Data security assessment method and system
By acquiring current and historical data from the financial system, filtering early warning data based on historical baselines, and performing clustering, the problem of inaccurate financial data risk assessment was solved, achieving more accurate risk identification and assessment.
Patent Information
- Application Number
- CN202511372185.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-09-24
- Publication Date
- 2025-12-30
AI Technical Summary
Existing technologies have low accuracy in assessing financial data risks and struggle to effectively identify anomalous data.
By acquiring current and historical data from the financial system, early warning financial data is selected based on the historical data baseline, clustering is performed to obtain the target clustering results, and risk assessment is conducted based on these results to generate target safety indicators.
It improves the accuracy of financial data risk assessment, and can reflect the security status of financial system data from multiple dimensions and identify potential risks.
Smart Images
Figure CN121234075A_ABST
Abstract
Description
Technical Field
[0001] This application belongs to the field of data security technology, and more specifically, relates to a data security assessment method and system. Background Technology
[0002] With the acceleration of enterprise digital transformation, financial systems have become a crucial foundational system supporting enterprise operations. Since financial data directly relates to an enterprise's compliance and economic security, how to conduct security assessments and risk monitoring of data within financial systems has become a key research direction in the field of information security. However, due to the scattered distribution of abnormal data in financial data, the accuracy of financial data risk assessments remains low.
[0003] Therefore, a data security assessment method is needed. Summary of the Invention
[0004] The purpose of this application is to provide a data security assessment method and system to improve the accuracy of financial data risk assessment.
[0005] A first aspect of this application provides a data security assessment method, comprising: in response to receiving a financial data security assessment instruction, acquiring financial system data; the financial system data being financial data stored in the financial system; the financial system data including: current financial data and historical financial data; Early warning financial data is derived based on current financial data and historical data baselines; the early warning financial data is a subset of the current financial data; the historical data baseline is determined based on historical financial data. Clustering is performed on the early warning financial data to obtain the target clustering results; Based on the obtained target clustering results, a risk assessment is performed on the financial system data to obtain the target security index; the target security index is used to characterize the security of the financial system data.
[0006] A second aspect of this application provides a data security assessment apparatus, comprising: The data acquisition module is used to acquire financial system data in response to receiving a financial data security assessment instruction; the financial system data is the financial data stored in the financial system; the financial system data includes: current financial data and historical financial data; The early warning data generation module is used to generate early warning financial data based on current financial data and historical data baselines; the early warning financial data is a portion of the current financial data; wherein, the historical data baseline is determined based on historical financial data; The clustering analysis module is used to cluster the early warning financial data to obtain the target clustering results. The risk assessment module is used to conduct risk assessments on financial system data based on the obtained target clustering results, and to obtain target security indicators; the target security indicators are used to characterize the security of financial system data.
[0007] A third aspect of this application provides an electronic device, including a memory, a processor, and a computer program stored in the memory and running on the processor, wherein the processor executes the computer program to implement the steps of the data security assessment method described above.
[0008] A fourth aspect of this application provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the data security assessment method described above.
[0009] The beneficial effects of the data security assessment method and system provided in this application are as follows: After obtaining financial system data, this application filters out early warning financial data based on current and historical data baselines to determine the assessment scope, avoiding blindly searching for anomalies in a large amount of normal data. Clustering of the early warning financial data yields target clustering results, strengthening the identification of risk characteristics and providing a more reliable basis for risk assessment. Finally, a comprehensive risk assessment of the financial system data is conducted based on the target clustering results, deriving target security indicators that characterize data security. This comprehensively reflects the data security status of the financial system from multiple dimensions, solving the problem of inaccurate data security assessment of the financial system. Attached Figure Description
[0010] To more clearly illustrate the technical solutions in the embodiments of this application, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0011] Figure 1 A schematic flowchart of a data security assessment method provided in an embodiment of this application; Figure 2 A structural block diagram of a data security assessment system provided in an embodiment of this application; Figure 3 This is a schematic block diagram of an electronic device provided in an embodiment of this application. Detailed Implementation
[0012] In the following description, specific details such as particular system architectures and techniques are set forth for illustrative purposes and not for limitation, in order to provide a thorough understanding of the embodiments of this application. However, those skilled in the art will understand that this application may also be implemented in other embodiments without these specific details. In other instances, detailed descriptions of well-known systems, apparatuses, circuits, and methods have been omitted so as not to obscure the description of this application with unnecessary detail.
[0013] To make the objectives, technical solutions, and advantages of this application clearer, specific embodiments will be described below in conjunction with the accompanying drawings. Please refer to Figure 1 , Figure 1 This is a flowchart illustrating a data security assessment method provided in an embodiment of this application. The method can be executed by a data security assessment device and may include: S101-S104.
[0014] S101: In response to receiving a financial data security assessment instruction, obtain financial system data; the financial system data is the financial data stored in the financial system; the financial system data includes: current financial data and historical financial data.
