A real-time monitoring system for risk management based on cloud computing

Abstract

The present invention discloses a cloud computing-based risk management real-time monitoring system, which relates to the technical field of data risk assessment and effectively improves the timeliness of risk assessment. The present invention sets up a data detection area, and then transfers the uploaded data of each user terminal through the data detection area. The corresponding user-side rules are established based on the uploaded data, and all user-side rules are matched to establish public-side rules. The user-side rules and public-side rules are installed in the data detection area, and then the uploaded data of the corresponding user terminal is respectively subjected to a first risk assessment and a second risk assessment, and the real-time user data set is filtered according to the results of the two risk assessments.

Description

Technical Field

[0001] The present invention relates to the technical field of data risk assessment, and in particular to a cloud computing-based risk management real-time monitoring system. Background Art

[0002] Data risk assessment is the process of systematically evaluating and analyzing the various potential threats and risks to an organization's or individual's data assets. Data risk assessment identifies and quantifies the likelihood and impact of threats to data assets, allowing appropriate security measures to be implemented to protect the confidentiality, integrity, and availability of data.

[0003] Existing data risk assessment technologies have the following flaws:

[0004] Threat modeling and scenario analysis: Using threat intelligence and models, model and analyze possible threats to assess the various potential threats facing data. Data risk assessments require timely updates and follow-up, but the constant generation and change of large amounts of data may make assessment results outdated.

[0005] Data classification and labeling technology: Classify and label data to assess the risks it faces based on its sensitivity and importance, so that appropriate protection measures can be taken. However, this method has significant limitations and is limited in scope of application in actual use. Summary of the Invention

[0006] In view of the shortcomings of the existing technology, the purpose of the present invention is to provide a cloud computing-based risk management real-time monitoring system to solve the problem of inaccurate data security detection caused by insufficient timeliness of risk assessment results and limited scope of application.

[0007] In order to achieve the above object, the present invention provides the following technical solutions:

[0008] A cloud computing-based risk management real-time monitoring system includes a cloud computing platform, wherein the cloud computing platform is communicatively connected to a data transfer module, a risk rule establishment module, and a data risk assessment model;

[0009] The data transfer module is used to establish a data transmission channel between the cloud computing platform and each user terminal, set a data detection area, perform risk detection on the uploaded data of each user terminal through the data detection area, and send the uploaded data to the risk rule establishment module and the data risk assessment module;

[0010] The risk rule establishment module is used to establish corresponding user-side rules according to the uploaded data, and to match all user-side rules with each other to establish public-side rules, and then send the user-side rules and public-side rules to the data risk assessment module;

[0011] The data risk assessment module is used to install user-side rules and public-side rules in the data detection area, and then perform a first risk assessment and a second risk assessment on the uploaded data of the corresponding user end in sequence, and filter the real-time user data set according to the results of the two risk assessments.

[0012] Furthermore, the process of setting up a data transmission channel for the user terminal includes:

[0013] Each client communicates with the cloud computing platform, and the cloud computing platform assigns a number to each client based on the IP address used by the client for communication. The data transfer module then sends a data transmission channel establishment request based on the IP address and number of each client.

[0014] Each client establishes a data transmission channel with the cloud computing platform based on the data transmission channel establishment request. The cloud computing platform marks each data transmission channel with a corresponding number. At the same time, the client periodically sends data upload requests to the cloud computing platform through the data transmission channel.

[0015] When the user sends a data upload request, the uploaded data generated between the last data upload request and the latest data upload request is sent to the data transmission channel;

[0016] The data transmission channel between the cloud computing platform and each user terminal can only carry out single-direction data transmission at any time point, and the data transmission direction is controlled in real time by the cloud computing platform;

[0017] When the cloud computing platform receives a data upload request, the data transfer module in the cloud computing platform will modify the data transmission direction of the corresponding data transmission channel in real time;

[0018] A data detection area is provided between the data transfer module and each data transmission channel.

