A real-time multi-dimensional sensitivity evaluation and adaptive security prevention and control method and system for natural resource geographic information

Abstract

The application discloses a real-time multi-dimensional sensitivity evaluation and adaptive security prevention and control method and system for natural resource geographic information. The method comprises the following steps: acquiring real-time natural resource geographic information data; acquiring a preset behavior graph model; updating the preset behavior graph model according to the real-time natural resource geographic information data, thereby obtaining an updated behavior graph model; acquiring an updated node risk vector according to the updated behavior graph model; acquiring a trained Bayesian risk prediction model; inputting the updated node risk vector into the trained Bayesian risk prediction model, thereby obtaining a real-time abnormal behavior recognition result; and generating a personalized prevention and control strategy scheme according to the real-time abnormal behavior recognition result. The application realizes intelligent identification, dynamic evaluation and active protection of natural resource geographic information in the whole life cycle by constructing a multi-dimensional sensitivity quantification model, a dynamic risk perception mechanism based on a graph structure and a real-time updateable security prevention and control strategy.

Description

Technical Field

[0001] This application relates to the field of natural resource data processing technology, specifically to a method and system for real-time multidimensional sensitivity assessment and adaptive security control of natural resource geographic information. Background Technology

[0002] With the accelerating pace of intelligent development in natural resource surveys, monitoring, and management, geographic information for natural resources is increasingly being applied in areas such as land spatial planning, ecological protection and restoration, mineral resource development, and disaster prevention and control. Geographic information data is characterized by high dimensionality, multi-temporal complexity, multi-source heterogeneity, and strong correlation. Throughout its entire lifecycle—from collection and transmission to storage, sharing, and use—it exhibits significant multidimensional sensitivity differences and dynamic security risks. How to quantitatively assess these different dimensions of sensitivity and implement adaptive prevention and control measures with real-time responsiveness while ensuring efficient data flow and sharing has become a key scientific issue in the information management of natural resources.

[0003] The inventors discovered through research that traditional models based on static rules and single-stage control are insufficient to meet the real-time dynamic evolution requirements of complex, multi-source geographic information data under multi-dimensional coupling. The sensitivity of natural resource data is influenced by multi-dimensional sensitivity factors such as spatial scale, temporal evolution, content complexity, and access behavior, exhibiting significant nonlinearity and uncertainty. Existing grading methods largely rely on experience or fixed thresholds, making it difficult to achieve continuous quantification, temporal tracking, and real-time adjustment of sensitivity, and are deficient in both dynamic responsiveness and computability. Especially in multi-source heterogeneous scenarios, differences in data formats, precision, and semantic levels lead to biases and redundancies among multi-dimensional sensitivity features, making it impossible for a single rule to accurately characterize its comprehensive sensitivity features. Existing risk perception models also lack the ability to globally model and dynamically analyze the relationships between multi-dimensional sensitivity, often relying solely on access logs or local behavioral statistics for identification, without constructing a graph model at the access path level to reflect the propagation chain and risk evolution patterns of multi-dimensional sensitive information. Risk assessment remains at the rule-triggered level, failing to combine Bayesian inference, graph model analysis, and reinforcement learning methods to conduct dynamic risk prediction and comprehensive reasoning based on uncertainty and multi-dimensional sensitivity features. In terms of prevention and control strategies, current systems generally suffer from rigid response and lag in feedback, relying heavily on fixed access control matrices or static security policies. They lack adaptive weight adjustments and online learning mechanisms to address real-time changes in multidimensional sensitivity. Due to the lack of timely feedback learning and online optimization processes, policy update cycles are long and response speeds are slow, making it difficult to form a closed-loop learning and dynamic optimization based on multidimensional sensitivity feedback loops. Summary of the Invention

[0004] The purpose of this invention is to provide a real-time multidimensional sensitivity assessment and adaptive security control method for natural resource geographic information to at least solve one of the above-mentioned technical problems.

[0005] One aspect of the present invention provides a method for real-time multidimensional sensitivity assessment and adaptive security control of natural resource geographic information, the method comprising:

[0006] Acquire real-time geographic information data of natural resources;

[0007] Obtain the preset behavior graph model;

[0008] The pre-set behavior graph model is updated based on real-time natural resource geographic information data to obtain the updated behavior graph model.

[0009] Obtain the updated node risk vector based on the updated behavioral graph model;

[0010] Obtain the trained Bayesian risk prediction model;

[0011] The updated node risk vector is input into the trained Bayesian risk prediction model to obtain real-time abnormal behavior identification results.

[0012] Personalized prevention and control strategies are generated based on real-time abnormal behavior identification results.

[0013] Optionally, before obtaining the preset behavioral graph model, the real-time multidimensional sensitivity assessment and adaptive security control method for natural resource geographic information further includes:

[0014] The real-time natural resource geographic information data is standardized. Specifically, feature point matching and affine transformation algorithms are used for multi-source images and vector data in the real-time natural resource geographic information data, and the Z-score standardization detection method is used for outliers.

[0015] Optionally, before obtaining the preset behavioral graph model, the real-time multidimensional sensitivity assessment and adaptive security control method for natural resource geographic information further includes:

[0016] Acquire historical multi-source geographic information sample data, historical sensitivity classification and annotation data, historical access records, and historical risk event annotation data;

[0017] A pre-defined behavioral graph model is constructed based on historical multi-source geographic information sample data, historical sensitivity classification and annotation data, historical access records, and historical risk event annotation data.

[0018] Optionally, the step of constructing a preset behavioral graph model based on historical multi-source geographic information sample data, historical sensitivity classification annotation data, historical access records, and historical risk event annotation data includes:

[0019] Extracting multidimensional features from historical multi-source geographic information sample data;

[0020] Calculate the initial entropy weights of each historical sample based on the multidimensional features;

[0021] Generate time decay coefficient and access correlation coefficient based on historical multi-source geographic information and historical access records;

[0022] Based on historical sensitivity classification annotation data, multidimensional features, and initial entropy weights of features, a calibrated comprehensive sensitivity scoring formula and four-level classification rules are generated.

[0023] The final visit behavior graph model is constructed based on historical visit records and historical multi-source geographic information sample data.

[0024] Optionally, the extraction of multidimensional features from historical multi-source geographic information sample data includes:

[0025] Spatial resolution features are obtained by using the smallest identifiable unit of geographic raster data in historical multi-source geographic information sample data.

[0026] The spatial area corresponding to historical multi-source geographic information sample data is statistically analyzed, and the geographic coverage characteristics are obtained through the coordinate range of historical multi-source geographic information sample data.

[0027] The semantic complexity features of the content are obtained by the number of land cover categories and the spatial distribution entropy in the sample data.

[0028] The update interval of historical multi-source geographic information sample data is statistically analyzed, and the reciprocal of the interval is taken as the time update frequency to obtain the time update frequency feature.

[0029] The number of associations between historical multi-source geographic information sample data and other highly sensitive data is statistically analyzed, and the association ratio is calculated as a feature of data association degree.

[0030] The spatial resolution feature, geographic coverage feature, content semantic complexity feature, time update frequency feature, and data correlation feature are normalized respectively to obtain the normalized spatial resolution feature, normalized geographic coverage feature, normalized content semantic complexity feature, normalized time update frequency feature, and normalized data correlation feature.

[0031] The initial entropy weights of the normalized spatial resolution feature, normalized geographical coverage feature, normalized content semantic complexity feature, normalized time update frequency feature, and normalized data correlation feature are calculated using the information entropy method, thereby obtaining the initial entropy weights of the spatial resolution feature, geographical coverage feature, content semantic complexity feature, time update frequency feature, and data correlation feature. These initial entropy weights, along with the spatial resolution feature, geographical coverage feature, content semantic complexity feature, time update frequency feature, and data correlation feature, constitute a multidimensional feature.

[0032] Optionally, the step of generating a time decay coefficient and an access correlation coefficient based on historical multi-source geographic information and historical access records includes:

[0033] Extracting time-dimensional features from historical multi-source geographic information sample data;

[0034] Generate access behavior characteristics from historical access records;

[0035] Define the range of values ​​for the time decay coefficient and the range of values ​​for the access correlation coefficient;

[0036] A candidate set of time decay coefficients is generated based on the time dimension characteristics and the value range of the time decay coefficient. The candidate set of time decay coefficients includes at least one initial time decay coefficient.

[0037] A candidate set of access correlation coefficients is generated based on access behavior characteristics and the value range of access correlation coefficients. The candidate set of access correlation coefficients includes at least one initial access correlation coefficient.

[0038] A valid coefficient candidate set is generated based on the time decay coefficient candidate set and the access correlation coefficient candidate set, wherein the valid coefficient candidate set includes at least one set of valid coefficients.

[0039] The following processing is performed on each group of effective coefficients:

[0040] The initial entropy weights of the features of each historical sample are corrected to obtain the corrected weight matrix of each sample; the corrected weight matrices of each feature are combined to form the corrected weight set of the effective coefficient group.

[0041] Calculate the prediction score for each historical sample to obtain the prediction score for each sample. The prediction scores of each sample form the prediction score set of the current candidate combination corresponding to the effective coefficient group.

[0042] The deviation value of the current candidate combination corresponding to the effective coefficient group is obtained based on the prediction score of each sample.

