Automatic railway network data risk level classification method and device

Abstract

The application discloses an automatic railway network data risk level classification method and device, wherein the method comprises the following steps: determining the ordered attribute and unordered attribute of each data sample in the railway network data based on the data importance level, data life cycle stage, risk type and risk influence degree of each data sample; performing K-means clustering on each data sample based on the ordered attribute and unordered attribute of each data sample, and obtaining a plurality of initial class clusters; performing Gaussian mixture clustering on each data sample based on the cluster center of each initial class cluster and the Gaussian distribution corresponding to each data sample in each initial class cluster, and obtaining a plurality of class clusters corresponding to the railway network data; and determining the data risk level of each class cluster based on the data importance level and risk influence degree of each data sample in each class cluster. The method and device provided by the application improve the effectiveness and accuracy of the risk level classification of the railway network data.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of network data security, in particular, to an automatic railway network data risk level classification method and device. BACKGROUND

[0002] With the development of science and technology, data has become an important production factor and a basic strategic resource. The value and importance of data are increasingly prominent, but at the same time, data security risks are also increasing. As a key infrastructure, railway network involves various business scenarios and complex information network architecture. It faces the management problems of large-scale data assets, various data types, and high data value density. There is a high demand for security protection of important data. Once the problem of data security threat such as data leakage, loss, tampering occurs, it will cause a significant impact. Therefore, it is of great significance to analyze the potential security risks of railway network data, classify the risk levels of data, and make railway network data meet the requirements of security management and ensure the controllability of railway network data security risks.

[0003] In the prior art, data risk level classification is usually realized by using artificial information labeling processing and other methods. This method has complex implementation process, poor usability, low efficiency and poor accuracy.

[0004] Therefore, how to improve the efficiency and accuracy of railway network data risk level classification has become a technical problem to be solved in the industry. SUMMARY

[0005] The present application provides an automatic railway network data risk level classification method and device to solve the technical problem of how to improve the efficiency and accuracy of railway network data risk level classification.

[0006] The present application provides an automatic railway network data risk level classification method, comprising:

[0007] Based on the data importance level, the stage of the data life cycle, the risk type and the risk impact degree of each data sample in the railway network data, the ordered attribute and the unordered attribute of each data sample are determined;

[0008] Based on the ordered attribute and the unordered attribute of each data sample, K-means clustering is performed on each data sample to obtain a plurality of initial class clusters;

[0009] Based on the cluster center of each initial class cluster and the Gaussian distribution corresponding to each data sample in each initial class cluster, Gaussian mixture clustering is performed on each data sample to obtain a plurality of class clusters corresponding to the railway network data;

[0010] Based on the data importance level and the risk impact degree of each data sample in each class cluster, the data risk level of each class cluster is determined.

[0011] In some embodiments, the K-means clustering of each data sample based on the ordered attribute and the unordered attribute of each data sample comprises:

[0012] performing first K-means clustering on each data sample based on the Euclidean distance between each data sample;

[0013] performing second K-means clustering on each data sample based on the Euclidean distance and the value difference metric distance between each data sample, to obtain a plurality of initial class clusters and a cluster center of each initial class cluster;

[0014] The Euclidean distance between each data sample is determined based on the ordered attribute of each data sample; and the value difference metric distance between each data sample is determined based on the unordered attribute and the initial label of each data sample.

[0015] In some embodiments, the second K-means clustering of each data sample based on the Euclidean distance and the value difference metric distance between each data sample, to obtain a plurality of initial class clusters and a cluster center of each initial class cluster, comprises:

[0016] determining a hybrid distance between each data sample based on the Euclidean distance and the value difference metric distance between each data sample;

[0017] performing second K-means clustering on each data sample based on the hybrid distance between each data sample, to obtain a plurality of initial class clusters and a cluster center of each initial class cluster.

[0018] In some embodiments, the Gaussian mixture clustering of each data sample based on the cluster center of each initial class cluster and the Gaussian distribution corresponding to each data sample in each initial class cluster, to obtain a plurality of class clusters corresponding to the railway network data, comprises:

[0019] performing Gaussian mixture clustering of each data sample for a plurality of rounds based on the cluster center of each initial class cluster and the Gaussian distribution corresponding to each data sample in each initial class cluster, to determine a clustering result of each round and a closeness index and a separation index of each round;

[0020] determining the plurality of class clusters corresponding to the railway network data based on the clustering result corresponding to the round with the minimum ratio of the closeness index and the separation index.

[0021] In some embodiments, the determination of the data risk level of each class cluster based on the data importance level and the risk impact degree of each data sample in each class cluster comprises:

[0022] determining a weight balance coefficient;

[0023] determine a first impact weight of the data importance level and a second impact weight of the risk impact degree based on the weight balance coefficient;

[0024] determine a risk score of each data sample based on the data importance level, the risk impact degree, the first impact weight and the second impact weight of each data sample;

[0025] determine a risk score of each cluster based on the risk score of each data sample in each cluster and the number of data samples in each cluster;

[0026] determine a data risk level of each cluster based on the risk score of each cluster.

[0027] In some embodiments, the determining the ordered attribute and the unordered attribute of each data sample based on the data importance level, the data lifecycle stage, the risk type and the risk impact degree of each data sample in the railway network data comprises:

[0028] determine the data importance level, the data lifecycle stage, the risk type and the risk impact degree of each data sample;

[0029] determine the data importance level and the risk impact degree of each data sample as the ordered attribute of each data sample;

[0030] determine the data lifecycle stage of each data sample as the unordered attribute of each data sample.

[0031] In some embodiments, the method further comprises:

[0032] determine a clustering evaluation result of the multiple clusters corresponding to the railway network data based on at least one of the silhouette coefficient, the CH score and the Davies-Bouldin index.

