Method for predicting data security risk and related product

Abstract

The invention discloses a method for predicting a data security risk and a related product thereof. The method comprises the following steps: constructing a topological graph among nodes of a target object according to a node type; determining a security event sequence and a candidate node set of the topological graph according to the data security event of each node in the topological graph, wherein the candidate node is a node which is directly adjacent to a tail node of the security event sequence and does not generate the data security event in the topological graph; and inputting the security event sequence into a preset security event prediction model for security event prediction to obtain a data security risk value of each candidate node in the candidate node set. According to the scheme disclosed by the invention, the node type of the next data security event and the specific data security event can be accurately predicted, so that the data security risk value of each candidate node directly adjacent to the current attack chain can be accurately predicted.

Description

Technical Field

[0001] The present disclosure generally relates to the field of data security technology. More specifically, the present disclosure relates to a method, an electronic device, and a computer-readable storage medium for predicting data security risks. Background Art

[0002] With the rapid development of the Internet and cloud technology, data has become the most important asset in all walks of life. All organizations and enterprises have begun to use more and more technologies and methods to process, store and use data. The resulting data security issues have become increasingly important. Security incidents such as data leakage, hacker attacks, and unauthorized operations may cause organizations or enterprises to suffer huge losses.

[0003] Advanced Persistent Threat (APT) attack channels are diverse, they remain hidden for a long time, and they are highly correlated with multiple factors in the environment where the attacked object is located, making it difficult to predict what kind of attack event will occur next time and in what environment.

[0004] In view of this, there is an urgent need to provide a solution for predicting data security risks, so as to predict the node type and specific data security event where the next data security incident will occur, so as to achieve efficient and accurate prediction of data security risks related to the current attack chain. Summary of the invention

[0005] In order to at least solve one or more of the technical problems mentioned above, the present disclosure proposes a solution for predicting data security risks in the following aspects.

[0006] In a first aspect, the present disclosure provides a method for predicting data security risks, comprising: constructing a topological graph between nodes of a target object according to node types, wherein the topological graph includes horizontal associations between nodes of the same node type and vertical associations between nodes of different node types; determining a security event sequence and a candidate node set of the topological graph according to data security events that have occurred at each node in the topological graph, wherein the candidate node is a node in the topological graph that is directly adjacent to the end node of the security event sequence and has not yet undergone a data security event; and inputting the security event sequence into a preset security event prediction model for security event prediction to obtain a data security risk value for each candidate node in the candidate node set.

[0007] In some embodiments, the node types include personnel, data, application systems, and cloud resources.

[0008] In some embodiments, constructing a topological map between nodes of a target object according to node type includes: using a risk feature detection tool to detect risk features of each node in the topological map; and based on the risk features, determining the possibility of a data security incident occurring at each node.

[0009] In some embodiments, after obtaining the data security risk value of each candidate node in the candidate node set, the method further includes: determining the value-weighted risk of each candidate node based on the data security value and the data security risk value of each candidate node; and outputting event warnings and prevention prompts based on the value-weighted risk.

[0010] In some embodiments, the data security value is determined based on the value factors of the candidate node; the value factors include: whether it is a data node or a node that directly stores data, whether the amount of stored data is greater than 1000, whether the level of stored data is a preset level or above, whether the stored data is generated or updated within a preset time limit, and whether the stored data is interrelated with other data sets.

[0011] In some embodiments, the security event sequence is input into a preset security event prediction model for security event prediction to obtain the data security risk value of each candidate node in the candidate node set, including: inputting the security event sequence into a preset security event prediction model for security event prediction to obtain the possibility of each node type being attacked and the probability of a data security incident occurring when a node of each node type is attacked after the security event sequence occurs; and determining the data security risk value of the candidate node based on the node type of the candidate node, the risk characteristics of the candidate node, the possibility of a data security incident occurring at the candidate node, the possibility of each node type being attacked, and the probability of a data security incident occurring when a node of each node type is attacked.

[0012] In some embodiments, after determining the possibility of a data security event occurring at each node, the method further includes: sorting the possibility of a data security event occurring at each node to determine the data security event corresponding to the maximum possibility of each node; and outputting a possibility event prompt for the data security event corresponding to the maximum possibility.

[0013] In some embodiments, the preset security event prediction model is a model obtained by training using a machine learning model. The preset security event prediction model obtained by training using a machine learning model includes: collecting and analyzing the historical security event data of the training object to obtain the security event sequence and induced security event information of the training object, wherein the induced security event information includes the type of node attacked after the security event sequence and the data security event occurring at the attacked node; and inputting the security event sequence and the induced security event information as training data into the machine learning model to train the machine learning model and obtain the preset security event prediction model.

[0014] In a second aspect, the present disclosure provides an electronic device, comprising: a processor; and a memory storing program instructions for predicting data security risks, wherein when the program instructions are executed by the processor, the method described in the first aspect and its multiple embodiments are implemented.

[0015] In a third aspect, the present disclosure provides a computer-readable storage medium storing program instructions for predicting data security risks. When the program instructions are executed by a processor, the method described in the first aspect and its multiple embodiments are implemented.

[0016] Through the scheme for predicting data security risks provided above, the disclosed embodiment can determine the security event sequence and candidate node set of the topological map according to the data security events that have occurred at each node in the topological map. Then, by inputting the security event sequence into the preset security event prediction model for security event prediction, the data security risk value of each candidate node in the candidate node set can be obtained. Thus, the disclosed scheme can accurately predict the node type and specific data security event where the next data security event will occur, thereby accurately predicting the data security risk value of each candidate node directly adjacent to the current attack chain.

