Data security dynamic evaluation system and protection method

Abstract

The invention discloses a data security dynamic evaluation system and a protection method, belongs to the technical field of information security, and is used for solving the problem of terminal equipment access control and behavior risk dynamic collaborative protection. The method comprises the following steps: generating fingerprints through terminal equipment features, verifying authorization, inputting access feature slices into a time sequence model by authorized terminal equipment, generating a trust score based on cosine similarity of a behavior sequence and a prediction sequence, and constructing a Markov model to dynamically select an authentication mode according to the trust score; calculating a risk index by combining network and geographic information, and distributing the risk index to a real or virtual environment; and the unauthorized terminal equipment distributes the virtual environment after registration. Differentiated monitoring is carried out, a time sequence library is established in the virtual environment, and doubt scores are generated through sequence matching; the state deviation of the real environment is calculated through a hidden Markov model, and the risk score is generated by fusing the multi-dimensional features. And based on the result management authority, the suspicion terminal equipment isolates and shrinks the authority, the compliance terminal equipment authenticates and migrates, and the access is regulated and controlled according to the minimum privilege principle and the time window mechanism.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and more specifically to a data security dynamic assessment system and protection method. Background Technology

[0002] In the wave of digital transformation, terminal devices, as key nodes in data interaction, are directly related to the security of core enterprise data and business continuity. Currently, the field of terminal security mainly relies on static access control and independent user behavior analysis technology. On the one hand, traditional access mechanisms mostly use static authentication methods such as usernames, passwords, and digital certificates, which only verify the legitimacy of the terminal device's identity and lack continuous monitoring of the terminal device's security status during operation. This allows legitimate terminal devices hijacked by malicious software to easily bypass protection, resulting in data leakage. On the other hand, although user behavior analysis systems can build behavioral baselines based on historical data, they are not deeply correlated with the terminal device's security status and permission allocation policies. Moreover, when facing data transmission behavior in encrypted traffic, traditional detection methods are limited by encryption protocols and find it difficult to identify abnormal operations, resulting in a large number of risk events with compliant permissions but abnormal behavior remaining in the detection blind spot. These fragmented and limited technical means make terminal security protection vulnerable to frequent vulnerabilities in complex attack scenarios. Therefore, to overcome these limitations, this invention proposes a dynamic data security assessment system and protection method to achieve deep synergy between terminal device access control, permission management, and behavior monitoring, thereby improving the overall integrity and dynamic adaptability of terminal security protection. Summary of the Invention

[0003] To address the shortcomings of existing technologies, the present invention aims to provide a data security dynamic assessment system and protection method, which solves the problem of collaborative protection for terminal devices under a unified security framework, including dynamic access control, behavioral risk monitoring, and adaptive permission adjustment.

[0004] To achieve the above objectives, the present invention provides the following technical solution:

[0005] The data security dynamic assessment system includes:

[0006] The system acquires the hardware and software environment characteristics of the terminal device, generates a unique terminal device fingerprint, and verifies the legality of the terminal device fingerprint to determine whether the terminal device is authorized, thereby implementing a differentiated access control strategy.

[0007] If authorized, the access characteristics are obtained, sliced ​​into preset time windows and input into a time-series behavior model. A trust score is generated by calculating the cosine similarity between the behavior sequence of the access characteristics and the predicted sequence. A Markov decision process model is constructed based on the trust score to dynamically select the authentication method. Combining authentication information, network type and geographic information, the fuzzy hierarchical analysis method is used to calculate the anomaly risk index, and then the terminal device is assigned to the real access environment or the virtual access environment.

[0008] If not authorized, initiate the authentication and registration process, generate and store the terminal device fingerprint that is bound to the user's identity, and simultaneously assign the terminal device to the virtual access environment;

[0009] Terminal devices are classified using a differentiated monitoring strategy. The differentiated monitoring strategy is configured as follows: For terminal devices in virtual access environments, classification is performed by capturing operation data, constructing a time-ordered database, generating frequent sequence patterns, and matching them with an attack pattern library to calculate a suspicion score; For terminal devices in real access environments, classification is performed by constructing a hidden Markov chain model to form a dynamic baseline, calculating state transition probability deviations, and combining multi-dimensional features to construct an anomaly scoring system.

[0010] Based on the classification results of terminal devices, access permissions are managed for terminal devices under permission monitoring through a dynamic permission contraction strategy and a time window control mechanism.

[0011] Specifically, the steps for classifying terminal devices using a differentiated monitoring strategy include:

[0012] For terminal devices entering the virtual access environment, capture operation data in real time and build a time-ordered operation sequence database;

[0013] An ordered event sequence is constructed by standardizing the timestamps, and a sliding window is used to divide the ordered event sequence into ordered event subsequences representing operation events;

[0014] Configure a time margin threshold to construct a fuzzy order relationship between operation events, obtain candidate operation events that meet the time margin threshold constraint, and generate a projection database;

[0015] Based on the set support threshold, combinations of operation events within the projection database are filtered to generate frequent sequence patterns.

[0016] Frequent sequence patterns are semantically mapped and similarity is calculated with a pre-built attack pattern library. A multi-dimensional risk feature weight system is constructed using the analytic hierarchy process to calculate the suspicion score. Risk thresholds are configured to classify terminal devices as suspicious or compliant.

[0017] Specifically, the steps for classifying terminal devices using a differentiated monitoring strategy also include:

[0018] For terminal devices entering the real access environment, real-time capture of operation data is used to construct the actual observation sequence, and historical operation data is acquired synchronously and timestamp aligned.

[0019] Historical operation data is standardized and preprocessed, and operation types are mapped to predefined operation spaces to construct a comprehensive sequence, which is then divided into observation sequences through a sliding window.

[0020] Construct a hidden Markov chain model, define operation type as hidden state and operation object as observable variable, initialize the state transition probability matrix by statistically analyzing the occurrence frequency of each operation type in historical operation data, and initialize the observation probability matrix based on the co-occurrence relationship between operation object and operation type.

[0021] The parameters of the hidden Markov chain model are trained by the expectation-maximization algorithm to form a basic baseline model that represents the state transition law of normal behavior, and then dynamically updated by combining the time decay factor.

[0022] Standard operation sequences are generated through Monte Carlo simulation, and state transition probability deviations are calculated using temporal difference analysis. Data access frequency feature values, sensitive operation feature values, and operation time window feature values ​​are extracted, and after normalization, an anomaly scoring system is constructed to generate a comprehensive risk score.

[0023] Configure dynamic risk thresholds to classify terminal devices as either questionable or compliant.

[0024] Specifically, the steps for implementing a differentiated access control strategy include:

[0025] The terminal device access characteristics are obtained, sliced ​​according to a preset time window, and normalized. A time series behavior model is constructed through time series analysis. The time series behavior model is used to capture the dependency relationship of the behavior sequence of access characteristics.