[0015] In this embodiment, the data security assessment instruction can be an operation request issued by the financial management system or user terminal to initiate a data security assessment process. It can be manually entered or automatically issued by the system scheduling strategy, such as daily scheduled execution or automatic triggering after major transactions.
[0016] In this embodiment, the financial system data can be a collection of data stored in the enterprise's financial system, which may include accounting records, accounting vouchers, cash flow records, invoice information, or report data. Current financial data may be the latest dataset extracted from the financial system at the time the evaluation instruction is received, while historical financial data may be financial records accumulated and stored in the financial system long before the current time.
[0017] For example, upon receiving a financial data security assessment instruction, the system enters the data acquisition phase. First, it connects to the financial system database, retrieves the required financial data based on the assessment task's timeframe and data category, and caches the search results in the security assessment engine's workspace. After data acquisition, the system categorizes and processes the collected data, ultimately outputting two datasets: current financial data and historical financial data.
[0018] S102: Early warning financial data is obtained based on current financial data and historical data baseline; the early warning financial data is a portion of the current financial data; wherein, the historical data baseline is determined based on historical financial data.
[0019] In this embodiment, historical baseline data can be obtained by the financial system through feature extraction, cluster analysis, and normal pattern screening of historical financial data. For example, the financial system first extracts key features from historical financial data, such as transaction amount, transaction frequency, department, supplier category, or time period distribution. Then, it uses clustering algorithms to identify stable normal pattern clusters and determines the parameter range of these clusters through screening and statistical methods, ultimately forming a historical data baseline that can characterize normal business behavior.
[0020] Early warning financial data can be obtained by comparing current financial data with historical data baselines through the financial system. For example, the financial system analyzes the degree of deviation of each data point from the historical data baseline, and filters out transaction records, vouchers, or report entries that show significant deviations, thereby forming an early warning data set.
[0021] S103: Perform clustering processing on the early warning financial data to obtain the target clustering results.
[0022] In this embodiment, clustering can be an unsupervised learning or statistical analysis method used to divide data into several clusters based on feature similarity. Through clustering, similar data points can be grouped into the same cluster, while data from different clusters show significant differences in the feature space, thereby discovering potential patterns or structures in the data. The target clustering result can be a set of results generated after the clustering process, including the cluster label, cluster center or feature of each early warning financial data point, and information on the relationships between clusters.
[0023] S104: Based on the obtained target clustering results, conduct a risk assessment on the financial system data to obtain the target security index; the target security index is used to characterize the security of the financial system data.
[0024] In this embodiment, the target security index can be a set of numerical or index-based indicators obtained by risk assessment of the target clustering results, representing the security of financial system data. The target security index can be a single comprehensive indicator, such as an overall risk score, or a multi-dimensional indicator, such as cluster-level risk, department-level risk, or transaction type risk. It can also be divided into three levels: high, medium, and low, for different levels of security assessment.
[0025] In this embodiment, the target safety index can be generated through the following process: First, the core features of each cluster are extracted, including the degree of anomaly in the data within the cluster and the degree of deviation from the historical baseline. Then, according to the pre-set weight allocation and scoring rules, each feature is comprehensively calculated to quantify the anomaly information within the cluster into a risk value, thereby forming an index that can reflect the overall risk level of the cluster.
[0026] In this embodiment, the degree of anomaly in the data within a cluster is the average anomaly score of all data within the cluster. For example, if DBSCAN clustering is used, it can be represented by the average Euclidean distance from the data to the center of the normal pattern cluster; the greater the distance, the higher the degree of anomaly. The degree of deviation from the historical baseline refers to the ratio of the difference between the mean of the data within the cluster and the mean of the historical baseline to the standard deviation of the historical baseline. In other words, the target security indicator is negatively correlated with the security of the financial system data.
[0027] As can be seen from the above, after obtaining financial system data, this application embodiment filters out early warning financial data based on current financial data and historical data baselines to determine the assessment scope, avoiding blindly searching for anomalies in a large amount of normal data; clustering the early warning financial data to obtain target clustering results strengthens the identification of risk characteristics and provides a more reliable basis for risk assessment; finally, based on the target clustering results, a comprehensive risk assessment of the financial system data is conducted to derive target security indicators that characterize data security, comprehensively reflecting the data security status of the financial system from multiple dimensions, and solving the problem of inaccurate data security assessment of the financial system.
[0028] In one embodiment of this application, the process of determining a historical data baseline includes: Feature extraction is performed on historical financial data to obtain a set of historical financial features; The first clustering algorithm is used to cluster the historical financial feature set to obtain multiple initial clusters; Multiple initial clusters are filtered to determine the normal pattern cluster; there must be at least one normal pattern cluster. Historical data baselines are determined based on normal pattern clusters.