[0019] Furthermore, the process of the user end sending the uploaded data to the data transfer module through the data transmission channel includes:

[0020] The data transfer module divides the data transmission channel into the same number of sub-data transmission channels according to the number of data types of the uploaded data;

[0021] When the user terminal sends the uploaded data to the data transmission channel, the data transmission channel traverses the uploaded data, and classifies the data type of the uploaded data according to the traversal result, and distributes the data type classification result to the corresponding sub-data transmission channel;

[0022] When the data transfer module receives the uploaded data sent by the data transmission channel, it sets the corresponding user terminal number for the uploaded data and sends it to the data detection area.

[0023] Furthermore, the process of the data detection area performing risk detection on the uploaded data includes:

[0024] The data detection area pre-acquires Num pieces of known dangerous data fragments through the Internet, extracts corresponding feature words and feature fragments from each known dangerous data fragment, and generates corresponding known dangerous data identification pointers based on the feature words and feature fragments, where Num is a natural number greater than 0;

[0025] The uploaded data is traversed and matched through the known dangerous data identification pointers. If a data segment in the uploaded data matches any known dangerous data identification pointer, the corresponding data segment is removed. Otherwise, no action is taken.

[0026] Then the data transfer module determines whether there is a user-side rule in the current data detection area. If there is no user-side rule in the data detection area, the data transfer module generates a data transfer instruction and sends it to the data detection area.

[0027] When the data detection area receives the data transfer instruction, it generates a data transfer sub-area according to the size of the current uploaded data, and sets a data access pointer outside the data transfer sub-area. The data access pointer records a string of randomly generated identification codes.

[0028] Furthermore, the process of generating the user-side rules includes:

[0029] The corresponding data receiving pointer is generated according to the identification code. The data detection area stores the uploaded data in the data transfer sub-area and outputs the data transfer sub-area. Then, the risk rule establishment module matches the data receiving pointer on the data transfer sub-area according to the data receiving pointer.

[0030] The risk rule establishment module aggregates the uploaded data of the same user terminal at different time nodes and sets a number for each uploaded data in chronological order;

[0031] Set a number of preference extraction pointers, and extract the preference data and corresponding data formats of the user terminal from each uploaded data through the preference extraction pointers;

[0032] Then, the corresponding user-side rules are generated according to each preference data and the corresponding data format. At the same time, a weight parameter θ is set for each user-side rule according to the occurrence frequency of each preference data and the generation time of its corresponding uploaded data. The calculation formula of the weight parameter θ is: ,

[0033] in 、 as well as They represent the weight parameter θ, occurrence frequency, and time correction parameter of the mth preference data, respectively, where M and m are natural numbers greater than 0, M represents the total number of preference data types, and m is less than or equal to M.

[0034] Furthermore, the process of generating public-side rules according to the user-side rules includes:

[0035] Set a weight parameter threshold and an occurrence threshold, and compare the weight parameter θ of each user-side rule with the weight parameter threshold. Mark the user-side rule whose weight parameter θ is greater than or equal to the weight parameter threshold; otherwise, do nothing.

[0036] Match the marked user-side rules in different user terminals with each other, count the number of occurrences of each user-side rule, and then select the marked user-side rules with a number of occurrences greater than or equal to the occurrence threshold as the public-side rules, otherwise do nothing;

[0037] The data transfer module migrates the data detection area to the data risk assessment module, and then the data risk assessment module installs the public side rules and user side rules to the data detection area.

[0038] Furthermore, the first risk assessment process includes:

[0039] When the data detection area determines that there is a user-side rule corresponding to the user terminal, the data detection area calls the corresponding user-side rule to perform a first risk assessment on the uploaded data. If the data fragment in the uploaded data is consistent with the preference data and data type in the user-side rule, the uploaded data is assigned a safety value according to the weight parameter θ of the corresponding user-side rule;

[0040] When the data detection area completes the first risk assessment of the uploaded data, a first safety numerical threshold A and a second safety numerical threshold B are set, where B is greater than A. Based on the relationship between the safety value of the uploaded data and the first safety numerical threshold A and the second safety numerical threshold B, the uploaded data is marked as abnormal data, sub-safe data or safe data.