[0017] Furthermore, in some embodiments, the node types of the disclosed embodiments may include personnel, data, application systems, and cloud resources, taking into account a variety of factors associated with data security incidents, which not only increases the depth and breadth of data security risk prediction, but also can simulate multi-dimensional and complex environments, helping to improve the accuracy of data security risk prediction.

[0018] Furthermore, in some embodiments, the disclosed embodiments can determine the data security value of each node based on the value factor of each node, and then can reduce the risk of the predicted data security risk value based on the data security value of the candidate node to determine the value-weighted risk of the candidate node. Based on this, the value-weighted risk of the disclosed embodiments is a data security risk value obtained by comprehensively considering the node type and data value factors of the node. In other words, for nodes of the same node type, different data security risk values ​​may be obtained under the influence of data value factors, which helps to improve the level of refinement of data security risk prediction. At the same time, it can avoid excessive prevention of nodes with low data security value, resulting in waste of resources. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] By reading the detailed description below with reference to the accompanying drawings, the above and other objects, features and advantages of the exemplary embodiments of the present disclosure will become readily understood. In the accompanying drawings, several embodiments of the present disclosure are shown in an exemplary and non-limiting manner, and the same or corresponding reference numerals represent the same or corresponding parts, wherein: Figure 1 An exemplary flow chart of a method for predicting data security risks according to an embodiment of the present disclosure is shown; Figure 2 An exemplary schematic diagram showing a topological diagram of association relationships of four types of nodes according to an embodiment of the present disclosure; Figure 3 An exemplary example of a topological diagram of association relationships of four types of nodes according to an embodiment of the present disclosure is shown; Figure 4 An exemplary schematic diagram showing a sequence of security events according to an embodiment of the present disclosure is shown; Figure 5 An exemplary schematic diagram showing candidate nodes of an embodiment of the present disclosure is shown; Figure 6 Shows Figure 1 An exemplary flow chart of a step in the process; Figure 7 Shows Figure 1 An exemplary flow chart of another step in Figure 8 An exemplary structural block diagram of an electronic device according to an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0020] The following will be combined with the drawings in the embodiments of the present disclosure to clearly and completely describe the technical solutions in the embodiments of the present disclosure. Obviously, the described embodiments are part of the embodiments of the present disclosure, not all of the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present disclosure.

[0021] It should be understood that when the terms "first", "second", "third" and "fourth" are used in the claims, the specification and the drawings of the present application, they are only used to distinguish different objects, rather than to describe a specific order. The terms "include" and "comprise" used in the specification and claims of the present disclosure indicate the presence of the described features, wholes, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components and / or their collections.

[0022] It should also be understood that the terms used in this disclosure are only for the purpose of describing specific embodiments and are not intended to limit the disclosure. As used in this disclosure and claims, the singular forms of "a", "an", and "the" are intended to include the plural forms unless the context clearly indicates otherwise. It should also be further understood that the term "and / or" used in this disclosure and claims refers to any combination of one or more of the associated listed items and all possible combinations, including these combinations.

[0023] As used in this specification and claims, the term "if" can be interpreted as "when" or "upon" or "in response to determining" or "in response to detecting," depending on the context. Similarly, the phrases "if it is determined" or "if [described condition or event] is detected" can be interpreted as meaning "upon determination" or "in response to determining" or "upon detection of [described condition or event]" or "in response to detecting [described condition or event]," depending on the context.

[0024] The specific implementation of the present disclosure is described in detail below with reference to the accompanying drawings. Overview of this Disclosure In the process of obtaining the solution disclosed herein, the applicant discovered that data security is built on network security. Without network security, there is no data security. However, when predicting data security risks, only considering network security cannot achieve the expected attack protection effect. Therefore, in addition to predicting data security risks and attack protection for the host, factors such as people, application systems, and data that may be associated with the host need to be considered. For example: a person being attacked by a social worker may lead to the leakage of the application system password. For another example, a security vulnerability in the cloud resource host may lead to an intrusion and the acquisition of sensitive data.

[0025] However, most of the existing data security risk prediction methods focus on a single dimension, usually only predicting data security risks and attack protection for host-type assets and / or data itself, ignoring the influence of factors such as personnel and application systems, with a limited prediction range and a relatively fixed backtracking sequence. At the same time, once an attack occurs, all assets need to be checked, which is labor-intensive, time-consuming and labor-intensive.

[0026] In order to achieve more accurate predictions of upcoming data security incidents, this disclosure collects and analyzes data security incidents that have occurred, and classifies all data security incidents that have occurred into four types of nodes: personnel, data, application systems, and cloud resources. The risk characteristics of nodes of different node types and their correlation with data security incidents are analyzed. Subsequently, the risk characteristics and correlations are combined with the security event sequence, and the node type and specific data security incident of the next data security incident are predicted through a multi-dimensional machine learning model, so as to achieve efficient and accurate prediction of security risks related to the current attack chain and risk reduction based on node value.

[0027] For ease of understanding, before the scheme of the present disclosure is introduced in detail, the technical terms involved in the present disclosure are first introduced.

[0028] Graph database: A type of database used to store relationships between entities. It uses a graph structure to represent data, where entities are represented as nodes and relationships between entities are represented as edges. Graph databases are particularly suitable for processing complex relational networks. In a graph database, the relationships between data are as important as the data itself, and they are stored as part of the data. This architecture gives graph databases the advantages of high performance, scalability, and flexibility, and can quickly respond to complex association queries because the relationships between entities have been stored in the database in advance.

