The sum of the three quantized values is 22, which is the original total score of the configuration characteristics of the certificate. In the third step, the value range of the original total score of the configuration characteristics is determined, that is, the original total scores of the configuration characteristics of all certificates are traversed, and the maximum value and the minimum value are counted. It is assumed that the maximum value is 30 and the minimum value is 12 after counting. In the fourth step, normalization processing is performed, that is, for the original total score of the configuration characteristics of each certificate, the third difference value is calculated first, that is, the difference between the original total score and the minimum value, for example, when the original total score is 30, 30-12 is used to obtain the third difference value 18; when the original total score is 22, 22-12 is used to obtain the third difference value 10. The fourth difference value is obtained by subtracting the minimum value from the maximum value, that is, 30-12, and the fourth difference value is 18. Finally, the third difference value of each certificate is divided by the fourth difference value to obtain the normalized configuration characteristic value, for example, 18 divided by 18 is 1; 10 divided by 18 is about 0.56. In the fifth step, the quantization processing is performed, that is, the normalized configuration characteristic value is kept to two decimal places, if the third decimal place is greater than or equal to 5, the second decimal place is incremented by 1, if it is less than 5, the third decimal place and the subsequent decimal places are discarded, for example, 0.564 is kept as 0.56, and 0.567 is kept as 0.57. Finally, the security strength index with continuous values is obtained.

[0039] The context association features are processed to generate a business criticality index. In the first step, each item of information in the context association features is quantitatively mapped for business importance. According to the influence of the business on the core operation of the enterprise, the payment interface business is directly associated with the flow of funds, and the corresponding quantitative value is 10. The user login business is associated with user identity verification and system access security, and the corresponding quantitative value is 9. The internal test business is only used for internal function verification, and the corresponding quantitative value is 3. The log storage business is mainly used for data recording, and the corresponding quantitative value is 2. According to the user scale and system dependence reflected by the business load, more than 1 million daily visits means serving a large number of users, and the corresponding quantitative value is 10. 50-100 million daily visits correspond to a quantitative value of 8. 10-50 million daily visits correspond to a quantitative value of 5. Less than 1 million daily visits correspond to a quantitative value of 3. According to the influence range and loss degree after the business interruption, the business that affects more than 100,000 users or causes economic loss corresponds to a quantitative value of 10. The business that affects 10-100,000 users corresponds to a quantitative value of 8. The business that affects less than 10,000 users corresponds to a quantitative value of 4. The business with no direct impact corresponds to a quantitative value of 2.

[0040] In the second step, the original total score of the context association features is calculated, that is, the quantitative values of a certificate in the business type, business load, and business interruption influence range are added to obtain the original total score of the context association features of the certificate. For example, a certificate corresponds to a payment interface business, a quantitative value of 10, a daily visit of 1.2 million, a quantitative value of 10, and a business interruption affecting 200,000 users, a quantitative value of 10. The sum of the three quantitative values is 30, which is the original total score of the context association features of the certificate. If a certificate corresponds to an internal test business, a quantitative value of 3, a daily visit of 50,000, a quantitative value of 3, and a business interruption affecting 500 users, a quantitative value of 4. The sum of the three quantitative values is 10, which is the original total score of the context association features of the certificate. In the third step, the value range of the original total score of the context association features is determined, that is, the original total scores of the context association features of all certificates are traversed to obtain the maximum value and the minimum value. Assuming that the maximum value is 30 and the minimum value is 8 after statistics.

[0041] In the fourth step, normalization processing is performed, that is, for the original total score of the context association feature of each certificate, first, the difference between the original total score and the minimum value, that is, the fifth difference value, is calculated, for example, when the original total score is 30, 30-8 is used to obtain the fifth difference value 22; when the original total score is 10, 10-8 is used to obtain the fifth difference value 2, then the difference between the maximum value and the minimum value, that is, the sixth difference value, is calculated, that is, 30-8 is used to obtain the sixth difference value 22, and finally, the fifth difference value of each certificate is divided by the sixth difference value to obtain the normalized context association feature value, for example, 22 divided by 22 is 1; 2 divided by 22 is about 0.09; in the fifth step, quantization processing is performed, that is, the normalized context association feature value is kept to two decimal places, if the third decimal place is greater than or equal to 5, the second decimal place is incremented by 1, if it is less than 5, the third decimal place and the subsequent decimal places are discarded, for example, 0.093 is kept as 0.09, and 0.096 is kept as 0.10, and finally, the business criticality index with continuous values is obtained; the remaining validity period index, the security strength index and the business criticality index are integrated to form three risk indexes required for subsequent risk assessment.

[0042] In the embodiment, the multi-layer self-attention mechanism is used to fully capture the deep association between the attributes of the digital certificate, and the remaining validity period, the security strength and the business criticality are separated, multi-dimensional coverage of the certificate expiration risk is realized, risk misjudgment caused by single-dimensional evaluation is avoided, the risk assessment is more in line with the actual security state and business value of the certificate; the three types of features of time sequence, configuration and context association are distinguished through deep semantic analysis, and then the features are converted into continuous indexes with a unified value range through normalization and quantization processing, so that the risk indexes of different certificates have comparability, evaluation deviation caused by information format difference or semantic ambiguity is avoided, and the reliability of the risk indexes is improved; the three continuous risk indexes generated can be directly used for spatial dimension reconstruction and weight adjustment, solving the problem of lack of quantifiable multi-dimensional risk parameters; potential risk patterns in the certificate attributes are fully mined, for example, the association between the key length and the expiration risk and the association between the business type and the risk influence are identified through high-dimensional feature analysis, solving the limitation of being unable to perceive potential risk association, so that the risk assessment not only focuses on the surface validity period information, but also can deeply identify the core factors influencing the expiration risk, improving the depth and comprehensiveness of the risk assessment In a preferred embodiment of the present application, the S3 comprises: In the embodiment of the present application, in step 300, the remaining validity period index, the security strength index and the service criticality index are taken as three orthogonal coordinate axes to construct a three-dimensional risk assessment space, and each risk index corresponds to an assessment dimension in the three-dimensional risk assessment space, specifically including: first, the corresponding relationship of the three orthogonal coordinate axes is determined, the remaining validity period index is set as the X-axis of the three-dimensional risk assessment space, the security strength index is set as the Y-axis, and the service criticality index is set as the Z-axis, the three coordinate axes are perpendicular to each other, and there is no overlapping dimension, which ensures that the risk index of each dimension can independently reflect the risk characteristics of the certificate in a certain aspect, then the value range of each coordinate axis is determined, since the three risk indexes have been normalized, the values of all indexes are between 0 and 1, therefore the value range of the three coordinate axes is uniformly set as from 0 to 1, and each numerical point on the coordinate axis corresponds to a specific value of a risk index.

[0043] For example, the 0 point on the X-axis corresponds to the minimum remaining validity period index, that is, the certificate is about to expire, and the 1 point corresponds to the maximum remaining validity period index, that is, the certificate has sufficient validity period; the 0 point on the Y-axis corresponds to the minimum security strength index, that is, the key configuration security is extremely low, and the 1 point corresponds to the maximum security strength index, that is, the key configuration security is extremely high; the 0 point on the Z-axis corresponds to the minimum service criticality index, that is, the certificate carries unimportant service, and the 1 point corresponds to the maximum service criticality index, that is, the certificate carries core service; then the meaning of “point” in the three-dimensional risk assessment space is defined, each digital certificate corresponds to a unique coordinate point in the three-dimensional space according to the values of the three risk indexes thereof, the X value of the coordinate point is the value of the remaining validity period index of the certificate, the Y value is the value of the security strength index, and the Z value is the value of the service criticality index, for example, the remaining validity period index of a certain certificate is 0.6, the security strength index is 0.8, and the service criticality index is 0.9, then the coordinate point corresponding to the certificate in the three-dimensional space is (0.6, 0.8, 0.9), and the comprehensive state of the certificate in the three risk dimensions can be intuitively presented through the coordinate point, and finally the construction of the three-dimensional risk assessment space is completed, and all historical certificate data and the to-be-evaluated certificate data are mapped into the space according to the above rules to form a visualized evaluation framework containing the risk coordinates of all certificates.

[0044] In step 301, based on historical certificate data, the feature extreme value region is determined on each evaluation dimension respectively; the historical certificate data includes three risk indicator data of expired digital certificates and unexpired digital certificates; the feature extreme value region includes a high-risk extreme value region and a low-risk extreme value region; the high-risk extreme value region corresponds to a numerical range in which the remaining validity period indicator is less than a first preset threshold, the security strength indicator is less than a second preset threshold, or the business criticality indicator is greater than or equal to a third preset threshold, and the low-risk extreme value region corresponds to a numerical range in which the remaining validity period indicator is greater than or equal to a fourth preset threshold, the security strength indicator is greater than or equal to a fifth preset threshold, or the business criticality indicator is less than a sixth preset threshold, and specifically includes: The historical certificate data is sorted, and three risk indicator data of all expired digital certificates and unexpired digital certificates in the past 3 to 5 years are collected, wherein the expired certificates need to be marked with the expiration time and the risk indicator change record before expiration, and the unexpired certificates need to be marked with the current risk indicator value and the historical update record, so as to ensure that the data covers certificates of different validity periods, different security configurations and different business scenarios, avoid the deviation of threshold setting caused by single data, and then determine the preset threshold of each dimension. Specifically: The first preset threshold, i.e., the high-risk threshold of the remaining validity period indicator, is determined. First, the remaining validity period indicator values of all expired certificates 90 days before expiration are counted, the median of these values is calculated, and the median is taken as the first preset threshold. For example, if 1000 expired certificate data is counted, the median of the remaining validity period indicator 90 days before expiration is 0.3, and the first preset threshold is set to 0.3. The numerical range in which the remaining validity period indicator is less than 0.3 is the high-risk extreme value region of this dimension.