[0029] In this embodiment, the historical financial feature set can be a data set obtained after feature extraction of historical financial data. Each record represents a key attribute of a historical financial data in the form of a feature vector. The feature vector may include transaction amount, transaction frequency, department, supplier category or time period distribution.
[0030] In this embodiment, the first clustering algorithm can be an unsupervised learning or statistical analysis method that clusters a set of historical financial features. This algorithm can divide historical financial data into several clusters based on the similarity of data features and can be used to identify pattern structures and abnormal distributions in the data. Common clustering algorithms include K-means clustering algorithm, density-based clustering algorithm, and hierarchical clustering algorithm.
[0031] In this embodiment, the initial clusters can be several data clusters generated after applying the first clustering algorithm to the historical financial feature set. Each cluster contains historical financial data records with similar features. These clusters represent the natural distribution structure of historical financial data in the feature space and are the original results output by the clustering algorithm. The normal pattern clusters can be one or more clusters selected from the initial clusters. These clusters can represent typical and normal patterns in the enterprise's historical financial feature set.
[0032] In this embodiment, the process of extracting features from historical financial data includes, for example, transaction amount features. The system calculates the amount of each transaction and the mean, maximum, minimum, and variance of the amount based on historical transaction records. It also identifies transaction frequency characteristics by calculating the number of transactions for each entity within a certain time period and normalizing this frequency characteristic. The period can be daily, weekly, or monthly. Furthermore, it identifies departmental characteristics by encoding the department to which the transaction belongs (e.g., department A=1, department B=2). Finally, it identifies supplier category characteristics by encoding supplier classification information (e.g., supplier A=A, supplier B=B). Finally, it identifies time period distribution characteristics by mapping transaction dates to time period categories and calculating the number or percentage of transactions in each category. Time categories can include the beginning of the month, middle of the month, end of the month, or weekdays / holidays.
[0033] In this embodiment, the initial cluster formation process can be as follows: First, historical financial data undergoes feature extraction and preprocessing to construct a set of feature vectors containing dimensions such as transaction amount, frequency, department, supplier category, and time period distribution. Then, based on a similarity measurement method, a clustering algorithm is used to group the feature vectors, aggregating data with high similarity into the same cluster, ultimately resulting in multiple initial clusters, each corresponding to a potential financial business model. For example, the generated initial clusters could be a daily office procurement cluster, a payroll cluster, a departmental special procurement cluster, a travel expense reimbursement cluster, and a miscellaneous payment cluster.
[0034] In this embodiment, the selection of normal pattern clusters can be determined based on their high frequency of occurrence, stable features, or alignment with business rules. The selection process can include the relative proportion of cluster size; normal clusters represent the company's mainstream business and should be significantly larger than abnormal clusters. This can be determined by sorting the sample size of all clusters and selecting the top N clusters (N > 0) with a total proportion ≥ 70%. It can also include the structural correlation between clusters; normal clusters exhibit business linkages, while abnormal clusters are often isolated and unrelated. This can be determined by calculating the feature overlap between any two clusters; the overlap between normal clusters should be greater than 50%, while the overlap between abnormal and normal clusters should be less than 10%. Furthermore, it can include a comparison of the temporal stability between clusters; normal clusters exhibit consistent temporal distribution patterns, while abnormal clusters exhibit chaotic temporal distributions. This can be determined by calculating the temporal feature similarity of each cluster; the temporal similarity between normal clusters should be greater than 90%, while the temporal similarity between abnormal and normal clusters should be less than 50%.
[0035] In this embodiment, the process of determining the historical data baseline can be as follows: after obtaining multiple initial clusters, normal pattern clusters are selected through the above process, and the feature center values, distribution ranges, and statistical regularities of these clusters are modeled to form a quantifiable baseline standard. For example, the mean and variance of transaction amounts, the distribution range of transaction frequency, and common combination patterns of department or supplier categories in the normal pattern clusters can be extracted as historical data baselines.
[0036] As can be seen from the above, this application obtains a feature set by extracting features from historical financial data covering multiple dimensions such as transaction amount and frequency. It then uses a first clustering algorithm to generate initial clusters reflecting the natural distribution structure of the historical financial data. Further, through multi-dimensional screening conditions, it determines normal pattern clusters that truly reflect the characteristics of normal financial business operations of the enterprise. Finally, based on their feature central values and distribution ranges, a historical data baseline is constructed. This process effectively identifies normal business patterns, provides a clear benchmark for financial data security assessment, avoids arbitrariness and subjectivity in the assessment, and improves the accuracy of data security risk assessment.
[0037] In one embodiment of this application, determining a historical data baseline based on a normal pattern cluster includes: Initial baselines were determined based on normal pattern clusters; Historical data baselines are obtained based on anomalous sample data and an initial baseline.
[0038] In this embodiment, the abnormal sample data can be historical financial transaction records that have been manually annotated or verified by the system and clearly have risk attributes. These records have triggered financial risk events or have been proven to deviate from normal business logic. The historical data baseline can be the core benchmark in the financial data security assessment. It is a normal range standard formed by adjusting the initial baseline based on the normal pattern cluster and incorporating the abnormal sample data.