[0029] Machine learning models: Algorithms that automatically learn and generate predictions based on given input data (also called features). These models can be divided into two main categories: supervised learning models and unsupervised learning models.

[0030] Exemplary Methods Next, combine Figure 1 The method 100 for predicting data security risks in some embodiments of the present disclosure is exemplarily introduced. It is understandable that the method 100 can be executed by any appropriate device with data processing capabilities, such as but not limited to terminal devices and servers.

[0031] like Figure 1As shown, at step S101, method 100 can construct a topology diagram between nodes of a target object according to the node type. Here, the target object is used to identify any object that is targeted when predicting data security risks, and the object can be any organization or institution.

[0032] In the scheme disclosed herein, the entities of the target object can be represented by nodes in a topological graph, and the mutual relationships between the entities can be represented by the association relationships between the nodes. The types of nodes in the topological graph (or also referred to as node types) can include but are not limited to personnel, data, application systems, and cloud resources. The association relationships between nodes in the topological graph can include horizontal associations between nodes of the same node type and vertical associations between nodes of different node types.

[0033] Based on this, when constructing a topological graph between the nodes of the target object, the solution disclosed in the present invention can first construct nodes corresponding to the entities of the target object, and classify the nodes according to the node type. Then, the association relationship between the nodes can be constructed based on the mutual relationship between the entities, so as to obtain the topological graph of the target object. From an implementation perspective, the present disclosure can use a graph database to store the topological graph of the target object. Through the relational storage method of the graph database, the association relationship between the nodes can be better expressed, which can facilitate complex data management and query operations.

[0034] For ease of understanding, here we combine Figure 2 and Figure 3 The topology diagram between nodes is introduced in more detail. Figure 2 As shown, it shows an exemplary schematic diagram of the association relationship topology diagram of four types of nodes. Figure 2 In the topology diagram, the domain is the value range of four types of nodes: personnel, data, application system, and cloud resource. In this topology diagram, a node can be connected to other nodes of the same type through horizontal associations, and can also be connected to nodes of different types through vertical associations. For example, a cloud resource can connect to and access other cloud resources in the local area network, which is a horizontal association, and an application system is running on the cloud resource, which is a vertical association. Here, the association relationship between nodes will be explained by taking the cloud resource node type as an example. By analogy, the association relationship between node types such as personnel, data, and application system can be understood.

[0035] Specifically, the curve connecting the cloud resource on the right side to itself represents the horizontal association between different nodes that are also cloud resources; the straight line connecting the cloud resource on the left side to the data represents the vertical association between nodes of the cloud resource type and nodes of the data type; the straight line connecting the cloud resource on the upper side to the application system represents the vertical association between nodes of the cloud resource type and nodes of the application system type; the straight line connecting the cloud resource on the upper left side to the personnel represents the vertical association between nodes of the cloud resource type and nodes of the personnel type.

[0036] Further, Figure 3 An exemplary example of a topological diagram of association relationships of four types of nodes is shown. Figure 3 As shown, one entity of the target object corresponds to one node, and the relationship between the entities determines the association relationship between the nodes. In this example, the nodes are classified into four types according to the node type: personnel, application system, cloud resource and data, and the number of nodes included in each type varies.

[0037] Specifically, the personnel type includes nodes such as Zhang San, Li Si, Wang Wu, and Personnel XXX, where Personnel XXX represents other personnel type nodes. The application system type includes nodes such as the financial system, performance system, attendance system, and application system XXX, where application system XXX represents other application system type nodes. The cloud resource type includes ECS that runs the financial system and performance system, ECS that runs the attendance system, RDS that stores employee identity information, OSS that stores employee-related unstructured information, and cloud resource XXX, where cloud resource XXX represents other cloud resource type nodes. The data type nodes include employee identity information table, employee face picture, fingerprint information file, and data XXX, where data XXX represents other data type nodes. Here, ECS is the abbreviation of Elastic Compute Service, RDS is the abbreviation of Relational Database Service, and OSS is the abbreviation of Object Storage Service.

[0038] like Figure 3As shown, the nodes of the personnel type can be horizontally associated with each other through a working relationship, and the nodes and the application system type can be vertically associated through a development, operation and maintenance, testing or design relationship. The nodes of the application system type can be horizontally associated with each other through data interaction, calling interface or transmitting data relationship, and in addition to being vertically associated with the nodes of the personnel type, each node can also be vertically associated with the nodes of the cloud resource type through a running relationship. The nodes of the cloud resource type can be horizontally associated with each other through intranet interconnection, data acquisition or data storage, and in addition to being vertically associated with the nodes of the application relationship type, each node can also be vertically associated with the nodes of the data type through a storage relationship. The nodes of the data type can be horizontally associated with each other through mutual blood relationship or logical association. It should be understood that Figure 3 The node types, node quantities, and node relationships shown in the figure are merely exemplary and illustrative. Those skilled in the art may set the node types, node quantities, and node relationships according to actual needs, and the present disclosure does not make any specific limitations in this regard.

[0039] Following the aforementioned step S101, at step S102, the method 100 may determine a security event sequence and a candidate node set of the topology graph according to data security events that have occurred at each node in the topology graph.