[0033] The present application provides an automatic railway network data risk level classification device, comprising:

[0034] a data acquisition unit configured to determine an ordered attribute and an unordered attribute of each data sample in the railway network data based on a data importance level, a data lifecycle stage, a risk type and a risk impact degree of each data sample;

[0035] a first clustering unit configured to perform K-means clustering on each data sample based on the ordered attribute and the unordered attribute of each data sample to obtain multiple initial clusters;

[0036] The second clustering unit is configured to perform Gaussian mixture clustering on each data sample based on the cluster center of each initial class cluster and the Gaussian distribution corresponding to each data sample in each initial class cluster, to obtain a plurality of class clusters corresponding to the railway network data.

[0037] The risk determination unit is configured to determine the data risk level of each class cluster based on the data importance level and the risk influence degree of each data sample in each class cluster.

[0038] The present application provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the automatic railway network data risk level classification method when executing the program.

[0039] The present application provides a non-transitory computer-readable storage medium having a computer program stored thereon, wherein the computer program is executable by a processor to implement the automatic railway network data risk level classification method.

[0040] The automatic railway network data risk level classification method provided by the present application comprises the following steps: performing K-means clustering on each data sample in the railway network data according to the ordered attribute and the unordered attribute of each data sample, to obtain a plurality of initial class clusters and the cluster center of each initial class cluster; performing Gaussian mixture clustering on each data sample based on the cluster center of each initial class cluster and the Gaussian distribution corresponding to each data sample in each initial class cluster, to obtain a plurality of class clusters corresponding to the railway network data; and determining the data risk level of each class cluster based on the data importance level and the risk influence degree of each data sample in each class cluster. The present application automatically classifies the railway network data into different risk levels without relying on manual information labeling, thereby improving the effectiveness of risk level classification of the railway network data. By combining K-means clustering and Gaussian mixture clustering, the present application solves the classification problem of railway network data with mixed attributes and the randomness problem caused by random initialization of K-means clustering, makes up for the possible inaccuracy of the classification result under a single distance clustering method, and improves the accuracy of risk level classification of the railway network data. BRIEF DESCRIPTION OF DRAWINGS

[0041] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and serve to explain the principles of the present application together with the specification.

[0042] In order to more clearly illustrate the technical solutions of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings described below are some embodiments of the present application, and those skilled in the art can obtain other drawings according to these drawings without creative labor.

[0043] Figure 1 is one of the flow diagrams of the automatic railway network data risk level classification method provided by the present application;

[0044] Figure 2 is the second flow diagram of the automatic railway network data risk level classification method provided by the present application;

[0045] Figure 3 is the structural diagram of the automatic railway network data risk level classification device provided by the present application;

[0046] Figure 4 is the structural diagram of the electronic device provided by the present application. DETAILED DESCRIPTION

[0047] In order for those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be described clearly and completely below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor should be within the scope of protection of the present application.

[0048] It should be noted that the terms "first", "second", etc. in the present application are used to distinguish similar objects, and do not necessarily describe a specific order or sequence. It should be understood that the data used in this way can be interchanged under appropriate circumstances, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device that includes a series of steps or units or modules does not necessarily limit to those steps or units or modules clearly listed, but can include other steps or units or modules that are not clearly listed or inherent to these processes, methods, products or devices.

[0049] Figure 1 is one of the flow diagrams of the automatic railway network data risk level classification method provided by the present application, as Figure 1 shown, the method comprises steps 110, 120, 130 and 140.

[0050] Step 110, based on the data importance level, the stage of the data life cycle, the risk type and the risk impact degree of each data sample in the railway network data, determining the ordered attribute and the unordered attribute of each data sample.

[0051] Specifically, the automatic railway network data risk level classification method provided in the embodiments of the present application has an execution subject of an automatic railway network data risk level classification device. The device can be implemented by software, such as a data risk level classification program running in a computer or a server, or can be a device for executing the automatic railway network data risk level classification method, such as a mobile terminal, a tablet computer, a desktop computer, or a server.

[0052] Railway network data refers to various types of data generated by each information system in the railway network in different business scenarios during data communication. Each piece of data can be regarded as a data sample.

[0053] Data importance level refers to the importance of data to the railway network, for example, the data importance level can be divided into core data, important data, and general data according to the importance.

[0054] Data life cycle refers to the whole process from data collection to destruction, for example, it mainly includes six stages of data collection, data transmission, data storage, data sharing, data processing, and data destruction.

[0055] Risk type refers to potential risks that data may have, such as invalid data writing, data classification errors, data theft, data interception, and data tampering.

[0056] Risk impact degree refers to the impact of various potential risks on the system or asset once they occur during the different stages of the data life cycle, for example, the risk impact degree can be divided into multiple levels, each level is represented by a number, and the larger the number, the greater the risk impact degree.

[0057] The data importance level, the stage of the data life cycle, the risk type, and the risk impact degree can be stored in the risk information database as attributes of the data sample. These attributes can be used to classify the risk level of the data sample.

[0058] According to whether the attribute values of the attributes can be calculated, the attributes can be divided into ordered attributes and unordered attributes. The ordered attribute refers to the distance that can be directly calculated on the continuous attribute value, that is, the size of the attribute value directly affects the distance. The unordered attribute refers to the distance that cannot be directly calculated on the discrete attribute value, that is, the size of the unordered attribute value cannot reflect the distance.

[0059] Step 120, based on the ordered attributes and unordered attributes of each data sample, K-means clustering is performed on each data sample to obtain multiple initial class clusters.

[0060] Specifically, the Euclidean distance between the data samples can be calculated according to the attribute values of the ordered attributes, and the VDM (Value Difference Metric) distance between the data samples can be calculated according to the attribute values of the unordered attributes.