[0041] Furthermore, the second risk assessment process includes:

[0042] After the first risk assessment is completed, the data risk assessment module performs a second risk assessment on the uploaded data that is judged to be less secure data using public side rules;

[0043] The uploaded data judged as sub-safe data by the public side rules is traversed. If there is a data segment that is inconsistent with the preferred data or its data type in the public side rules, the data risk assessment module will delete the corresponding data segment through the data detection area. Otherwise, no action will be taken;

[0044] When the second risk assessment is completed, the secondary safe data will be marked as safe data, and then the data detection area will generate a data detection sub-area to send the uploaded data marked as safe data to the data risk assessment model for storage. When the risk assessment of the real-time uploaded data is completed, the data risk assessment module will migrate the data detection area to the data transfer module.

[0045] Compared with the prior art, the present invention has the following beneficial effects:

[0046] 1. The present invention sets up a data detection zone to transfer the uploaded data of each user terminal through the data detection zone, and there is no direct data interaction between the data detection zone and the cloud computing platform, which effectively improves the security of data and operating environment in the cloud computing platform;

[0047] 2. The present invention establishes user-side rules based on the uploaded data of the user end, and matches all the user-side rules to establish public-side rules. The user-side rules and public-side rules are installed in the data detection area, and then the first risk assessment and the second risk assessment are performed on the uploaded data of the corresponding user end respectively, which increases the scope of application of data risk assessment to a certain extent. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, a brief introduction will be given below to the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments recorded in the present invention.

[0049] Figure 1 This is a schematic diagram of the present invention. DETAILED DESCRIPTION

[0050] To make the objectives, technical solutions, and advantages of the present invention more apparent, the technical solutions of the present invention will be described in detail below. Obviously, the embodiments described are only some of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other implementations obtained by those of ordinary skill in the art without inventive effort are within the scope of protection of the present invention.

[0051] like Figure 1 As shown, a cloud computing-based risk management real-time monitoring system includes a cloud computing platform, wherein the cloud computing platform is communicatively connected to a data transfer module, a risk rule establishment module, and a data risk assessment model;

[0052] The data transfer module is used to establish a data transmission channel between the cloud computing platform and each user terminal, set a data detection area, perform risk detection on the uploaded data of each user terminal through the data detection area, and send the uploaded data to the risk rule establishment module and the data risk assessment module;

[0053] The risk rule establishment module is used to establish corresponding user-side rules according to the uploaded data, and to match all user-side rules with each other to establish public-side rules, and then send the user-side rules and public-side rules to the data risk assessment module;

[0054] The data risk assessment module is used to install user-side rules and public-side rules in the data detection area, and then perform a first risk assessment and a second risk assessment on the uploaded data of the corresponding user end, and filter the real-time user data set according to the results of the two risk assessments;

[0055] The user terminal is used to send data transmission requests and data acquisition requests to the cloud computing platform, and then send data to the cloud computing platform or acquire required data from the cloud computing platform.

[0056] Further, the working principle of the present invention is described by way of examples:

[0057] Each client communicates with the cloud computing platform, and the cloud computing platform assigns a number to each client based on the IP address used by the client for communication. The number may be s1, s2, s3, ..., sn, where n is a natural number greater than 3.

[0058] The cloud computing platform sends the IP address and number of each user terminal to the data transfer module, and then the data transfer module sends a data transmission channel establishment request to each user terminal based on the IP address and number of each user terminal;

[0059] Each client establishes a data transmission channel with the cloud computing platform based on the data transmission channel establishment request. The cloud computing platform marks each data transmission channel with a corresponding number. At the same time, the client periodically sends data upload requests to the cloud computing platform through the data transmission channel.

[0060] When the user terminal sends a data upload request, the uploaded data generated between the last data upload request and the latest data upload request is sent to the data transmission channel. The uploaded data can be audio data, text data, image data, etc.

[0061] It should be noted that the data transmission channel between the cloud computing platform and each user terminal can only carry out single-direction data transmission at any time point, and the data transmission direction is controlled in real time by the cloud computing platform;

[0062] When the cloud computing platform receives a data upload request, the data transfer module in the cloud computing platform will modify the data transmission direction of the corresponding data transmission channel in real time;

[0063] A data detection area is set between the data transfer module in the cloud computing platform and each data transmission channel. The data detection area cannot directly interact with any module in the cloud computing platform.