[0039] In this embodiment, the process of determining the initial baseline can be as follows: first, calculate the mean and variance within the normal pattern cluster to determine the initial baseline range. For numerical data, the initial baseline range can be [L, U], where L represents the minimum value and U represents the maximum value. L can be obtained by subtracting the standard deviation from the cluster mean, and U can be obtained by adding the standard deviation to the cluster mean. For categorical data, the baseline range can be determined by the frequency of sample occurrence. When the frequency of a sample occurrence is greater than 5%, that sample is retained.
[0040] In this embodiment, the historical data baseline is obtained based on the abnormal sample data and the initial baseline, including: The deviation of abnormal samples is determined based on the abnormal sample data and the initial baseline. The deviation of abnormal samples is used to characterize the distance of abnormal sample data to the cluster center of normal pattern clusters. The normal pattern cluster of the initial baseline is adjusted based on the deviation of abnormal samples to obtain the first normal pattern cluster; Historical data baselines are determined based on the first normal pattern cluster.
[0041] In this embodiment, the first normal pattern cluster can represent a pattern cluster that has been adjusted for deviation from abnormal samples. This can be obtained through the following calculation process: Taking a normal cluster as an example, this normal cluster contains n samples, and the cluster center vector is:
[0042] Here, C represents the center vector of a normal pattern cluster. The center vector includes 5 parameters, which can include transaction amount, transaction frequency, department, supplier category and time period distribution, and correspond one-to-one with the elements in C.
[0043] In this embodiment, each sample includes n data points, such as:
[0044] in, For numerical parameters, For non-numeric type parameters, For ordered category parameters.
[0045] Calculate the mean of samples within the cluster :
[0046]
[0047] Calculate the mean of samples within the cluster It is determined by the frequency of occurrence of samples within a cluster. An occurrence frequency of less than 5% or a frequency of greater than 30% in abnormal samples is considered abnormal. For numerical data divided into monthly cycles, such as the peak purchasing period from the 5th to the 25th of each month being coded as 0, and the rest of the time being the off-season being coded as 1, the final value is obtained by taking the mode of i data points.
[0048] Then , , Normalization process is performed to obtain , ,
[0049] The feature vector of the abnormal sample is: [ ] In this case, the parameter types of the feature vectors for abnormal samples are the same as those for the feature vectors of normal pattern clusters. Similarly, Normalization was performed separately to obtain , , .
[0050] Then, the deviation (Euclidean distance) is calculated:
[0051] Based on the calculated deviation, the deviations of all abnormal samples are integrated into a set D. This represents the 95th percentile value of set D, meaning that 95% of outlier samples deviate from this value. This represents the maximum distance from the sample within the initial normal pattern cluster to the cluster center.
[0052] according to and The formula for calculating the adjustment factor α is as follows:
[0053] in, Less than 1.5.
[0054] According to the adjustment coefficient Adjust the initial baseline range:
[0055]
[0056] Among them, normal cluster numerical features The initial baseline range is [ , The adjusted range is []. , Correspondingly, numerical features can be adjusted. scope.
[0057] Other non-numerical features cannot participate in deviation quantification and do not interfere with numerical range adjustment. It is only necessary to count the non-compliant categories that occur frequently in abnormal samples and include them in the warning list.
[0058] Subsequently, each cluster in the normal pattern cluster is adjusted based on the abnormal samples to obtain the first normal pattern cluster. The historical data baseline is then determined based on this first normal pattern cluster. The range of the historical data baseline includes both numerical feature ranges and categorical feature ranges. The numerical feature range is as described above. and The range of categorical features is the range filtered by removing the warning list from the original range.
[0059] As can be seen from the above, in the embodiments of this application, firstly, when determining the initial baseline, for numerical data, a reasonable range is determined by calculating the mean and standard deviation within the normal pattern cluster. For categorical data, high-frequency samples are selected and retained based on their frequency of occurrence, following the characteristic distribution patterns of normal financial data. Abnormal sample data, as historical financial transaction records that have been manually labeled or verified by the system to clearly possess risk attributes, enriches the evaluation dimensions. The deviation of abnormal samples is used to characterize their distance from the cluster center of the normal pattern cluster, and the normal pattern cluster of the initial baseline is adjusted accordingly to obtain the first normal pattern cluster. This process considers the potential impact of actual risk data on the normal pattern. During the adjustment process, for numerical features, adjustment coefficients are calculated based on deviation-related indicators, thereby adjusting the initial baseline range so that the baseline can dynamically adapt to data changes and avoid evaluation bias caused by a fixed baseline. For non-numerical features, although they do not participate in deviation measurement, the scope of risk identification is expanded by statistically analyzing the frequently occurring non-compliant categories in abnormal samples and including them in the early warning list. Finally, the historical data baseline determined based on the first normal pattern cluster simultaneously covers the range of both numerical and categorical features. This comprehensive baseline determination method makes the core benchmarks for financial data security assessment more accurate and comprehensive, enabling more effective identification of financial data that deviates from normal patterns and timely detection of potential financial risks.