[0040] In the scheme disclosed herein, data security events indicate specific circumstances in which a node is attacked or negatively affected. Data security events may include, but are not limited to, password leakage, social engineering attacks, injection of shell rebound instructions, data tampering, password cracking, attack payload placement, unauthorized access, and distributed denial of service (DDOS) attacks. It should be understood that the data security events shown here are merely exemplary and illustrative, and those skilled in the art may expand them according to actual needs, and this disclosure does not specifically limit this aspect.

[0041] From the implementation level, the present disclosure can use a data security event set to store the data security events to be used. As an example, the data security event set can be expressed as {password leaked, social engineering attack, shell rebound command injected, data tampered, password cracked, attack payload dropped, unauthorized access, DDOS attack}.

[0042] The security event sequence disclosed herein indicates a set of associated nodes that have been attacked successively within a period of time. The security event sequence may specifically include each node that has been attacked, the order in which each node has been attacked, the type of each node, and the data security events that have occurred at each node. It is easy to understand that the node that is directly adjacent to the end node of the security event sequence and has not yet had a data security event has the highest probability of having a data security event in the next attack, and precautions should be taken. Therefore, in the embodiment of the present disclosure, a node that is directly adjacent to the end node of the security event sequence and has not yet had a data security event is determined as a candidate node, and its data security risk value is predicted so that the staff can formulate corresponding prevention strategies based on the data security risk value to ensure the data security of the candidate node.

[0043] For ease of understanding, continue to combine the above Figure 3 How to determine the security event sequence and candidate node set of the topology diagram is introduced in detail. Prior to this, the data security events that have occurred at each node in the topology diagram are specifically introduced.

[0044] The sequence of data security incidents: 1. Li Si obtained the password of the financial system stored in plain text by Zhang San in the enterprise shared document. 2. When browsing the financial system, Li Si found that the financial system would call the interface of the performance system to obtain employee information, and the interface provided by the performance system did not implement the authentication mechanism and could be accessed without restrictions. Therefore, Li Si injected a shell rebound command into the interface. 3. Li Si successfully invaded the ECS running the performance system through the shell rebound command and achieved complete control of the ECS.

[0045] By analyzing the data security events that have occurred at each node in the topology diagram, we can see that in data security event 1, the attacked node is the financial system, the attack order is 1, the node type is the application system, and the data security event that occurred is the password leakage; in data security event 2, the attacked node is the performance system, the attack order is 2, the node type is the application system, and the data security event that occurred is the injection of shell rebound instructions; in data security event 3, the attacked node is the ECS running the performance system, the attack order is 3, the node type is the cloud resource, and the data security event that occurred is unauthorized access. Therefore, we can get the following: Figure 4 A safety event sequence of length 3 is shown.

[0046] After the security event sequence is determined, the node that is directly adjacent to the end node of the security event sequence and has not yet experienced a data security event can be determined as a candidate node. Figure 3As shown, the last node of the security event sequence is the ECS running the performance system. The nodes directly adjacent to the last node and where no data security events have occurred are the RDS storing employee identity information and the ECS running the attendance system. Both nodes are cloud resource types. At the same time, the ECS running the performance system and the RDS storing employee identity information are horizontally associated through the acquisition data relationship, and the ECS running the performance system and the ECS running the attendance system are horizontally associated through the intranet interconnection relationship. Thus, the following can be obtained: Figure 5 The candidate nodes are shown.

[0047] Following the aforementioned step S102, at step S103, the method 100 may input the security event sequence into a preset security event prediction model to perform security event prediction to obtain the data security risk value of each candidate node in the candidate node set.

[0048] In the scheme disclosed herein, the preset security event prediction model is a model obtained by training using a machine learning model, which is used to predict the possibility of a certain type of candidate node being attacked and the probability of a specific data security event occurring when the type of node is attacked after a security event sequence occurs. In actual operation, the machine learning model can use any one of a recurrent neural network (RNN), a support vector regression (SVR), a long short-term memory network (LSTM), and a transformer network (Transformer).

[0049] In the scheme disclosed herein, when a preset security event prediction model is obtained by training using a machine learning model, the historical security event data of the training object can be first collected and analyzed to obtain the security event sequence and induced security event information of the training object. The induced security event information here includes the node type attacked after the security event sequence and the data security event that occurred in the attacked node. Then, the security event sequence and the induced security event information can be input into the machine learning model as training data to train the machine learning model and obtain the preset security event prediction model.

[0050] In the scheme disclosed herein, the training object is similar to the aforementioned target object and can be any organization or institution. The historical security event data of the training object can be regularly collected, processed, analyzed and sorted out through multiple channels such as open source intelligence, cooperating organizations, long-term logs of the enterprise intranet, and attack and defense drill data.

[0051] The data security risk value disclosed herein can identify the risk of a candidate node being attacked. After the preset security event prediction model predicts the possibility of a certain type of candidate node being attacked and the probability of a specific data security event occurring when the node is attacked, the node type of each candidate node can be combined to determine the possibility of each candidate node being attacked and the probability of a specific data security event occurring when attacked, thereby determining the data security risk value of each candidate node.

[0052] Furthermore, after determining the data security risk value of each candidate node, the method 100 may also output the data security risk value of each candidate node. Additionally or optionally, the method 100 may output the data security risk value of each candidate node in a visual or audible manner.