[0045] The second preset threshold, i.e., the high-risk threshold of the security strength indicator, is determined. Certificates that have experienced security events such as key leakage and signature verification failure in history need to be screened, the security strength indicator values of these certificates are counted, the average of these values is calculated, and the average is taken as the second preset threshold. For example, if 500 certificate data with security events is counted, the average of the security strength indicator is 0.4, and the second preset threshold is set to 0.4. The numerical range in which the security strength indicator is less than 0.4 is the high-risk extreme value region of this dimension.

[0046] The third preset threshold, i.e., the high-risk threshold of the business criticality indicator, is determined. The business criticality indicator values of all certificates carrying core businesses such as payment interfaces and user logins are counted, and the minimum value of these values is taken as the third preset threshold. For example, if 800 core business certificate data is counted, the minimum value of the business criticality indicator is 0.8, and the third preset threshold is set to 0.8. The numerical range in which the business criticality indicator is greater than or equal to 0.8 is the high-risk extreme value region of this dimension.

[0047] The fourth preset threshold, i.e. the low-risk threshold of the remaining validity period index, is determined by counting the values of the remaining validity period index of all certificates that are not expired and have a remaining validity period exceeding 180 days, calculating the median of these values, and setting the median as the fourth preset threshold. For example, if 1200 pieces of such certificate data are counted and the median of the remaining validity period index is 0.7, then the fourth preset threshold is set to 0.7, and the value range of the remaining validity period index that is greater than or equal to 0.7 is the low-risk extreme value region of this dimension.

[0048] The fifth preset threshold, i.e. the low-risk threshold of the security strength index, is determined by screening certificates that have never had a security event in history and have a key configuration that meets the current industry security standards, such as a key length of not less than 2048 bits, a signature algorithm of SHA256 or above, and counting the values of the security strength index of these certificates, calculating the median of these values, and setting the median as the fifth preset threshold. For example, if 1500 pieces of such certificate data are counted and the median of the security strength index is 0.8, then the fifth preset threshold is set to 0.8, and the value range of the security strength index that is greater than or equal to 0.8 is the low-risk extreme value region of this dimension.

[0049] The sixth preset threshold, i.e. the low-risk threshold of the business criticality index, is determined by counting the values of the business criticality index of all certificates that carry non-core business, such as internal testing and log storage, and taking the maximum value of these values as the sixth preset threshold. For example, if 600 pieces of non-core business certificate data are counted and the maximum value of the business criticality index is 0.3, then the sixth preset threshold is set to 0.3, and the value range of the business criticality index that is less than 0.3 is the low-risk extreme value region of this dimension. Finally, for each evaluation dimension, the specific value range of the high-risk extreme value region and the low-risk extreme value region is determined, for example, the X-axis, i.e. the high-risk extreme value region of the remaining validity period index is 0 to 0.3, and the low-risk extreme value region is 0.7 to 1.0; the Y-axis, i.e. the high-risk extreme value region of the security strength index is 0 to 0.4, and the low-risk extreme value region is 0.8 to 1.0; the Z-axis, i.e. the high-risk extreme value region of the business criticality index is 0.8 to 1.0, and the low-risk extreme value region is 0 to 0.3, providing clear boundary basis for subsequent statistical analysis and region integration.

[0050] In each evaluation dimension, the size order of the high-risk and low-risk thresholds must comply with the risk logic of the dimension: The remaining validity period index: the lower the value, the higher the risk, so the high-risk threshold (the first preset threshold) must be smaller than the low-risk threshold (the fourth preset threshold).

[0051] The security strength index: the lower the value, the higher the risk, so the high-risk threshold (the second preset threshold) must be smaller than the low-risk threshold (the fifth preset threshold).

[0052] Business Key Indicator: the higher the value, the higher the risk, so the high-risk threshold (third preset threshold) must be greater than the low-risk threshold (sixth preset threshold).

[0053] At step 302, statistical analysis is performed on the risk indicator value distribution on each evaluation dimension, and a characteristic density concentration area on each evaluation dimension is identified based on the statistical distribution characteristics in the historical data. Specifically, first, the value range of each evaluation dimension is divided into intervals. Since the values of all risk indicators are between 0 and 1, the value range of each dimension is evenly divided into 10 consecutive numerical intervals, with each interval having a range of 0.1. The first interval is 0.0 to 0.1, the second interval is 0.1 to 0.2, the third interval is 0.2 to 0.3, and so on, with the tenth interval being 0.9 to 1.0, ensuring consistent span for each interval. The number of historical certificates in each interval is counted. Taking the X-axis, i.e., the remaining validity period indicator, as an example, the remaining validity period indicator values of all certificates are first extracted from the historical certificate data, and then the indicator values of each certificate are matched with the corresponding interval. That is, the value range of each interval is first determined, such as the 0.7 to 0.8 interval, which includes 0.7 and is less than 0.8. Then, the remaining validity period indicator value of a certificate is checked. If the value is greater than or equal to the start value of the interval and less than the end value of the interval, the certificate is counted in the statistical number of that interval.

[0054] For example, the remaining validity period indicator of a certain certificate is 0.72, which is greater than 0.7 and less than 0.8, meeting the range requirements of the 0.7 to 0.8 interval, so the certificate is counted in the statistical number of the 0.7 to 0.8 interval. For example, the remaining validity period indicator of a certain certificate is 0.65, which is greater than 0.6 and less than 0.7, meeting the range requirements of the 0.6 to 0.7 interval, so the certificate is counted in the statistical number of the 0.6 to 0.7 interval. In this way, each certificate in the historical data is judged and classified one by one. After all certificates are assigned to the corresponding intervals, the total number of certificates contained in each interval is counted, which is the original statistical number of each interval. Then, the certificate density of each interval is calculated. The calculation method of certificate density is the number of certificates in each interval divided by the total number of historical certificates. For example, the total number of historical certificates is 5000, and the number of certificates in the 0.2 to 0.3 interval is 800, so the certificate density of this interval is 800 divided by 5000. The certificate density of the 0.7 to 0.8 interval is 1200 divided by 5000. By calculating the density, the influence of the total number on the interval statistical result is eliminated, and the concentration degree of certificates in different intervals is more accurately reflected.

[0055] Afterwards, the feature density concentration area is identified, 10 intervals of each dimension are sorted from high to low according to the certificate density, and the top 2 intervals with the highest density are selected as the core candidate intervals. If the two candidate intervals are continuous, such as 0.2 to 0.3 and 0.3 to 0.4, they are merged into a continuous numerical range as the feature density concentration area of the dimension. If the two candidate intervals are not continuous, such as 0.2 to 0.3 and 0.5 to 0.6, the density of the adjacent intervals is checked. If the density difference between the adjacent interval and the candidate interval is less than 0.02, the adjacent interval is also included to form a continuous concentration area. For example, in the remaining validity period indicator, the interval density of 0.6 to 0.7 is 0.22, and the interval density of 0.7 to 0.8 is 0.24. These two intervals are continuous and have the highest density. After merging, the range of 0.6 to 0.8 is the feature density concentration area of the remaining validity period dimension. In the security strength indicator, the interval density of 0.7 to 0.8 is 0.21, and the interval density of 0.8 to 0.9 is 0.23. After merging, the range of 0.7 to 0.9 is the feature density concentration area of the security strength dimension. In the business criticality indicator, the interval density of 0.4 to 0.5 is 0.19, and the interval density of 0.5 to 0.6 is 0.20. After merging, the range of 0.4 to 0.6 is the feature density concentration area of the business criticality dimension. The feature density concentration area of each dimension is verified to check whether the certificates in the area meet the risk characteristics of the dimension. For example, the density concentration area of the remaining validity period dimension is 0.6 to 0.8. It needs to be confirmed that the certificates in this area are mostly non-expired and have sufficient remaining validity period. If it meets the requirements, the area is determined as the final feature density concentration area. If it does not meet the requirements, the interval with the next highest density is reselected to ensure that the feature density concentration area truly reflects the risk indicator distribution of most certificates.

[0056] In step 303, the feature extreme value area and the distribution range of the feature density concentration area are integrated to form the core area definition of each evaluation dimension. Specifically, for each evaluation dimension, the specific numerical range of the high-risk extreme value area, the low-risk extreme value area, and the feature density concentration area of the dimension is sorted, and the boundaries of each area are determined. For example, in the remaining validity period indicator, the high-risk extreme value area is 0.0 to 0.3, the low-risk extreme value area is 0.7 to 1.0, and the feature density concentration area is 0.6 to 0.8. In the security strength indicator, the high-risk extreme value area is 0.0 to 0.4, the low-risk extreme value area is 0.8 to 1.0, and the feature density concentration area is 0.7 to 0.9. In the business criticality indicator, the high-risk extreme value area is 0.8 to 1.0, the low-risk extreme value area is 0.0 to 0.3, and the feature density concentration area is 0.4 to 0.6.