[0043] Among all groups of effective coefficients, the effective coefficient group with the smallest MSE is selected, and the initial time decay coefficient in the effective coefficient group with the smallest MSE is used as the time decay coefficient.

[0044] The initial access correlation coefficient in the effective coefficient group corresponding to the minimum MSE is used as the access correlation coefficient.

[0045] Optionally, the step of constructing an access behavior graph model and a risk propagation damping matrix based on historical access records and historical multi-source geographic information sample data includes:

[0046] Obtain user nodes, data nodes, and terminal nodes based on historical access logs;

[0047] Using the access relationships between nodes as edges and setting the weight attributes of the edges, the user nodes, data nodes, terminal nodes, and each edge form an initial graph;

[0048] Obtain node distribution characteristics, access behavior characteristics, and risk interaction characteristics;

[0049] Generate a set of simulated nodes, which includes simulated user nodes, simulated data nodes, and simulated terminal nodes;

[0050] Generate a simulated edge set;

[0051] Obtain the initial damping matrix;

[0052] Obtain a candidate set of damping coefficients, wherein the candidate set of damping coefficients includes multiple candidate values ​​of damping coefficients;

[0053] For each candidate value of damping coefficient, risk propagation calculation is performed to obtain each candidate value of damping coefficient separately;

[0054] For each candidate damping coefficient value, obtain its final node risk vector;

[0055] Based on the risk vector of the final node, the accuracy and efficiency of each candidate value of the damping coefficient are evaluated to obtain the optimal damping coefficient.

[0056] The initial damping matrix is ​​updated based on the optimal damping coefficient to obtain the final damping matrix; the initial graph and the final damping matrix together form the final access behavior graph model.

[0057] This application also provides a real-time multi-dimensional sensitivity assessment and adaptive security control system for natural resource geographic information, the real-time multi-dimensional sensitivity assessment and adaptive security control system for natural resource geographic information comprising:

[0058] A real-time natural resource geographic information data acquisition module, wherein the real-time natural resource geographic information data acquisition module is used to acquire real-time natural resource geographic information data;

[0059] A behavior graph model acquisition module, which is used to acquire a preset behavior graph model;

[0060] The behavior graph model update module is used to update the preset behavior graph model according to real-time natural resource geographic information data, so as to obtain the updated behavior graph model.

[0061] A node risk vector extraction module is used to obtain an updated node risk vector based on the updated behavioral graph model.

[0062] A Bayesian risk prediction module acquisition module is used to acquire a trained Bayesian risk prediction model.

[0063] The identification module is used to input the updated node risk vector into the trained Bayesian risk prediction model to obtain real-time abnormal behavior identification results.

[0064] A personalized prevention and control strategy generation module is used to generate personalized prevention and control strategy schemes based on real-time abnormal behavior identification results.

[0065] This application's real-time multidimensional sensitivity assessment and adaptive security control method for natural resource geographic information achieves intelligent identification, dynamic assessment, and proactive protection of natural resource geographic information throughout its entire lifecycle by constructing a multidimensional sensitivity quantification model, a graph-based dynamic risk perception mechanism, and a real-time updatable security control strategy. The invention proposes a real-time coupled multidimensional sensitivity weight update algorithm, introducing an "access association constraint term" and a "time decay term" on top of information entropy weights to form a sensitivity weight function that can be adjusted in real-time according to changes in access behavior and time. Simultaneously, a risk propagation damping matrix based on node interaction frequency is introduced into the risk graph model, effectively reducing the computational complexity of high-dimensional access graphs and ensuring real-time inference and rapid response capabilities even at a scale of millions of nodes, thereby achieving efficient dynamic control of the multidimensional sensitivity of natural resource geographic information. Attached Figure Description

[0066] Figure 1 This is a schematic diagram of the overall process of a multi-dimensional sensitivity assessment and security control method for the entire life cycle of natural resource geographic information in one embodiment of this application;

[0067] Figure 2 This is a schematic diagram of the structure of a multidimensional sensitivity assessment model in one embodiment of this application; Detailed Implementation

[0068] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions in the embodiments of this application will be described in more detail below with reference to the accompanying drawings. In the drawings, the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The described embodiments are some, but not all, embodiments of this application. The embodiments described below with reference to the accompanying drawings are exemplary and intended to explain this application, and should not be construed as limiting this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application. The embodiments of this application will be described in detail below with reference to the accompanying drawings.

[0069] Example 1: As Figure 1 The real-time multi-dimensional sensitivity assessment and adaptive security control method for natural resource geographic information described herein includes: acquiring real-time natural resource geographic information data; acquiring a preset behavior graph model; updating the preset behavior graph model based on the real-time natural resource geographic information data to obtain an updated behavior graph model; acquiring updated node risk vectors based on the updated behavior graph model; acquiring a trained Bayesian risk prediction model; inputting the updated node risk vectors into the trained Bayesian risk prediction model to obtain real-time abnormal behavior identification results; and generating personalized prevention and control strategy schemes based on the real-time abnormal behavior identification results.

[0070] In this embodiment, real-time natural resource geographic information data is acquired from different sources and cleaned, standardized and fused. The pre-processed data enters the Multi-Source Geographic Information Database (MGID) as input for the subsequent real-time sensitivity assessment module. Specifically, the system collects geographic information in batches from natural resource-related data sources through multiple channels, including remote sensing images, topographic mapping data, geological data, ecological monitoring data, land use maps and socio-economic statistics.

[0071] In this embodiment, the real-time natural resource geographic information data also includes real-time access behavior data;

[0072] In this embodiment, when the real-time natural resource geographic information data includes remote sensing imagery, topographic mapping data, geological data, ecological monitoring data, land use maps, socio-economic statistical data, and real-time access behavior data, this application performs the following processing after acquiring the real-time natural resource geographic information data:

[0073] In this embodiment, the collected data will be preprocessed, as follows:

[0074] The collected data undergoes automatic standardization and quality verification by the system. Feature point matching and affine transformation algorithms are used for multi-source images and vector data, and Z-score standardization detection is used for outliers. Duplicate records, erroneous coordinates, and abnormal pixel data are removed.

[0075] Outlier detection is achieved using Z-score standardization. The Z-score formula is:

[0076]

[0077] in, For data points, The mean, Standard deviation The pixel normalization formula is:

[0078]

[0079] in These are the original image pixel values. For each pixel value, the normalized pixel value is represented by the minimum pixel value in the current dataset, and the maximum pixel value is represented by the maximum pixel value in the current dataset. Spatial consistency test formula:

[0080]

[0081]

[0082] in, It serves as a spatial consistency indicator. The origin point, Here, ϵ represents the registration point, and ϵ is the tolerance threshold. Indicates the proportion of spatial consistency. Total number of sample points; It is usually defined as the Euclidean distance between two points, where ( , ( ) represents the original point coordinates; , () represents the coordinates of the registered points.

[0083] A metadata file is automatically generated for each piece of processed data, and a unique identifier is assigned to each piece of data to ensure subsequent data tracking and traceability.

[0084] For each piece of real-time standardized data described above, the following dynamic features are extracted:

[0085] Real-time spatial resolution: Immediately resolves the smallest recognizable cell size of real-time imagery and calculates resolution feature values;

[0086] In this embodiment, the spatial resolution feature It is obtained by calculating the smallest distinguishable unit of geographic raster data, and is defined as:

[0087]

[0088] No. Spatial resolution feature values ​​of a data object It represents the smallest identifiable unit of geographic data and is used to measure the fineness of the data's granularity.

[0089] Real-time geographic coverage (area of ​​the geographic region corresponding to the data): The geographic area corresponding to the data is calculated in real time (such as the area of ​​the watershed covered by real-time monitoring data, or the shooting range of real-time images).

[0090] Content complexity: The number m of land cover categories (such as cultivated land, forest land, and disaster-damaged areas in real-time land use data) in the real-time statistical data, and the real-time proportion of each category are calculated using the following formula:

[0091] The complexity of the content Calculated using the number of land cover categories and spatial distribution entropy:

[0092]

[0093] No. The content complexity of a data object The number of categories in the data object No. The relative frequency of a class appearing in a data object. Indicates category The contribution to the overall complexity is summed over all categories to obtain the overall information entropy, where... For the first The proportion of land features in the data.

[0094] Time update frequency: Instantly query the "collection timestamp" in the metadata and calculate Δt with the collection time of the last collection of the same type of data (e.g., if it is 1 hour since the last collection, the update frequency = 1 time / hour).

[0095] Access permissions: Based on the current user's real-time access request, instantly match the system's preset permission level (e.g., if the user requests "confidentiality", assign a value of 3);

[0096] Data correlation: In real time, query the database to count the number of associations between the current new data and "marked high-sensitivity data" (e.g., associate 2 high-sensitivity mineral data). Correlation = 2 / total number of high-sensitivity data in the system (database counts in real time).

[0097] For the above real-time feature values, the range normalization formula is applied immediately:

[0098] in, / Take the extreme values ​​of similar new data within the past hour (database is updated in real time) to ensure that the standardized values ​​are mapped to the [0,1] interval.