[0026] The behavior sequence of the current terminal device access features is input into the trained temporal behavior model, and a trust score is generated by calculating the cosine similarity between the behavior sequence of the current terminal device access features and the predicted sequence of the temporal behavior model.

[0027] Based on the trust score of the terminal device, an authentication decision mechanism is constructed using a Markov decision process that includes a state space and an action space. The state space consists of the trust score, historical authentication success rate, and security event frequency, while the action space consists of the authentication policy.

[0028] Establish a mapping relationship between authentication strategies and authentication results, including authentication success rate, user time consumption, and security benefits. Based on the mapping relationship, update the Q-value table in real time to adjust the probability of authentication strategy selection.

[0029] Based on the authentication policy, user authentication information of terminal devices is collected. Combined with access network type and geographical information, a fuzzy hierarchical analysis risk assessment model containing target layer, criterion layer and indicator layer is constructed. The indicator weights are determined by the fuzzy judgment matrix, and the terminal device abnormality risk index is calculated by the weighted average operator.

[0030] Specifically, the steps for updating the Q-value table include:

[0031] Trust scores, historical authentication success rates, and security event frequencies are divided into finite interval levels to generate a discrete state space.

[0032] Initialize the Q-value entries of the state-action pairs in the state space and action space, and select the authentication strategy for the action space based on a greedy strategy;

[0033] After executing the authentication policy, record the feedback data, construct a comprehensive reward function that includes success rewards, failure penalties, and time deductions, and calculate the immediate reward;

[0034] The prediction error is calculated by combining immediate reward and expected value of the next state. The learning rate is dynamically adjusted based on the historical access frequency of state-action pairs, and the Q-value table is updated.

[0035] Specifically, the steps for implementing a differentiated access control strategy include:

[0036] The hardware and software environment characteristics of the terminal device applying for access are obtained, and feature extraction and fusion processing are performed to generate a unique terminal device fingerprint. This fingerprint is then compared with the registration database to determine whether the terminal device is authorized.

[0037] If the terminal device authorizes, obtain the terminal device's abnormal risk index;

[0038] Set a risk threshold. If the terminal device's abnormal risk index is less than the risk threshold, then grant permissions to the real access environment and establish a secure communication tunnel.

[0039] If the terminal device's abnormal risk index is greater than or equal to the risk threshold, the terminal device will be redirected to a virtual access environment.

[0040] If the terminal device is not authorized, the terminal device registration process will be initiated. Based on the submitted registration application information, a unique terminal device fingerprint will be generated, bound to the user's identity information, stored in the registration database, and the terminal device will be guided to the virtual access environment.

[0041] Specifically, the steps for calculating the doubt score include:

[0042] Frequent sequence patterns are converted into operational feature vectors through semantic mapping, and then dynamically matched with an attack pattern library containing operational feature vectors of attack pattern attributes of known threat behaviors.

[0043] Calculate the similarity between the operation feature vector and the attribute operation feature vector of each attack mode in the attack mode library;

[0044] Configure a similarity threshold to filter target attack pattern attributes with a similarity greater than the similarity threshold;

[0045] A multi-dimensional risk feature weighting system is constructed. The multi-dimensional risk feature weighting system sets feature weights for target attack pattern attributes through the hierarchical analysis method, and performs weighted aggregation calculation on the selected target attack pattern attributes to calculate the doubt score.

[0046] Specifically, the steps for generating the comprehensive risk score include:

[0047] Standard operating sequences that conform to the probability distribution of the baseline model are generated by Monte Carlo simulation, and the state transition probability deviation between the actual observed sequences and the standard operating sequences is calculated using time series difference analysis.

[0048] The deviation between the number of operations per unit time and the average number of operations in the same period of historical operation data is calculated by a standardized method to generate data access frequency feature values.

[0049] Monitor the frequency and proportion of sensitive operation sets in the observation sequence, and generate sensitive operation feature values;

[0050] Divide the operation time window intervals, calculate the difference between the proportion of operation times in each interval and the operation distribution in the corresponding time period in the baseline model, and generate operation time window feature values;

[0051] The state transition probability deviation, data access frequency feature value, sensitive operation feature value, and operation time window feature value are normalized and then weighted to generate a comprehensive risk score.

[0052] Specifically, the steps for managing access permissions on access monitoring terminal devices include:

[0053] Implement a collaborative control mechanism of network isolation and access restriction for suspicious terminal devices in the virtual access environment;

[0054] For compliant terminal devices in the virtual access environment, a progressive authentication process is initiated, a trusted environment migration is performed, and the compliant terminal devices that have passed enhanced authentication are incorporated into the real access environment.

[0055] A dynamic permission contraction strategy is implemented for permission monitoring terminal devices in real access environments. Based on the principle of least privilege, a triple permission control is performed on the permission monitoring terminal, including network access control, data operation control and account permission management.

[0056] A time window control mechanism is built for the permission monitoring terminal, dividing the working period and non-working period and configuring differentiated rules: during the working period, access to resources within the scope of the restricted permissions is open, while during the non-working period, operations are restricted through enhanced restriction policies; cross-time period access requires verification by the security policy engine and temporary access windows are granted through multi-factor authentication.

[0057] The dynamic data security protection method includes the following steps:

[0058] Step S1: Obtain the hardware and software environment characteristics of the terminal device, generate a unique terminal device fingerprint, and verify the legality of the terminal device fingerprint to determine whether the terminal device is authorized, and implement a differentiated access control strategy.

[0059] Step S2: If authorized, obtain its access characteristics, slice the access characteristics according to a preset time window and input them into the time-series behavior model, generate a trust score by calculating the cosine similarity between the behavior sequence of the access characteristics and the predicted sequence; construct a Markov decision process model based on the trust score to dynamically select the authentication method; combine authentication information, network type and geographical information, use fuzzy hierarchical analysis to calculate the abnormal risk index, and then allocate the terminal device to the real access environment or the virtual access environment;

[0060] Step S3: If not authorized, initiate the authentication and registration process, generate and store the terminal device fingerprint that is bound to the user's identity, and simultaneously assign the terminal device to the virtual access environment;

[0061] Step S4: Classify terminal devices using a differentiated monitoring strategy. The differentiated monitoring strategy is configured as follows: For terminal devices in virtual access environments, classify them by capturing operation data, constructing a time-ordered database, generating frequent sequence patterns, and matching them with an attack pattern library to calculate a suspicion score; For terminal devices in real access environments, classify them by constructing a hidden Markov chain model to form a dynamic baseline, calculating the state transition probability deviation, and combining multi-dimensional features to construct an anomaly scoring system.

[0062] Step S5: Based on the terminal device classification results, manage access permissions for the terminal devices under permission monitoring through a dynamic permission contraction strategy and a time window control mechanism.