[0057] The overlapping relationship between the feature density concentration area and the feature extreme value area is determined, and integration is performed in three cases. In the first case, the feature density concentration area overlaps the high-risk extreme value area. Taking the X-axis as an example, if the high-risk extreme value area of a certain dimension is 0.0 to 0.3, and the feature density concentration area is 0.2 to 0.4, the overlapping range of the two is 0.2 to 0.3. This overlapping range is the high-risk core area of the dimension, because this area belongs to the high-risk extreme value range and is also concentrated with a large number of historical certificates, which is the main distribution area of high-risk certificates. In the second case, the feature density concentration area overlaps the low-risk extreme value area. Taking the Y-axis as an example, the low-risk extreme value area is 0.8 to 1.0, and the feature density concentration area is 0.7 to 0.9. The overlapping range of the two is 0.8 to 0.9, which is the low-risk core area of the dimension, because this area belongs to the low-risk extreme value range and is also concentrated with a large number of historical certificates, which is the main distribution area of low-risk certificates. In the third case, the feature density concentration area neither overlaps the high-risk extreme value area nor overlaps the low-risk extreme value area.

[0058] Taking the Z-axis as an example, the high-risk extreme value area is 0.8 to 1.0, the low-risk extreme value area is 0.0 to 0.3, and the feature density concentration area is 0.4 to 0.6. There is no overlap among the three, and this feature density concentration area is the medium-risk core area of the dimension, because this area is concentrated with a large number of certificates that are neither high-risk nor low-risk, and is the main distribution area of medium-risk certificates. Then, the definition of non-overlapping areas is supplemented. For the part of the feature extreme value area that does not overlap with the density concentration area, if the density of the certificates in this part is less than 0.05, i.e., the proportion of the number of certificates in this area to the total number is less than 5%, then this area is defined as a high-risk edge area or a low-risk edge area, indicating that this area belongs to the extreme value range but has a small number of certificates and is not typical. If the density is higher than 0.05, it is included in the extension range of the corresponding core area. For example, in the high-risk extreme value area of the X-axis 0.0 to 0.3, the density of the interval 0.0 to 0.2 is 0.03, which is less than 0.05, and is defined as a high-risk edge area. The density of the interval 0.2 to 0.3 is 0.16, which is higher than 0.05, and is included in the high-risk core area. Finally, the complete core area definition of each evaluation dimension is formed, and the specific numerical range of the high-risk core area, the medium-risk core area, the low-risk core area, and the edge area is determined.

[0059] For example, the core area of the X axis, i.e. the remaining validity period index, is defined as a high-risk core area of 0.2 to 0.3, a high-risk edge area of 0.0 to 0.2, a medium-risk core area of 0.3 to 0.7, a low-risk core area of 0.7 to 0.8, and a low-risk edge area of 0.8 to 1.0; the core area of the Y axis, i.e. the security strength index, is defined as a high-risk core area of 0.0 to 0.4 (with a density higher than 0.05), a medium-risk core area of 0.4 to 0.8, a low-risk core area of 0.8 to 0.9, and a low-risk edge area of 0.9 to 1.0; and the core area of the Z axis, i.e. the business criticality index, is defined as a low-risk core area of 0.0 to 0.3 (with a density higher than 0.05), a medium-risk core area of 0.4 to 0.6, a high-risk core area of 0.8 to 1.0 (with a density higher than 0.05), and a high-risk edge area of 0.6 to 0.8.

[0060] In this embodiment, by constructing a three-dimensional risk assessment space, the remaining validity period, security strength and business criticality are converted into orthogonal assessment dimensions, the comprehensive risk state of the certificate in multiple dimensions can be intuitively presented, the risk misjudgment caused by single-dimensional assessment is avoided, and the risk assessment is more in line with the actual security and business attributes of the certificate; based on historical certificate data, including expired and unexpired certificates, the extreme value area of the features is determined, the preset threshold is set by the median, average and other features of the historical data, the boundary of the high-risk and low-risk areas is supported by the objective data, the deviation caused by the artificial setting of the threshold is avoided, and the reliability of the risk area division is improved; the risk distribution law of most certificates is captured, the feature density concentration area is identified through interval division and density calculation, the main distribution range of the certificate risk index in the historical data can be accurately found, and the risk features of most certificates are avoided to be ignored by only focusing on the extreme value area; a precise risk core area definition is formed, the boundaries of the high, medium and low risk core areas are defined by integrating the feature extreme value area and the density concentration area, the risk warning significance of the extreme value area is retained, the distribution features of most certificates are integrated, the problems of risk area ambiguity and unclear judgment standard are solved, and the precision of the risk assessment is improved.

[0061] In a preferred embodiment of the application, the S4 comprises: In the embodiment of the present application, step 400, the feature representation of the certificate expiration risk is projected onto three evaluation dimensions of the three-dimensional risk evaluation space to obtain the feature value distribution on each evaluation dimension, specifically including: clearly defining that the feature representation of the certificate expiration risk corresponds to three core indicators, which is composed of the remaining validity period indicator, the security strength indicator and the business criticality indicator obtained by previous processing, and each indicator corresponds to one evaluation dimension of the three-dimensional risk evaluation space, that is, the remaining validity period indicator corresponds to the X axis, the security strength indicator corresponds to the Y axis, and the business criticality indicator corresponds to the Z axis; extracting the values of the three risk indicators of all certificates in the certificate set to be analyzed, and obtaining the value of the remaining validity period indicator, the value of the security strength indicator and the value of the business criticality indicator of each certificate from the certificate data record one by one, to ensure that the values of the three indicators of each certificate are complete and accurate, without missing or incorrect data.

[0062] For example, it is extracted from the record of certificate A that the remaining validity period indicator is 0.68, the security strength indicator is 0.75, and the business criticality indicator is 0.82; it is extracted from the record of certificate B that the remaining validity period indicator is 0.42, the security strength indicator is 0.53, and the business criticality indicator is 0.35, and so on, to complete the extraction of the values of all certificate indicators; then the dimension projection of the indicator values is performed, that is, the value of the remaining validity period indicator of each certificate is corresponded to the corresponding position of the X axis as the feature value of the certificate on the X axis, that is, the remaining validity period dimension; the value of the security strength indicator of each certificate is corresponded to the corresponding position of the Y axis as the feature value of the certificate on the Y axis, that is, the security strength dimension; the value of the business criticality indicator of each certificate is corresponded to the corresponding position of the Z axis as the feature value of the certificate on the Z axis, that is, the business criticality dimension, and the feature value distribution of each dimension is arranged, that is, the feature values of all certificates on the same dimension are summarized to form a feature value set of the dimension, for example, the values of the remaining validity period indicators of all certificates are summarized to obtain the feature value set of the X axis dimension, such as 0.68, 0.42, 0.72, 0.35, …; the values of the security strength indicators of all certificates are summarized to obtain the feature value set of the Y axis dimension, such as 0.75, 0.53, 0.81, 0.48, …; the values of the business criticality indicators of all certificates are summarized to obtain the feature value set of the Z axis dimension, such as 0.82, 0.35, 0.66, 0.29, …, and the arrangement of the values in each set is the feature value distribution on the corresponding evaluation dimension.

[0063] At step 401, based on the distribution of feature values on each evaluation dimension, the standard deviation of the feature values is calculated as a dispersion degree indicator, and the kurtosis coefficient of the feature values is calculated as a clustering degree indicator, which specifically includes: calculating the standard deviation of the feature values of each evaluation dimension, i.e., the dispersion degree indicator, first calculating the average value of the feature values of each dimension, taking the X-axis, i.e., the remaining valid period dimension as an example, first counting the total number of values in the feature value set of this dimension, then adding all the feature values in the set to obtain the total sum of the feature values, and dividing the total sum of the feature values by the total number of values to obtain the average value of the feature values of this dimension. For example, the X-axis feature value set contains 100 values, the total sum of all values is 65, and 65 divided by 100 gives an average value of 0.65 for the X-axis feature values. The Y-axis feature value set contains 100 values, the total sum is 72, and 72 divided by 100 gives an average value of 0.72 for the Y-axis feature values. The Z-axis feature value set contains 100 values, the total sum is 58, and 58 divided by 100 gives an average value of 0.58 for the Z-axis feature values. Then the squared deviation of each feature value from the average value is calculated. For the feature value set of each dimension, the feature values in the set are taken one by one, the feature value is subtracted from the average value of the dimension to obtain the deviation value, and the deviation value is squared to obtain the squared deviation value.

[0064] For example, the X-axis feature value is 0.68, and the average value is 0.65. The deviation value is 0.03 obtained by 0.68-0.65, and the squared deviation value is obtained by squaring 0.03. Another X-axis feature value is 0.42, and the deviation value is -0.23 obtained by 0.42-0.65. The squared deviation value is obtained by squaring -0.23. The squared deviation of all feature values of this dimension is calculated in this way. Then the average value of the squared deviation is calculated, the squared deviation values of all feature values of this dimension are added to obtain the total sum of the squared deviation, and the total sum of the squared deviation is divided by the total number of feature values of this dimension to obtain the average value of the squared deviation. For example, the total sum of the squared deviation values of all feature values of the X-axis is 2.5, and the total number of feature values is 100. Dividing 2.5 by 100 gives an average value of the squared deviation of 0.025. Finally, the standard deviation is calculated by taking the square root of the average value of the squared deviation, and the result is the standard deviation of the feature values of this dimension, which is the dispersion degree indicator. For example, the average value of the squared deviation of the X-axis is 0.025, and the value obtained by taking the square root of 0.025 reflects the dispersion degree of the feature values of the X-axis dimension. The larger the value, the more dispersed the feature value distribution. The standard deviations of the feature values of the Y-axis and Z-axis dimensions are calculated in the same way to obtain their respective dispersion degree indicators.