[0099] Initial entropy weights are calculated in real time: the system instantly calculates the feature distribution of the new data in the current batch and calculates the probability of each feature. Information entropy In this embodiment, the information entropy is calculated using the following formula:

[0100]

[0101] Indicates the first The first indicator in the The probability distribution values ​​in the class, For the first The information entropy of an indicator reflects its uncertainty;

[0102] The initial weights are calculated using the following formula:

[0103]

[0104] in, For the first The weight values ​​of each indicator, For the first The information entropy value of an indicator reflects the information dispersion of that indicator. For the total number of indicators, The information utility value of an indicator is its value, which represents the amount of effective information provided by the indicator. This is the sum of the utility values ​​of all indicators, used for normalization.

[0105] Dynamic weight adjustment: Introducing "Δt between current time and data collection time" (e.g., Δt = 0.5 hours 30 minutes after data collection) and "access relevance". (If there are currently 2 instances of high-privilege access,) =0.2), and the information utility value is dynamically adjusted using the following formula:

[0106]

[0107] in, For the first The original entropy weights of each indicator, For the corrected dynamic weights, This is the time decay coefficient, with a value of 0 < <1, It is a time interval. This is the access relevance coefficient. This mechanism enables dynamic updates of sensitivity weights in both time series and behavior, ensuring the evaluation results are real-time and relevant.

[0108] Secondary weight adjustment: Real-time calculation of the variance of the current feature. Introducing an adjustment factor β=0.2, the final weights are obtained using the following formula:

[0109]

[0110] For the first The original entropy weights of each indicator, The final weight is determined by a comprehensive dynamic adjustment. The time decay coefficient, For time intervals, The access relevance coefficient, For characteristic dynamic adjustment coefficients, It is the first The normalized eigenvalues ​​of each indicator For the first The variance of the normalized characteristics of each indicator.

[0111] Calculating single-feature sensitivity: For continuous features (such as resolution), use a linear formula:

[0112]

[0113] Nonlinear characteristics (such as complexity) are expressed using an exponential formula:

[0114]

[0115] No. The overall sensitivity score for each object is calculated using the following formula:

[0116]

[0117] in, Indicates the first The weight of each indicator, whose value is... The value, express The normalized sensitivity function value of each indicator is used to convert feature values ​​of different dimensions and scales. Mapped to a uniform interval [0, 1] It is the first The overall sensitivity score of each object; For the first The sample at the th The original values ​​in the feature dimension, and For the first The maximum and minimum values ​​of the feature. Adaptive parameter adjustment.

[0118] Grading: Each geographic data object is assigned a multidimensional sensitivity score. Divide into four levels:

[0119]

[0120] in "Low-sensitivity" For "Zhongmin", For "high sensitivity", The threshold is set to "extremely high sensitivity". Initial values ​​for the threshold range can be 0.25, 0.5, or 0.75.

[0121] In addition, the formula for adjusting risk sensitivity bias is:

[0122]

[0123] in, The revised overall sensitivity index, Adjustment coefficient (can be set as needed). The variance of the standardized features is used to adjust for sensitivity bias caused by uneven feature distribution.

[0124] The "New Data Unique Identifier - Real-time Sensitivity Score - Level Label" is written into the metadata immediately and updated to the sensitivity index database. (It is understood that if there are no remote sensing images, topographic mapping data, geological data, ecological monitoring data, land use maps, and socio-economic statistics in the real-time natural resource geographic information data, the above steps can be omitted, because no new remote sensing images, topographic mapping data, geological data, ecological monitoring data, land use maps, and socio-economic statistics have been acquired at this time, so there is no need to update the sensitivity index database. How to establish the sensitivity index database will be further described in the following description, and will not be repeated here.)

[0125] In this embodiment, updating the preset behavioral graph model based on real-time natural resource geographic information data to obtain the updated behavioral graph model includes:

[0126] The following operations are performed on the preset behavior graph model:

[0127] Replace each new data point (new remote sensing imagery, topographic mapping data, geological data, ecological monitoring data, land use maps, and socioeconomic statistics data) and access behavior data with real-time sensitivity scores and level labels mentioned above with nodes or edges in the behavior graph model for updating:

[0128] Add nodes and edges. For example, suppose the access behavior data is as follows: such as user U1 accessing a "highly sensitive" image through terminal Dev3, including access frequency and operation type;

[0129] Add "User U1 (node), Real-time Data (node, with extremely high sensitivity label), Terminal Dev3 (node) to the preset behavior graph model, add edge E (U1-data), set edge attributes to permission level 3, access frequency 1 (current first access), risk label pending judgment;

[0130] Update the adjacency matrix: The system automatically updates the sparse adjacency matrix A. The sparse adjacency matrix A is constrained by the local clustering coefficients, which reduces the global computational complexity.

[0131]

[0132] For elements of the adjacency matrix, Edge weights between nodes The set of edges in the graph, with other unchanged elements remaining unchanged;

[0133] Computational node risk: Introducing a damping matrix. And adopts local propagation update rules:

[0134]

[0135] Through the above formula Iterate 1-2 times until convergence to obtain the real-time risk value of the data node (e.g., r=0.75).

[0136] Extracting Access Features: Two core features are extracted from real-time access behavior data:

[0137] Access frequency characteristics: The number of times the current user accesses the target data within a preset time period (e.g., the last hour) (denoted as f). t );

[0138] Access path / permission characteristics: The "terminal-user-data" path of the current user accessing the target data (compared with historically frequently used paths, denoted as path deviation p). t ), or the deviation between the currently requested permission and the user's historical permissions (denoted as permission deviation p). t );

[0139] For example, obtain the real-time access frequency f of U1.t =1 (first access in the last hour), access path "Dev3→U1→Ultra-high sensitivity data" (compared with the commonly used path of U1 in the last hour, the difference is 0.8).

[0140] Calculate the outlier score: The outlier score is calculated using the following formula:

[0141]

[0142] in, Score the access exception. Current access frequency, , The mean and standard deviation of the access frequency. This represents the distance or permission deviation of the current access path. , The mean and standard deviation of the access paths. , These are weighting coefficients used to control the influence of frequency features and path features on anomaly scoring.

[0143] If multi-feature evaluation is required, the following multi-dimensional anomaly comprehensive scoring formula can be used:

[0144]

[0145] in, For multidimensional comprehensive anomaly scoring, Indicates the first Anomaly score for each access characteristic, As weight, Number of feature dimensions;

[0146] For example, if there are access frequency, access time deviation, and permission deviation, then the anomaly score for access frequency, the anomaly score for access time deviation, and the anomaly score for permission deviation are calculated separately, and then applied using the formula above. Obtain the comprehensive weight, where the weights of the three feature classes are summed to 1. The weights can be set as follows: access frequency weight λ1=0.4; permission deviation weight λ2=0.5; access time deviation weight λ3=0.1.

[0147] Based on the historical access logs, calculate the prior probability P(Risk) according to formula (24):

[0148]

[0149] Extract the feature vector of the current access behavior (If features include access frequency, path deviation, permission level, etc.), the feature vector is processed by damping + neighborhood aggregation according to the following formula:

[0150]

[0151] Then calculate the likelihood function using the following formula. :

[0152]

[0153] Calculate the posterior probability P(Risk|Access) immediately using Bayes' theorem:

[0154]

[0155] Where P (Access) is the overall probability of the access behavior;

[0156] Calculate using the following formula:

[0157]

[0158] (r=1 represents a "risk event", r=0 represents a "safety event");

[0159] in, This represents the posterior probability of risk given the access behavior. The likelihood function represents the probability of access behavior under risk conditions. This is the feature vector of the current access behavior. The feature vector after damping and neighborhood aggregation processing. As a risk access feature center, The normalization coefficient is... As a priori risk, among which This indicates the number of visits marked as risk events during the historical observation period. This represents the total number of visits during the historical observation period. Let be the overall probability of the access behavior, used for normalization, where =1 indicates that a risk event exists. =0 indicates a security event. This represents the conditional probability of access behavior under different risk conditions. The prior probability of the corresponding risk state.

[0160] The risk posterior probability P(Risk|Access) is compared with a preset threshold to classify risk levels (the original text clearly states the classification logic, such as P≥0.8=extremely high risk, 0.5≤P<0.8=high risk, 0.2≤P<0.5=medium risk, P<0.2=low risk), and corresponding warning signals are generated (such as extremely high risk - red warning, high risk - orange warning, etc.).

[0161] For events marked as abnormal access or with a risk level ≥ medium risk, a risk log is generated immediately. The log fields are strictly defined as follows: {User_ID (unique user identifier), Data_ID (unique identifier of accessed data), Risk_Level (risk level), Timestamp (access timestamp), Probability (risk probability P(Risk|Access))}. The log is written to the risk log database immediately (only a write operation is performed, not a new database is created; the original text explicitly states that it is used for subsequent security decisions).

[0162] Based on the combined sensitivity and risk levels, a prevention and control strategy is generated. First, a dynamic threshold function is defined:

[0163]

[0164] in To determine the comprehensive prevention and control threshold, This is a comprehensive function used to calculate the threshold. For resolution, For coverage, For historical overreach rate, , , These are the weighting coefficients for each variable, reflecting the degree of influence of different variables.