[0063] The beneficial effects of this invention are:

[0064] This invention employs a differentiated access control strategy, leveraging terminal device fingerprinting and blockchain technology to achieve precise verification of terminal identity. It combines temporal behavior models and Hidden Markov Decision Processes (HMMs) to dynamically adapt authentication strength, addressing the security vulnerabilities of traditional static authentication. By integrating multi-dimensional risk factors using fuzzy hierarchical analysis, it achieves quantitative assessment of terminal access risks, avoiding the limitations of single indicators. Through sequence pattern mining and dynamic matching of attack pattern libraries in virtual access environments, along with HMM baseline modeling and temporal difference analysis in real access environments, it constructs a bidirectional dynamic monitoring system. This system enables accurate identification of known threats and probabilistic detection of unknown anomalies, significantly improving the comprehensiveness and timeliness of threat discovery. A dynamic permission contraction and time window control mechanism based on the principle of least privilege, combined with full log auditing and real-time blocking technology, effectively reduces the risk of permission abuse and enhances fine-grained control over data access. The overall solution, through technological integration and process closure, overcomes the static and fragmented limitations of traditional security protection, constructing a dynamic security protection system covering access, monitoring, and response, significantly improving the intelligence and adaptability of data security protection in complex network environments. Attached Figure Description

[0065] Figure 1 This is a schematic diagram of the data security dynamic assessment system of the present invention;

[0066] Figure 2 A flowchart illustrating the specific steps involved in implementing the differentiated access control strategy of this invention;

[0067] Figure 3 This is a flowchart illustrating the specific steps of a terminal device entering a virtual access environment according to the present invention.

[0068] Figure 4 This is a flowchart illustrating the specific steps of the terminal device entering the real access environment according to the present invention.

[0069] Figure 5 This is a flowchart of the dynamic data security protection method of the present invention. Detailed Implementation

[0070] Example 1

[0071] Please see Figure 1 This embodiment introduces a data security dynamic assessment system, including: an access decision module, a behavior monitoring module, and a permission control module;

[0072] The access decision module integrates multi-dimensional identity authentication and risk decision-making mechanisms. It is responsible for conducting initial security assessments of terminal devices applying for access and planning access paths through differentiated access control policies. By integrating technologies such as terminal device fingerprint verification, biometric recognition, and digital certificate verification, a three-dimensional authentication system is constructed to verify the legitimacy of terminal device identities in real time. It automatically generates isolated virtual access environments, configured with limited access permissions and simulated business data, used to trap and observe the subsequent behavior of suspicious terminal devices. For compliant terminal devices that pass rigorous authentication, a real data interaction channel is directly opened and an initial trusted connection is established. Simultaneously, the module has a built-in access policy engine that dynamically adjusts authentication strength based on contextual information such as network environment risk level and access time, ensuring the dynamic and adaptable nature of identity verification and providing reliable initial data input for subsequent behavior assessments.

[0073] Please see Figure 2 Preferably, the specific steps for implementing a differentiated access control strategy include:

[0074] The uniqueness of hardware and software characteristics can identify the identity of a terminal device. The hardware characteristics and software environment characteristics of the terminal device applying for access are obtained. Hardware characteristics include: MAC address, BIOS serial number, CPU-ID; software environment characteristics include: operating system version, list of installed applications. The hardware characteristics and software environment characteristics are extracted and fused through a hash algorithm to generate a unique terminal device fingerprint. This fingerprint is compared with the registration database. A distributed identity verification technology based on blockchain is used to verify the legality and integrity of the terminal device fingerprint through a smart contract to determine whether the terminal device is authorized.

[0075] The temporal distribution and historical patterns of terminal device behavior are continuous, and time series analysis can capture long-term dependency characteristics of abnormal operations. If the terminal device is authorized, its access characteristics are obtained, including connection time distribution, data transmission mode, target IP address, and request frequency. These access characteristics are sliced ​​according to a preset fixed time window and normalized. A temporal behavior model is constructed through time series analysis. The temporal behavior model captures long-term dependencies of behavior sequences through a gating mechanism. During the training phase of the temporal behavior model, historical behavior data of the terminal device is extracted from the security logs of the access environment as the training set. The Adam optimizer is used to minimize the mean squared error loss function, and iterative training is performed until convergence. During real-time evaluation, the behavior sequence of the current terminal device access characteristics is input into the trained temporal behavior model. A trust score of 0-100 is generated by calculating the cosine similarity between the behavior sequence of the current terminal device access characteristics and the predicted sequence of the temporal behavior model, forming a quantitative assessment of the credibility of the terminal device behavior.

[0076] A single authentication method cannot balance security and efficiency. Based on the trust score of the terminal device, an authentication decision mechanism is constructed based on a three-dimensional authentication system. Through Markov decision process modeling, the authentication method for the terminal device is dynamically selected.

[0077] The authentication decision engine is constructed using a Markov decision process, treating authentication method selection as a sequential decision problem. The state space consists of multi-dimensional variables such as trust score, historical authentication success rate, and security event frequency. The action space contains various authentication strategies, including single-factor authentication, two-factor authentication, and multimodal biometric authentication. A mapping relationship between authentication strategies and authentication effectiveness is established using Q-learning, where effectiveness includes success rate, user time consumption, and security benefits. The Q-value table is updated in real-time based on the mapping relationship between authentication strategies and effectiveness, updating the probability of strategy selection. This achieves dynamic matching between authentication strength and access efficiency, ensuring rapid access for high-trust terminal devices while implementing enhanced authentication for low-trust terminal devices.

[0078] Specifically, the steps for updating the Q-value table in real time based on the mapping relationship between authentication strategy and authentication effect include:

[0079] Original data such as trust scores and historical authentication success rates are usually continuous values. Directly using them for reinforcement learning would result in an infinitely large state space and an exponential increase in computational complexity. Therefore, trust scores, historical authentication success rates, and security event frequencies are divided into a finite number of interval levels to form a discrete state space.

[0080] Create a corresponding Q-value entry for each state in the state space and each action in the action space, and initialize it to the default value;

[0081] A purely greedy strategy can lead the algorithm into local optima, while completely random selection lacks a direction for strategy optimization. At each authentication decision, based on the greedy strategy, the authentication strategy of the action space is randomly selected in the current state with a preset probability according to the Q-value table of state-action pairs in the state space and action space.

[0082] A single metric may overlook user experience or security risks; a comprehensive reward function is needed to map multi-dimensional metrics into a unified numerical feedback. Implement the selected authentication strategy and record feedback data, including whether authentication was successful, the time taken for the user to complete authentication, and whether any security events were triggered.

[0083] A comprehensive reward function is constructed, awarding a positive reward for successful authentication without any security incidents, and a negative reward for failure or triggering a security incident. User time consumption is deducted proportionally as a penalty. Real-time rewards are calculated based on authentication results, user time consumption, and security incidents, simultaneously optimizing both security and efficiency.

[0084] By combining the current state, the action performed, the immediate reward, and the expected value of the next state, the prediction error is calculated using the temporal difference learning method, and the learning rate is dynamically adjusted based on the historical access frequency of the state and action to achieve adaptive updating of the Q-value table.