[0065] The kurtosis coefficient of each evaluation dimension characteristic value, i.e. the concentration degree index, is calculated. First, the fourth power of the deviation of each characteristic value from the average value is calculated. For each set of characteristic values of each dimension, the characteristic values in the set are taken one by one, the characteristic value is subtracted from the average value of the dimension to obtain a deviation value, and the deviation value is subjected to a fourth power operation to obtain a deviation fourth power value. For example, the average value of the Y-axis characteristic value is 0.72, and a characteristic value is 0.75. The deviation value 0.03 is obtained by subtracting 0.72 from 0.75, and the deviation fourth power value is obtained by subjecting 0.03 to a fourth power operation. Another characteristic value of the Y-axis is 0.53. The deviation value -0.19 is obtained by subtracting 0.72 from 0.53, and the deviation fourth power value is obtained by subjecting -0.19 to a fourth power operation. The deviation fourth power calculation of all characteristic values of the dimension is completed in this way. Then, the average value of the deviation fourth power is calculated. The deviation fourth power values of all characteristic values of the dimension are added to obtain a deviation fourth power total sum, and the deviation fourth power total sum is divided by the total number of characteristic values of the dimension to obtain the average value of the deviation fourth power. For example, the total sum of the deviation fourth power values of all characteristic values of the Y-axis is 0.085, and the total number of characteristic values is 100. The average value of the deviation fourth power is 0.00085 obtained by dividing 0.085 by 100. Then, the fourth power of the standard deviation is calculated. The fourth power value of the standard deviation of the dimension is obtained by subjecting the standard deviation obtained before to a fourth power operation.

[0066] For example, the standard deviation of the Y-axis characteristic value is 0.12. The fourth power value of the standard deviation is obtained by subjecting 0.12 to a fourth power operation. Finally, when calculating the kurtosis coefficient, the average value of the deviation fourth power is divided by the fourth power value of the standard deviation, and the result obtained is subtracted by 3. The value obtained is the kurtosis coefficient of the characteristic value of the dimension, which is used as the concentration degree index. For example, the average value of the deviation fourth power of the Y-axis is 0.00085, and the fourth power value of the standard deviation is 0.00020736. The result obtained by dividing 0.00085 by 0.00020736 is about 4.1. The kurtosis coefficient is about 1.1 obtained by subtracting 3 from 4.1. The value reflects the concentration degree of the characteristic value. The larger the value, the more concentrated the characteristic value is around the average value. If the value is less than 0, it indicates that the characteristic value is distributed relatively dispersedly. The kurtosis coefficients of the X-axis and Z-axis dimension characteristic values are calculated in the same way to obtain the respective concentration degree indexes.

[0067] At step 402, the risk weight adjustment parameter of each evaluation dimension is generated according to the ratio of the aggregation degree index to the dispersion degree index on each evaluation dimension, specifically including: determining the aggregation degree index and the dispersion degree index of each dimension, corresponding the kurtosis coefficient, i.e. the aggregation degree index, and the standard deviation, i.e. the dispersion degree index, of each dimension calculated in step 401, to ensure that the two indexes of each dimension correspond to each other without confusion, for example, the aggregation degree index, i.e. the kurtosis coefficient, of the X-axis is 0.8, and the dispersion degree index, i.e. the standard deviation, is 0.158; the aggregation degree index, i.e. the kurtosis coefficient, of the Y-axis is 1.1, and the dispersion degree index, i.e. the standard deviation, is 0.12; the aggregation degree index, i.e. the kurtosis coefficient, of the Z-axis is 0.6, and the dispersion degree index, i.e. the standard deviation, is 0.18, then the ratio of the aggregation degree index to the dispersion degree index of each dimension is calculated, for each dimension, the kurtosis coefficient, i.e. the aggregation degree index, of the dimension is divided by the standard deviation, i.e. the dispersion degree index, of the dimension to obtain the ratio result.

[0068] The ratio reflects the strength of the aggregation degree of the characteristic value in the dimension relative to the dispersion degree, the larger the ratio, the more significant the aggregation of the characteristic value of the dimension, and the stronger the ability to distinguish the risk of certificate expiration; then the ratio results of all dimensions are normalized, first, the sum of the ratio results of all dimensions is calculated, the ratios of the three dimensions are added to obtain the sum of the ratios, for example, the ratio of the X-axis is 5.06, the ratio of the Y-axis is 9.17, and the ratio of the Z-axis is 3.33, 5.06 is added to 9.17 and 3.33 to obtain the sum of the ratios of 17.56, then the ratio of each dimension is divided by the sum of the ratios to obtain the normalized ratio of the dimension, for example, the X-axis is divided by 5.06 to obtain the normalized ratio; the Y-axis is divided by 9.17 to obtain the normalized ratio; the Z-axis is divided by 3.33 to obtain the normalized ratio, the normalized ratio is determined as the risk weight adjustment parameter of each dimension, the normalized ratio of each dimension is the risk weight adjustment parameter of the dimension, for example, the risk weight adjustment parameter of the X-axis, i.e. the remaining validity period dimension, is 0.288, the risk weight adjustment parameter of the Y-axis, i.e. the security strength dimension, is 0.522, and the risk weight adjustment parameter of the Z-axis, i.e. the business criticality dimension, is 0.189, the larger the weight parameter, the higher the weight of the dimension in the overall risk assessment, and the greater the influence on the risk level determination.

[0069] This embodiment projects the characteristic representation of certificate expiration risk onto a three-dimensional assessment dimension, transforming abstract risk characteristics into quantifiable and analyzable dimensional numerical distributions, thus addressing the disconnect between characteristics and the assessment framework in risk assessment. By calculating the standard deviation and kurtosis coefficient, the distribution of characteristic values ​​is described from the two dimensions of dispersion and clustering, respectively, avoiding the limitations of relying solely on subjective judgment to assess the characteristic distribution. This makes the analysis results of the characteristic distribution more objective and accurate, aligning with the data accuracy requirements of digital certificate risk assessment. Risk weight adjustment parameters are generated based on the ratio of clustering to dispersion, ensuring that the weight allocation reflects the actual situation of the characteristic distribution in each dimension, enhancing the influence of that dimension on risk assessment. By balancing the influence of different dimensions through weight adjustment parameters, the dimensions that can better distinguish risk differences in risk assessment—that is, those with strong clustering and weak dispersion—play a greater role, reducing the interference of irrelevant or low-discrimination dimensions on the assessment results. This makes the final risk assessment result more closely reflect the actual situation of certificate expiration risk, solving the assessment bias problem caused by the rigidity of dimensional weights in the assessment.

[0070] In a preferred embodiment of the present invention, S5 includes: In this embodiment of the invention, step 500, based on the definition of the core region, calculates the geometric distance between the center point of the feature value distribution on each evaluation dimension and the center point of the corresponding core region, and generates a position adjustment coefficient based on the geometric distance. Specifically, this includes: determining the core region and the center point of the core region corresponding to each evaluation dimension; based on the core region definition of each dimension formed in step 303, clarifying the core region that matches the current risk status of the certificate under each evaluation dimension. For example, if the remaining validity period index of a certificate is 0.72, corresponding to the X-axis, that is, the low-risk core region of the remaining validity period dimension is 0.7 to 0.8; the security strength index is 0.85, corresponding to the Y-axis, that is, the low-risk core region of the security strength dimension is 0.8 to 0.9; the business criticality index is 0.6, corresponding to the Z-axis, that is, the medium-risk core region of the business criticality dimension is 0.4 to 0.6; for each matching core region, calculate its center point value, that is, add the starting value of the core region to the ending value, divide the sum by 2, and obtain the center point value of the core region.

[0071] For example, the low-risk core area of the X-axis is 0.7 to 0.8, and 0.7+0.8=1.5, and 1.5 divided by 2 is 0.75, which is the center point value of the core area; the low-risk core area of the Y-axis is 0.8 to 0.9, and 0.8+0.9=1.7, and 1.7 divided by 2 is 0.85, which is the center point value of the core area; the medium-risk core area of the Z-axis is 0.4 to 0.6, and 0.4+0.6=1.0, and 1.0 divided by 2 is 0.5, which is the center point value of the core area; then the center point of the feature value distribution of each evaluation dimension is calculated, which is the average value of the feature values calculated in step 401, and the center point of the feature value distribution is the central tendency of all feature values, and the average value can accurately reflect this trend, for example, the average value of the X-axis, i.e., the remaining effective period dimension feature value, is 0.65, which is the center point of the X-axis feature value distribution; the average value of the Y-axis, i.e., the safety strength dimension feature value, is 0.72, which is the center point of the Y-axis feature value distribution; the average value of the Z-axis, i.e., the business criticality dimension feature value, is 0.58, which is the center point of the Z-axis feature value distribution; then the geometric distance between the center points of the feature value distribution and the core area is calculated, because each evaluation dimension is a single-axis linear dimension, the geometric distance is the absolute amount of the difference between the two center point values, and the calculation method is to subtract the value of the core area center point from the value of the feature value distribution center point, and take the absolute value of the difference to avoid negative distance values, and obtain the geometric distance between the two center points.

[0072] For example, the center point of the X-axis feature value distribution is 0.65, and the center point of the core area is 0.75, and the difference is obtained by 0.65-0.75, and the geometric distance is obtained by taking the absolute value, which is 0.1; the center point of the Y-axis feature value distribution is 0.72, and the center point of the core area is 0.85, and the difference is obtained by 0.72-0.85, and the geometric distance is obtained by taking the absolute value, which is 0.13; the center point of the Z-axis feature value distribution is 0.58, and the center point of the core area is 0.5, and the difference is obtained by 0.58-0.5, and the geometric distance is obtained by taking the absolute value, which is 0.08; finally, the position adjustment coefficient is generated based on the geometric distance, and the position adjustment coefficient is used to reflect the fitting degree of the feature value distribution and the core area, the closer the fitting (the smaller the distance), the larger the coefficient, and vice versa, and the calculation method is to subtract the geometric distance from 1, because the value range of each dimension is 0 to 1, and the maximum geometric distance is 1, and subtracting the distance from 1 can make the coefficient range fall between 0 and 1, and obtain the position adjustment coefficient, for example, the geometric distance of the X-axis is 0.1, and the position adjustment coefficient is obtained by 1-0.1, which is 0.9; the geometric distance of the Y-axis is 0.13, and the position adjustment coefficient is obtained by 1-0.13, which is 0.87; the geometric distance of the Z-axis is 0.08, and the position adjustment coefficient is obtained by 1-0.08, which is 0.92; if the geometric distance is 0 (completely fitted), the position adjustment coefficient is 1; if the geometric distance is 1 (completely away), the position adjustment coefficient is 0, which ensures that the coefficient can accurately reflect the position fitting degree.