[0165] The weight of an edge in the graph is calculated using the following formula. It is determined by the frequency of access, the level of access privileges, and the sensitivity of the data:

[0166]

[0167] in To normalize the access frequency, This is a score indicating abnormal access permissions. The weighting coefficients represent the shortest path cost from any user to the high-sensitivity data in the graph. satisfy >τ, the system executes the following sequence of actions: differential privacy protection → dynamic key rotation → temporary freezing of external shared interfaces;

[0168] Calculate the comprehensive prevention and control strategy score S_policy using the following two formulas:

[0169]

[0170]

[0171] in, Represents the policy response function. For sensitivity score, The probability of risk prediction is derived from Bayesian prediction results. , These are the weighting coefficients. It is a comprehensive prevention and control strategy score. This indicates the number of metrics considered when evaluating a system. For indexing indicators, For the first The module assigns weights to each metric and calls subsystems such as encryption, access control, and log monitoring based on the policy.

[0172] Based on "sensitivity level + risk level + "Three dimensions are used to instantly match prevention and control measures from the basic prevention and control strategy database. The core matching rules are as follows:"

[0173] Extremely high sensitivity (S≥0.75) + extremely high risk (P≥0.8): Access whitelist control + AES-256 encryption + dynamic key rotation (every 24 hours) + differential privacy protection (ε=0.1) + real-time auditing;

[0174] High sensitivity (0.5≤S<0.75) + high risk (0.5≤P<0.8): Multi-factor authentication + SM4 encryption + core field desensitization + access frequency limit (≤5 times per hour) + periodic auditing;

[0175] Medium risk (0.25≤S<0.5) + Medium sensitivity (0.2≤P<0.5): Hierarchical access control + partial field fuzzing + daily audit report;

[0176] Low sensitivity (S<0.25) + low risk (P<0.2): basic identity authentication + operation log recording + weekly audit.

[0177] The system calculates the adaptive control weights using the following formula:

[0178]

[0179] For adaptive prevention and control weights, For the balance coefficient, satisfying + =1, For conditional risk probability. When When the threshold τ is exceeded, the system automatically triggers the differential privacy protection and key rotation mechanism and enters the enhanced prevention and control mode.

[0180] Adjust encryption strength instantly using the following formula:

[0181]

[0182] Indicates the actual encryption strength. Indicates the basic encryption strength. It is the adaptive control weight, where δ is the sensitivity coefficient;

[0183] Desensitization level according to Dynamic adjustment: Delete core fields when the value is ≥0.7, and ≤0.4. When the value is less than 0.7, key information is fuzzy processed. When the value is less than 0.4, only unnecessary identifiers are hidden.

[0184] The corresponding functional modules are invoked to execute matching prevention and control measures: Access control module: intercepts unauthorized access (such as non-whitelisted users, users with mismatched permissions), and implements frequency limits; Encryption module: performs real-time encryption on data transmission and storage (by pressing E). level Determine the intensity); Desensitization module: Performs real-time desensitization processing on the output data (by pressing W). ctrl (Degree of certainty); Audit module: Real-time recording of prevention and control operation logs (including encryption key ID, de-identified fields, reasons for interception, etc.).

[0185] After the prevention and control measures are completed, the system collects real-time performance data (such as risk interception success rate and false interception rate) and updates the prevention and control weights according to the following formula:

[0186] This enables adaptive optimization of the strategy parameters. Among them, The current control weight parameter. The updated prevention and control weights will be used for the next moment. This is the learning rate coefficient, used to control the adjustment range. This is the actual risk feedback value. Predict risk values ​​for the model.

[0187] The system adjusts the prevention and control parameters to minimize the overall cost using the following formula:

[0188]

[0189] in, The objective is to minimize the entire weighted cost function, thereby minimizing the overall risk and cost of the prevention and control strategy. For underreported weighting coefficients, It is the false alarm weighting coefficient. It is the response time weighting coefficient. The false negative rate, For false alarm rate, For response time.

[0190] The comprehensive prevention and control threshold τ is updated in real time according to the following formula:

[0191]

[0192] in , / / These are the false alarm rate, false alarm rate, and average detection latency, respectively. , As a weighting factor, The threshold learning rate is used. When discrete security policy parameters cannot be directly differentiated, this invention employs a reinforcement learning update mechanism based on policy gradient approximation.

[0193] Define the reward function using the following formula:

[0194]

[0195] For overall benefits, For risk reduction rate, This refers to the weighting coefficient for strategy switching.

[0196] Update the weight vector after each round of policy execution:

[0197]

[0198] The parameter vector of the policy. For learning rate, For parameters gradient, This represents the expected return. This approximation method does not rely on the assumption of continuous differentiability and can achieve adaptive weight adjustment in the discrete event space.

[0199] Real-time generation of prevention and control execution logs, with fields including: prevention and control strategy ID, unique data identifier, executed prevention and control measures (encryption / de-identification / access control details), prevention and control weight W_ctrl, execution timestamp, and user access result (allowed / blocked); logs are immediately stored in the system database for subsequent policy optimization and traceability;

[0200] At every critical stage of the data lifecycle (collection, storage, retrieval, sharing, and destruction), structured operation logs are automatically generated in real time. The log fields are strictly defined according to the original text: operator ID, operation timestamp, operation location, action type (such as collection / download / encryption / destruction), associated data ID, and associated prevention and control strategy ID. Regardless of whether the data is accessed, as long as there is a change in status (such as adding storage or triggering destruction), logs are generated immediately to ensure that no stage is missed.

[0201] The system calculates the hash value of each new log entry using the following formula to construct an immutable log chain:

[0202]

[0203] in, The hash value currently recorded in the log. No. Log entries, The hash value of the previous log entry. Use a hash function to ensure chain integrity;

[0204] Blockchain-based evidence storage. Hash digests of critical security events are generated and uploaded to the consortium blockchain to ensure the immutability of operation records. Access events, policy IDs, and security logs are stored on the blockchain.

[0205]

[0206] Represents a blockchain record unit. This represents a data hash digest, used to uniquely identify data content and ensure its immutability. Represents a timestamp, recording the time of uploading to the blockchain to ensure the traceability of event order. Set a policy identifier and performance constraints.

[0207] The block hash calculation formula is as follows:

[0208]

[0209] Current block hash value, Hash function transaction collection, Previous block hash, Random numbers;

[0210] Step E3, model retraining and closed-loop optimization, involves the system periodically updating the sensitivity model weights, risk prediction thresholds, and prevention and control strategy parameters to achieve continuous evolution of the safety model. The model parameter update formula is:

[0211]

[0212]

[0213]

[0214]

[0215] in, The parameter vector of the current iteration step. The updated parameter vector, Learning rate The gradient of the loss function with respect to the parameters. Number of iterations The joint loss function for sensitivity and risk prediction. It is the loss function of the sensitivity model. It is the loss function of the risk prediction model. It is the total number of samples. For the first The predictive sensitivity level for each sample For the first The true sensitivity level of each sample Indicates the first The true risk label of each sample Indicates the first The predicted risk probability of a sample For sensitivity loss weighting coefficients, This is the risk prediction loss weighting coefficient.

[0216] In this embodiment, based on traditional natural resource information security management, three innovative mechanisms are introduced: multi-dimensional sensitivity assessment, graphical model risk prediction, and adaptive prevention and control optimization. Compared with the traditional manual classification and static security strategy, this invention can objectively and dynamically classify geographic information data; achieve real-time access behavior prediction across departments and time periods; and realize an intelligent prevention and control system with dynamic weight adjustment and continuous optimization. This method effectively solves the problems of controllable security, predictable risks, and traceable behavior of natural resource geographic information data throughout its entire lifecycle, significantly improving the system's real-time response capability and management refinement level.

[0217] In this embodiment, before obtaining the preset behavioral graph model, the real-time multidimensional sensitivity assessment and adaptive security control method for natural resource geographic information further includes:

[0218] Acquire historical multi-source geographic information sample data, historical sensitivity classification and annotation data, historical access records, and historical risk event annotation data;

[0219] A pre-defined behavioral graph model is constructed based on historical multi-source geographic information sample data, historical sensitivity classification and annotation data, historical access records, and historical risk event annotation data.

[0220] In this embodiment, the step of constructing a preset behavioral graph model based on historical multi-source geographic information sample data, historical sensitivity classification annotation data, historical access records, and historical risk event annotation data includes:

[0221] Extracting multidimensional features from historical multi-source geographic information sample data;

[0222] In this embodiment, based on the collected data, the system constructs a real-time multidimensional sensitivity assessment model, extracting features from multiple dimensions such as spatial scale, content complexity, time update frequency, access frequency, and data correlation, and calculating a comprehensive sensitivity score through the information entropy method and weighting function.

[0223] In this embodiment, historical multi-source geographic information sample data also needs to undergo the above preprocessing (e.g., removing duplicate records, normalization, etc.).