[0060] In one embodiment of this application, clustering is performed on early warning financial data to obtain a target clustering result, including: The early warning financial data are clustered based on the second clustering algorithm to obtain the target clustering result; The parameters of the second clustering algorithm are determined based on the parameters of the first clustering algorithm.
[0061] In this embodiment, the second clustering algorithm uses the same algorithm as the first clustering algorithm, and the parameters of the second clustering algorithm can inherit the core logical parameters of the first algorithm. The core parameters of the second clustering algorithm are obtained by adjusting the parameters of the first clustering algorithm to ensure that the judgment criteria of the two clusters are consistent, while adapting to the characteristics of small sample size and concentrated features in the early warning data.
[0062] As can be seen from the above, in the embodiments of this application, a second clustering algorithm consistent with the first clustering algorithm is adopted, and the second clustering algorithm inherits the core logic parameters of the first algorithm. On this basis, the core parameters are adjusted according to the parameters of the first clustering algorithm, ensuring that the two types of clusters are consistent in the judgment criteria, avoiding the deviation of analysis results caused by the difference in judgment criteria, and improving the accuracy and reliability of cluster analysis.
[0063] In one embodiment of this application, the process of determining the parameters of the second clustering algorithm includes: Obtain the first distance threshold; the first distance threshold is a parameter of the first clustering algorithm; The second distance threshold is determined based on the first distance threshold and the first sensitivity coefficient; The second distance threshold is determined as the initial parameter of the second clustering algorithm to perform clustering processing on the early warning financial data, and the initial clustering results are obtained. The target distance threshold is determined based on the initial clustering results and the preset evaluation criteria; The target distance threshold is determined as a parameter of the second clustering algorithm.
[0064] In this embodiment, the first distance threshold can be a core distance parameter used in the first clustering algorithm to determine whether samples belong to the same cluster. When the distance between two clusters is less than or equal to this threshold, it is determined that their features are sufficiently similar and they should be classified into the same cluster. The first sensitivity can be an adjustment coefficient used to adapt the first distance threshold to the input parameters of the second clustering algorithm. The second distance threshold can be an initial parameter of the second clustering algorithm, which can be obtained by multiplying the first distance threshold and the first sensitivity.
[0065] In this embodiment, the initial clustering result may be a temporary result obtained by clustering the early warning financial data using a second distance threshold. This may result in too many / too few clusters or large differences in samples within clusters. The preset evaluation criteria can be a quantitative indicator for assessing the quality of the clustering results and can be used to determine whether the second distance threshold is reasonable. The target distance threshold can be the final distance parameter optimized using the preset evaluation criteria and used as the parameter input for the second clustering algorithm.
[0066] In this embodiment, the process of determining the target distance threshold can be as follows: First, cluster the early warning financial data using the second distance threshold as the initial parameter to obtain the initial clustering result; then, calculate the inter-cluster separation and similarity of the initial result and compare it with the preset threshold. If the result does not meet the standard, iteratively adjust the distance threshold and re-cluster until the result meets the evaluation criteria, and finally determine the target distance threshold.
[0067] As can be seen from the above, this application uses the first distance threshold of the first clustering algorithm as a basis, and determines the second distance threshold using the first sensitivity coefficient as the initial parameter of the second clustering algorithm. After obtaining the initial results by clustering using the second distance threshold, the algorithm is evaluated and optimized using preset evaluation criteria. By calculating the inter-cluster separation and comparing it with the preset threshold, if the criteria are not met, the threshold is iteratively adjusted and the clusters are re-clustered until the criteria are met to determine the target distance threshold. This ensures that the second clustering algorithm runs with optimal parameters, improving the accuracy and effectiveness of clustering.
[0068] In one embodiment of this application, determining the target distance threshold based on the initial clustering results and a preset evaluation criterion includes: Calculate the first and second indices of the initial clustering results; the first index is used to evaluate the inter-cluster separation in the initial clustering results; the second index is used to evaluate the inter-cluster similarity in the initial clustering results. In response to a first indicator being less than a first indicator threshold and / or a second indicator being greater than a second indicator threshold, the first distance threshold is iteratively adjusted until a preset condition is met; and the first distance threshold corresponding to the preset condition is determined as the target distance threshold; the preset condition is that the early warning financial data is clustered based on the iteratively adjusted first distance threshold and the second clustering algorithm, and the clustering results obtained meet the preset evaluation criteria. In response to a first indicator being greater than or equal to a first indicator threshold and a second indicator being less than or equal to a second indicator threshold, the first distance threshold is determined as the target distance threshold.