[0073] Step 501, the risk weight adjustment parameter of each evaluation dimension is weighted with the position adjustment coefficient to obtain the comprehensive weight coefficient of each evaluation dimension, specifically including: arranging the risk weight adjustment parameter and the position adjustment coefficient corresponding to each evaluation dimension, obtaining the risk weight adjustment parameter of each dimension according to step 402, such as X axis 0.288, Y axis 0.522, Z axis 0.189, and the position adjustment coefficient of each dimension obtained in step 500, such as X axis 0.9, Y axis 0.87, Z axis 0.92, one by one, ensuring that the two parameters of each dimension are matched without error and confusion; each dimension is weighted, and the weighting method is to multiply the risk weight adjustment parameter of the dimension by the position adjustment coefficient of the dimension, and the product obtained is the comprehensive weight coefficient of the dimension, for example, the risk weight adjustment parameter 0.288 of X axis is multiplied by the position adjustment coefficient 0.9 to obtain the value of X axis, that is, the comprehensive weight coefficient of the remaining effective period dimension; the risk weight adjustment parameter 0.522 of Y axis is multiplied by the position adjustment coefficient 0.87 to obtain the result of Y axis, that is, the comprehensive weight coefficient of the security strength dimension; the risk weight adjustment parameter 0.189 of Z axis is multiplied by the position adjustment coefficient 0.92 to obtain the result of Z axis, that is, the comprehensive weight coefficient of the business criticality dimension; verify the rationality of the comprehensive weight coefficient of each dimension, add the comprehensive weight coefficients of the three dimensions, and check whether the sum is between 0.95 and 1.05, because there is a small decimal error in the calculation process, a small fluctuation is allowed, if it exceeds the range, recheck the parameter value and multiplication calculation process to ensure that the comprehensive weight coefficient is accurate.

[0074] Step 502, the comprehensive weight coefficient of each evaluation dimension is used to weight and sum the corresponding risk indicators, and the comprehensive risk evaluation value is calculated, which specifically includes: extracting the risk indicator values of the certificate to be evaluated in three evaluation dimensions, obtaining the remaining validity period indicator value, the security strength indicator value and the business criticality indicator value of the certificate from the risk indicator record of the certificate respectively, such as the remaining validity period indicator of a certain certificate is 0.72, the security strength indicator is 0.85, and the business criticality indicator is 0.6, ensuring that the indicator values correspond to the evaluation dimensions one by one; the risk indicator values of each dimension are weighted and calculated, the risk indicator values of each dimension are multiplied by the comprehensive weight coefficient of the dimension to obtain the weighted result of the dimension, for example, the X axis, that is, the remaining validity period dimension uses the risk indicator value 0.72x the comprehensive weight coefficient 0.2592 to obtain the X axis weighted result; the Y axis, that is, the security strength dimension uses the risk indicator value 0.85x the comprehensive weight coefficient 0.45414 to obtain the Y axis weighted result; the Z axis, that is, the business criticality dimension uses the risk indicator value 0.6x the comprehensive weight coefficient 0.17388 to obtain the Z axis weighted result, and the weighted results of the three dimensions are added to obtain the comprehensive risk evaluation value, that is, the weighted results of the X axis, the Y axis and the Z axis are added in turn to obtain the final comprehensive risk evaluation value, which integrates the risk indicators and the corresponding weights of the three dimensions and reflects the overall risk level of the certificate.

[0075] Step 503, the comprehensive risk evaluation value is normalized to obtain an optimized risk evaluation result with a value range of 0 to 1, which specifically includes: determining the value range of the comprehensive risk evaluation value, because the risk indicator value range of each evaluation dimension is 0 to 1, the comprehensive weight coefficient range is 0 to 1, the maximum weighted result of a single dimension is 1x1=1, and the maximum weighted result sum of the three dimensions is 1+1+1=3, so the comprehensive risk evaluation value of all certificates has a value range of 0 to 3; calculate the normalization coefficient, which is the maximum possible value of the comprehensive risk evaluation value, i.e. 3, because the maximum weighted result sum of the three dimensions is 3, this coefficient is used to map all comprehensive risk evaluation values to the range of 0 to 1; then the comprehensive risk evaluation value of each certificate is normalized, and the normalized result is obtained by dividing the comprehensive risk evaluation value of the certificate by the normalization coefficient 3; if the comprehensive risk evaluation value of a certain certificate is 0, the normalized result is 0; if it is 3, the normalized result is 1, ensuring that all results fall within 0 to 1, the normalized result is processed for precision, retaining four decimal places, or retaining a specified number of decimal places according to actual needs, removing meaningless zeros at the end to obtain the optimized risk evaluation result, for example, 0.225657 retains four decimal places as 0.2257, and 0.8 retains four decimal places as 0.8000, the final result can directly reflect the relative level of certificate risk, and the closer the value is to 1, the higher the risk, and the closer the value is to 0, the lower the risk.

[0076] In this embodiment, by calculating the geometric distance of the feature value distribution and the core area and the position adjustment coefficient, the weight adjustment not only considers the feature distribution characteristics, but also combines the actual risk area position, avoids blind weight allocation that deviates from the definition of the core area, makes the risk assessment more in line with the area division logic of the three-dimensional risk assessment space, and improves the pertinence of the evaluation; the risk weight adjustment parameter and the position adjustment coefficient are combined by weighting, which comprehensively considers the discrete aggregation characteristics of the feature distribution and the area position fitting degree, avoids the one-sidedness of a single parameter determining the weight, makes the comprehensive weight coefficient of each dimension more comprehensively reflect the actual influence of the dimension on the overall risk, and reduces the evaluation error caused by weight deviation; by weighted summation to calculate the comprehensive risk assessment value, the risk indicators of the three evaluation dimensions contribute to the overall evaluation according to their respective comprehensive weights, avoiding the problem of ignoring the importance difference of dimensions caused by simple addition, so that the comprehensive evaluation value can objectively reflect the overall risk level of the digital certificate in multiple dimensions, and fit the actual situation of the multi-factor influence of the digital certificate risk; through normalization processing, the comprehensive risk assessment value is mapped to the range of 0 to 1, eliminating the problem of inconsistent numerical range of different certificate comprehensive values caused by dimension weight difference, making the risk assessment results of different certificates directly comparable, and facilitating quick identification of high-risk and low-risk certificates.

[0077] In a preferred embodiment of the present application, S6 comprises: In the embodiment of the present application, step 600, according to the optimized risk assessment result, the digital certificate whose optimized risk assessment result is greater than the preset risk threshold is selected as the high-risk certificate set to be processed, specifically including: first, determine the preset risk threshold, which is determined based on the statistical results of the optimized risk assessment results of historical high-risk certificates, collect the certificates that are judged as high-risk and actually expired or have security events in the past 1 to 2 years, extract the optimized risk assessment results of these certificates, calculate the median of these results, and take the median as the preset risk threshold, for example, 500 historical high-risk certificate data are counted, and the median of the optimized risk assessment results is 0.65, then the preset risk threshold is set to 0.65, which is used to distinguish high-risk and non-high-risk certificates; extract the optimized risk assessment results of all to-be-evaluated certificates, and obtain the optimized risk assessment result of each certificate from the certificate risk assessment record one by one.

[0078] For example, Certificate A is 0.72, Certificate B is 0.58, and Certificate C is 0.81, etc. to ensure that the results of each certificate are complete, without missing or incorrect data; compare the optimized risk assessment results of each certificate with the preset risk threshold one by one. If the optimized risk assessment result of the certificate is greater than the preset risk threshold, the certificate is included in the high-risk certificate set to be processed; if the result is less than or equal to the preset risk threshold, the certificate is classified as a non-high-risk certificate and is not included in the set. For example, the preset risk threshold is 0.65, the result of Certificate A is 0.72, which is greater than 0.65, and is included in the high-risk set. The result of Certificate B is 0.58, which is less than 0.65, and is not included. The result of Certificate C is 0.81, which is greater than 0.65, and is included in the high-risk set. Sort all high-risk certificates selected by certificate identification, such as serial number, to form a complete high-risk certificate set list to be processed, which contains the identification, optimized risk assessment result, and other basic information of each high-risk certificate.