[0064] The data transfer module divides the data transmission channel into the same number of sub-data transmission channels according to the number of data types interacting with the user end;

[0065] When the user terminal sends the uploaded data to the data transmission channel, the data transmission channel traverses the uploaded data, and classifies the data type of the uploaded data according to the traversal result, and distributes the data type classification result to the corresponding sub-data transmission channel;

[0066] When the data transfer module receives the uploaded data sent by the data transmission channel, it sets the corresponding user terminal number for the uploaded data and sends it to the data detection area.

[0067] Furthermore, the data detection area pre-acquires Num pieces of known dangerous data fragments through the Internet, extracts corresponding feature words and feature fragments from each known dangerous data fragment, and generates corresponding known dangerous data identification pointers based on the feature words and feature fragments, where Num is a natural number greater than 0;

[0068] The data detection area traverses and matches the uploaded data with the known dangerous data identification pointers. If there is a data segment in the uploaded data that matches any known dangerous data identification pointer, the corresponding data segment is removed. Otherwise, no action is taken.

[0069] Then the data transfer module determines whether there is a user-side rule in the current data detection area. If there is no user-side rule in the data detection area, the data transfer module generates a data transfer instruction and sends it to the data detection area;

[0070] When the data detection area receives the data transfer instruction, it generates a data transfer sub-area according to the size of the current uploaded data, and sets a data access pointer outside the data transfer sub-area. The data access pointer records a string of randomly generated identification codes.

[0071] Furthermore, the data transfer module sends the identification code on the data transfer sub-area to the risk rule establishment module, and the risk rule establishment module generates a corresponding data receiving pointer according to the identification code;

[0072] The data detection area stores the uploaded data in the data transfer sub-area and outputs the data transfer sub-area. Then, the risk rule establishment module matches the data receiving pointer on the data transfer sub-area according to the data receiving pointer;

[0073] The risk rule establishment module aggregates the uploaded data of the same user terminal at different time nodes, and sets numbers ai,1, ai,2, ..., ai,j for each uploaded data in chronological order, where i,j are natural numbers greater than 0, and i is less than or equal to n;

[0074] The risk rule establishment module sets a number of preference extraction pointers and traverses each uploaded data with the preference extraction pointers, thereby extracting the user's preference data and corresponding data format from each uploaded data;

[0075] It should be noted that the preference data may be a characteristic noun, a characteristic data segment, etc., and the data format may be the character length of the characteristic noun or the style of the characteristic data segment, such as a picture or audio;

[0076] Then, the corresponding user-side rules are generated according to each preference data and the corresponding data format. At the same time, a weight parameter θ is set for each user-side rule according to the occurrence frequency of each preference data and the generation time of its corresponding uploaded data. The calculation formula of the weight parameter θ is:

[0077] ,

[0078] in 、 as well as They represent the weight parameter θ, occurrence frequency, and time correction parameter of the mth preference data, respectively, where M and m are natural numbers greater than 0, M represents the total number of preference data types, m is less than or equal to M, and k is less than or equal to j;

[0079] Set a weight parameter threshold and an occurrence threshold, and compare the weight parameter θ of each user-side rule with the weight parameter threshold. Mark the user-side rule whose weight parameter θ is greater than or equal to the weight parameter threshold; otherwise, do nothing.

[0080] Match the marked user-side rules in different user terminals with each other, count the number of occurrences of each user-side rule, and then select the marked user-side rules with a number of occurrences greater than or equal to the occurrence threshold as the public-side rules, otherwise do nothing;

[0081] The risk rule establishment module sends the public side rules and the user side rules of each user terminal to the data risk assessment module;

[0082] The data transfer module migrates the data detection area to the data risk assessment module, and then the data risk assessment module installs the public side rules and user side rules to the data detection area.