[0085] Specifically, the target value is first calculated based on the current reward and the maximum expected value of the next state. Then, the difference between the target value and the current Q value estimate is used as the error signal. Finally, the corresponding entries are updated according to the dynamically decaying learning rate to ensure that parameter updates are more cautious in high-frequency states and that exploration is maintained in low-frequency states.

[0086] Terminal device access risks involve multiple uncertainties, including terminal device trustworthiness, network risk, and geographical risk. Traditional quantitative analysis struggles to effectively handle these fuzzy aspects. This paper describes a risk assessment model constructed using fuzzy hierarchical analysis (AHP) to collect user authentication information from terminal devices based on authentication policies and combining this information with the network type and geographical information of the terminal devices. The target layer of the risk assessment model is the anomaly risk index, the criterion layer includes terminal device trustworthiness, network risk, and geographical risk, and the indicator layer covers specific indicators such as trust score, network type risk value, and geographical location risk value. A fuzzy judgment matrix is ​​constructed to obtain the weights of each indicator, and a weighted average operator is used to calculate the terminal device anomaly risk index, achieving a multi-dimensional quantitative assessment of terminal access risks.

[0087] Terminal devices need to be subject to tiered management and control. Based on the terminal device's anomaly risk index, a differentiated access control strategy should be implemented, namely:

[0088] Directly rejecting high-risk terminal devices may trigger further probing by attackers, while exposing sensitive data in the real environment poses a risk of leakage. Therefore, a risk threshold is set. If the abnormal risk index of a terminal device is less than the risk threshold, then permissions to access the real environment are granted and a secure communication tunnel is established.

[0089] If the anomaly risk index of a terminal device is greater than or equal to the risk threshold, the terminal device will be redirected to a virtual access environment. The virtual access environment employs dynamic resource allocation technology to generate simulated business scenarios and forged data resources based on the characteristics of the terminal device being evaluated. Its interface and operational logic maintain a high degree of consistency with the real access environment, but all data is simulated data that has undergone anonymization processing. By monitoring the behavior patterns of the terminal device being evaluated in the virtual environment, potential attack intentions and abnormal operations are identified.

[0090] If the terminal device is not authorized, the terminal device registration process will be initiated. A comprehensive authentication system will be used to perform full-factor authentication on the terminal device. The terminal device will submit registration application information, including terminal device information and user identity information. The validity of the user's identity will be confirmed through SMS verification codes, email verification, and other methods. Simultaneously, the submitted terminal device information will be verified for hardware authenticity to prevent registration using forged terminal device information.

[0091] After registration and authentication are completed, a unique terminal device fingerprint is generated based on the submitted registration application information, which is then bound to the user's identity information and stored in the registration database.

[0092] Unauthorized terminal devices may carry malicious software or exhibit abnormal behavior during the registration phase. During the registration process, unauthorized terminal devices will be guided to a virtual access environment for pre-evaluation of their behavior.

[0093] The behavior monitoring module is responsible for the full-cycle collection and in-depth analysis of terminal device behavior data. Through differentiated monitoring strategies, it categorizes terminal devices entering virtual and real access environments into suspicious and compliant devices. For virtual terminals, sequence pattern mining technology is used to track file operations, network connections, and data transmission in a fine-grained manner. A real-time operation sequence model is constructed and dynamically matched with a known attack pattern library to identify potential threats such as data theft and port scanning, classifying them as suspicious or compliant devices. For compliant devices, a dynamic behavior baseline is constructed based on historical operation data. Temporal difference analysis and Hidden Markov Models are used to calculate the deviation of the current behavior from the baseline in real time. Anomaly quantification assessment is performed based on dimensions such as data access frequency and sensitive data operation types, classifying them as suspicious or compliant devices. This provides multi-level behavioral feature inputs for access control and risk decision-making, achieving a technological upgrade from single behavior detection to sequence correlation assessment.

[0094] Preferably, the specific steps for classifying terminal devices entering the virtual access environment and those entering the real access environment into suspicious terminal devices and compliant terminal devices through differentiated monitoring strategies include:

[0095] Please see Figure 3 Attacks on terminal devices typically manifest as specific operation sequences, such as abnormal file traversal before file theft or network connection probing before port scanning. For terminal devices entering a virtual access environment, operation data is captured in real time, including file operation instruction streams, network connection session records, and data transmission packets. Timestamp technology is used to arrange the above operation data in the order of events to build a time-ordered operation sequence database.

[0096] Timestamps from different data sources may have clock skew. By standardizing the timestamps, the captured operation sequences are sorted by occurrence time to construct an ordered event sequence. A sliding window is then used to divide the ordered event sequence into time-continuous ordered event subsequences to represent operation events.

[0097] Actual attack behavior may deviate from the order of operations due to factors such as system load and network latency. A time margin threshold is configured to define the maximum allowed time deviation, relax the operation order constraints, and construct fuzzy order relationships between operation events. For each operation event, a projection database is constructed, which contains subsequent operation events that satisfy the time margin threshold constraint. This provides a time-constrained association data foundation for subsequent frequent pattern mining.

[0098] High-frequency co-occurring operation event combinations are often associated with known attack patterns. For example, the combination of file reading, network connection and data outgoing operation events is associated with data theft. By processing the projection database of operation events and setting a support threshold, high-frequency co-occurring operation event combinations are filtered out, and frequent sequence patterns containing operation type, operation frequency and operation correlation are generated. Frequent sequence patterns reflect the operation characteristics of terminal devices in the virtual environment.

[0099] The generated frequent sequence patterns are dynamically matched with a pre-built attack pattern library, which contains operational feature templates of known threat behaviors. Through semantic mapping, elements such as operation types and relationships in the frequent sequence patterns are converted into operational feature representations consistent with the attack pattern library, establishing a mapping relationship between operational features and attack pattern attributes to form comparable operational feature vectors. Attack pattern attributes include: the operational feature template includes operational feature vectors of each attack pattern attribute.

[0100] Similarity calculation is used to calculate the similarity between the semantically mapped operation feature vector and the operation feature vector of each attack mode attribute in the attack mode library. The similarity calculation supports algorithms such as cosine similarity and dynamic time warping. Target attack mode attributes with similarity greater than the similarity threshold can be filtered by configuring a similarity threshold.

[0101] A single similarity index cannot comprehensively assess risk. Therefore, a multi-dimensional risk feature weighting system is constructed. This system uses the analytic hierarchy process (AHP) to determine the weight of each feature by combining the severity, frequency, and business impact of attack pattern attributes. The selected attack pattern attributes are then weighted and aggregated to calculate the skepticism score.

[0102] Configure risk thresholds based on real-time network security status and business risk level. If the suspiciousness score of a terminal device is greater than the risk threshold, the terminal device is classified as a suspicious terminal device; otherwise, it is classified as a compliant terminal device and included in the continuous trust monitoring system.