[0079] In step 601, for each digital certificate in the high-risk certificate set, extract the remaining validity period indicator and the business criticality indicator, divide the certificate into four time efficiency levels according to the size of the remaining validity period indicator, and divide the certificate into three business levels according to the size of the business criticality indicator. Specifically, from each certificate record in the high-risk certificate set, extract the corresponding remaining validity period indicator and business criticality indicator, to ensure that the two indicators of each certificate correspond one-to-one with the certificate identification without confusion. For example, from the record of Certificate A, extract the remaining validity period indicator 0.35 and the business criticality indicator 0.92; from the record of Certificate D, extract the remaining validity period indicator 0.12 and the business criticality indicator 0.55; count the remaining validity period indicator values of all certificates in the high-risk certificate set, and calculate the 25th percentile, 50th percentile (median), and 75th percentile of these values. Use these three percentiles as the boundaries for level division. For example, if the remaining validity period indicators of 100 high-risk certificates are counted, the 25th percentile is 0.2, the 50th percentile is 0.4, and the 75th percentile is 0.6. The four time efficiency level division standards are as follows: indicators less than 0.2 are classified as the extremely short time efficiency level, indicators greater than or equal to 0.2 and less than 0.4 are classified as the relatively short time efficiency level, indicators greater than or equal to 0.4 and less than 0.6 are classified as the medium time efficiency level, and indicators greater than or equal to 0.6 are classified as the relatively long time efficiency level.

[0080] The three business level division standards of the business criticality index are determined again, and the values of the business criticality index of all certificates in the high-risk certificate set are also counted, and the 33th percentile and the 67th percentile of these values are calculated, and these two percentiles are used as the boundaries of the level division, for example, the business criticality index of 100 high-risk certificates is counted, the 33th percentile is 0.4, and the 67th percentile is 0.7, so the three business level division standards are that the index less than 0.4 is the general business level, the index greater than or equal to 0.4 and less than 0.7 is the important business level, and the index greater than or equal to 0.7 is the core business level; for each certificate in the high-risk certificate set, first determine the time efficiency level to which the remaining validity period index of the certificate belongs, that is, compare the remaining validity period index of the certificate with the division standards of the four time efficiency levels one by one, and determine the level corresponding to the index.

[0081] For example, the remaining validity period index of certificate A is 0.35, which is greater than or equal to 0.2 and less than 0.4, and is divided into the short time efficiency level; the remaining validity period index of certificate D is 0.12, which is less than 0.2, and is divided into the very short time efficiency level; the remaining validity period index of a certificate is 0.58, which is greater than or equal to 0.4 and less than 0.6, and is divided into the medium time efficiency level; the remaining validity period index of a certificate is 0.65, which is greater than or equal to 0.6, and is divided into the long time efficiency level; then determine the business level to which the business criticality index of each certificate belongs, that is, compare the business criticality index of the certificate with the division standards of the three business levels one by one, and determine the level corresponding to the index, for example, the business criticality index of certificate A is 0.92, which is greater than or equal to 0.7, and is divided into the core business level; the business criticality index of certificate D is 0.55, which is greater than or equal to 0.4 and less than 0.7, and is divided into the important business level; the business criticality index of a certificate is 0.32, which is less than 0.4, and is divided into the general business level; the corresponding time efficiency level and business level of each high-risk certificate are recorded to ensure that the level division result of each certificate is stored together with the certificate identifier and the values of the two indexes.

[0082] In step 602, according to the time limit level and the business level, a multi-level classification matrix is used to evaluate the comprehensive risk level of each high-risk certificate, and a structured evaluation report containing the certificate identification, risk level, validity period status and business importance is generated; a visual risk level identifier is added to each high-risk certificate in the evaluation report, and the high-risk certificates are sorted in descending order of risk level, which specifically includes: first, a multi-level classification matrix is constructed, which has time limit level as rows and business level as columns, forming a 4-row 3-column matrix structure, each matrix cell corresponds to a comprehensive risk level, according to the logic that the shorter the time limit, the more core the business, the higher the risk level, the comprehensive risk level of each cell is determined, wherein the intersection cell of row 1, i.e. the extremely short time limit level, and column 3, i.e. the core business level, corresponds to the first level of high risk; the intersection cells of row 1, i.e. the extremely short time limit level, and column 2, i.e. the important business level, row 2, i.e. the shorter time limit level, and column 3, i.e. the core business level, correspond to the second level of high risk; the intersection cells of row 1, i.e. the extremely short time limit level, and column 1, i.e. the general business level, row 2, i.e. the shorter time limit level, and column 2, i.e. the important business level, row 3, i.e. the medium time limit level, and column 3, i.e. the core business level, correspond to the third level of high risk; the intersection cells of row 2, i.e. the shorter time limit level, and column 1, i.e. the general business level, row 3, i.e. the medium time limit level, and column 2, i.e. the important business level, row 4, i.e. the longer time limit level, and column 3, i.e. the core business level, correspond to the fourth level of high risk; the intersection cells of row 3, i.e. the medium time limit level, and column 1, i.e. the general business level, row 4, i.e. the longer time limit level, and column 2, i.e. the important business level, correspond to the fifth level of high risk; the intersection cell of row 4, i.e. the longer time limit level, and column 1, i.e. the general business level, corresponds to the sixth level of high risk, wherein the first level of high risk is the highest level, and the sixth level of high risk is the lowest level.

[0083] For each high-risk certificate, find the corresponding cell in the multi-level classification matrix, i.e. determine the row according to the time limit level of the certificate, determine the column according to the business level, and the intersection cell of the row and the column corresponds to the comprehensive risk level, i.e. the final comprehensive risk level of the certificate. For example, certificate A is a short time limit level (row 2), a core business level (column 3), corresponding to a second-level high risk in the matrix; certificate D is an extremely short time limit level (row 1), an important business level (column 2), corresponding to a second-level high risk in the matrix; a certain certificate is a long time limit level (row 4), a general business level (column 1), corresponding to a six-level high risk in the matrix; determine the content of the structured assessment report, which contains four core fields, of which the certificate identification needs to fill in the unique serial number or number of the certificate, which is used to distinguish different certificates; the risk level needs to fill in the comprehensive risk level after evaluation, such as first-level high risk, second-level high risk, etc.; the validity period state needs to be converted into a popular description according to the time limit level, such as an extremely short time limit level corresponding to an imminent expiration, i.e. a very short remaining validity period, a long time limit level corresponding to a long remaining validity period; the business importance needs to be converted into a popular description according to the business level, such as a core business level corresponding to bearing core business, i.e. a major interruption, a general business level corresponding to bearing general business, i.e. a smaller interruption, and the above information of each high-risk certificate is filled in the report field one by one to form an evaluation record of a single certificate.

[0084] For each high-risk certificate, add a visual risk level identifier, use icons or labels of different colors to correspond to different risk levels, such as a red exclamation point icon for a first-level high risk, an orange exclamation point icon for a second-level high risk, a yellow exclamation point icon for a third-level high risk, a blue exclamation point icon for a fourth to sixth-level high risk, and a corresponding risk level text next to the icon, making the risk level intuitive and distinguishable; all high-risk certificates in the evaluation report are sorted by comprehensive risk level from high to low, all first-level high-risk certificates are placed at the front, followed by second-level, third-level, fourth-level, fifth-level, and sixth-level high-risk certificates; if there are multiple certificates under the same risk level, sort them by the remaining validity period index from small to large (the shorter the time limit, the closer to the front), to ensure that the report can present the highest risk and most urgent certificates first, and after sorting, the complete structured assessment report is arranged, which is convenient for staff to quickly locate high-priority processing tasks.

[0085] In the embodiment, the certificates whose risk assessment results after optimization exceed the preset risk threshold are screened, the non-high-risk certificates are prevented from occupying processing resources, the staff can focus on the certificates that really need intervention, the efficiency of risk processing is improved, the actual needs of accurate positioning of problems in digital certificate risk control are met, the two core influencing factors of remaining validity period (time limit level) and business criticality (business level) are combined to avoid one-dimensional assessment of risk level, the risk level can more comprehensively reflect the emergency degree and business impact of the certificate, and a basis is provided for differentiated processing, the risk level corresponding to different time limit and business level combinations is determined through a multi-level classification matrix to avoid level deviation caused by subjective assessment, the level assessment standards of all high-risk certificates are unified, and the objectivity and consistency of the assessment results are improved; the structured report contains certificate core information and visual identification, and after sorting, high-priority certificates can be preferentially displayed, which facilitates the staff to quickly understand the certificate risk state and determine the processing order, solves the problems of messy report information and lack of highlights, and improves the response speed of risk processing.

[0086] In a preferred embodiment of the application, the S7 comprises: In the embodiment of the application, in step 700, the risk level information in the evaluation report is parsed, and a certificate update task queue is generated in the order from high to low risk level, specifically including: reading the certificate identifier, comprehensive risk level, remaining validity period index, and business criticality level of each high-risk certificate from the structured evaluation report one by one, and storing these information in association with the certificate identifier to ensure that each item of information of each certificate corresponds one by one without misplacement or omission, for example, the identifier of certificate A is SN12345, the comprehensive risk level is first high risk, the remaining validity period index is 0.35, and the business criticality level is core business level; the identifier of certificate B is SN67890, the comprehensive risk level is second high risk, the remaining validity period index is 0.22, and the business criticality level is important business level; a risk level sorting rule is determined to clearly define the priority order of the comprehensive risk level, that is, the priority of first high risk is the highest, followed by second high risk, then third high risk, fourth high risk, fifth high risk, and sixth high risk with the lowest priority, according to this order, all high-risk certificates are first grouped according to the comprehensive risk level, and certificates with the same risk level are grouped into the same group to form a first group, a second group, and a sixth group.