[0083] Furthermore, when the data detection area determines that there is a user-side rule corresponding to the user terminal, the data detection area calls the corresponding user-side rule to perform a first risk assessment on the uploaded data. If the data segment in the uploaded data is consistent with the preference data and data type in the user-side rule, the uploaded data is assigned a safety value according to the weight parameter θ of the corresponding user-side rule. For example, if the weight parameter θ is equal to 0.1, the corresponding uploaded data is assigned a value of 10;

[0084] If there is any inconsistency between the data segment in the uploaded data and the preference data and data type in the user-side rule, a safety value is assigned to the uploaded data according to half the data value of the weight parameter θ corresponding to the user-side rule;

[0085] If the data segments in the uploaded data are completely inconsistent with the preferred data and data types in the user-side rules, no action will be taken;

[0086] After the data detection area completes the first risk assessment of the uploaded data, it sets a first safety value threshold A and a second safety value threshold B, where B is greater than A. If the safety value of the uploaded data is less than the first safety value threshold A, the corresponding uploaded data is marked as abnormal data and deleted;

[0087] If the safety value of the uploaded data is greater than or equal to the first safety value threshold A and less than or equal to the second safety value threshold B, the corresponding uploaded data is marked as sub-safe data;

[0088] If the safety value of the uploaded data is greater than the first safety value threshold B, the corresponding uploaded data is determined to be marked as safe data.

[0089] Furthermore, after the first risk assessment is completed, the data risk assessment module performs a second risk assessment on the uploaded data judged as sub-safe data using public-side rules;

[0090] The uploaded data judged as sub-safe data by the public side rules is traversed. If there is a data segment that is inconsistent with the preferred data or its data type in the public side rules, the data risk assessment module will delete the corresponding data segment through the data detection area. Otherwise, no action will be taken;

[0091] When the second risk assessment is completed, the sub-safe data is marked as safe data, and then the data detection area generates a data detection sub-area to send the uploaded data marked as safe data to the data risk assessment model for storage;

[0092] When the risk assessment of the real-time uploaded data is completed, the data risk assessment module migrates the data detection area to the data transfer module.

[0093] The above embodiments are only used to illustrate the technical method of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical method of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical method of the present invention.

Claims

1. A cloud computing-based risk management real-time monitoring system, comprising a cloud computing platform, characterized in that: The cloud computing platform is communicatively connected to a data transfer module, a risk rule establishment module, and a data risk assessment model; The data transfer module is used to establish a data transmission channel between the cloud computing platform and each user terminal, set a data detection area, perform risk detection on the uploaded data of each user terminal through the data detection area, and send the uploaded data to the risk rule establishment module and the data risk assessment module; The risk rule establishment module is used to establish corresponding user-side rules according to the uploaded data, and to match all user-side rules with each other to establish public-side rules; The data risk assessment module is used to install user-side rules and public-side rules in the data detection area, and then perform a first risk assessment and a second risk assessment on the uploaded data of the corresponding user end, and filter the real-time user data set according to the results of the two risk assessments; Determine whether there is a user-side rule in the current data detection area. If there is no user-side rule in the data detection area, the data transfer module generates a data transfer instruction and sends it to the data detection area; When the data detection area receives the data transfer instruction, it generates a data transfer sub-area according to the size of the currently uploaded data, and sets a data access pointer outside the data transfer sub-area. The data access pointer records a string of randomly generated identification codes. The process of generating the user-side rules includes: The corresponding data receiving pointer is generated according to the identification code. The data detection area stores the uploaded data in the data transfer sub-area. Then, the risk rule establishment module matches the data receiving pointer with the data access pointer on the data transfer sub-area. The risk rule establishment module aggregates the uploaded data of the same user terminal at different time nodes and sets a number for each uploaded data in chronological order; Set a number of preference extraction pointers, and extract the preference data and corresponding data formats of the user terminal from each uploaded data through the preference extraction pointers; Generate corresponding user-side rules based on each preference data and the corresponding data format. At the same time, set a weight parameter θ for each user-side rule based on the occurrence frequency of each preference data and the generation time of its corresponding uploaded data. The calculation formula of the weight parameter θ is: ,in 、 as well as They represent the weight parameter θ, occurrence frequency, and time correction parameter of the mth preference data, respectively, where M and m are natural numbers greater than 0, M represents the total number of preference data types, and m is less than or equal to M; The process of generating public-side rules according to the user-side rules includes: Set a weight parameter threshold and an occurrence threshold, and compare the weight parameter θ of each user-side rule with the weight parameter threshold. Mark the user-side rule whose weight parameter θ is greater than or equal to the weight parameter threshold; otherwise, do nothing. Match the marked user-side rules in different user terminals with each other, count the number of occurrences of each user-side rule, and then select the marked user-side rules with a number of occurrences greater than or equal to the occurrence threshold as the public-side rules, otherwise do nothing; The data transfer module migrates the data detection area to the data risk assessment module, and then the data risk assessment module installs the public side rules and user side rules to the data detection area.