[0103] Please see Figure 4In real-world environments, it is necessary to monitor the deviation between the terminal's real-time behavior and the historical baseline. For terminal devices entering real-world access environments, operation data is captured in real time to construct a time-ordered and formatted actual observation sequence. This actual observation sequence is used to characterize the real-time operation behavior pattern of the terminal device. Its construction process integrates multi-source data acquisition and time consistency processing technologies. By capturing operation data such as the terminal's file operation command stream, network connection session records, and data transmission traffic characteristics in real time, an original sequence with precise timestamps is generated according to the order of events. To address potential clock deviations in multi-source data, a timestamp alignment algorithm is used to perform spatiotemporal calibration on the original sequence to ensure that operation events are arranged in the actual order of occurrence. A time-ordered and formatted actual observation sequence is formed through a unified data format.

[0104] Synchronously acquire historical operation data covering a preset evaluation period, including file operation command sequences, network connection information, and data transmission traffic characteristics, and use a timestamp alignment algorithm to eliminate clock deviations in multi-source data;

[0105] Historical operation data is standardized and preprocessed to map operation types to a predefined operation space, construct a comprehensive sequence containing operation type, operation object and operation time, and divide the comprehensive sequence into fixed-length observation sequences through a sliding window;

[0106] Normal behavior has a time-series dependency. A hidden Markov chain model is constructed, where operation type is defined as a hidden state and operation object is defined as an observable variable. The state transition probability matrix is ​​initialized by statistically analyzing the frequency of occurrence of each operation type in historical operation data, and the observation probability matrix is ​​initialized based on the co-occurrence relationship between operation object and operation type.

[0107] The Hidden Markov Chain Model is trained with the Expectation Maximization (EM) algorithm. The expected value of the state transition probability is calculated by the forward-backward algorithm. The model parameters are iteratively updated until the log-likelihood function converges, forming a basic baseline model that represents the state transition law of normal behavior.

[0108] User behavior patterns may change with business needs. By setting a time decay factor to weight historical operation data, the influence of recent behavior on the parameters of the Hidden Markov Chain Model gradually increases, thereby realizing a dynamic update mechanism for the basic baseline model.

[0109] By generating standard operating sequences that conform to the probability distribution of the baseline model through Monte Carlo simulation, a reference benchmark for normal behavior is used. Temporal difference analysis is employed to calculate the state transition probability deviation between the actual observed sequence and the standard operating sequence, avoiding the subjectivity of traditional threshold setting and realizing dynamic anomaly detection based on probability distribution.

[0110] The system counts the number of operations performed on terminal devices per unit time, calculates the deviation from the average number of operations performed during the same period in historical operation data, and converts this deviation into a data access frequency feature value through a standardization method. For sensitive data operation types, a set of sensitive operations, including reading and writing classified documents and accessing information with administrator privileges, is predefined. The system monitors the frequency and proportion of sensitive data operations in the actual observation sequence in real time and generates sensitive operation feature values. For operation time windows, the day is divided into different time intervals, such as working hours and non-working hours. The system calculates the difference between the proportion of operations performed in each interval and the corresponding time period operation distribution in the baseline model, and quantifies the time window feature value.

[0111] Normalize the state transition probability deviation, data access frequency feature value, sensitive operation feature value and time window feature value, construct an anomaly scoring system, and generate a comprehensive risk score through a weighted synthesis algorithm to achieve multi-dimensional quantitative assessment and risk classification of terminal operations.

[0112] Configure dynamic risk thresholds and adaptively adjust them based on business operation characteristics, network security status and historical trust level of terminals. Compare the comprehensive risk score with the dynamic risk threshold. Terminal devices with a score greater than the dynamic risk threshold are classified as suspicious terminal devices, otherwise they are classified as compliant terminal devices. The operation baseline model is continuously updated using an incremental learning algorithm. By setting a trust decay factor, continuous trust assessment of terminal devices is achieved, forming a closed-loop dynamic monitoring mechanism.

[0113] Based on the evaluation results output by the behavior monitoring module, the access control module intelligently and dynamically adjusts access permissions and automates the execution of risk response strategies. According to the classification of terminal devices entering the virtual access environment and the real access environment, it manages access permissions for suspicious and compliant terminal devices separately, generating access control instructions. For suspicious terminal devices confirmed to exhibit threatening behavior in the virtual access environment, it disconnects their network connection using micro-segmentation technology, triggers firewalls to implement IP blocking, and activates a terminal device blacklist mechanism to prevent subsequent access. For terminals with abnormal behavior but compliant identities, it automatically narrows access permissions based on the degree of abnormality and the sensitivity level of data assets, using a hybrid strategy based on rule engines and machine learning.

[0114] Preferably, the specific steps for managing terminal device access permissions include:

[0115] Suspicious terminal devices in virtual access environments may carry malicious code or exhibit abnormal behavior. Direct access to the real environment could lead to the spread of attacks. Therefore, a collaborative control mechanism of network isolation and access restrictions should be implemented for terminals classified as suspicious in the virtual access environment.

[0116] First, a security isolation boundary is built at the data link layer. Communication filtering rules based on hardware addresses are used to cut off the connection channels between suspicious terminal devices and virtual resources in real time, blocking their data interaction capabilities. Simultaneously, network security terminal devices are linked to generate dynamic access control policies based on the fingerprint characteristics of terminal devices. Bidirectional access blocking is implemented at the network layer to prevent suspicious terminal devices from attempting to access the real access environment and the virtual access environment.

[0117] For persistent threat terminal devices that trigger security incidents multiple times, they will be marked as high-risk and all access requests will be rejected during the preset isolation period. After the isolation period expires, they can reapply for access only after passing an enhanced verification process that includes multi-factor biometric authentication and deep security scanning.

[0118] Compliant terminal devices in virtual access environments may pose a risk of identity theft. For terminal devices deemed compliant in the virtual access environment, a progressive authentication process is initiated to achieve trusted environment migration. An enhanced authentication mechanism is adopted to improve verification dimensions, verifying the authenticity of the user's identity through a multi-level identity confirmation process.

[0119] Upon successful enhanced authentication, a security credential containing permission levels is issued, the interaction channel in the real access environment is decrypted, and a quantum-encrypted communication link is established. Simultaneously, a trust assessment model is initialized based on the terminal's behavioral characteristics in the virtual environment, and this model is incorporated into the dynamic monitoring system of the real access environment, providing a behavioral baseline reference for subsequent permission adjustments.

[0120] Implement a dynamic permission contraction strategy for permission monitoring terminal devices in the real access environment. Permission monitoring terminal devices include compliant terminal devices in the virtual access environment that enter the real access environment through secondary authentication and suspicious terminal devices in the real access environment.

[0121] Based on the principle of least privilege, triple permission control is implemented on the permission monitoring terminal:

[0122] In terms of network access control, unnecessary service ports are disabled and unauthorized communication protocols are closed. The network connection of high-risk external targets is restricted through the license list mechanism, and the data transmission path of unregistered domain names and unverified IP addresses is blocked.