[0069] In this embodiment, the first index can be used to characterize the degree of separation between different clusters. The core logic of this index is that when the clustering effect is good, the core features of different clusters should be significantly different. A commonly used index is the Calinski-Harabasz (CH) index, and the larger the value, the higher the separation between clusters. The second index can be used to characterize the degree of similarity between different clusters. The core logic is that when the clustering effect is good, the boundaries between different clusters should be clear and without overlap. A commonly used index is the Davidson-Bolding index, and the smaller the value, the lower the similarity between clusters.
[0070] In this embodiment, if the first indicator is less than a first indicator threshold and / or the second indicator is greater than a second indicator threshold, the first distance threshold is iteratively adjusted until a preset condition is met. For example: The first threshold is preset to 200, and the second threshold is preset to 1.5. A first threshold greater than 200 indicates satisfactory separation, while a second threshold less than 1.5 indicates satisfactory similarity. The iterative process involves multiplying the initial first threshold by a first sensitivity coefficient to obtain the second threshold, which is then used as input for the second clustering algorithm. Alarms are clustered to obtain abnormal clusters. The CH index is obtained by calculating the sum of squared deviations between clusters and the sum of squared deviations within clusters. The ratio of the mean standard deviation of each feature within a cluster to the Euclidean distance between the centers of two clusters is calculated. Finally, the maximum ratio for each cluster among all cluster pairs is found. These maximum ratios are summed and divided by the total number of clusters to obtain the average value, which is the Davidson-Borging index. By comparing the relationship between the two indices and the index threshold, if either of the two indices is not met, the first distance threshold is iteratively adjusted until a distance threshold that meets the criteria is obtained, which is then used as the target distance threshold.
[0071] As described above, this application first calculates the first and second indicators of the initial clustering results. If the first indicator is less than the first indicator threshold and / or the second indicator is greater than the second indicator threshold, it means that the current clustering result is not ideal, and the first distance threshold needs to be iteratively adjusted. If the requirements are not met, a new threshold is obtained by multiplying the initial first threshold by the first sensitivity coefficient, which is used as the input parameter for the second clustering algorithm. The early warning financial data is clustered, and the CH index and Davidson-Bourdin index are recalculated and compared with the threshold. If the relationship is not met, the iteration continues until the preset conditions are met, that is, the new clustering result meets the evaluation criteria. The corresponding first distance threshold at this time is the target distance threshold. If the first indicator is greater than or equal to the first indicator threshold and the second indicator is less than or equal to the second indicator threshold, it indicates that the current clustering result is good, and the first distance threshold is directly determined as the target distance threshold. The distance threshold can be dynamically adjusted according to the clustering results to ensure that the second clustering algorithm runs with optimal parameters and improves the clustering accuracy.
[0072] Corresponding to the data security assessment method in the above embodiments, Figure 2 This is a structural block diagram of a data security assessment system provided in one embodiment of this application. For ease of explanation, only the parts relevant to the embodiment of this application are shown. References Figure 2 The data security assessment system 20 includes: a data acquisition module 21, an early warning data generation module 22, a cluster analysis module 23, and a risk assessment module 24.
[0073] The data acquisition module 21 is used to acquire financial system data in response to receiving a financial data security assessment instruction; the financial system data is the financial data stored in the financial system; the financial system data includes: current financial data and historical financial data; The early warning data generation module 22 is used to obtain early warning financial data based on current financial data and historical data baseline; the early warning financial data is a portion of the current financial data; wherein, the historical data baseline is determined based on historical financial data; Cluster analysis module 23 is used to perform clustering processing on early warning financial data to obtain target clustering results; Risk assessment module 24 is used to conduct risk assessment on financial system data based on the obtained target clustering results, and obtain target security indicators; target security indicators are used to characterize the security of financial system data.
[0074] In one embodiment of this application, the data security assessment system 20 further includes: a data baseline determination module, used to extract features from historical financial data to obtain a set of historical financial features; The first clustering algorithm is used to cluster the historical financial feature set to obtain multiple initial clusters; Multiple initial clusters are filtered to determine the normal pattern cluster; there must be at least one normal pattern cluster. Historical data baselines are determined based on normal pattern clusters.
[0075] In one embodiment of this application, the data baseline determination module is specifically used for: Initial baselines were determined based on normal pattern clusters; Historical data baselines are obtained based on anomalous sample data and an initial baseline.
[0076] In one embodiment of this application, the data baseline determination module is specifically used for: The deviation of abnormal samples is determined based on the abnormal sample data and the initial baseline. The deviation of abnormal samples is used to characterize the distance of abnormal sample data to the cluster center of normal pattern clusters. The normal pattern cluster of the initial baseline is adjusted based on the deviation of abnormal samples to obtain the first normal pattern cluster; Historical data baselines are determined based on the first normal pattern cluster.