2. The cloud computing-based real-time risk management monitoring system according to claim 1, characterized in that: The process of setting up a data transmission channel for the user end includes: Each client communicates with the cloud computing platform, and the cloud computing platform assigns a number to each client based on the IP address used by the client for communication. The data transfer module then sends a data transmission channel establishment request based on the IP address and number of each client. Each client establishes a data transmission channel with the cloud computing platform based on the data transmission channel establishment request. The cloud computing platform marks each data transmission channel with a corresponding number. At the same time, the client periodically sends data upload requests to the cloud computing platform through the data transmission channel. When the user sends a data upload request, the uploaded data generated between the last data upload request and the latest data upload request is sent to the data transmission channel; The data transmission channel between the cloud computing platform and each user terminal can only carry out single-direction data transmission at any time point, and the data transmission direction is controlled in real time by the cloud computing platform; When the cloud computing platform receives a data upload request, the data transfer module will modify the data transmission direction of the corresponding data transmission channel in real time; A data detection area is provided between the data transfer module and each data transmission channel.

3. The cloud computing-based risk management real-time monitoring system according to claim 2, characterized in that: The process of the user end sending uploaded data to the data transfer module through the data transmission channel includes: The data transfer module divides the data transmission channel into the same number of sub-data transmission channels according to the number of data types of the uploaded data; When the user sends the uploaded data to the data transmission channel, the data transmission channel traverses the uploaded data, classifies the uploaded data into data types according to the traversal results, and distributes the data type classification results to the corresponding sub-data transmission channels; When the data transfer module receives the uploaded data sent by the data transmission channel, it sets the corresponding user terminal number for the uploaded data and sends it to the data detection area.

4. The cloud computing-based risk management real-time monitoring system according to claim 3, characterized in that: The process of risk detection of uploaded data in the data detection area includes: The data detection area pre-acquires Num pieces of known dangerous data fragments through the Internet, extracts corresponding feature words and feature fragments from each known dangerous data fragment, and generates corresponding known dangerous data identification pointers based on the feature words and feature fragments, where Num is a natural number greater than 0; The uploaded data is traversed and matched through the known dangerous data identification pointers. If there is a data segment in the uploaded data that matches any known dangerous data identification pointer, the corresponding data segment is removed, otherwise no operation is performed.

5. The cloud computing-based real-time risk management monitoring system according to claim 4, characterized in that: The process of the first risk assessment includes: When the data detection area determines that there is a user-side rule corresponding to the user terminal, the data detection area calls the corresponding user-side rule to perform a first risk assessment on the uploaded data. If the data fragment in the uploaded data is consistent with the preference data and data type in the user-side rule, the uploaded data is assigned a safety value according to the weight parameter θ of the corresponding user-side rule; When the data detection area completes the first risk assessment of the uploaded data, a first safety numerical threshold A and a second safety numerical threshold B are set, where B is greater than A. Based on the relationship between the safety value of the uploaded data and the first safety numerical threshold A and the second safety numerical threshold B, the uploaded data is marked as abnormal data, sub-safe data or safe data.

6. The cloud computing-based real-time risk management monitoring system according to claim 5, characterized in that: The second risk assessment process includes: After the first risk assessment is completed, the data risk assessment module performs a second risk assessment on the uploaded data that is judged to be less secure data using public side rules; The uploaded data judged as sub-safe data by the public side rules is traversed. If there is a data segment that is inconsistent with the preferred data or its data type in the public side rules, the data risk assessment module will delete the corresponding data segment through the data detection area. Otherwise, no action will be taken; When the second risk assessment is completed, the secondary safe data will be marked as safe data, and then the data detection area will generate a data detection sub-area to send the uploaded data marked as safe data to the data risk assessment model for storage. When the risk assessment of the real-time uploaded data is completed, the data risk assessment module will migrate the data detection area to the data transfer module.

Images