[0087] The certificates in the same level group are secondarily sorted, and the certificates in the same risk level group are sorted from small to large according to the remaining validity period index. The smaller the remaining validity period index, the shorter the remaining validity period of the certificate, and the higher the emergency processing priority. For example, there are certificate A with a remaining validity period index of 0.35 and certificate C with a remaining validity period index of 0.18 in the first high-risk group. The index of certificate C is smaller than that of certificate A, so certificate C is placed before certificate A in the first group. There are certificate B with a remaining validity period index of 0.22 and certificate D with a remaining validity period index of 0.28 in the second high-risk group. Certificate B is placed before certificate D. The certificates in the first high-risk group are placed in the queue in the order of the second sorting result. After all the certificates in the first group are placed, the sorting result of the second high-risk group is placed, and then the sorting results of the third, fourth, fifth and sixth high-risk groups are sequentially placed to form a complete task queue. Each task node in the queue contains a certificate identifier, a comprehensive risk level, a remaining validity period index and a business criticality level. Subsequently, the certificate update operation is performed in the order of the queue.

[0088] In step 701, a new digital certificate is generated for each certificate to be updated in the order of the certificate update task queue. The validity period of the new digital certificate is adjusted based on the business criticality level of the original certificate. Specifically, a basic validity period standard corresponding to different business criticality levels is determined. The basic validity period is set based on the conventional validity period of digital certificates in the industry and the business importance demand. The basic validity period corresponding to the core business level is 3 years, the basic validity period corresponding to the important business level is 2 years, and the basic validity period corresponding to the general business level is 1 year. This basic standard ensures that the more core the business, the longer the initial validity period, reducing the impact of frequent updates on core businesses. Each certificate to be updated is processed in the order of the task queue. Starting from the head of the queue, the business criticality level of the certificate to be updated and the key configuration information of the original certificate, such as the key algorithm type, key length and signature algorithm type, are extracted one by one. For example, the business criticality level of certificate C is extracted from the first task node in the queue, which is the core business level, and the original key configuration is ECC256-bit algorithm and SHA384withECC signature algorithm.

[0089] The service criticality level of the certificate A extracted from the second node is the core service level, the original key configuration is the RSA2048 algorithm, and the SHA256 with RSA signature algorithm; after determining the basic validity period according to the business criticality level of the certificate to be updated, no additional adjustment is required, if there is a special business requirement later, the time can be increased or decreased on the basis of the validity period, but this time the basic validity period is directly used as the validity period of the new certificate according to the basic standard, for example, the certificate C and the certificate A of the core service level, the validity period of the new certificate is set to 3 years; if a certificate to be updated is an important service level, the validity period of the new certificate is set to 2 years; the validity period of the new certificate of the general service level is set to 1 year; the information of the issuing agency of the new certificate is filled in, which is consistent with the original certificate, the certificate identifier, that is, the new unique serial number is generated, the key algorithm and length are consistent with the original certificate or are adjusted according to the industry upgrading standard, such as the original RSA1024 can be upgraded to RSA2048, the signature algorithm is consistent with the original certificate, the starting effective time of the new certificate is set to the current time, and the termination invalidation time is the current time plus the newly determined validity period, for example, the current time is May 20, 2024, the validity period is 3 years, and the termination invalidation time is May 20, 2027, after generating the new certificate, the certificate is digitally signed to ensure the integrity and authority of the certificate, and the new certificate generation of a single certificate is completed.

[0090] In step 702, the new digital certificate is distributed to the corresponding target server through a secure transmission channel, and the validity and compatibility of the new certificate are verified after the certificate distribution is completed; the certificate state information in the certificate management database is updated, the certificate update time and update operation log are recorded, and the certificate update process is completed, which specifically includes: querying the target server IP address or domain name corresponding to the certificate to be updated from the certificate management record, using HTTPS protocol or special encryption transmission channel, such as file transmission based on SSL / TLS, to ensure that the certificate data is not stolen or tampered during transmission, for example, the target server address corresponding to the certificate C is 192.168.1.100, and the transmission is carried out by using HTTPS protocol; the target server address corresponding to the certificate A is 192.168.1.200, and the new certificate file generated, such as PEM format or DER format, is sent to the specified directory of the target server through the determined secure transmission channel, after the transmission is completed, the transmission success signal is fed back to the distribution system, if the transmission fails, such as network interruption, the transmission is reinitiated until success.

[0091] The validity of the new certificate is verified, and the verification operation is performed on the target server. First, the digital signature of the new certificate is checked to verify whether the signature is legal through the public key of the certificate authority and whether the certificate has been tampered with. Second, the validity period of the new certificate is checked to confirm that the starting effective time is earlier than the current time, the termination invalidation time is later than the current time, and the effective period is consistent with the preset new effective period. Third, the certificate subject information, such as the issuing authority and the certificate identifier, is checked. If all three checks pass, it means that the new certificate is valid. If any one of them does not pass, the new certificate needs to be regenerated and distributed. The application services that depend on the certificate, such as Web services and database services, are started on the target server. It is observed whether the services can normally load the new certificate and establish a secure connection. For example, the Web service is accessed through a browser to check whether the HTTPS identifier can be displayed normally. At the same time, the service log is checked to confirm that there is no certificate format error, algorithm unsupported, and other compatibility error information. If the service runs normally and there is no error, it means that the new certificate is compatible. If there is a compatibility problem, the configuration of the new certificate needs to be adjusted according to the server environment, such as replacing the supported signature algorithm, and the new certificate needs to be regenerated and distributed.

[0092] The certificate state information in the certificate management database is updated. The certificate management database is logged in, and the record corresponding to the certificate to be updated (the original certificate) is found. The state of the original certificate is modified from valid or to be updated to expired (if the original certificate has expired) or replaced (if the original certificate has not expired). At the same time, a new record of the new certificate is added in the database, and the identifier, issuing authority, validity period, key configuration, target server address, and state of the new certificate are filled in. The new certificate record and the original certificate record are bound through the updated association ID to facilitate the tracing of the update history. In the database record of the new certificate, the update time field is filled in as the current time of the distribution verification, accurate to seconds, such as May 20, 2024, 15:30:22. In the record of the original certificate, the expiration time field is filled in as the starting effective time of the new certificate, which clearly indicates the time node when the original certificate is replaced. A log record is added in the operation log system, which includes the operation time, which is consistent with the update time, the operation type, which is certificate update, the operation personnel (the account that performs the update task), the original certificate identifier, the new certificate identifier, the target server address, and the update result, which is success or failure, and here it is success. The verification result is that the validity is qualified and the compatibility is qualified. The log record needs to be permanently saved. After the database update and log record are completed, the update process of a single certificate is ended, and the next certificate to be updated is processed in the order of the task queue until all queue tasks are completed.

[0093] The embodiment ensures that high-risk and fast-expiring certificates are updated in priority through task queue sorting by risk level and time limit, avoids security incidents caused by failure to update high-risk certificates in time due to disordered processing sequence, improves timeliness and pertinence of risk response, and meets the urgency demand of digital certificate risk control; adjusts the validity period of new certificates based on the criticality level of business, so that core business certificates have a more sufficient validity period, reduces frequent interference to core business, balances the update frequency of general business certificates, and takes into account business stability and security update demand; avoids data leakage in the distribution process through a secure transmission channel, and validity and compatibility verification ensures that new certificates can be normally used and adapt to the server environment, reduces the probability of service failure after updating, protects the continuous and stable operation of the business system, and solves the problem caused by re-distribution and light verification during updating.

[0094] As shown in Figure 2 The embodiment of the application also provides a digital certificate expiration risk monitoring and evaluation system based on a large model, comprising: A data acquisition module is configured to acquire a set of secure communication protocol digital certificates through a target server management interface, extract attributes of each digital certificate, and perform standardized processing on the attributes to generate a structured certificate dataset; An index generation module is configured to input the structured certificate dataset into a pre-trained large model based on a transformer architecture, extract a feature representation of certificate expiration risk, and analyze certificate risk features to obtain three risk indexes including a remaining validity period, a security strength, and a business criticality; A framework construction module is configured to reconstruct the three risk indexes in spatial dimensions to establish a risk evaluation framework comprising three evaluation dimensions, each evaluation dimension corresponding to one risk index, and determine a core region of feature distribution in each of the three evaluation dimensions, including a feature extreme region and a feature density concentration region; A parameter generation module is configured to map the feature representation of the certificate expiration risk to each evaluation dimension, and generate risk weight adjustment parameters according to the aggregation degree and dispersion degree of the feature representation; An optimization calculation module is configured to perform weighted optimization calculation on the three risk indexes by using core region data and risk weight adjustment parameters to obtain an optimized risk evaluation result; A report generation module is configured to identify digital certificates that will expire within a preset time range according to the optimized risk evaluation result, perform multi-level risk classification according to the remaining validity time and business importance, and generate an evaluation report with risk level identification; A certificate update module is configured to trigger a certificate update mechanism according to the evaluation report, generate new certificates according to the risk level priority order, and distribute the new certificates to target servers.

[0095] It should be noted that the system is a system corresponding to the above method, and all the implementation manners in the above method embodiments are applicable to this embodiment and can achieve the same technical effects.

[0096] Embodiments of the application also provide a large model-based digital certificate expiration risk monitoring and evaluation device, comprising a processor and a memory storing a computer program, wherein when the computer program is run by the processor, the method as described above is executed. All the implementation manners in the above method embodiments are applicable to this embodiment and can achieve the same technical effects.

[0097] The digital certificate data acquisition, processing and evaluation process described in the application only targets the digital certificate attribute information (such as issuing agency, validity period, key configuration, etc.) authorized by the target server, does not involve user personal identity information, transaction details and other private data, and all data acquisition needs to comply with relevant laws and regulations and obtain the legal authorization of the data subject. In the technical solution of the application, the storage, transmission and model training of the structured certificate data set all need to use encryption, access control and other security measures to prevent data leakage, tampering or misuse; the historical data used for pre-training of the large model need to be desensitized to eliminate any sensitive identification information that can be associated with a specific user or agency. The application only provides a technical method for monitoring and evaluating the expiration risk of digital certificates, and does not bear the legal responsibility and loss compensation responsibility caused by the failure of the data provider to obtain legal authorization, the violation of privacy protection regulations in the data processing process, or the illegal acquisition and use of relevant data by third parties. Based on the actual system built based on the technical solution of the application, the operator needs to develop a complete privacy protection scheme according to the specific application scenario and make a public announcement to ensure the user's or data subject's right to know, inquire and correct the data processing situation and fulfill the privacy protection notification obligation.