[0077] In one embodiment of this application, the clustering analysis module 23 is specifically used for: The early warning financial data are clustered based on the second clustering algorithm to obtain the target clustering result; The parameters of the second clustering algorithm are determined based on the parameters of the first clustering algorithm.
[0078] In one embodiment of this application, the data security assessment system 20 further includes: a clustering algorithm parameter determination module, used to obtain a first distance threshold; the first distance threshold is a parameter of a first clustering algorithm; The second distance threshold is determined based on the first distance threshold and the first sensitivity coefficient; The second distance threshold is determined as the initial parameter of the second clustering algorithm to perform clustering processing on the early warning financial data, and the initial clustering results are obtained. The target distance threshold is determined based on the initial clustering results and the preset evaluation criteria; The target distance threshold is determined as a parameter of the second clustering algorithm.
[0079] In one embodiment of this application, the preset evaluation criteria include: a first index threshold and a second index threshold; the clustering algorithm parameter determination module is further used to calculate the first index and the second index of the initial clustering result; the first index is used to evaluate the inter-cluster separation degree in the initial clustering result; the second index is used to evaluate the inter-cluster similarity of the initial clustering result. In response to a first indicator being less than a first indicator threshold and / or a second indicator being greater than a second indicator threshold, the first distance threshold is iteratively adjusted until a preset condition is met; and the first distance threshold corresponding to the preset condition is determined as the target distance threshold; the preset condition is that the early warning financial data is clustered based on the iteratively adjusted first distance threshold and the second clustering algorithm, and the clustering results obtained meet the preset evaluation criteria. In response to a first indicator being greater than or equal to a first indicator threshold and a second indicator being less than or equal to a second indicator threshold, the first distance threshold is determined as the target distance threshold.
[0080] See Figure 3 , Figure 3 This is a schematic block diagram of an electronic device provided according to an embodiment of this application. Figure 3 The electronic device 300 in this embodiment may include one or more processors 301, one or more input devices 302, one or more output devices 303, and one or more memories 304. The processors 301, input devices 302, output devices 303, and memories 304 communicate with each other via a communication bus 305. The memories 304 store computer programs, including program instructions. The processors 301 execute the program instructions stored in the memories 304. Specifically, the processors 301 are configured to invoke the program instructions to perform the functions of each module / unit in the above system embodiments, for example... Figure 2 The functions of the data acquisition module 21, the early warning data generation module 22, the cluster analysis module 23, and the risk assessment module 24 are shown.
[0081] It should be understood that, in the embodiments of this application, the processor 301 may be a central processing unit (CPU), or it may be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor.
[0082] Input device 302 may include a touchpad, a fingerprint sensor (for collecting the user's fingerprint information and fingerprint orientation information), a microphone, etc., and output device 303 may include a display (LCD, etc.), a speaker, etc.
[0083] The memory 304 may include read-only memory and random access memory, and provides instructions and data to the processor 301. A portion of the memory 304 may also include non-volatile random access memory. For example, the memory 304 may also store device type information.
[0084] In specific implementations, the processor 301, input device 302, and output device 303 described in the embodiments of this application can execute the implementation methods described in the data security assessment method provided in the embodiments of this application, or they can execute the implementation methods of the electronic devices described in the embodiments of this application, which will not be repeated here.
[0085] In another embodiment of this application, a computer-readable storage medium is provided. This computer-readable storage medium stores a computer program, which includes program instructions. When executed by a processor, the program instructions implement all or part of the processes in the methods described above. Alternatively, the computer program can instruct related hardware to complete the process. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include any entity or device capable of carrying computer program code, a recording medium, a USB flash drive, a portable hard drive, a magnetic disk, an optical disk, a computer memory, a read-only memory (ROM), a random access memory (RAM), an electrical carrier signal, a telecommunication signal, and a software distribution medium, etc.
[0086] The computer-readable storage medium can be an internal storage unit of the electronic device in any of the foregoing embodiments, such as a hard disk or memory of the electronic device. The computer-readable storage medium can also be an external storage device of the electronic device, such as a plug-in hard disk, smart media card (SMC), secure digital card (SD), flash card, etc., provided on the electronic device. Furthermore, the computer-readable storage medium can include both internal and external storage units of the electronic device. The computer-readable storage medium is used to store computer programs and other programs and data required by the electronic device. The computer-readable storage medium can also be used to temporarily store data that has been output or will be output.
[0087] Those skilled in the art will recognize that the modules and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.
[0088] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working process of the electronic devices and units described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.
[0089] In the several embodiments provided in this application, it should be understood that the disclosed electronic devices and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For instance, the division of modules is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple modules, units, or components may be combined or integrated into another system, or some features may be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed may be indirect coupling or communication connection through some interfaces or modules, or it may be an electrical, mechanical, or other form of connection.
[0090] The modules described as separate components may or may not be physically separate. Similarly, the components shown as modules may or may not be physical modules; they may be located in one place or distributed across multiple network modules. Some or all of the modules can be selected to achieve the purpose of the embodiments of this application, depending on actual needs.