[0061] The K-means clustering is performed on each data sample according to the calculated distance, to obtain a plurality of initial class clusters and a cluster center of each initial class cluster. The cluster center is also referred to as a clustering center.

[0062] In step 130, Gaussian mixture clustering is performed on each data sample based on the cluster center of each initial class cluster and the Gaussian distribution corresponding to each data sample in each initial class cluster, to obtain a plurality of class clusters corresponding to the railway network data.

[0063] Specifically, the Gaussian mixture clustering (GMM) algorithm can overcome the K-means clustering algorithm and the like, which cannot cluster two class clusters with the same cluster center.

[0064] The Gaussian mixture clustering algorithm uses a probability model to express a clustering prototype. It is assumed that all data samples come from a plurality of Gaussian distributions with different parameters, and data samples from the same distribution are divided into the same class. The returned result is the probability that the data sample belongs to different class clusters, and the class cluster with the maximum probability is selected as the category of the data sample. The Gaussian mixture clustering algorithm can process multi-dimensional data, set different parameters for each Gaussian distribution, so that the model is more accurate. It can also process mixed distribution data. By using a plurality of Gaussian distributions to describe the mixed distribution data, the data can be better fitted, and the model has stronger expression ability. The Gaussian mixture clustering algorithm is better than the traditional K-means clustering algorithm and has wider applicability.

[0065] Therefore, the initial clustering center of the Gaussian mixture clustering can be determined according to the cluster center of each initial class cluster, the Gaussian distribution corresponding to each data sample is determined by using a maximum likelihood function, the Gaussian mixture clustering is performed on each data sample, and finally a plurality of class clusters are obtained.

[0066] In step 140, the data risk level of each class cluster is determined based on the data importance level and the risk influence degree of each data sample in each class cluster.

[0067] Specifically, the data importance level and the risk influence degree of all data samples in each class cluster can be quantitatively calculated to obtain the data risk level of each class cluster. Through the above method, the railway network data is divided into a plurality of class clusters, and each class cluster has a different data risk level.

[0068] The automatic railway network data risk level classification method provided by the embodiments of the present application performs K-means clustering on each data sample in the railway network data according to the ordered attributes and unordered attributes of each data sample, obtains a plurality of initial class clusters and cluster centers of each initial class cluster, performs Gaussian mixture clustering on each data sample according to the cluster centers of each initial class cluster and the Gaussian distribution corresponding to each data sample in each initial class cluster, and obtains a plurality of class clusters corresponding to the railway network data. The data risk level of each class cluster is determined according to the data importance level and risk influence degree of each data sample in each class cluster. The risk level classification of the railway network data is automatically realized without relying on manual information labeling, and the efficiency of the risk level classification of the railway network data is improved. Since the K-means clustering and the Gaussian mixture clustering are combined, the classification problem of the railway network data with mixed attributes and the randomness problem caused by the random initialization of the K-means clustering are solved, the inaccuracy of the classification result under the single distance clustering method is compensated, and the accuracy of the risk level classification of the railway network data is improved.

[0069] It should be noted that each embodiment of the present application can be freely combined, the order can be changed or each embodiment can be executed independently, and does not need to rely on or depend on a fixed execution order.

[0070] In some embodiments, step 120 comprises:

[0071] performing first K-means clustering on each data sample based on the Euclidean distance between each data sample, and determining the initial label of each data sample;

[0072] performing second K-means clustering on each data sample based on the Euclidean distance and the value difference metric distance between each data sample, obtaining a plurality of initial class clusters and the cluster center of each initial class cluster;

[0073] The Euclidean distance between each data sample is determined based on the ordered attributes of each data sample, and the value difference metric distance between each data sample is determined based on the unordered attributes and the initial label of each data sample.

[0074] Specifically, when calculating the value difference metric distance between each data sample, the label of each data sample needs to be used, and there is no available label for each data sample in the railway network data. Therefore, two K-means clusterings can be used, wherein the first K-means clustering is used to determine the initial label of each data sample, and the second K-means clustering is used to cluster according to the mixed distance (including the Euclidean distance determined according to the ordered attributes and the value difference metric distance determined according to the unordered attributes) to obtain the initial class cluster. The value of K in the K-means clustering can be determined according to the number of risk levels corresponding to the data sample.

[0075] The K-means clustering algorithm is a cyclic iteration solution clustering algorithm, and the steps are as follows: (1) determining N data samples, the number of class clusters is k, and randomly selecting k data points as initial clustering centers; (2) calculating the Euclidean distance of the remaining sample points to the initial clustering center, distributing the remaining sample points to the nearest clustering center to generate k class clusters; (3) calculating the mean of all sample points included in the k class clusters as the k center points of the next iteration; (4) repeating the above steps until convergence, that is, the center point does not change or reaches a specified number of iterations, and the final clustering result is obtained.

[0076] The Euclidean distance is the Euclidean metric, which refers to the real distance between two points in an m-dimensional space. Given a sample x i =(x i1 ,x i2 ,...,x in ) and x j =(x j1 ,x j2 ,...,x jn ), where i, j represent two different samples, each sample has n ordered attributes, u is the attribute number, x iu is the u-th attribute of x i , and x ju is the u-th attribute of x j .

[0077] The Euclidean distance dist ed between two samples is calculated as follows:

[0078]

[0079] The attribute values of the ordered attributes of each data sample can be substituted into the above formula to calculate the Euclidean distance between each data sample. The first K-means clustering of each data sample can obtain the class label of each data sample, which is used as the initial label of the data sample.

[0080] According to the unordered attributes of the data sample, the value difference metric distance (VDM distance) of the data sample can be calculated. The initial label of the data sample is used to calculate the VDM distance. The initial label is used to distinguish the corresponding sample cluster.