[0123] In terms of data operation control, the policy engine is used to force sensitive data access mode to read-only, prohibiting the execution of data export, modification and deletion commands, and triggering real-time approval process for operations that need to change the data status.

[0124] In terms of account permission management, the user account permissions of the permission monitoring terminal are uniformly downgraded to the restricted user level, the system management function call permission is removed, and when a privileged operation request is detected, a secondary authentication mechanism is forcibly started to verify the permission.

[0125] Abnormal access outside of working hours is often related to data theft. Therefore, a time window control mechanism should be built for the access monitoring terminal based on the business operation cycle, dividing working hours and non-working hours and configuring differentiated rules:

[0126] During working hours, the permission monitoring terminal is allowed to access authorized resources within the narrowed permission scope; outside working hours, the enhanced restriction policy is activated to restrict operations, automatically close database write permissions and disable the sensitive file download function, and only retain the emergency transaction processing channel.

[0127] For cross-time period access requests, after real-time verification by the security policy engine, a temporary access window is granted through multi-factor authentication and automatically restored to the default restriction state after the operation is completed. The duration of the temporary access window is determined according to business requirements.

[0128] Deploy a full log collection system to continuously record file operations, network connections, and data transmission behaviors. Analyze the operation logs in real time through a security information and event management platform to identify abnormal patterns, and coordinate with firewalls and intrusion detection systems to intercept unauthorized operations in real time based on preset blocking rules.

[0129] Example 2

[0130] Please see Figure 5 This embodiment introduces a dynamic data security protection method, including the following steps:

[0131] Step S1: Obtain the hardware and software environment characteristics of the terminal device, generate a unique terminal device fingerprint, verify the legality of the terminal device fingerprint to determine whether the terminal device is authorized, and implement a differentiated access control strategy based on the authorization result.

[0132] Step S2: If the terminal device is authorized, its access characteristics are obtained, the access characteristics are sliced ​​according to a preset time window and input into the time-series behavior model, and a trust score is generated by calculating the cosine similarity between the behavior sequence of the access characteristics and the predicted sequence; a Markov decision process model is constructed based on the trust score to dynamically select the authentication method; combined with authentication information, network type and geographical information, the fuzzy hierarchical analysis method is used to calculate the anomaly risk index, and the terminal device is assigned to the real access environment or the virtual access environment according to the anomaly risk index;

[0133] Step S3: If the terminal device is not authorized, the authentication and registration process is initiated, a terminal device fingerprint bound to the user's identity is generated and stored, and the terminal device is assigned to the virtual access environment.

[0134] Step S4: Classify terminal devices using a differentiated monitoring strategy. For terminal devices in virtual access environments, capture operational data and construct a time-ordered database, generate frequent sequence patterns and match them with an attack pattern library, and classify them by calculating a suspicion score through a multi-dimensional risk feature weight system. For terminal devices in real access environments: construct a hidden Markov chain model to form a dynamic baseline, calculate the state transition probability deviation, and construct an anomaly scoring system by combining data access frequency feature values, sensitive operation feature values, and operation time window feature values ​​for classification.

[0135] Step S5: Based on the terminal device classification results, implement network isolation and access restrictions on suspicious terminal devices in the virtual access environment; initiate a progressive authentication process for compliant terminal devices in the virtual access environment, and migrate them to the real access environment after successful authentication; implement a dynamic permission contraction strategy for terminal devices in the real access environment, and perform network access control, data operation management and account permission management based on the principle of least privilege; divide working hours and non-working hours through a time window control mechanism, configure differentiated access rules and perform cross-time period security verification.

[0136] Preferably, the specific steps for implementing a differentiated access control strategy include:

[0137] The terminal device access characteristics are obtained, sliced ​​according to a preset time window, and normalized. A time series behavior model is constructed through time series analysis. The time series behavior model is used to capture the dependency relationship of the behavior sequence of access characteristics.

[0138] The behavior sequence of the current terminal device access features is input into the trained temporal behavior model, and a trust score is generated by calculating the cosine similarity between the behavior sequence of the current terminal device access features and the predicted sequence of the temporal behavior model.

[0139] Based on the trust score of the terminal device, an authentication decision mechanism is constructed using a Markov decision process that includes a state space and an action space. The state space consists of the trust score, historical authentication success rate, and security event frequency, while the action space consists of the authentication policy.

[0140] Establish a mapping relationship between authentication strategies and authentication results, including authentication success rate, user time consumption, and security benefits. Based on the mapping relationship, update the Q-value table in real time to adjust the probability of authentication strategy selection.

[0141] Based on the authentication policy, user authentication information of terminal devices is collected. Combined with access network type and geographical information, a fuzzy hierarchical analysis risk assessment model containing target layer, criterion layer and indicator layer is constructed. The indicator weights are determined by the fuzzy judgment matrix, and the terminal device abnormality risk index is calculated by the weighted average operator.

[0142] Preferably, the specific steps for implementing a differentiated access control strategy include:

[0143] The hardware and software environment characteristics of the terminal device applying for access are obtained, and feature extraction and fusion processing are performed to generate a unique terminal device fingerprint. This fingerprint is then compared with the registration database to determine whether the terminal device is authorized.

[0144] If the terminal device authorizes, obtain the terminal device's abnormal risk index;

[0145] Set a risk threshold. If the terminal device's abnormal risk index is less than the risk threshold, then grant permissions to the real access environment and establish a secure communication tunnel.

[0146] If the terminal device's abnormal risk index is greater than or equal to the risk threshold, the terminal device will be redirected to a virtual access environment.

[0147] If the terminal device is not authorized, the terminal device registration process will be initiated. Based on the submitted registration application information, a unique terminal device fingerprint will be generated, bound to the user's identity information, stored in the registration database, and the terminal device will be guided to the virtual access environment.

[0148] Preferably, the specific steps for classifying terminal devices using a differentiated monitoring strategy include:

[0149] For terminal devices entering the virtual access environment, capture operation data in real time and build a time-ordered operation sequence database;

[0150] An ordered event sequence is constructed by standardizing the timestamps, and a sliding window is used to divide the ordered event sequence into ordered event subsequences representing operation events;

[0151] Configure a time margin threshold to construct a fuzzy order relationship between operation events, obtain candidate operation events that meet the time margin threshold constraint, and generate a projection database;

[0152] Based on the set support threshold, combinations of operation events within the projection database are filtered to generate frequent sequence patterns.

[0153] The frequent sequence patterns are semantically mapped and similarity is calculated with a pre-built attack pattern library. A multi-dimensional risk feature weight system is constructed using the hierarchical analysis method to calculate the doubt score, configure risk thresholds, and classify terminal devices into doubtful terminal devices or compliant terminal devices.

[0154] For terminal devices entering the real access environment, real-time capture of operation data is used to construct the actual observation sequence, and historical operation data is acquired synchronously and timestamp aligned.

[0155] Historical operation data is standardized and preprocessed, and operation types are mapped to predefined operation spaces to construct a comprehensive sequence, which is then divided into observation sequences through a sliding window.