[0053] Combination of the above Figure 1 A method 100 for predicting data security risks is described. The method 100 can determine the security event sequence and candidate node set of the topology map based on the data security events that have occurred at each node in the topology map. Then, by inputting the security event sequence into a preset security event prediction model for security event prediction, the data security risk value of each candidate node in the candidate node set can be obtained. As a result, the scheme disclosed in the present invention can accurately predict the node type and specific data security event where the next data security event will occur, thereby predicting the data security risk value of each candidate node directly adjacent to the current attack chain.

[0054] Figure 6 Shows Figure 1 An exemplary flow chart of step S101 in the method. It is understood that the following Figure 1 The description is a specific implementation of the aforementioned step S101. Figure 1 The features described in can be applied analogously here.

[0055] like Figure 6 As shown, at step S1011, method 100 may use a risk feature detection tool to detect the risk feature of each node in the topology graph.

[0056] In the scheme disclosed herein, the risk feature detection tool is a set of tools for daily node status checks within a domain. In one embodiment, the risk feature detection tool may include a vulnerability scanning tool, a code auditing tool, and a weak password scanning tool. The risk feature detection tool can regularly update the risk features of each node in the graph database based on daily detection results and in real time in combination with data security event records. In actual operation, there may be risk features that the risk feature detection tool cannot detect. In this case, the risk features of the node can be determined through manual replay analysis.

[0057] In the scheme disclosed herein, the risk characteristics of a node are characteristics that make the node a target of attackers and attacked, and the risk characteristics of nodes of different node types may be different. As shown in Table 1 below, the risk characteristics of nodes of personnel type may include failure to sign a confidentiality agreement, failure to receive security training, and failure to access an entry survey. The risk characteristics of nodes of application system type may include passwords being stored in plain text, no multi-factor authentication, and unauthenticated interface calls. The risk characteristics of nodes of data types may include no desensitization, no encryption, and no watermarks. The risk characteristics of nodes of cloud resource type may include the existence of vulnerabilities, the existence of weak passwords, and unrestricted opening of high-risk ports.

[0058] It should be understood that the risk features shown in Table 1 are merely exemplary and illustrative, and those skilled in the art can expand the risk features of each node type according to actual needs, and the present disclosure does not make specific limitations in this regard. From the implementation level, the present disclosure can use a risk feature set to store the risk features to be used. As an example, the risk feature set can be expressed as {passwords are stored in plain text, no security training has been received, interfaces are not authenticated, data is not encrypted, vulnerabilities exist, weak passwords exist, and high-risk ports are opened without restrictions}.

[0059] Table 1 Example of risk characteristics of various types of nodes

[0060] Next, an example is used to illustrate how to use risk feature detection tools and manual review analysis to determine the risk features of each node in the topology graph.

[0061] First, the personnel management system issues a warning after regular automated checks: Operation and maintenance personnel Zhang San has not received data security training from the enterprise organization after joining the company, and may cause data leakage risks due to improper behavior. As a result, the risk characteristics of the node (personnel Zhang San) in the graph database can be updated (not receiving security training).

[0062] Secondly, since Zhang San had not received security training, he did not know the dangers of storing passwords in plain text, and mistakenly saved the operation and maintenance account password of the financial system in plain text in a shared document within the company. As a result, the risk characteristics of the node (application system financial system) in the graph database can be updated (passwords are stored in plain text).

[0063] Then, the code audit tool scanned and found that the performance system did not provide authentication capabilities for some interfaces, leaving a security vulnerability backdoor. As a result, the risk characteristics of the nodes (application system performance system) in the graph database can be updated (interface without authentication).

[0064] Then, the weak password scanning tool issues a warning after periodic scanning: the ECS running the attendance system has a weak password that can be easily cracked, which may lead to the risk of unauthorized access to cloud resources. As a result, the risk characteristics of the node (the ECS running the attendance system on cloud resources) in the graph database can be updated (there is a weak password).

[0065] Next, because Zhang San mistakenly saved the account and password of the RDS that stores employee identity information in plain text in a shared document within the company, the risk characteristics of the node (the cloud resource RDS that stores employee identity information) in the graph database can be updated (the password is stored in plain text).

[0066] Finally, the vulnerability scanning tool found that most of the RDS in the organization (including the RDS that stores employee identity information) had security vulnerabilities due to outdated database engine versions, which led to the risk of being exploited. As a result, the risk characteristics of the nodes in the graph database (the cloud resource RDS that stores employee identity information) can be updated (vulnerabilities exist).

[0067] Later, when you need to analyze the risk characteristics of nodes in the graph database, you can use the following form to determine whether the node has a certain risk characteristic: (1) As an example, has(Zhang San, not receiving security training) = 1, indicating that Zhang San has the risk characteristic of not receiving security training. As another example, has(ECS running the attendance system, passwords stored in plain text) = 0, indicating that the ECS running the attendance system does not have the risk characteristic of passwords stored in plain text.

[0068] Furthermore, when it is necessary to statistically analyze the risk characteristics of multiple nodes in the graph database, the quantitative form shown in Table 2 below can be used to indicate whether multiple nodes have a certain risk characteristic. As can be seen from Table 2, the employee Zhang San has the risk characteristic of not receiving security training; the application system financial system has the risk characteristic of passwords being stored in plain text; the application system performance system has the risk characteristic of interfaces without authentication; the cloud resource RDS that stores employee identity information has the risk characteristic of passwords being stored in plain text and having vulnerabilities; the cloud resource ECS that runs the attendance system has the risk characteristic of weak passwords.

[0069] Table 2 Quantitative table of risk characteristics of various types of nodes

[0070] Following the aforementioned step S1011, at step S1012, method 100 may determine the possibility of a data security incident occurring at each node based on the risk characteristics of each node.