[0224] In this embodiment, extracting multidimensional features from historical multi-source geographic information sample data includes:

[0225] Feature extraction: The system extracts multi-dimensional feature metrics from the standardized dataset. The feature correlation matrix is ​​as follows:

[0226]

[0227] in, Indicates the first The first feature and the second The correlation coefficient between features is used to describe the linear correlation between different features. Indicates the first A data vector of features or variables Indicates the first A data vector of features or variables Covariance represents the common trend of change of two eigenvalues;

[0228] Since the units of each indicator are different, the system uses the range normalization method for standardization (formula (6)):

[0229] In this embodiment, the initial entropy weights of each historical sample are calculated based on multidimensional features; the specific scheme is as follows:

[0230] The weights of each indicator are determined using the information entropy method. ;

[0231] Calculate the information entropy of each indicator (Formula (7)):

[0232] Calculate the information entropy for each indicator:

[0233]

[0234] Calculate the entropy weight of each indicator (Formula (8));

[0235] The formula for normalized information gain weights is:

[0236]

[0237] The formula is used to help assess the contribution of a feature to the sensitivity level, where For the first Information gain weights for each feature For the first Information gain of each feature The sum of all feature information gains is used for normalization to ensure that the sum of all weights is 1. For the total number of features, The target variable Information entropy It is conditional entropy, which represents the condition under known characteristics. Under the conditions, The remaining uncertainty;

[0238] The original entropy weights (Formula 10) are obtained and corrected using time decay and access-related weights. To enhance the dynamism of four-dimensional fusion, the system introduces a time decay coefficient based on traditional entropy weight calculation. Relevance to access The information utility value is dynamically adjusted.

[0239] The dynamic feature weights are adjusted using formula (11).

[0240] Based on historical sensitivity classification annotation data, multidimensional features, and initial entropy weights of features, a calibrated comprehensive sensitivity scoring formula and four-level classification rules are generated.

[0241] Specifically, a sensitivity scoring function based on multidimensional feature weighted fusion is adopted (Formula 12).

[0242] Formula (13) is used for continuous features, and formula (14) is used for nonlinear distribution features.

[0243] For each geographic data object, a multidimensional sensitivity score is applied. Perform a four-level division (Formula (15)), where "Low-sensitivity" For "Zhongmin", For "high sensitivity", The threshold is set to "extremely high sensitivity". Initial values ​​for the threshold range can be 0.25, 0.5, or 0.75.

[0244] The final visit behavior graph model is constructed based on historical visit records and historical multi-source geographic information sample data.

[0245] Specifically, based on real-time sensitivity results and access behavior data, the system constructs an access graph model to dynamically monitor access subjects, access paths, permission changes, and access frequency.

[0246] In this embodiment, the extraction of multidimensional features from historical multi-source geographic information sample data includes:

[0247] Spatial resolution features are obtained by using the smallest identifiable unit of geographic raster data in historical multi-source geographic information sample data (using formula 50).

[0248] The spatial area corresponding to historical multi-source geographic information sample data is statistically analyzed, and the geographic coverage characteristics are obtained through the coordinate range of historical multi-source geographic information sample data.

[0249] The semantic complexity features of the content are obtained by the number of land cover categories and spatial distribution entropy in the sample data (using formula (51)).

[0250] The update interval of historical multi-source geographic information sample data is statistically analyzed, and the reciprocal of the interval is taken as the time update frequency to obtain the time update frequency feature.

[0251] The number of associations between historical multi-source geographic information sample data and other highly sensitive data is statistically analyzed, and the association ratio is calculated as a feature of data association degree.

[0252] The spatial resolution feature, geographic coverage feature, content semantic complexity feature, time update frequency feature, and data correlation feature are normalized respectively (original formula (6)) to obtain the normalized spatial resolution feature, normalized geographic coverage feature, normalized content semantic complexity feature, normalized time update frequency feature, and normalized data correlation feature.

[0253] The initial entropy weights of the normalized spatial resolution feature, normalized geographical coverage feature, normalized content semantic complexity feature, normalized time update frequency feature, and normalized data correlation feature are calculated respectively using the information entropy method (original formulas (7) and (8)). This yields the initial entropy weights of the spatial resolution feature, geographical coverage feature, content semantic complexity feature, time update frequency feature, and data correlation feature. The initial entropy weights of the spatial resolution feature, geographical coverage feature, content semantic complexity feature, time update frequency feature, and data correlation feature, along with the spatial resolution feature, geographical coverage feature, content semantic complexity feature, time update frequency feature, and data correlation feature, constitute a multidimensional feature.

[0254] Formula 8: Calculate the entropy weights of each indicator:

[0255]

[0256] In this embodiment, the generation of time decay coefficient and access correlation coefficient based on historical multi-source geographic information and historical access records includes:

[0257] Extracting time-dimensional features from historical multi-source geographic information sample data;

[0258] Generate access behavior characteristics from historical access records;

[0259] Define the range of values ​​for the time decay coefficient and the range of values ​​for the access correlation coefficient (0 < λt < 1, γa ≥ 0).

[0260] A candidate set of time decay coefficients is generated based on the time dimension characteristics and the value range of the time decay coefficient. The candidate set of time decay coefficients includes at least one initial time decay coefficient (Formula (10)).

[0261] A candidate set of access correlation coefficients is generated based on access behavior characteristics and the value range of access correlation coefficients. The candidate set of access correlation coefficients includes at least one initial access correlation coefficient.

[0262] A valid coefficient candidate set is generated based on the time decay coefficient candidate set and the access correlation coefficient candidate set, wherein the valid coefficient candidate set includes at least one set of valid coefficients.

[0263] The following processing is performed on each group of effective coefficients:

[0264] The initial entropy weights of the features of each historical sample are corrected to obtain the corrected weight matrix of each sample; the corrected weight matrices of each feature are combined to form the corrected weight set of the effective coefficient group.

[0265] Calculate the prediction score for each historical sample to obtain the prediction score for each sample. The prediction scores of each sample form the prediction score set of the current candidate combination corresponding to the effective coefficient group.

[0266] The deviation value of the current candidate combination corresponding to the effective coefficient group is obtained based on the prediction score of each sample.

[0267] Among all groups of effective coefficients, the effective coefficient group with the smallest MSE is selected, and the initial time decay coefficient in the effective coefficient group with the smallest MSE is used as the time decay coefficient.

[0268] The initial access correlation coefficient in the effective coefficient group corresponding to the minimum MSE is used as the access correlation coefficient.

[0269] In this embodiment, the step of constructing an access behavior graph model and a risk propagation damping matrix based on historical access records and historical multi-source geographic information sample data includes:

[0270] Obtain user nodes, data nodes, and terminal nodes based on historical access logs;

[0271] Using the access relationships between nodes as edges and setting the weight attributes of the edges, the user nodes, data nodes, terminal nodes, and each edge form an initial graph;

[0272] Obtain node distribution characteristics, access behavior characteristics, and risk interaction characteristics;

[0273] Generate a set of simulated nodes, which includes simulated user nodes, simulated data nodes, and simulated terminal nodes;

[0274] Generate a simulated edge set;

[0275] Obtain the initial damping matrix;

[0276] Obtain a candidate set of damping coefficients, wherein the candidate set of damping coefficients includes multiple candidate values ​​of damping coefficients;

[0277] For each candidate value of damping coefficient, risk propagation calculation is performed to obtain each candidate value of damping coefficient separately;

[0278] For each candidate damping coefficient value, obtain its final node risk vector;

[0279] Based on the risk vector of the final node, the accuracy and efficiency of each candidate value of the damping coefficient are evaluated to obtain the optimal damping coefficient.

[0280] The initial damping matrix is ​​updated based on the optimal damping coefficient to obtain the final damping matrix; the initial graph and the final damping matrix together form the final access behavior graph model.

[0281] For example, extract historical interaction statistical features: node distribution features: count the number of user nodes, the number of data nodes (classified by sensitivity level: low sensitivity / L1, medium sensitivity / L2, high sensitivity / L3, extremely high sensitivity / L4), the number of terminal nodes, and the association density of each type of node (such as the average number of users accessing high sensitivity data nodes) in the historical logs.

[0282] Access behavior characteristics: Calculate the frequency distribution of users with different permissions accessing various sensitive data (such as the average frequency of administrator users accessing highly sensitive data and the frequency range of ordinary users accessing low-sensitivity data), and the binding relationship between terminal nodes and user nodes (such as the binding ratio between fixed terminals and users, and the usage frequency of temporary terminals).

[0283] Risk interaction characteristics: Statistical analysis of the interaction patterns of "user-terminal-data" in historical risk events (e.g., abnormal access often comes from temporary terminals, and unauthorized operations often target highly sensitive data).

[0284] (2) Generate a set of simulated nodes

[0285] Simulated user nodes: N are generated based on the historical user permission level distribution (e.g., administrators 5%, editors 20%, and ordinary users 75%). u Each user node is assigned a permission level and historical access preferences (such as preference for accessing a certain type of data).

[0286] Simulated data nodes: N are generated based on the historical data sensitivity level distribution (e.g., low sensitivity 40%, medium sensitivity 30%, high sensitivity 20%, and extremely high sensitivity 10%). d Each data node is associated with a sensitivity level and data type (such as remote sensing images or geological data).

[0287] Simulated terminal nodes: N generated based on historical terminal binding characteristics dev Each terminal node is divided into fixed terminals (bound to a specific user) and temporary terminals (randomly associated with a user), and terminal attributes (such as IP address and historical access stability) are assigned.

[0288] (3) Generate simulated edge set (access relationship)

[0289] Edge generation rules: Based on the historical access frequency distribution, the frequency of accessing data nodes is assigned to simulated user nodes (e.g., ordinary users access low-sensitivity data 1-3 times per day, and administrators access high-sensitivity data 2-5 times per day).