[0098] The above is the preferred embodiment of the application. It should be noted that for ordinary skilled persons in the technical field, without departing from the principles of the application, a number of improvements and refinements can be made, which should also be considered within the scope of protection of the application.

Claims

1. A method for monitoring and assessing the risk of digital certificate expiration based on a large model, characterized in that, The method includes: Step S1: Obtain the set of secure communication protocol digital certificates through the management interface of the target server, and extract the attributes of each digital certificate; standardize the digital certificate attributes to generate a structured certificate dataset; Step S2: Input the structured certificate dataset into the pre-trained large model based on the transformer architecture, extract the feature representation of certificate expiration risk, and analyze the certificate risk features to obtain three risk indicators including remaining validity period, security strength and business criticality. Step S3: Reconstruct the spatial dimensions of the three risk indicators to establish a risk assessment framework with three assessment dimensions. Each assessment dimension corresponds to a risk indicator. In the three assessment dimensions, the core regions of feature distribution are determined, including feature extreme value regions and feature density concentration regions. Step S4: Map the feature representation of certificate expiration risk to each assessment dimension, and generate risk weight adjustment parameters based on the degree of clustering and dispersion of the feature representation; Step S5: Using core area data and risk weight adjustment parameters, perform weighted optimization calculations on the three risk indicators to obtain the optimized risk assessment results. Step S6: Based on the optimized risk assessment results, identify digital certificates that are about to expire within a preset time range, and classify them into multiple risk levels according to the remaining validity time and business importance, and generate an assessment report with risk level labels. Step S7: Trigger the certificate update mechanism based on the assessment report, generate new certificates according to risk level priority order and distribute them to the target server.

2. The method for monitoring and assessing the risk of digital certificate expiration based on a large model according to claim 1, characterized in that, Step S1 includes: Step 100: Collect the set of secure communication protocol digital certificates deployed on the target server through the management interface, and extract the issuing authority attribute, validity period attribute and key configuration attribute of each digital certificate; Step 101: Standardize the digital certificate attributes, including converting the certificate validity period into a unified time format and converting the key configuration attributes into a standardized parameter representation, to obtain the standardized digital certificate attributes. Step 102: Organize the standardized digital certificate attributes according to a predefined data structure to generate a structured certificate dataset containing all standardized digital certificate attributes.

3. The method for monitoring and assessing the risk of digital certificate expiration based on a large model according to claim 2, characterized in that, Step S2 includes: Step 200: Input the structured certificate dataset into a pre-trained large model based on a transformer architecture, encode the digital certificate attributes through a multi-layer self-attention mechanism, and generate a high-dimensional feature representation vector for each digital certificate. Step 201: Perform deep semantic parsing on the high-dimensional feature representation vector to identify potential patterns related to certificate expiration risk, and separate the temporal features used to represent the remaining validity period, the configuration features used to represent the key security strength, and the contextual features used to represent the business criticality from the potential patterns. Step 202 involves normalizing and quantifying the time-series features, configuration features, and context-related features to obtain the remaining validity period indicator, security strength indicator, and business criticality indicator with continuous values, which together constitute three risk indicators.

4. The method for monitoring and assessing the expiration risk of digital certificates based on a large model according to claim 3, characterized in that, Step S3 includes: Step 300: Construct a three-dimensional risk assessment space using the remaining validity period indicator, security strength indicator, and business criticality indicator as three orthogonal coordinate axes. Each risk indicator corresponds to an assessment dimension in the three-dimensional risk assessment space. Step 301: Based on historical certificate data, determine the characteristic extreme value region for each evaluation dimension; the historical certificate data includes three risk indicator data for expired digital certificates and non-expired digital certificates; the characteristic extreme value region includes a high-risk extreme value region and a low-risk extreme value region; the high-risk extreme value region corresponds to the numerical range where the remaining validity period indicator is less than a first preset threshold, the security strength indicator is less than a second preset threshold, or the business criticality indicator is greater than or equal to a third preset threshold; the low-risk extreme value region corresponds to the numerical range where the remaining validity period indicator is greater than or equal to a fourth preset threshold, the security strength indicator is greater than or equal to a fifth preset threshold, or the business criticality indicator is less than a sixth preset threshold. Step 302: Perform statistical analysis on the distribution of risk indicator values ​​for each assessment dimension, and identify the concentrated areas of feature density for each assessment dimension based on the statistical distribution characteristics in historical data. Step 303: Integrate the distribution range of the feature extreme value region and the feature density concentration region to form the core region definition for each evaluation dimension.

5. The method for monitoring and assessing the risk of digital certificate expiration based on a large model according to claim 4, characterized in that, Step S4 includes: Step 400: Project the feature representation of certificate expiration risk onto the three assessment dimensions of the three-dimensional risk assessment space to obtain the feature value distribution on each assessment dimension. Step 401: Based on the eigenvalue distribution on each evaluation dimension, calculate the standard deviation of the eigenvalues ​​as an indicator of dispersion, and calculate the kurtosis coefficient of the eigenvalues ​​as an indicator of clustering. Step 402: Generate risk weight adjustment parameters for each assessment dimension based on the ratio of clustering index to dispersion index on each assessment dimension.

6. The method for monitoring and assessing the expiration risk of digital certificates based on a large model according to claim 5, characterized in that, Step S5 includes: Step 500: Based on the definition of the core region, calculate the geometric distance between the center point of the feature value distribution on each evaluation dimension and the center point of the corresponding core region, and generate a position adjustment coefficient based on the geometric distance; Step 501: The risk weight adjustment parameter and the position adjustment coefficient of each assessment dimension are weighted and calculated to obtain the comprehensive weight coefficient of each assessment dimension; Step 502: Use the comprehensive weight coefficient of each assessment dimension to perform a weighted summation of the corresponding risk indicators to calculate the comprehensive risk assessment value; Step 503: Normalize the comprehensive risk assessment value to obtain an optimized risk assessment result with a value range between 0 and 1.

7. The method for monitoring and assessing the expiration risk of digital certificates based on a large model according to claim 6, characterized in that, Step S6 includes: Step 600: Based on the optimized risk assessment results, select digital certificates whose optimized risk assessment results are greater than the preset risk threshold as a set of high-risk certificates to be processed. Step 601: For each digital certificate in the high-risk certificate set, extract the remaining validity period indicator and the business criticality indicator. Divide the certificate into four validity levels based on the size of the remaining validity period indicator and into three business levels based on the size of the business criticality indicator. Step 602: Based on the timeliness level and business level, use a multi-level classification matrix to conduct a comprehensive risk level assessment for each high-risk certificate, and generate a structured assessment report that includes certificate identifier, risk level, validity period status and business importance; add a visual risk level identifier to each high-risk certificate in the assessment report, and sort them in order of risk level from high to low.

8. The method for monitoring and assessing the expiration risk of digital certificates based on a large model according to claim 7, characterized in that, Step S7 includes: Step 700: Parse the risk level information in the assessment report and generate a certificate update task queue in descending order of risk level; Step 701: Generate a new digital certificate for each certificate to be updated in the order of the certificate update task queue. The validity period of the new digital certificate is adjusted based on the business criticality level of the original certificate. Step 702: Distribute the new digital certificate to the corresponding target server through a secure transmission channel, and verify the validity and compatibility of the new certificate after the certificate distribution is completed; update the certificate status information in the certificate management database, record the certificate update time and update operation log, and complete the certificate update process.

9. A digital certificate expiration risk monitoring and assessment system based on a large model, wherein the system implements the method as described in any one of claims 1 to 8, characterized in that, include: The data acquisition module is used to obtain a set of secure communication protocol digital certificates through the target server management interface, extract the attributes of each digital certificate, standardize the attributes, and generate a structured certificate dataset. The indicator generation module is used to input the structured certificate dataset into a pre-trained large model based on the transformer architecture, extract the feature representation of certificate expiration risk, analyze the certificate risk features, and obtain three risk indicators including remaining validity period, security strength, and business criticality. The framework construction module is used to reconstruct the three risk indicators spatially, establish a risk assessment framework with three assessment dimensions, each assessment dimension corresponds to a risk indicator, and determine the core area of ​​feature distribution in the three assessment dimensions, including the feature extreme value area and the feature density concentration area. The parameter generation module is used to map the feature representation of certificate expiration risk to various evaluation dimensions, and generate risk weight adjustment parameters based on the degree of clustering and dispersion of the feature representation. The optimization calculation module is used to perform weighted optimization calculations on three risk indicators using core area data and risk weight adjustment parameters to obtain optimized risk assessment results. The report generation module is used to identify digital certificates that are about to expire within a preset time range based on the optimized risk assessment results, and to classify them into multiple levels of risk according to the remaining validity time and business importance, and generate an assessment report with risk level labels. The certificate update module is used to trigger the certificate update mechanism based on the assessment report, generate new certificates in order of risk level priority, and distribute them to the target server.

10. A device for monitoring and assessing the risk of digital certificate expiration based on a large model, characterized in that, include: One or more processors; A storage device for storing one or more programs, which, when executed by one or more processors, cause the one or more processors to implement the method as described in any one of claims 1 to 8.

Images