[0081] Let m u,a represent the number of samples with value a on attribute u, m u,a,i represent the number of samples with value a on attribute u in the i-th sample cluster, m u,b represent the number of samples with value b on attribute u, and m u,b,iwhere k is the number of sample clusters, and VDM2(a, b) is the VDM distance between two discrete values a and b on attribute u in the i-th sample cluster.

[0082]

[0083] The Euclidean distance and the value difference metric distance between each data sample can be combined to obtain a hybrid distance. According to the obtained hybrid distance, the second K-means clustering is performed on each data sample to obtain a plurality of initial class clusters and a cluster center of each initial class cluster.

[0084] The automatic railway network data risk level classification method provided by the embodiment of the application can perform twice K-means clustering on each data sample according to the ordered attributes and unordered attributes of each data sample to obtain a plurality of initial class clusters, which can effectively utilize various attribute information of the data sample and improve the accuracy of risk level classification of the railway network data.

[0085] In some embodiments, the second K-means clustering is performed on each data sample based on the Euclidean distance and the value difference metric distance between each data sample to obtain a plurality of initial class clusters and a cluster center of each initial class cluster, including:

[0086] Based on the Euclidean distance and the value difference metric distance between each data sample, a hybrid distance between each data sample is determined.

[0087] Based on the hybrid distance between each data sample, the second K-means clustering is performed on each data sample to obtain a plurality of initial class clusters and a cluster center of each initial class cluster.

[0088] Specifically, the Minkowski distance includes the Euclidean distance. The MinkovDM distance is a hybrid distance obtained by combining the Minkowski distance and the VDM distance, and is used for processing the hybrid attribute.

[0089] Suppose there are n attributes in total, where n c unordered attributes, n-n c ordered attributes, i and j represent two different samples, u is the serial number of the attribute, x iu is the u-th attribute of x i , x ju is the u-th attribute of x j , and the MinkovDM distance between the data samples x i and x j is represented by the formula:

[0090]

[0091] According to the mixed distance between each data sample, the second K-means clustering is performed on each data sample, and a plurality of initial class clusters are obtained. The center point of each obtained initial class cluster is recorded, and a sample point closest to the center point of each initial class cluster is taken as the cluster center of the class.

[0092] The automatic railway network data risk level classification method provided in the embodiments of the present application can effectively utilize various attribute information of the data samples and improve the accuracy of risk level classification of the railway network data.

[0093] In some embodiments, step 130 comprises:

[0094] Based on the cluster center of each initial class cluster and the Gaussian distribution corresponding to each data sample in each initial class cluster, a plurality of rounds of Gaussian mixture clustering are performed on each data sample, and a clustering result of each round and a closeness index and a spacing index of each round are determined.

[0095] Based on the clustering result corresponding to the round with the minimum ratio of the closeness index and the spacing index, a plurality of class clusters corresponding to the railway network data are determined.

[0096] Specifically, the Gaussian mixture distribution is a linear combination of a plurality of Gaussian distribution functions. Assuming that there is a random variable X, the Gaussian mixture distribution model can be expressed as:

[0097]

[0098] wherein N(x|μ k ,∑ k ) is the kth component in the model, μ k is the mean of the kth Gaussian distribution, ∑ k is the covariance matrix of the kth Gaussian distribution, and is a symmetric matrix. p(x) is a mixing coefficient, π k is the proportion of the kth Gaussian distribution in the entire Gaussian mixture distribution model, is a hidden variable, and has 0≤π k ≤1. P is the total number of Gaussian distributions in the model, and x is a specific value of the random variable X.

[0099] In the embodiments of the present application, the data sample can be represented as a multi-dimensional data X, and the probability density function (PDF) of the Gaussian distribution can be expressed as:

[0100]

[0101] where D is the dimension of data, P(x|θ) is the probability density function of data sample x, μ is the mean, ∑ is the covariance, T is the transpose operator, ∑ -1 is the inverse matrix of ∑, and θ is the influence parameter of data sample x.

[0102] When performing clustering on high-dimensional data using a Gaussian mixture clustering algorithm, an EM (Expectation-Maximum) algorithm is a core algorithm for maximum likelihood estimation of parameters of a probability model containing hidden variables. Each iteration of the EM algorithm consists of two steps: (1) an E step for determining the probability that a sample belongs to each Gaussian distribution, and taking the Gaussian distribution corresponding to the maximum probability as the class cluster to which the sample belongs; and (2) an M step for maximum likelihood estimation, in which the model parameters are cyclically updated until convergence.

[0103] However, when performing Gaussian mixture clustering on high-dimensional data, the EM algorithm has an inherent defect. During the process of iteratively optimizing the mean, covariance matrix, and weight matrix, the covariance matrix is not symmetric positive definite, and subsequent iterations cannot be performed.

[0104] Therefore, before performing Gaussian mixture clustering, the embodiments of the present application can perform dimensionality reduction processing on high-dimensional data using PCA (Principal Component Analysis) to generate low-dimensional data, such as two-dimensional data, and then cyclically iteratively optimize the data using the EM algorithm until convergence, and the clustering ends, that is, one clustering process is completed.

[0105] In order to obtain the best clustering result, multiple rounds of Gaussian mixture clustering are performed on each data sample based on the cluster center of each initial class cluster and the Gaussian distribution corresponding to each data sample in each initial class cluster, and the clustering result of each round and the compactness index and the interval index of each round are determined.

[0106] When performing Gaussian mixture clustering, the data sample closest to the cluster center of the initial class cluster can be taken as the initial clustering center point of the Gaussian mixture clustering.