[0290] Edge attribute assignment: Assign each edge a permission level (consistent with user node permissions), access time period (randomly distributed according to historical access time periods), and risk label (based on historical risk interaction characteristics, randomly label some edges of "temporary terminal - high-sensitivity data" and "low-privilege user - high-sensitivity data" as "abnormal", and the rest as "normal");

[0291] Scale control: The scale of simulated node interaction data is matched with historical access logs to ensure coverage of the two core edges, "user-terminal" and "user-data", supporting risk propagation testing at a scale of millions of nodes (original document: "ensure real-time inference and rapid response capabilities at a scale of millions of nodes").

[0292] Ultimately, we obtained the simulated node interaction dataset and the simulated risk labeling data;

[0293] The simulated node interaction dataset contains a set of simulated user nodes (N) u (N) simulated data node set (N) d (N) simulated terminal node set (N) dev (individual), and edge sets with attributes (including access frequency, permission level, access time period, and risk label);

[0294] The simulated risk labeling data and the risk labels (normal / abnormal) corresponding to the simulated edge set are used to verify the accuracy of the risk propagation results in subsequent verification.

[0295] Testing the accuracy and efficiency of risk propagation under different damping coefficients:

[0296] (1) Risk propagation calculation (Formula 18): For each candidate value of damping coefficient δ_curr, perform the following operations: Construct the current damping matrix (risk propagation damping matrix) Initialize node risk vector: Based on the risk labels of simulated node interaction data, initialize the risk value of abnormal nodes to 1 and the risk value of normal nodes to 0; Iterative propagation calculation: Substitute into formula 18, iterate until the risk vector converges (the change in risk value between two iterations is less than the threshold 1e-5); Output the final node risk vector: r final (Risk propagation score for each node, ranging from [0,1]).

[0297] (2) Accuracy assessment (matching degree between risk propagation results and annotations): Risk node identification: r final Nodes with a medium-risk score ≥ 0.5 are identified as "propagation risk nodes" and compared with risk labels in simulated data. Evaluation metrics are calculated: based on the confusion matrix, accuracy (number of correctly identified risk nodes / total number of identified risk nodes) and recall (number of correctly identified risk nodes / total number of actual risk nodes) are calculated, and the F1 score is taken as the core accuracy metric (F1 = 2 × accuracy × recall / (accuracy + recall)). Historical data verification: the propagation results corresponding to the optimal candidate value are compared with historical risk event labeling data to ensure consistent matching (the document implicitly contains real-world scenario verification logic).

[0298] (3) Efficiency evaluation (calculation time statistics): Record the calculation time: Statistically calculate the total time (including matrix multiplication and iterative calculation time) of risk propagation from initialization to convergence for each candidate value of damping coefficient; Stability test: Under the same hardware environment, repeat the calculation 3 times for each candidate value and take the average time as the efficiency index.

[0299] Determine the optimal damping coefficient and construct the trained graphical model of access behavior.

[0300] (1) Screening valid candidate coefficients: Eliminate candidate values ​​that violate the constraints: exclude δ_curr with F1 score <0.8 or calculation time >100ms (e.g., the recall rate is too low when δ=0.1, and the calculation time is too long when δ=0.9, both are eliminated); retain the valid candidate set: the remaining damping coefficient candidate values ​​that satisfy the constraints (e.g., δ_candidate_valid=[0.3,0.4,0.5,0.6]).

[0301] (2) Determine the optimal damping coefficient: Construct a comprehensive scoring function: taking into account both accuracy and efficiency, the formula is Score=0.7×F1+0.3×(1-time / 100); Calculate the comprehensive score: calculate the score for each valid candidate value, and select the δ with the highest score as the optimal damping coefficient δ. opt (e.g., δ) opt The score is highest when δ = 0.4); final verification: confirming δ opt Satisfying λ t ・Δt max <1, and the propagation results in historical risk event data have the best matching degree.

[0302] (3) Construct the trained access behavior graph model: ;

[0303] Update the damping matrix: Change the initial damping matrix D r Replace the coefficient in with δ opt Fusion graph model and damping matrix: The initial access behavior graph model is combined with the optimal damping coefficient to form a trained access behavior graph model, which includes node / edge definitions, edge weight adjacency matrix A, and risk propagation damping matrix that determines the damping coefficient.

[0304] Example 2:

[0305] See appendix Figure 1 , attached Figure 2 As shown in the figure, this embodiment discloses a real-time multidimensional sensitivity assessment and adaptive security control method and system for natural resource geographic information. This method innovates the structure of the weight update law, graph model risk propagation and adaptive optimization mechanism for geographic information security characteristics.

[0306] In this embodiment, a multi-dimensional sensitivity quantification model is introduced based on traditional natural resource geographic information security management. Compared with existing security methods that rely solely on manual grading or single-indicator judgment, this invention constructs a sensitivity calculation framework, making sensitivity assessment more objective, quantifiable, and dynamically updated. This model can automatically adjust weights based on the characteristics of different data sources and business scenarios, thereby accurately identifying the true sensitivity of data and avoiding the ambiguity of security boundaries caused by previous qualitative judgments.

[0307] Building upon this foundation, this invention proposes a dynamic risk perception mechanism based on an access behavior graph model. This mechanism abstracts access subjects, data objects, and operational behaviors into a graph structure, analyzing access paths and permission evolution relationships between nodes in real time to capture potential risk characteristics. By introducing a Bayesian risk prediction algorithm, the probability of abnormal behavior is continuously updated, enabling the system to provide real-time warnings before security incidents occur, avoiding the lag and passivity inherent in traditional static prevention and control methods. This mechanism transforms risk monitoring from "post-event tracking" to "pre-event prediction," achieving a technological leap from passive defense to proactive prevention and control.

[0308] Furthermore, this invention proposes an adaptive dynamic optimization strategy for security control weights. This strategy constructs a dynamic weight update model by jointly analyzing real-time sensitivity assessment results and risk prediction results, automatically adjusting the security control strength based on real-time risk feedback. The system continuously learns from the control effectiveness and risk interception rate, gradually optimizing access control thresholds, encryption strength, and shared review strategies, enabling the control mechanism to possess self-learning and self-evolution capabilities. Compared to traditional fixed-threshold security strategies, this invention can dynamically balance "availability" and "security" based on data characteristics and risk trends, significantly improving the intelligence, precision, and real-time control level of natural resource geographic information management.

[0309] In this embodiment, natural resource geographic information data are collected from remote sensing imagery, topographic mapping, geological exploration, ecological monitoring, land use, and socio-economic statistics through a multi-source data interface. The collected data undergoes preprocessing, including format standardization, coordinate system unification, outlier removal, and time alignment, to construct a multi-source geographic information basic database.

[0310] The specific steps include the following process:

[0311] Multi-source data acquisition and metadata generation: Automatically generate metadata files for each piece of processed data, and assign a unique identifier to each piece of data to ensure subsequent data tracking and traceability.

[0312] Based on the collected data, the system constructs a real-time multidimensional sensitivity assessment model, extracting features from multiple dimensions such as spatial scale, content complexity, time update frequency, access frequency, and data correlation, and calculating a comprehensive sensitivity score through the information entropy method and weighting function.

[0313] The system extracts multidimensional feature indicators from the standardized dataset. The feature correlation matrix is ​​Equation 5. Since the units of each indicator are different, the system uses the range normalization method for standardization, which is Equation 6.

[0314] Weight calculation: The information entropy method is used to determine the weight of each indicator. ;Calculate the information entropy of each indicator using Formula 7; calculate the entropy weight of each indicator using Formula 8.

[0315] The formula for normalized information gain weights is Formula 9;

[0316] To enhance the dynamism of four-dimensional fusion, the system introduces a time decay coefficient on top of the traditional entropy weight calculation. Relevance to access The information utility value is dynamically adjusted using Formula 10. Dynamic feature weight adjustment (Formula 11);

[0317] For comprehensive sensitivity calculation, the system employs a sensitivity scoring function based on multi-dimensional feature weighted fusion (Formula 12); Formula 13 is used for continuous features; and Formula 14 is used for non-linear distribution features. A multi-dimensional sensitivity score is applied to each geographic data object. Divide into four levels (using formulas 15 and 16);

[0318] The process of generating and recording tags involves writing sensitivity levels into data metadata, generating tags, and storing them in the sensitivity index database.

[0319] Based on real-time sensitivity results and access behavior data, the system constructs an access graph model to dynamically monitor access subjects, access paths, permission changes, and access frequency. Through a Bayesian risk prediction model, it performs probabilistic analysis of access anomalies and unauthorized behaviors, achieving risk perception and trend prediction. The system updates risk levels in real time and generates corresponding early warning signals.

[0320] Access behavior modeling. The system constructs an access behavior graph model G=(V,E) based on user access logs, where nodes V are divided into three categories: user nodes, data nodes, and device nodes. Edges E represent access relationships and their attributes {permission level, access frequency, risk label}. The graph structure uses an adjacency sparse matrix A and local clustering coefficient constraints to reduce global computational complexity (see Equation 17). A risk propagation damping matrix is ​​introduced. And adopt the local propagation update rule (Formula 18).