[0071] It is understandable that there is an inevitable correlation between the risk characteristics of a node and the data security incident that will occur at the node. In actual operation, the correlation between the risk characteristics and the data security incident can be obtained by statistically analyzing the historical data security incident data, and a value in the range of [0, 1] can be used to represent the degree of correlation between the two. In one embodiment, the correlation between the risk characteristics and the data security incident can be represented in the following form: (2) As an example, , indicating that the correlation between the risk feature of passwords being stored in plain text and the data security incident of password leakage is 1. In other words, if a node has the risk feature of passwords being stored in plain text, the probability of a data security incident of password leakage occurring in the node is 1, which means that the probability of password leakage is very high.

[0072] As another example, , indicating that the correlation between the risk feature of vulnerability and the data security incident of unauthorized access is 0.3. In other words, if a node has the risk feature of vulnerability, the probability of the data security incident of unauthorized access occurring in the node is 0.3, which means that the probability of unauthorized access occurring is not high.

[0073] As another example, , indicating that the correlation between the risk characteristic of not accepting the on-site investigation and the data security incident of data tampering is 0. In other words, if a node has the risk characteristic of not accepting the on-site investigation, the possibility of a data security incident of data tampering occurring in the node is 0, that is, there is no possibility of data tampering occurring.

[0074] Subsequently, when it is necessary to statistically analyze the correlation between different risk features and different data security events, the correlation between different risk features and different data security events can be expressed in a quantitative form as shown in Table 3 below. From an implementation perspective, the present disclosure can use a matrix to store the correlation between risk features and data security events.

[0075] Table 3 Quantitative table of the correlation between risk characteristics and data security incidents

[0076] Based on the statistical analysis of historical data security incident data and the correlation between the aforementioned risk characteristics and data security incidents, the possibility of different data security incidents occurring at each node can be determined based on the risk characteristics of each node.

[0077] Furthermore, the method 100 can sort the likelihood of different data security events occurring at each node to determine the data security event corresponding to the maximum likelihood of each node. Thereafter, the method 100 can also output a possibility event prompt in a visual or audible manner for the data security event corresponding to the maximum likelihood. Here, the possibility event prompt is used to prompt the user of the data security event that is most likely to occur at each node, so that the user can make corresponding preventive preparations.

[0078] Figure 7 Shows Figure 1 An exemplary flow chart of step S103 in the method. It is understood that the following Figure 1 The description is a specific implementation of the aforementioned step S103. Figure 1 The features described in can be applied analogously here.

[0079] like Figure 7 As shown, at step S1031, method 100 can input the security event sequence into a preset security event prediction model to perform security event prediction to obtain the possibility of each node type being attacked after the security event sequence occurs and the probability of a data security incident occurring when a node of each node type is attacked.

[0080] Taking the cloud resource type node as an example, the prediction results output by the preset security event prediction model are as follows: P(cloud resource type node attacked | data security event sequence occurs) = 0.35, indicating that the probability of cloud resource type node being attacked is 0.35; P(password leaked | data security event sequence occurs, cloud resource type node is attacked) = 0.5, indicating that the probability of password leakage when the cloud resource type node is attacked is 0.5; P(password cracked|data security event sequence occurs, cloud resource type node is attacked) = 0.1, indicating that the probability of password cracking when the cloud resource type node is attacked is 0.1; P(attack payload dropped|data security event sequence occurs, cloud resource type node is attacked) = 0.35, indicating that the probability of attack payload being dropped when the cloud resource type node is attacked is 0.35; P(unauthorized access|data security event sequence occurs, cloud resource type node is attacked) = 0.05, indicating that when the cloud resource type node is attacked, the probability of unauthorized access is 0.05; P(Occurrence of other data security events|Occurrence of data security event sequence, cloud resource type node being attacked) = 0, indicating that when a cloud resource type node is attacked, the probability of other data security events occurring in the cloud resource type node is 0.

[0081] It can be seen that for nodes of the same node type, the prediction results of the preset security event prediction model are the same. Then, for the two candidate nodes determined in the aforementioned step S102 (RDS node storing employee identity information and ECS node running the attendance system), since both candidate nodes are cloud resource types, the prediction results of the two nodes are the same.

[0082] At step S1032, method 100 may determine the data security risk value of the candidate node based on the node type of the candidate node, the risk characteristics of the candidate node, the possibility of a data security incident occurring at the candidate node, the possibility of each node type being attacked, and the probability of a data security incident occurring when a node of each node type is attacked.

[0083] In actual operation, the following formula can be used to calculate the data security risk value of the candidate node directly adjacent to the end of the security event sequence being attacked when a security event sequence occurs:

[0084] in, Indicates whether the candidate node has a certain risk feature; Indicates the correlation between a risk feature of a candidate node and a data security incident; It represents the probability of a candidate node being attacked after a security event sequence occurs; It indicates the probability that a candidate node is attacked and a data security incident occurs after a security incident sequence occurs. Indicates the data security risk value of the candidate node.

[0085] Next, continue to refer to Figure 1 In the solution disclosed herein, after method 100 determines the data security risk value of the candidate node at step S103, steps S104 and S105 may also be executed.

[0086] Next, at step S104, method 100 may determine the value-weighted risk of each candidate node based on the data security value and the data security risk value of each candidate node. Specifically, the product of the data security value and the data security risk value may be used as the value-weighted risk of the candidate node. In actual operation, the value-weighted risk of the candidate node may be calculated using the following formula.