[0156] Construct a hidden Markov chain model, define operation type as hidden state and operation object as observable variable, initialize the state transition probability matrix by statistically analyzing the occurrence frequency of each operation type in historical operation data, and initialize the observation probability matrix based on the co-occurrence relationship between operation object and operation type.

[0157] The parameters of the hidden Markov chain model are trained by the expectation-maximization algorithm to form a basic baseline model that represents the state transition law of normal behavior, and then dynamically updated by combining the time decay factor.

[0158] Standard operation sequences are generated through Monte Carlo simulation, and state transition probability deviations are calculated using temporal difference analysis. Data access frequency feature values, sensitive operation feature values, and operation time window feature values ​​are extracted, and after normalization, an anomaly scoring system is constructed to generate a comprehensive risk score.

[0159] Configure dynamic risk thresholds to classify terminal devices as either questionable or compliant.

[0160] Working principle and its effects:

[0161] This invention generates a unique terminal device fingerprint by extracting terminal hardware and software features, verifies its legitimacy, and implements differentiated access. Authorized terminal devices calculate a trust score through a time-series behavior model, dynamically select an authentication method based on a Markov decision process, and calculate an anomaly risk index by combining fuzzy hierarchical analysis with network and geographic information. The index is then assigned to a real or virtual environment. Unauthorized terminal devices enter the virtual environment after registration, thus achieving accurate identity verification and multi-dimensional risk quantification assessment.

[0162] In the differentiated monitoring stage, the virtual environment terminal captures operational data, processes it with timestamps, divides it into sliding windows to generate frequent sequence patterns, and matches it with the attack pattern library to calculate the suspicion score; the real environment terminal constructs a hidden Markov chain model, trains it with the expectation-maximization algorithm and updates it dynamically, combines Monte Carlo simulation and temporal difference analysis to calculate the state transition bias, extracts multi-dimensional features to construct an anomaly scoring system, and realizes accurate identification of known threats and probability detection of unknown anomalies.

[0163] During the access control phase, network isolation is implemented for questionable terminal devices in the virtual environment, while compliant terminal devices are migrated to the real environment through progressive authentication. Terminal devices in the real environment implement triple access control of network, data, and account based on the principle of least privilege, construct a time window control mechanism, require multi-factor authentication for cross-time period access, and reduce the risk of permission abuse by combining log collection and analysis, thereby achieving fine-grained dynamic control.

[0164] The overall solution organically integrates key technologies such as terminal device fingerprint generation, temporal behavior model, Markov decision process, fuzzy hierarchical analysis, and hidden Markov chain model. It breaks through the static and fragmented limitations of traditional security protection, and builds a dynamic security protection system covering the entire lifecycle from terminal access to access. This significantly improves the intelligence, adaptability, and threat response efficiency of data security protection in complex network environments.

[0165] The above description is merely a preferred embodiment of the present invention. The scope of protection of the present invention is not limited to the above embodiments. All technical solutions falling within the scope of the present invention's concept are within the scope of protection of the present invention. It should be noted that for those skilled in the art, any improvements and modifications made without departing from the principle of the present invention should also be considered within the scope of protection of the present invention.

Claims

1. A data security dynamic assessment system, characterized in that, include: The system acquires the hardware and software environment characteristics of the terminal device, generates a unique terminal device fingerprint, and verifies the legality of the terminal device fingerprint to determine whether the terminal device is authorized, thereby implementing a differentiated access control strategy. If authorized, the access characteristics are obtained, the access characteristics are sliced ​​according to a preset time window and input into a time-series behavior model, and a trust score is generated by calculating the cosine similarity between the behavior sequence of the access characteristics and the predicted sequence; a Markov decision process model is constructed based on the trust score to dynamically select the authentication method; combined with authentication information, network type and geographical information, the fuzzy hierarchical analysis method is used to calculate the abnormal risk index, and then the terminal device is assigned to the real access environment or the virtual access environment. If not authorized, initiate the authentication and registration process, generate and store the terminal device fingerprint bound to the user's identity, and simultaneously assign the terminal device to the virtual access environment; Terminal devices are classified using a differentiated monitoring strategy. The differentiated monitoring strategy is configured as follows: for terminal devices in virtual access environments, classification is performed by capturing operation data, constructing a time-ordered database, generating frequent sequence patterns, and matching them with an attack pattern library to calculate a suspicion score; for terminal devices in real access environments, classification is performed by constructing a hidden Markov chain model to form a dynamic baseline, calculating state transition probability deviation, and combining multi-dimensional features to construct an anomaly scoring system. Based on the classification results of terminal devices, access permissions are managed for terminal devices under permission monitoring through a dynamic permission contraction strategy and a time window control mechanism.

2. The data security dynamic assessment system as described in claim 1, characterized in that, The specific steps for classifying terminal devices using a differentiated monitoring strategy include: For terminal devices entering the virtual access environment, capture operation data in real time and build a time-ordered operation sequence database; An ordered event sequence is constructed by standardizing timestamps, and a sliding window is used to divide the ordered event sequence into ordered event subsequences representing operation events; Configure a time margin threshold to construct a fuzzy order relationship between operation events, obtain candidate operation events that satisfy the time margin threshold constraint, and generate a projection database; Based on the set support threshold, combinations of operation events within the projection database are filtered to generate frequent sequence patterns. Frequent sequence patterns are semantically mapped and similarity is calculated with a pre-built attack pattern library. A multi-dimensional risk feature weight system is constructed using the analytic hierarchy process to calculate the suspicion score. Risk thresholds are configured to classify terminal devices as suspicious or compliant.

3. The data security dynamic assessment system as described in claim 2, characterized in that, The specific steps for classifying terminal devices using a differentiated monitoring strategy also include: For terminal devices entering the real access environment, real-time capture of operation data is used to construct the actual observation sequence, and historical operation data is acquired synchronously and timestamp aligned. The historical operation data is standardized and preprocessed, and the operation type is mapped to a predefined operation space to construct a comprehensive sequence, which is then divided into observation sequences by a sliding window. Construct a hidden Markov chain model, define operation type as hidden state and operation object as observable variable, initialize the state transition probability matrix by statistically analyzing the occurrence frequency of each operation type in historical operation data, and initialize the observation probability matrix based on the co-occurrence relationship between operation object and operation type. The parameters of the hidden Markov chain model are trained by the expectation-maximization algorithm to form a basic baseline model that represents the state transition law of normal behavior, and then dynamically updated by combining the time decay factor. Standard operation sequences are generated through Monte Carlo simulation, and state transition probability deviations are calculated using temporal difference analysis. Data access frequency feature values, sensitive operation feature values, and operation time window feature values ​​are extracted, and after normalization, an anomaly scoring system is constructed to generate a comprehensive risk score. Configure dynamic risk thresholds to classify terminal devices as either questionable or compliant.