[0321] For anomaly detection, the system extracts access characteristics and calculates anomaly scores (Formula 19). Additionally, the multi-dimensional anomaly comprehensive scoring formula is Formula 20.

[0322] Risk prediction is based on a Bayesian prediction model constructed from the access feature sequence (Equations 21 to 25).

[0323] Risk events are recorded. Each risk event is written to the risk log, which contains {User_ID, Data_ID, Risk_Level, Timestamp, Probability}, for use in subsequent security decisions.

[0324] Based on sensitivity grading and risk prediction results, the system employs an adaptive security control strategy generation mechanism to automatically allocate control weights and response levels. High-risk data automatically triggers encryption, access restrictions, and multi-factor authentication mechanisms; medium-risk data undergoes de-identification and access frequency control; and low-risk data is controlled for use through audit log tracking and shared review. After control measures are implemented, the system dynamically optimizes strategy parameters based on real-time risk feedback, achieving closed-loop management of security control throughout its entire lifecycle, including the following steps:

[0325] Strategy generation involves jointly generating prevention and control strategies based on sensitivity and risk levels. First, a dynamic threshold function is defined (Formula 26). Access to edge weights in the graph is then performed. The score is determined by the frequency of access, the level of access permission, and the sensitivity of data (Formula 27); secondly, the dynamic strategy scoring formula is Formula (28, 29).

[0326] Prevention and control implementation, strategy generation, and comprehensive strategy scoring are all part of the process. ∈[0,1] is used to drive adaptive control weights. Calculation (Formula 30):

[0327]

[0328] For adaptive prevention and control weights, For the balance coefficient, satisfying + =1, For conditional risk probability. When When the set threshold τ is exceeded, the system automatically triggers the differential privacy protection and key rotation mechanism (where the encryption strength adjustment formula is Formula 31) and enters the enhanced prevention and control mode.

[0329] Strategy optimization. After the control measures are completed, the system collects data on the effectiveness of the control measures and adjusts the strategy parameters through a feedback mechanism (Formula 32). Online learning of the thresholds adopts adaptive updates based on historical performance indicators (Formula 34). The system defines a reward function (Formula 35) and updates the weight vector after each round of strategy execution (Formula 36).

[0330] To achieve full-process security, controllability, and traceability of responsibility from data generation to destruction, the following steps are included: Step E1, Security Log Tracking: The system automatically generates operation logs at each stage of data collection, storage, retrieval, sharing, and destruction, including the operator, time, location, and action type. The log integrity verification formula is formula (37); Step E2, Blockchain On-Chain Evidence Storage: Hash digests of key security events are generated and uploaded to the consortium blockchain to ensure that operation records are tamper-proof. Access events, policy IDs, and security logs are stored on the blockchain (formula 38). Step E3, Model Retraining and Closed-Loop Optimization: The system periodically updates the sensitivity model weights, risk prediction thresholds, and prevention and control strategy parameters to achieve continuous evolution of the security model. The model parameter update formula is formulas (40, 41, 42, 43).

[0331] In this embodiment, based on traditional natural resource information security management, three innovative mechanisms are introduced: multi-dimensional sensitivity assessment, graphical model risk prediction, and adaptive prevention and control optimization. Compared with the traditional manual classification and static security strategy, this invention can objectively and dynamically classify geographic information data; achieve real-time access behavior prediction across departments and time periods; and realize an intelligent prevention and control system with dynamic weight adjustment and continuous optimization. This method effectively solves the problems of controllable security, predictable risks, and traceable behavior of natural resource geographic information data throughout its entire lifecycle, significantly improving the system's real-time response capability and management refinement level.

[0332] In this embodiment, the sensitivity assessment weight adopts an online update law of entropy weight with time decay and access association correction, the risk prediction model adopts a Bayesian propagation algorithm with sparse graph structure, and the adaptive prevention and control module realizes the weight update of discrete security parameters based on policy gradient approximation.

[0333] Multidimensional sensitivity quantification assessment stage: Calculate sensitivity scores based on a multidimensional feature weighted fusion model.

[0334]

[0335] in, It is the first The overall sensitivity index of an object It is the number of features. It is the first A set of features of an object Indicates the feature dimension index. To standardize the characteristic function, see formula (12) for details. For adaptive weights, their values ​​are The value satisfies =1.

[0336] Risk perception and prediction phase: Construct a graph-based access path model G=(V,E), where node V represents the access subject and data object, and edge E represents the access relationship and permission level. Define access anomaly degree:

[0337]

[0338] node Risk perception value, node The degree, Adjacent nodes, node and The probability of anomalies between them.

[0339] Furthermore, Bayesian inference formulas are used to dynamically predict and update access chain risks. This represents the posterior probability of risk given the access behavior. The likelihood function represents the probability of the visit behavior under risk conditions, as shown in formula (22). As a priori risk, see formula (23). The overall probability of the access behavior is used for normalization, as shown in formula (24). The risk prediction model takes the access behavior sequence as input and outputs the risk probability. The prediction period ΔT = 5 minutes, which can be dynamically adjusted.

[0340] Adaptive prevention and control decision-making phase: based on sensitivity score Risk Probability The system calculates comprehensive security weights. Security policies are dynamically adjusted based on these weights, including access control, differential privacy masking, cross-domain encryption, key updates, and blockchain-based traceability and evidence storage. The security weights are monotonically mapped to the encryption / masking policies.

[0341] The aforementioned spatial resolution features It is obtained by calculating the smallest identifiable unit of geographic raster data.

[0342] Content complexity Calculated by the number of land cover categories and spatial distribution entropy.

[0343] The probability of access anomalies Calculated based on a combination of access path frequency deviation and permission anomaly:

[0344]

[0345] On the nth visit or interaction, the node With nodes The overall degree of difference or risk probability, of which For access frequency deviation, Due to permission level deviation, , This is the adjustment coefficient.

[0346] The system uses a real-time risk prediction module to trigger threshold alarms for abnormal access behavior. The explicit piecewise form of the threshold function τ=f(R,S,ρ) is as follows:

[0347]

[0348] in For resolution, For coverage, For historical overreach rate, , , , These are constants preset for the project or obtained through training. When the abnormal shortest path cost d > τ, key rotation and differential privacy protection are triggered.

[0349] Adaptive control weights The parameters α and β are automatically adjusted by the security policy engine based on historical response results through real-time feedback.

[0350] Blockchain technology is used to record every access operation and control decision, forming a time-series chain-like evidence structure to ensure the verifiability and immutability of data traceability. A lightweight node consensus and asynchronous on-chain strategy are employed, keeping the average on-chain latency within 3 seconds, and this can be dynamically adjusted according to the network node scale. The single-node query concurrency capacity (QPS) can exceed 300.

[0351] This method addresses the dynamic changes throughout the entire lifecycle of natural resource data. It tackles the dynamic evolution of sensitivity in geographic information under multi-dimensional coupling of spatial scale, temporal evolution, content complexity, and access behavior, constructing a security system with real-time perception, dynamic prediction, and adaptive prevention and control capabilities. Through a multi-dimensional weighted model based on information entropy, it achieves real-time assessment and online updating of natural resource data sensitivity; a risk prediction module based on access relationship graphs and Bayesian inference completes real-time risk perception and propagation estimation of access behavior; and by combining reinforcement learning and adaptive control strategies, it dynamically adjusts security and prevention measures according to changes in sensitivity and risk. This invention enables multi-dimensional sensitivity assessment, real-time monitoring, and adaptive strategy optimization of natural resource geographic information, significantly improving the real-time security and resilience of natural resource data during sharing, distribution, and circulation.

[0352] This invention constructs a multi-source geographic information database and establishes a multi-dimensional sensitivity index system by combining characteristics such as spatial resolution, data content complexity, access frequency, time update cycle, and data correlation, thereby achieving dynamic quantification of data sensitivity. Simultaneously, it utilizes an access behavior graph model and a Bayesian risk prediction algorithm to monitor and predict risks throughout the entire data lifecycle in real time, identifying potential risk events in advance. To prevent rigid control strategies or delayed responses, the system further introduces an adaptive security strategy generation mechanism. Through dynamic weight adjustment and feedback optimization, it achieves continuous self-learning and optimization of control parameters, thus constructing a quantifiable, predictable, and real-time evolving natural resource geographic information security control system.

[0353] This invention proposes a real-time multidimensional sensitivity assessment and adaptive security control method for natural resource geographic information. By constructing a multidimensional sensitivity quantification model, a graph-based dynamic risk perception mechanism, and a real-time updatable security control strategy, it achieves intelligent identification, dynamic assessment, and proactive protection of natural resource geographic information throughout its entire lifecycle. Unlike the loose combination of existing methods such as "entropy weighting + Bayesian + reinforcement learning," this invention proposes a real-time coupled multidimensional sensitivity weight update algorithm. Based on information entropy weighting, it introduces "access association constraint terms" and "time decay terms," ​​forming a sensitivity weight function that can be adjusted in real-time according to changes in access behavior and time. Simultaneously, a risk propagation damping matrix based on node interaction frequency is introduced into the risk graph model, effectively reducing the computational complexity of high-dimensional access graphs and ensuring real-time inference and rapid response capabilities even at a scale of millions of nodes, thereby achieving efficient dynamic control of the multidimensional sensitivity of natural resource geographic information.