[0087]

[0088] in, represents the value-weighted risk of the candidate node, Represents the data security risk value of the candidate node, Indicates the data security value of the candidate node.

[0089] In the scheme disclosed herein, the data security value of a candidate node may be a numerical value in the range of [0, 1]. Method 100 may determine the data security value of each candidate node based on its value factor. Specifically, the data security value of the candidate node may be calculated based on whether the candidate node satisfies the value factor. The value factors disclosed herein may include, but are not limited to: whether it is a data node or a node that directly stores data, whether the amount of stored data is greater than a preset byte, whether the stored data classification is a preset classification and above, whether the stored data is generated or updated within a preset time limit, and whether the stored data is interrelated with other data sets. It is understandable that those skilled in the art may set specific values ​​of preset bytes, preset classifications, and preset time limits according to actual needs, and this disclosure does not specifically limit this.

[0090] In an implementation scenario, the more value factors a candidate node satisfies, the higher the data security value of the candidate node can be determined. Conversely, the fewer value factors a candidate node satisfies, the lower the data security value of the candidate node can be determined. In this scenario, the data security value corresponding to each value factor can be pre-set, and the sum of the data security values ​​corresponding to multiple value factors satisfied by the candidate node can be added as the final data security value of the candidate node. In one embodiment, the data security value of the candidate node can be expressed in the following form:

[0091] As an example, at the aforementioned step S102, the data security values ​​of the two candidate nodes (RDS node storing employee identity information and ECS node running the attendance system) are respectively: V (RDS node storing employee identity information) = 1.0; V (ECS node running the attendance system) = 0.5. In order to facilitate understanding of how to determine the data security risk value and value-weighted risk of the candidate nodes, the following describes the calculation process of the data security risk value and value-weighted risk of the aforementioned two candidate nodes (RDS node storing employee identity information and ECS node running the attendance system).

[0092] By the aforementioned Figure 3 It can be seen that the type of RDS node storing employee identity information is cloud resource. From the above Table 2, it can be seen that the RDS node storing employee identity information has the risk characteristics of passwords being stored in plain text and vulnerabilities. From the above Table 3, it can be seen that the correlation between passwords being stored in plain text and each data security event in the data security event sequence, as well as the correlation between storage vulnerabilities and each data security event in the data security event sequence. In addition, the data security key value of the RDS node storing employee identity information is V (RDS node storing employee identity information) = 1.0.

[0093] Furthermore, by the aforementioned Figure 3 It can be seen that the type of ECS node running the attendance system is cloud resource. From the above Table 2, it can be seen that the ECS node running the attendance system has the risk characteristics of weak passwords. From the above Table 3, it can be seen that there is a correlation between weak passwords and each data security event in the data security event sequence. In addition, V (ECS node running the attendance system) = 0.5.

[0094] Based on this, the calculation process of the data security risk value and value-weighted risk of the RDS node storing employee identity information is as follows:

[0095] The data security risk value and value-weighted risk calculation process of the ECS node running the attendance system is as follows:

[0096] Based on the above calculation results, it can be concluded that the risk of RDS nodes storing employee identity information is higher than that of ECS nodes running the attendance system. For RDS nodes storing employee identity information, due to the risk characteristic of passwords being stored in plain text, attention should be paid to preventing data security incidents such as password leakage; due to the risk characteristic of vulnerabilities, attention should be paid to preventing data security incidents such as attack payloads being deployed and unauthorized access; for EC nodes running the attendance system, due to the risk characteristic of weak passwords, attention should be paid to preventing data security incidents such as password cracking.

[0097] Finally, at step S105, the method 100 may output event warnings and prevention prompts based on the value-weighted risk. Here, the event warnings and prevention prompts are used to remind the user that the candidate node needs to prevent data security events. Specifically, the method 100 may output the event warnings and prevention prompts in a visual or audible manner.

[0098] Furthermore, method 100 can also determine the warning and prevention levels according to the value-weighted risk. In actual operation, method 100 can pre-set multiple warning and prevention levels, and set the value range of the value-weighted risk corresponding to each warning and prevention level. Thus, method 100 can determine the warning and prevention level of the candidate node according to the value range of the value-weighted risk of the candidate node. It is understandable that those skilled in the art can set multiple warning and prevention levels according to actual needs, as well as the value range of the value-weighted risk corresponding to each warning and prevention level, and this disclosure does not make specific limitations.

[0099] Next, combine Figure 8 An electronic device 800 provided in the embodiment of the present disclosure is exemplarily introduced. Figure 8As shown, the electronic device 800 of the embodiment of the present disclosure may include a processor 801 , a memory 802 , and a communication bus 803 .

[0100] In the specific embodiment, the processor 801 may be at least one of an application-specific integrated circuit (ASIC), a digital signal processor (DSP), a digital signal processing device (DSPD), a programmable logic device (PLD), a field programmable gate array (FPGA), a CPU, a controller, a microcontroller, and a microprocessor. It is understandable that for different devices, the electronic device used to implement the processor function may also be other, which is not specifically limited in this embodiment.

[0101] In the embodiment of the present disclosure, the communication bus 803 is used to realize the connection and communication between the processor 801 and the memory 802; the memory 802 stores program instructions for predicting data security risks; when the processor 801 executes the program instructions stored in the memory 802, the present disclosure is realized in combination with the attached Figures 1 to 7 A method for predicting data security risks is described.