[0091] Furthermore, the functional modules in the various embodiments of this application can be integrated into one processing module, or each module can exist physically separately, or two or more modules can be integrated into one module. The integrated modules described above can be implemented in hardware or as software functional modules.
[0092] The above are merely specific embodiments of this application, but the scope of protection of this application is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in this application, and these modifications or substitutions should all be covered within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.
Claims
1. A data security assessment method, characterized by, The method comprises the following steps: in response to receiving the financial data security evaluation instruction, obtaining financial system data; the financial system data is financial data stored in a financial system; the financial system data includes current financial data and historical financial data; obtain early warning financial data based on the current financial data and the historical data baseline; the early warning financial data is part of the current financial data; wherein the historical data baseline is determined based on the historical financial data; perform clustering processing on the early warning financial data to obtain a target clustering result; based on the target clustering result, perform risk assessment on the financial system data to obtain a target security index; the target security index is used to represent the security of the financial system data.
2. The data security assessment method of claim 1, wherein, The process of determining the historical data baseline comprises: perform feature extraction on the historical financial data to obtain a historical financial feature set; perform clustering processing on the historical financial feature set using a first clustering algorithm to obtain a plurality of initial clusters; filter the plurality of initial clusters to determine normal mode clusters; the normal mode clusters are at least one; determine the historical data baseline based on the normal mode clusters.
3. The data security assessment method of claim 2, wherein, The determination of the historical data baseline based on the normal mode clusters comprises: determine an initial baseline based on the normal mode clusters; obtain the historical data baseline based on abnormal sample data and the initial baseline.
4. The data security assessment method of claim 3, wherein, The determination of the historical data baseline based on abnormal sample data and the initial baseline comprises: determine an abnormal sample deviation based on the abnormal sample data and the initial baseline; the abnormal sample deviation is used to represent the distance from the abnormal sample data to the clustering center of the normal mode cluster; adjust the normal mode cluster of the initial baseline based on the abnormal sample deviation to obtain a first normal mode cluster; determine the historical data baseline based on the first normal mode cluster.
5. The data security assessment method of claim 2, wherein, The clustering processing of the early warning financial data to obtain the target clustering result comprises: perform clustering processing on the early warning financial data based on a second clustering algorithm to obtain the target clustering result; wherein the parameters of the second clustering algorithm are determined based on the parameters of the first clustering algorithm.
6. The data security assessment method of claim 5, wherein, The process of determining the parameters of the second clustering algorithm comprises: obtain a first distance threshold; the first distance threshold is a parameter of the first clustering algorithm; determine a second distance threshold based on the first distance threshold and a first sensitivity coefficient; determine the second distance threshold as the initial parameter of the second clustering algorithm to perform clustering processing on the early warning financial data to obtain an initial clustering result; determine a target distance threshold based on the initial clustering result and a preset evaluation standard; determine the target distance threshold as the parameter of the second clustering algorithm.
7. The data security assessment method of claim 6, wherein, The preset evaluation standard comprises a first index threshold and a second index threshold. The determination of the target distance threshold based on the initial clustering result and the preset evaluation standard comprises: calculate a first index and a second index of the initial clustering result; the first index is used to evaluate the separation degree between clusters in the initial clustering result; the second index is used to evaluate the similarity between clusters in the initial clustering result; In response to the first index being less than the first index threshold and / or the second index being greater than the second index threshold, iteratively adjust the first distance threshold until a preset condition is met; and determine the first distance threshold corresponding to the time when the preset condition is met as the target distance threshold; the preset condition is that the clustering result obtained by clustering the early warning financial data based on the first distance threshold after the iterative adjustment and the second clustering algorithm meets the preset evaluation standard; In response to the first index being greater than or equal to the first index threshold and the second index being less than or equal to the second index threshold, determine the first distance threshold as the target distance threshold.
8. A data security assessment system, characterized by, Comprise: A data acquisition module configured to acquire financial system data in response to receiving a financial data security evaluation instruction; The financial system data is financial data stored in a financial system; The financial system data includes current financial data and historical financial data; An early warning data generation module configured to obtain early warning financial data based on the current financial data and a historical data baseline; the early warning financial data is part of the current financial data; wherein the historical data baseline is determined based on the historical financial data; A clustering analysis module configured to cluster the early warning financial data to obtain a target clustering result; A risk assessment module configured to assess the risk of the financial system data based on the target clustering result to obtain a target security index; the target security index is used to represent the security of the financial system data.
9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, The processor executes the computer program to realize the steps of the method of any one of claims 1 to 7.
10. A computer-readable storage medium storing a computer program, the computer program comprising instructions that, when executed by a computer, cause the computer to perform the method of any one of claims 1 to 9. The computer program is executed by the processor to realize the steps of the method of any one of claims 1 to 7.