[0107] The compactness index (Compactness) CP can be expressed as:

[0108]

[0109]

[0110] where x i represents the data sample point of the i-th cluster, w i represents the clustering center of the i-th cluster, Ω i represents the total number of data in the i-th cluster, K represents the number of class clusters after clustering, and i is the label of the class cluster. Separation Index (SI) represents the average of compactness index of the i-th cluster.

[0111] Separation Index (SI) can be represented as:

[0112]

[0113] where w i where w j where w

[0114] Compactness Index calculates the average distance of each point in a cluster to the cluster center, and the lower the value is, the closer the distance between points in the cluster is. However, the effect between clusters is not considered. Separation Index calculates the average distance between each cluster center, and the higher the value is, the farther the distance between clusters is. However, the effect within a cluster is not considered.

[0115] After all the clustering rounds are completed, the clustering result with the minimum ratio of Compactness Index and Separation Index is taken as the final clustering result, and a plurality of cluster groups corresponding to the railway network data are obtained, and each cluster group represents a different risk level.

[0116] The automatic railway network data risk level classification method provided in the embodiments of the present application obtains a plurality of cluster groups corresponding to the railway network data through a plurality of rounds of Gaussian mixture clustering, solves the randomness problem caused by random initialization of K-means clustering, makes up for the possible inaccuracy of the classification result under a single distance clustering method, and improves the accuracy of risk level classification of the railway network data.

[0117] In some embodiments, step 140 comprises:

[0118] determining a weight balance coefficient;

[0119] based on the weight balance coefficient, determining a first influence weight of the data importance level and a second influence weight of the risk influence degree;

[0120] based on the data importance level, the risk influence degree, the first influence weight and the second influence weight of each data sample, determining a risk score of each data sample;

[0121] based on the risk score of each data sample in each cluster group and the number of data samples in each cluster group, determining a risk score of each cluster group;

[0122] based on the risk score of each cluster group, determining a data risk level of each cluster group.

[0123] Specifically, after Gaussian mixture clustering, a plurality of class clusters corresponding to the railway network data can be obtained, and each class cluster represents a different risk level. Further, according to the ordered attributes of each data sample in each class cluster, the data risk level of each class cluster can be determined.

[0124] The ordered attributes at least include a data importance level and a risk impact degree. A first impact weight can be set to measure the impact degree of the data importance level on the data risk level, and a second impact weight can be set to measure the impact degree of the risk impact degree on the data risk level.

[0125] A weight balance coefficient a can be set to balance the impact degrees of the data importance level and the risk impact degree on the data risk level. Since the high or low of the data importance level is also an important factor affecting the potential risk harm degree of the data, a is usually set to be greater than or equal to 0.5.

[0126] In each class cluster, an intra-cluster risk score can be calculated to obtain the data risk level of each class cluster.

[0127] For any class cluster, assuming that each data sample faces m data risks, according to the weight balance coefficient, the first impact weight is a and the second impact weight is 1-a, the risk score calculation method of each data sample is as follows:

[0128] Risk score of data sample = data importance level × a + risk impact degree × (1-a)

[0129]

[0130] Assuming that there are n data samples in the class cluster, the risk score of the class cluster can be:

[0131]

[0132] Since the number of samples contained in each class cluster after clustering is usually not equal, in the above calculation method, the mean value of the risk scores of the data samples can be taken as the risk score of the class cluster. The higher the risk score of the class cluster is, the greater the risk of the class is, and the higher the corresponding risk level is.

[0133] The automatic railway network data risk level classification method provided by the embodiments of the present application determines the data risk level of each class cluster through the data importance level and the risk impact degree of each data sample in each class cluster, and improves the accuracy of the risk level classification of the railway network data.

[0134] In some embodiments, step 110 comprises:

[0135] The data importance level, the data life cycle stage, the risk type, and the risk impact degree of each data sample are determined.

[0136] determining a data importance level and a risk impact degree of each data sample as an ordered attribute of each data sample;

[0137] determining a stage of a data life cycle of each data sample as an unordered attribute of each data sample.

[0138] Specifically, railway network data can be obtained from each information system in the railway network. The data is preprocessed, and key information of each piece of data is extracted from the data perspective and the risk perspective.

[0139] From the data perspective, the key information of different levels of data is extracted based on the classification and grading requirements of the railway network data, including the data importance level and the different stages of the data in the whole life cycle, to form data information. The data importance level can be divided into 6 levels, represented by numbers 0 to 5, and the lower the number, the lower the data importance level, as shown in Table 1:

[0140] Table 1 Data Importance Level Table

[0141]

[0142] From the risk perspective, the existing data risks are analyzed according to the railway network data risk assessment index system, the risk types and risk impact degrees faced by the data in different stages of the life cycle are obtained, and unified risk information is formed.

[0143] The data life cycle mainly includes six stages of data collection, data transmission, data storage, data sharing, data processing and data destruction, and the risk types faced by each stage are shown in Tables 2 and 3.

[0144] Table 2 Stage of Data Life Cycle and Corresponding Risk Type Table 1

[0145]

[0146]

[0147] Table 3 Stage of Data Life Cycle and Corresponding Risk Type Table 2

[0148]

[0149] The risk impact degree can be 5 levels, and the larger the number, the higher the impact degree and the more serious the harm. In addition, 0 represents that there is no such risk in the current stage, as shown in Table 4.

[0150] Table 4 Risk Impact Degree Table

[0151]

[0152]

[0153] Each data sample may be in more than one life cycle stage, and a data sample may span multiple stages, and the potential security risks of each life cycle stage may overlap, so when the risks overlap, it means that the current data may face the same risk from different life cycle stages, and the impact degree of the risk should be doubled in a data.