[0354] This application also provides a real-time multi-dimensional sensitivity assessment and adaptive security control system for natural resource geographic information. The system includes: a real-time natural resource geographic information data acquisition module for acquiring real-time natural resource geographic information data; a behavior graph model acquisition module for acquiring a preset behavior graph model; a behavior graph model update module for updating the preset behavior graph model based on the real-time natural resource geographic information data, thereby acquiring an updated behavior graph model; a node risk vector extraction module for acquiring updated node risk vectors based on the updated behavior graph model; a Bayesian risk prediction module for acquiring a trained Bayesian risk prediction model; an identification module for inputting the updated node risk vectors into the trained Bayesian risk prediction model, thereby acquiring real-time abnormal behavior identification results; and a personalized prevention and control strategy generation module for generating personalized prevention and control strategy schemes based on the real-time abnormal behavior identification results.

[0355] Although the present invention has been described in detail above with general descriptions and specific embodiments, modifications or improvements can be made to it, which will be obvious to those skilled in the art. Therefore, all such modifications or improvements made without departing from the spirit of the present invention fall within the scope of protection claimed by the present invention.

Claims

1. A method for real-time multidimensional sensitivity assessment and adaptive security control of natural resource geographic information, characterized in that, The real-time multi-dimensional sensitivity assessment and adaptive security control method for natural resource geographic information includes: Acquire real-time geographic information data of natural resources; Obtain the preset behavior graph model; The pre-set behavior graph model is updated based on real-time natural resource geographic information data to obtain the updated behavior graph model. Obtain the updated node risk vector based on the updated behavioral graph model; Obtain the trained Bayesian risk prediction model; The updated node risk vector is input into the trained Bayesian risk prediction model to obtain real-time abnormal behavior identification results. Generate personalized prevention and control strategy solutions based on real-time abnormal behavior identification results; Before acquiring the preset behavioral graph model, the real-time multidimensional sensitivity assessment and adaptive security control method for natural resource geographic information further includes: Acquire historical multi-source geographic information sample data, historical sensitivity classification and annotation data, historical access records, and historical risk event annotation data; A pre-defined behavioral graph model is constructed based on historical multi-source geographic information sample data, historical sensitivity classification and annotation data, historical access records, and historical risk event annotation data. The construction of the pre-defined behavioral graph model based on historical multi-source geographic information sample data, historical sensitivity classification and annotation data, historical access records, and historical risk event annotation data includes: Extracting multidimensional features from historical multi-source geographic information sample data; Calculate the initial entropy weights of each historical sample based on the multidimensional features; Based on historical multi-source geographic information and historical access records, a time decay coefficient and an access correlation coefficient are generated. On the basis of the initial entropy weight calculation, the time decay coefficient and the access correlation coefficient are introduced to dynamically correct the feature weights. Based on historical sensitivity classification and annotation data, multidimensional features, and the comprehensive sensitivity scoring formula and four-level classification rules generated by the initial entropy weight of features after calibration, each geographic data object is divided into four levels through multidimensional sensitivity scores. The final visit behavior graph model is constructed based on historical visit records and historical multi-source geographic information sample data. The process of constructing the final visit behavior graph model based on historical visit records and historical multi-source geographic information sample data includes: Obtain user nodes, data nodes, and terminal nodes based on historical access logs; Using the access relationships between nodes as edges and setting the weight attributes of the edges, the user nodes, data nodes, terminal nodes, and each edge form an initial graph; Obtain node distribution characteristics, access behavior characteristics, and risk interaction characteristics; Generate a set of simulated nodes, which includes simulated user nodes, simulated data nodes, and simulated terminal nodes; Generate a simulated edge set; Obtain the initial damping matrix; Obtain a candidate set of damping coefficients, wherein the candidate set of damping coefficients includes multiple candidate values ​​of damping coefficients; For each candidate value of damping coefficient, risk propagation calculation is performed to obtain each candidate value of damping coefficient separately; For each candidate damping coefficient value, obtain its final node risk vector; Based on the risk vector of the final node, the accuracy and efficiency of each candidate value of the damping coefficient are evaluated to obtain the optimal damping coefficient. The initial damping matrix is ​​updated based on the optimal damping coefficient to obtain the final damping matrix; the initial graph and the final damping matrix together form the final access behavior graph model.

2. The real-time multi-dimensional sensitivity assessment and adaptive security control method for natural resource geographic information as described in claim 1, characterized in that, Before acquiring the preset behavioral graph model, the real-time multidimensional sensitivity assessment and adaptive security control method for natural resource geographic information further includes: The real-time natural resource geographic information data is standardized. Specifically, feature point matching and affine transformation algorithms are used for multi-source images and vector data in the real-time natural resource geographic information data, and the Z-score standardization detection method is used for outliers.

3. The real-time multi-dimensional sensitivity assessment and adaptive security control method for natural resource geographic information as described in claim 2, characterized in that, The extraction of multidimensional features from historical multi-source geographic information sample data includes: Spatial resolution features are obtained by using the smallest identifiable unit of geographic raster data in historical multi-source geographic information sample data. The spatial area corresponding to historical multi-source geographic information sample data is statistically analyzed, and the geographic coverage characteristics are obtained through the coordinate range of historical multi-source geographic information sample data. The semantic complexity features of the content are obtained by the number of land cover categories and the spatial distribution entropy in the sample data. The update interval of historical multi-source geographic information sample data is statistically analyzed, and the reciprocal of the interval is taken as the time update frequency to obtain the time update frequency feature. The number of associations between historical multi-source geographic information sample data and other highly sensitive data is statistically analyzed, and the association ratio is calculated as a feature of data association degree. The spatial resolution feature, geographic coverage feature, content semantic complexity feature, time update frequency feature, and data correlation feature are normalized respectively to obtain the normalized spatial resolution feature, normalized geographic coverage feature, normalized content semantic complexity feature, normalized time update frequency feature, and normalized data correlation feature. The initial entropy weights of the normalized spatial resolution feature, normalized geographical coverage feature, normalized content semantic complexity feature, normalized time update frequency feature, and normalized data correlation feature are calculated using the information entropy method, thereby obtaining the initial entropy weights of the spatial resolution feature, geographical coverage feature, content semantic complexity feature, time update frequency feature, and data correlation feature. These initial entropy weights, along with the spatial resolution feature, geographical coverage feature, content semantic complexity feature, time update frequency feature, and data correlation feature, constitute a multidimensional feature.

4. The real-time multi-dimensional sensitivity assessment and adaptive security control method for natural resource geographic information as described in claim 3, characterized in that, The generation of time decay coefficient and access correlation coefficient based on historical multi-source geographic information and historical access records includes: Extracting time-dimensional features from historical multi-source geographic information sample data; Generate access behavior characteristics from historical access records; Define the range of values ​​for the time decay coefficient and the range of values ​​for the access correlation coefficient; A candidate set of time decay coefficients is generated based on the time dimension characteristics and the value range of the time decay coefficient. The candidate set of time decay coefficients includes at least one initial time decay coefficient. A candidate set of access correlation coefficients is generated based on access behavior characteristics and the value range of access correlation coefficients. The candidate set of access correlation coefficients includes at least one initial access correlation coefficient. A valid coefficient candidate set is generated based on the time decay coefficient candidate set and the access correlation coefficient candidate set, wherein the valid coefficient candidate set includes at least one set of valid coefficients. The following processing is performed on each group of effective coefficients: The initial entropy weights of the features of each historical sample are corrected to obtain the corrected weight matrix of each sample; the corrected weight matrices of each feature are combined to form the corrected weight set of the effective coefficient group. Calculate the prediction score for each historical sample to obtain the prediction score for each sample. The prediction scores of each sample form the set of prediction scores for the current candidate combination corresponding to the effective coefficient group. The deviation value of the current candidate combination corresponding to the effective coefficient group is obtained based on the prediction score of each sample. Among all groups of effective coefficients, the effective coefficient group with the smallest MSE is selected, and the initial time decay coefficient in the effective coefficient group with the smallest MSE is used as the time decay coefficient. The initial access correlation coefficient in the effective coefficient group corresponding to the minimum MSE is used as the access correlation coefficient.

5. A real-time multi-dimensional sensitivity assessment and adaptive security control system for natural resource geographic information, used in the real-time multi-dimensional sensitivity assessment and adaptive security control method for natural resource geographic information as described in any one of claims 1 to 4, characterized in that, The real-time multi-dimensional sensitivity assessment and adaptive security control system for natural resource geographic information includes: A real-time natural resource geographic information data acquisition module, wherein the real-time natural resource geographic information data acquisition module is used to acquire real-time natural resource geographic information data; A behavior graph model acquisition module, which is used to acquire a preset behavior graph model; The behavior graph model update module is used to update the preset behavior graph model according to real-time natural resource geographic information data, so as to obtain the updated behavior graph model. A node risk vector extraction module is used to obtain an updated node risk vector based on the updated behavioral graph model. A Bayesian risk prediction module acquisition module is used to acquire a trained Bayesian risk prediction model. The identification module is used to input the updated node risk vector into the trained Bayesian risk prediction model to obtain real-time abnormal behavior identification results. A personalized prevention and control strategy generation module is used to generate personalized prevention and control strategy schemes based on real-time abnormal behavior identification results.

Images