4. The data security dynamic assessment system as described in claim 1, characterized in that, The specific steps for implementing the differentiated access control strategy include: The terminal device access characteristics are obtained, sliced ​​according to a preset time window, and normalized. A time series behavior model is constructed through time series analysis. The time series behavior model is used to capture the dependency relationship of the behavior sequence of the access characteristics. The behavior sequence of the current terminal device access features is input into the trained temporal behavior model, and a trust score is generated by calculating the cosine similarity between the behavior sequence of the current terminal device access features and the predicted sequence of the temporal behavior model. Based on the trust score of the terminal device, an authentication decision mechanism is constructed using a Markov decision process that includes a state space and an action space. The state space consists of the trust score, historical authentication success rate, and security event frequency, while the action space consists of the authentication policy. Establish a mapping relationship between authentication strategies and authentication results, whereby authentication results include authentication success rate, user time consumption, and security benefits. Based on this mapping relationship, update the Q-value table in real time to adjust the probability of selecting authentication strategies. Based on the authentication policy, user authentication information of terminal devices is collected. Combined with access network type and geographical information, a fuzzy hierarchical analysis risk assessment model containing target layer, criterion layer and indicator layer is constructed. The indicator weights are determined by the fuzzy judgment matrix, and the terminal device abnormality risk index is calculated by the weighted average operator.

5. The data security dynamic assessment system as described in claim 4, characterized in that, The specific steps for updating the Q-value table include: Trust scores, historical authentication success rates, and security event frequencies are divided into finite interval levels to generate a discrete state space. Initialize the Q-value entries of the state-action pairs in the state space and action space, and select the authentication strategy for the action space based on a greedy strategy; After executing the authentication policy, record the feedback data, construct a comprehensive reward function that includes success rewards, failure penalties, and time deductions, and calculate the immediate reward; The prediction error is calculated by combining immediate reward and expected value of the next state. The learning rate is dynamically adjusted based on the historical access frequency of state-action pairs, and the Q-value table is updated.

6. The data security dynamic assessment system as described in claim 1, characterized in that, The specific steps for implementing the differentiated access control strategy include: The hardware and software environment characteristics of the terminal device applying for access are obtained, and feature extraction and fusion processing are performed to generate a unique terminal device fingerprint. This fingerprint is then compared with the registration database to determine whether the terminal device is authorized. If the terminal device authorizes, obtain the terminal device's abnormal risk index; Set a risk threshold. If the terminal device's abnormal risk index is less than the risk threshold, then grant permissions to the real access environment and establish a secure communication tunnel. If the terminal device's abnormal risk index is greater than or equal to the risk threshold, the terminal device will be redirected to a virtual access environment. If the terminal device is not authorized, the terminal device registration process will be initiated. Based on the submitted registration application information, a unique terminal device fingerprint will be generated, bound to the user's identity information, stored in the registration database, and the terminal device will be guided to the virtual access environment.

7. The data security dynamic assessment system as described in claim 2, characterized in that, The specific steps for calculating the doubt score include: Frequent sequence patterns are converted into operational feature vectors through semantic mapping and dynamically matched with an attack pattern library containing operational feature vectors of attack pattern attributes of known threat behaviors. The similarity between the calculated operation feature vector and the operation feature vector of each attack mode attribute in the attack mode library is calculated. Configure a similarity threshold to filter target attack pattern attributes with a similarity greater than the similarity threshold; A multi-dimensional risk feature weighting system is constructed. The multi-dimensional risk feature weighting system sets feature weights for target attack pattern attributes through the hierarchical analysis method, and performs weighted aggregation calculation on the selected target attack pattern attributes to calculate the doubt score.

8. The data security dynamic assessment system as described in claim 3, characterized in that, The specific steps for generating the comprehensive risk score include: Standard operating sequences that conform to the probability distribution of the baseline model are generated by Monte Carlo simulation, and the state transition probability deviation between the actual observed sequences and the standard operating sequences is calculated using time series difference analysis. The deviation between the number of operations per unit time and the average number of operations in the same period of historical operation data is calculated by a standardized method to generate data access frequency feature values. Monitor the frequency and proportion of sensitive operation sets in the observation sequence, and generate sensitive operation feature values; Divide the operation time window intervals, calculate the difference between the proportion of operation times in each interval and the operation distribution in the corresponding time period in the baseline model, and generate operation time window feature values; The state transition probability deviation, data access frequency feature value, sensitive operation feature value, and operation time window feature value are normalized and then weighted to generate a comprehensive risk score.

9. The data security dynamic assessment system as described in claim 1, characterized in that, The specific steps for managing access permissions on the permission monitoring terminal device include: Implement a collaborative control mechanism of network isolation and access restriction for suspicious terminal devices in the virtual access environment; For compliant terminal devices in the virtual access environment, a progressive authentication process is initiated, a trusted environment migration is performed, and the enhanced authentication-passed compliant terminal devices are incorporated into the real access environment. A dynamic permission contraction strategy is implemented for permission monitoring terminal devices in real access environments. Based on the principle of least privilege, a triple permission control is performed on the permission monitoring terminal, including network access control, data operation control and account permission management. A time window control mechanism is built for the permission monitoring terminal, dividing the working period and non-working period and configuring differentiated rules: during the working period, access to resources within the scope of the restricted permissions is open, while during the non-working period, operations are restricted through enhanced restriction policies; cross-time period access requires verification by the security policy engine and temporary access windows are granted through multi-factor authentication.

10. A dynamic data security protection method, implemented based on the dynamic data security assessment system according to any one of claims 1-9, characterized in that, Includes the following steps: Step S1: Obtain the hardware and software environment characteristics of the terminal device, generate a unique terminal device fingerprint, and verify the legality of the terminal device fingerprint to determine whether the terminal device is authorized, and implement a differentiated access control strategy. Step S2: If authorized, obtain its access characteristics, slice the access characteristics according to a preset time window and input them into the time-series behavior model, generate a trust score by calculating the cosine similarity between the behavior sequence of the access characteristics and the predicted sequence; construct a Markov decision process model based on the trust score to dynamically select the authentication method; combine authentication information, network type and geographical information, use fuzzy hierarchical analysis to calculate the abnormal risk index, and then allocate the terminal device to the real access environment or the virtual access environment; Step S3: If not authorized, initiate the authentication and registration process, generate and store the terminal device fingerprint that is bound to the user's identity, and simultaneously assign the terminal device to the virtual access environment; Step S4: Classify terminal devices using a differentiated monitoring strategy. The differentiated monitoring strategy is configured as follows: For terminal devices in virtual access environments, classify them by capturing operation data, constructing a time-ordered database, generating frequent sequence patterns, and matching them with an attack pattern library to calculate a suspicion score; For terminal devices in real access environments, classify them by constructing a hidden Markov chain model to form a dynamic baseline, calculating state transition probability deviation, and combining multi-dimensional features to construct an anomaly scoring system. Step S5: Based on the terminal device classification results, manage access permissions for the terminal devices under permission monitoring through a dynamic permission contraction strategy and a time window control mechanism.

Images