[0154] According to the risk information and data information extracted from the railway network data, a risk information database is constructed, and a series of evaluation attributes that can assist in risk level classification are determined in combination with the risk information and the data information. The following attributes are extracted in the embodiments of the application, including data importance level, data life cycle stage, risk type and risk impact degree. Among them, the data level and the risk impact degree of each data sample are ordered attributes, and the data life cycle stage is an unordered attribute, which is represented by 0 indicating that the current data does not belong to the stage, and 1 indicating that the current data is in the stage.

[0155] The automatic railway network data risk level classification method provided by the embodiments of the application improves the accuracy of railway network data risk level classification by preprocessing the data to obtain ordered attributes and unordered attributes of the data samples.

[0156] In some embodiments, the method further comprises:

[0157] Based on at least one of the silhouette coefficient, the CH score and the Davies-Bouldin index, a clustering evaluation result of the multiple class clusters corresponding to the railway network data is determined.

[0158] Specifically, after completing the Gaussian mixture clustering of each data sample to obtain the multiple class clusters corresponding to the railway network data, the clustering result can be evaluated based on the principle of high aggregation within the class and low coupling between the classes. The silhouette coefficient, the CH (Calinski Harabasz) score and the Davies-Bouldin index (DBI) can be used for clustering effect evaluation.

[0159] The silhouette coefficient is suitable for the case where the actual class information is unknown. For a single data sample in each class cluster, let a be the average distance from it to other data samples in the same class, and b be the average distance from it to the sample in the nearest different class, and the silhouette coefficient s of the data sample is:

[0160]

[0161] For a cluster, its silhouette coefficient is the average of all sample silhouette coefficients, ranging from [-1, 1], the closer the distance between samples of the same class and the farther the distance between samples of different classes, the higher the silhouette coefficient, and the better the clustering effect.

[0162] The CH score measures the tightness of the class by calculating the sum of the squared distances of each point in the class to the class center, and measures the separation degree of the data set by calculating the sum of the squared distances of each class center point to the data set center point. The CH index is obtained by the ratio of the separation degree to the tightness. The value range is [0, +∞), and the larger the CH score represents that the class itself is more compact, and the classes are more dispersed, that is, a better clustering result.

[0163] The Davies-Bouldin index (DBI), also known as the classification accuracy index, selects any two classes, calculates the average Euclidean distance of all samples in each class to its class center, sums the average distances of the two classes, and then divides by the distance between the cluster centers of the two classes to obtain the maximum value. The value range is [0, +∞), and the smaller the index means that the intra-class distance is smaller, and the inter-class distance is larger, and the clustering effect is better, and the calculation formula is as follows:

[0164]

[0165] wherein, is the average Euclidean distance of the i-th cluster sample to its cluster center, is the average Euclidean distance of the j-th cluster sample to its cluster center, and i -w j is the Euclidean distance between the i-th cluster and the j-th cluster, N is the number of clusters, and i is the cluster center of the i-th cluster, j is the cluster center of the j-th cluster.

[0166] The automatic railway network data risk level classification method provided by the embodiments of the present application improves the accuracy of risk level classification of railway network data by evaluating the clustering results of multiple clusters through silhouette coefficients, CH scores and Davies-Bouldin indexes.

[0167] Figure 2 is a second process schematic diagram of the automatic railway network data risk level classification method provided by the present application, as Figure 2 indicated, the automatic railway network data risk level classification method comprises:

[0168] Step 210, acquiring railway network data, pre-processing the data, and determining the ordered attributes and unordered attributes of the data samples;

[0169] Step 220, performing K-means clustering according to the ordered attributes of the data samples to obtain the initial labels of each data sample;

[0170] Step 230, K-means clustering is performed according to the ordered attributes and unordered attributes of the data samples, to obtain initial class clusters;

[0171] Step 240, Gaussian mixture clustering is performed on the data samples, to obtain a clustering result;

[0172] Step 250, the clustering result is evaluated to determine whether the current clustering result is available;

[0173] Step 260, intra-cluster risk score calculation is performed on each class cluster in the current clustering result, to obtain a final risk level classification result.

[0174] The automatic railway network data risk level classification method provided by the embodiments of the present application has the following characteristics:

[0175] 1) According to the characteristics of railway data, the data is processed, and the data risk attributes and data level attributes are extracted from the risk and data angles, so as to perform risk level division subsequently;

[0176] 2) The K-means clustering algorithm used in the existing risk level classification scheme is improved. The existing algorithm does not consider the ordered and unordered problems of attributes. The ordered and unordered attributes are comprehensively considered by using different distance calculation methods in the algorithm to obtain the initial clustering center;

[0177] 3) The clustering center obtained according to the above method is used to take the nearest sample point as the initial clustering center of Gaussian mixture, and multiple rounds of clustering are set to obtain the best clustering result;

[0178] 4) According to the designed risk score calculation formula, the risk score value of each class cluster data is obtained, and the risk level is divided according to the score size, to complete the risk level classification of railway network data.

[0179] The device provided by the embodiments of the present application is described below. The device described below can be correspondingly referred to the method described above.

[0180] Figure 3 is a structural schematic diagram of the automatic railway network data risk level classification device provided by the present application, as Figure 3 shown, the device comprises:

[0181] The data acquisition unit 310 is configured to determine the ordered attributes and unordered attributes of each data sample based on the data importance level, data life cycle, risk type and risk impact degree of each data sample in the railway network data;

[0182] The first clustering unit 320 is configured to perform K-means clustering on each data sample based on the ordered attributes and unordered attributes of each data sample, to obtain a plurality of initial class clusters;

[0183] The second clustering unit 330 is configured to perform Gaussian mixture clustering on each data sample based on the cluster center of each initial class cluster and the Gaussian distribution corresponding to each data sample in each initial class cluster, to obtain a plurality of class clusters corresponding to the railway network data.