[0102] Combination of the above Figure 8 A device for predicting data security risks that can be used to perform the present disclosure is described. It should be understood that the device structure or architecture here is merely exemplary, and the implementation method and implementation entity of the present application are not limited thereto, but can be changed without departing from the spirit of the present application. It can be understood that the description of each embodiment of the present disclosure emphasizes the differences between the various embodiments, and the same or corresponding parts can be referenced to each other. For the purpose of brevity, the present disclosure will not go into details one by one.

[0103] According to the above description in combination with the accompanying drawings, those skilled in the art can also understand that the embodiments of the present application can also be implemented by a software program. Therefore, the present application also provides a computer-readable storage medium. The computer-readable storage medium stores program instructions for predicting data security risks, and the program instructions can be used to implement the present disclosure in combination with the accompanying drawings. Figures 1 to 7 A method for predicting data security risks is described.

[0104] It should be noted that although the operations of the method of the present application are described in a specific order in the accompanying drawings, this does not require or imply that the operations must be performed in this specific order, or that all the operations shown must be performed to achieve the desired results. On the contrary, the steps depicted in the flow chart can be performed in a different order. Additionally or alternatively, some steps can be omitted, multiple steps can be combined into one step, and / or one step can be decomposed into multiple steps.

[0105] Although multiple embodiments of the present disclosure have been shown and described herein, it will be apparent to those skilled in the art that such embodiments are provided by way of example only. Those skilled in the art may think of many changes, modifications, and alternatives without departing from the thought and spirit of the present disclosure. It should be understood that in the process of practicing the present disclosure, various alternatives to the embodiments of the present disclosure described herein may be adopted. The attached claims are intended to define the scope of protection of the present disclosure, and therefore cover equivalents or alternatives within the scope of these claims.

[0106] The collection and acquisition of various data in this application complies with relevant laws and regulations and is authorized by the data provider. Any organization or individual that needs to obtain external data must obtain authorization in accordance with the law and ensure data security. It is not allowed to illegally collect, use, process, or transmit unauthorized or unprotected data, or to illegally buy, sell, provide, or disclose unauthorized or unprotected data.

Claims

1. A method for predicting data security risks, comprising: Constructing a topological graph between nodes of the target object according to the node type, wherein the topological graph includes horizontal associations between nodes of the same node type and vertical associations between nodes of different node types; Determining a security event sequence and a candidate node set of the topological graph according to data security events that have occurred at each node in the topological graph, wherein the candidate node is a node in the topological graph that is directly adjacent to the end node of the security event sequence and has not yet experienced a data security event; and The security event sequence is input into a preset security event prediction model to perform security event prediction to obtain the data security risk value of each candidate node in the candidate node set.

2. The method according to claim 1, wherein: The node types include personnel, data, application systems and cloud resources.

3. The method according to claim 2, wherein: The topology diagram between the nodes of the target object is constructed according to the node type, including: Using a risk feature detection tool to detect the risk feature of each node in the topology graph; and Based on the risk characteristics, the possibility of a data security incident occurring at each node is determined.

4. The method according to claim 1, after obtaining the data security risk value of each candidate node in the candidate node set, the method further comprises: Determining the value-weighted risk of each candidate node based on the data security value and the data security risk value of each candidate node; as well as Event warnings and prevention tips are output externally based on the value-weighted risks.

5. The method according to claim 4, wherein: The data security value is determined based on the value factors of the candidate node; the value factors include: whether it is a data node or a node that directly stores data, whether the amount of stored data is greater than 1000, whether the level of stored data is a preset level or above, whether the stored data is generated or updated within a preset time limit, and whether the stored data is interrelated with other data sets.

6. The method according to claim 3, wherein: Inputting the security event sequence into a preset security event prediction model to perform security event prediction to obtain the data security risk value of each candidate node in the candidate node set includes: Inputting the security event sequence into a preset security event prediction model to perform security event prediction, so as to obtain the possibility of each node type being attacked after the security event sequence occurs and the probability of a data security event occurring when a node of each node type is attacked; and The data security risk value of the candidate node is determined based on the node type of the candidate node, the risk characteristics of the candidate node, the possibility of a data security incident occurring at the candidate node, the possibility of each node type being attacked, and the probability of a data security incident occurring when a node of each node type is attacked.

7. The method according to claim 3, after determining the possibility of a data security incident occurring at each node, the method further comprises: sorting the likelihood of a data security event occurring at each node to determine a data security event corresponding to the maximum likelihood of each node; as well as A possible event prompt is outputted externally for the data security event corresponding to the maximum possibility value.

8. The method according to any one of claims 1 to 7, wherein: The preset security event prediction model is a model obtained by training using a machine learning model. The preset security event prediction model obtained by training using a machine learning model includes: Collecting and analyzing the historical security event data of the training object to obtain the security event sequence and induced security event information of the training object, wherein the induced security event information includes the node type attacked after the security event sequence and the data security event occurring in the attacked node; and The security event sequence and the induced security event information are input into the machine learning model as training data to train the machine learning model and obtain the preset security event prediction model.

9. An electronic device, comprising: processor; as well as A memory storing program instructions for predicting data security risks, wherein when the program instructions are executed by the processor, the electronic device executes the method according to any one of claims 1-8.

10. A computer-readable storage medium storing program instructions for predicting data security risks, wherein when the program instructions are executed by a processor, the method according to any one of claims 1 to 8 is implemented.

Images