[0184] The risk determination unit 340 is configured to determine a data risk level of each class cluster based on the data importance level and the risk influence degree of each data sample in each class cluster.

[0185] The automatic railway network data risk level classification device provided by the embodiments of the present application automatically realizes the risk level classification of the railway network data without relying on manual information labeling, and improves the efficiency of the risk level classification of the railway network data. Since the K-means clustering and the Gaussian mixture clustering are combined, the classification problem of the railway network data with mixed attributes and the randomness problem caused by the random initialization of the K-means clustering are solved, the possible inaccuracy of the classification result under the single distance clustering method is compensated, and the accuracy of the risk level classification of the railway network data is improved.

[0186] In some embodiments, the first clustering unit is specifically configured to:

[0187] perform first K-means clustering on each data sample based on the Euclidean distance between each data sample, to determine an initial label of each data sample;

[0188] perform second K-means clustering on each data sample based on the Euclidean distance and the value difference measurement distance between each data sample, to obtain a plurality of initial class clusters and a cluster center of each initial class cluster;

[0189] The Euclidean distance between each data sample is determined based on the ordered attribute of each data sample; and the value difference measurement distance between each data sample is determined based on the unordered attribute and the initial label of each data sample.

[0190] In some embodiments, the first clustering unit is specifically configured to:

[0191] determine a mixed distance between each data sample based on the Euclidean distance and the value difference measurement distance between each data sample;

[0192] perform second K-means clustering on each data sample based on the mixed distance between each data sample, to obtain a plurality of initial class clusters and a cluster center of each initial class cluster.

[0193] In some embodiments, the second clustering unit is specifically configured to:

[0194] perform multiple rounds of Gaussian mixture clustering on each data sample based on the cluster center of each initial class cluster and the Gaussian distribution corresponding to each data sample in each initial class cluster, to determine a clustering result of each round and a closeness index and a separation index of each round;

[0195] determine the multiple class clusters corresponding to the railway network data based on the clustering result corresponding to the round with the minimum ratio of the closeness index and the separation index.

[0196] In some embodiments, the risk determination unit is specifically configured to:

[0197] determine a weight balance coefficient;

[0198] determine a first impact weight of the data importance level and a second impact weight of the risk impact degree based on the weight balance coefficient;

[0199] determine a risk score of each data sample based on the data importance level, the risk impact degree, the first impact weight and the second impact weight of each data sample;

[0200] determine a risk score of each class cluster based on the risk score of each data sample in each class cluster and the number of data samples in each class cluster;

[0201] determine a data risk level of each class cluster based on the risk score of each class cluster.

[0202] In some embodiments, the data acquisition unit is specifically configured to:

[0203] determine the data importance level, the data life cycle stage, the risk type and the risk impact degree of each data sample;

[0204] determine the data importance level and the risk impact degree of each data sample as the ordered attribute of each data sample;

[0205] determine the data life cycle stage of each data sample as the unordered attribute of each data sample.

[0206] In some embodiments, the apparatus further comprises:

[0207] an evaluation unit configured to determine a clustering evaluation result of the multiple class clusters corresponding to the railway network data based on at least one of the silhouette coefficient, the CH score and the Davies-Bouldin index.

[0208] Figure 4 is a structural schematic diagram of an electronic device provided by the present application, such as Figure 4As shown, the electronic device can include a processor 410, a communications interface 420, a memory 430, and a communications bus 440, wherein the processor 410, the communications interface 420, and the memory 430 complete mutual communication through the communications bus 440. The processor 410 can invoke a logical command in the memory 430 to execute the method described in the above embodiments, for example:

[0209] Based on the data importance level, the data life cycle stage, the risk type, and the risk impact degree of each data sample in the railway network data, the ordered attribute and the unordered attribute of each data sample are determined; based on the ordered attribute and the unordered attribute of each data sample, K-means clustering is performed on each data sample to obtain a plurality of initial class clusters; based on the cluster center of each initial class cluster and the Gaussian distribution corresponding to each data sample in each initial class cluster, Gaussian mixture clustering is performed on each data sample to obtain a plurality of class clusters corresponding to the railway network data; and based on the data importance level and the risk impact degree of each data sample in each class cluster, the data risk level of each class cluster is determined.

[0210] In addition, the logical command in the memory described above can be implemented in the form of a software function unit and sold or used as an independent product, which can be stored in a computer-readable storage medium. Based on such understanding, the technical solutions of the present application essentially or the part that contributes to the prior art or part of the technical solutions can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a plurality of commands to make a computer device (which can be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk, and various media that can store program codes.

[0211] The processor in the electronic device provided by the embodiments of the present application can invoke the logical instructions in the memory to implement the above method, and the specific implementation manners are consistent with the foregoing method implementation manners, and the same beneficial effects can be achieved, which will not be described here.

[0212] The embodiments of the present application also provide a computer-readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the method provided by each of the above embodiments.

[0213] The specific implementation is consistent with the foregoing method implementation, and the same beneficial effects can be achieved, which will not be repeated here.

[0214] The embodiment of the application provides a computer program product, comprising a computer program, and the computer program is executed by a processor to realize the method.

[0215] The device embodiments described above are only schematic, wherein the units described as separated components can or can not be physically separated, and the components displayed as units can or can not be physical units, that is, they can be located in one place, or distributed on multiple network units. Part or all of the modules can be selected according to actual needs to achieve the purpose of the embodiment scheme. Those skilled in the art can understand and implement without creative labor.

[0216] Through the description of the foregoing embodiments, those skilled in the art can clearly understand that each embodiment can be realized by means of software and the necessary general hardware platform, and of course, can also be realized by hardware. Based on such understanding, the foregoing technical solutions can be embodied in the form of a software product in essence or in the form of a contribution to the prior art. The computer software product can be stored in a computer readable storage medium, such as a ROM / RAM, a magnetic disk, an optical disk, and the like, and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0217] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the application, and not to limit them; although the application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that: it can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacement for some technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the application.

Claims

1. An automated railway network data risk level classification method, characterized by, The method comprises the steps of: determining ordered attributes and unordered attributes of each data sample based on data importance levels, data life cycle stages, risk types and risk impact degrees of each data sample in the railway network data; performing K-means clustering on each data sample based on the ordered attributes and the unordered attributes of each data sample to obtain a plurality of initial class clusters; performing Gaussian mixture clustering on each data sample based on cluster centers of each initial class cluster and Gaussian distributions corresponding to each data sample in each initial class cluster to obtain a plurality of class clusters corresponding to the railway network data; determining a data risk level of each class cluster based on data importance levels and risk impact degrees of each data sample in each class cluster. The method of performing K-means clustering on each data sample based on the ordered attributes and the unordered attributes of each data sample to obtain a plurality of initial class clusters comprises the steps of: performing first K-means clustering on each data sample based on Euclidean distances between each data sample to determine initial labels of each data sample; performing second K-means clustering on each data sample based on the Euclidean distances and value difference metric distances between each data sample to obtain a plurality of initial class clusters and cluster centers of each initial class cluster; wherein the Euclidean distances between each data sample are determined based on the ordered attributes of each data sample, and the value difference metric distances between each data sample are determined based on the unordered attributes and the initial labels of each data sample.

2. The automated railway network data risk level classification method of claim 1, wherein, The method of performing second K-means clustering on each data sample based on the Euclidean distances and the value difference metric distances between each data sample to obtain a plurality of initial class clusters and cluster centers of each initial class cluster comprises the steps of: determining hybrid distances between each data sample based on the Euclidean distances and the value difference metric distances between each data sample; performing second K-means clustering on each data sample based on the hybrid distances between each data sample to obtain a plurality of initial class clusters and cluster centers of each initial class cluster.

3. The automated railroad network data risk level classification method of claim 1, wherein, The method of performing Gaussian mixture clustering on each data sample based on the cluster centers of each initial class cluster and Gaussian distributions corresponding to each data sample in each initial class cluster to obtain a plurality of class clusters corresponding to the railway network data comprises the steps of: performing a plurality of rounds of Gaussian mixture clustering on each data sample based on the cluster centers of each initial class cluster and the Gaussian distributions corresponding to each data sample in each initial class cluster to determine clustering results of each round and tightness indicators and interval indicators of each round; determining the plurality of class clusters corresponding to the railway network data based on clustering results corresponding to a round in which a ratio of the tightness indicator to the interval indicator is minimum.

4. The automated railroad network data risk level classification method of claim 1, wherein, The method of determining a data risk level of each class cluster based on data importance levels and risk impact degrees of each data sample in each class cluster comprises the steps of: determining a weight balance coefficient; determining a first impact weight of the data importance level and a second impact weight of the risk impact degree based on the weight balance coefficient; determining a risk score of each data sample based on the data importance level, the risk impact degree, the first impact weight and the second impact weight of each data sample. determine a risk score of each class cluster based on the risk scores of the data samples in the class cluster and a number of data samples in the class cluster; determine a data risk level of each class cluster based on the risk score of the class cluster.

5. The automated railroad network data risk level classification method of claim 1, wherein, The determining of the ordered attribute and the unordered attribute of each data sample based on the data importance level, the data lifecycle stage, the risk type and the risk impact degree of each data sample in the railway network data comprises: determining the data importance level, the data lifecycle stage, the risk type and the risk impact degree of each data sample; determining the data importance level and the risk impact degree of each data sample as the ordered attribute of each data sample; determining the data lifecycle stage of each data sample as the unordered attribute of each data sample.

6. The method of automatic railway network data risk level classification according to any one of claims 1 to 5, characterized in that, The method further comprises: determining a clustering evaluation result of the multiple class clusters corresponding to the railway network data based on at least one of the silhouette coefficient, the CH score and the Davies-Bouldin index.

7. An automated railway network data risk level classification apparatus, characterized by, comprise: a data acquisition unit configured to determine the ordered attribute and the unordered attribute of each data sample based on the data importance level, the data lifecycle stage, the risk type and the risk impact degree of each data sample in the railway network data; a first clustering unit configured to perform K-means clustering on each data sample based on the ordered attribute and the unordered attribute of each data sample to obtain multiple initial class clusters; a second clustering unit configured to perform Gaussian mixture clustering on each data sample based on the cluster center of each initial class cluster and the Gaussian distribution corresponding to each data sample in each initial class cluster to obtain the multiple class clusters corresponding to the railway network data; a risk determination unit configured to determine a data risk level of each class cluster based on the data importance level and the risk impact degree of each data sample in the class cluster; The performing of the K-means clustering on each data sample based on the ordered attribute and the unordered attribute of each data sample to obtain the multiple initial class clusters comprises: performing first K-means clustering on each data sample based on the Euclidean distance between each data sample to determine an initial label of each data sample; performing second K-means clustering on each data sample based on the Euclidean distance between each data sample and the value difference metric distance to obtain the multiple initial class clusters and the cluster center of each initial class cluster; wherein the Euclidean distance between each data sample is determined based on the ordered attribute of each data sample; and the value difference metric distance between each data sample is determined based on the unordered attribute and the initial label of each data sample.

8. An electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The processor implements the automatic railway network data risk level classification method according to any one of claims 1 to 6 when executing the program. 9.A non-transitory computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program implements the automatic railway network data risk level classification method according to any one of claims 1 to 6 when executed by the processor.

Images