Data security risk assessment system based on artificial intelligence

Abstract

The present invention relates to the field of information security, and discloses an artificial intelligence-based data security risk assessment system for solving the problem that the source of high-risk abnormal behavior cannot be identified when performing data security risk assessment. The system comprises the following steps: collecting multi-source data, obtaining an event abnormality index based on the multi-source data assessment, screening out high-risk events based on the event abnormality index, marking the high-risk events, constructing a behavior chain based on the screened high-risk events, finding out the causal relationship through correlation analysis of the behavior chain, generating a complete event chain, calculating the traceability coefficient of the event chain, marking the event chain as traceable based on the traceability coefficient, tracing the event chain marked as a traceable chain, locating the risk source, and processing the risk source through a security team, effectively intercepting abnormal behavior from the source, preventing similar attacks from happening again, and effectively improving data security.

Description

Technical Field

[0001] The present invention relates to the field of information security, and more specifically to a data security risk assessment system based on artificial intelligence. Background Art

[0002] Data security risk refers to the possibility that the confidentiality, integrity and availability of data may be damaged due to vulnerabilities, potential threats or human negligence in the storage, transmission, access or processing of data. These risks may lead to security incidents such as data leakage, tampering and loss, which in turn may affect the interests, privacy and compliance of organizations or individuals.

[0003] With the deepening of digital transformation, the amount of enterprise data has grown rapidly, and data security threats have become increasingly complex. Traditional static data security risk assessment methods are usually based on fixed rules and predefined strategies. They identify known risks and vulnerabilities in the system through regular scanning, vulnerability assessment, and manual inspection. However, this risk assessment method cannot identify the source of high-risk abnormal behavior, intercept it at the source, fundamentally solve the risk problem, prevent similar attacks from happening again, and effectively improve data security.

[0004] In view of the above problems, the present invention proposes a solution. Summary of the invention

[0005] In order to overcome the above-mentioned defects of the prior art, the present invention provides a data security risk assessment system based on artificial intelligence to solve the problems existing in the above-mentioned background technology.

[0006] To achieve the above object, the present invention provides the following technical solutions:

[0007] A data security risk assessment system based on artificial intelligence, the system comprising:

[0008] The abnormal event marking module is used to collect multi-source data, including traffic data, user behavior data and log data, obtain an event abnormality index based on the multi-source data evaluation, screen out high-risk events based on the event abnormality index, and mark the high-risk events;

[0009] Behavior chain building module, used to build behavior chains based on the screened high-risk events;

[0010] The causal chain generation module is used to find out the causal relationship and generate a complete event chain through correlation analysis of the behavior chain;

[0011] The traceability chain screening module is used to calculate the traceability coefficient of the event chain through the constructed event chain. The calculation formula is: , where AC is the traceability coefficient, n is the number of events in the event chain, EX i is the event anomaly index of the ith event in the event chain, and is marked as traceable according to the traceability coefficient;

[0012] The traceability module is used to trace the event chain marked as a traceable chain, locate the risk source, and handle the risk source through the security team.

[0013] Preferably, the step of obtaining the event abnormality index based on multi-source data evaluation is:

[0014] Obtain flow data from multiple sources, and calculate flow anomaly coefficients based on the flow data;

[0015] Obtain user behavior data from multi-source data, and calculate the user behavior abnormality coefficient based on the user behavior data;

[0016] Obtain the number of error logs and warning logs corresponding to the log data in the multi-source data, and calculate the log anomaly coefficient based on the number of error logs and warning logs corresponding to the log data. The calculation formula is: , where LE is the log anomaly coefficient, num c Indicates the number of error logs corresponding to the log data, num j Indicates the number of warning logs corresponding to the log data;

[0017] The event anomaly index is calculated based on the traffic anomaly coefficient, user behavior anomaly coefficient, and log anomaly coefficient. The calculation formula is: , where EX represents the event anomaly index, AT represents the traffic anomaly coefficient, AB represents the user behavior anomaly coefficient, LE represents the log anomaly coefficient, and a1, a2, and a3 represent the weight coefficients of the traffic anomaly coefficient, the user behavior anomaly coefficient, and the log anomaly coefficient.

[0018] Preferably, the step of calculating the flow anomaly coefficient according to the flow data is:

[0019] Obtain traffic data from multi-source data, including packet rate, bandwidth usage, traffic peak, and session frequency, and calculate the traffic anomaly coefficient based on the traffic data. The calculation formula is: , where AT represents the traffic anomaly coefficient, sl represents the packet rate, dl represents the bandwidth utilization, hl represents the session frequency, and lf represents the traffic peak value.

[0020] Preferably, the step of calculating the user behavior abnormality coefficient based on the user behavior data is:

[0021] Obtain user behavior data, including login frequency, number of failed login attempts, and session duration, and calculate the user behavior abnormality coefficient based on the user behavior data. The calculation formula is: , where AB represents the user behavior abnormality coefficient, dp represents the login frequency, sd represents the number of failed login attempts, and ht represents the session duration.

[0022] Preferably, the step of screening out high-risk events according to the event abnormality index is:

[0023] The event anomaly index is compared with the preset threshold. If the event anomaly index is less than the preset threshold, the event is judged to have a low risk and is not a high-risk event; if the event anomaly index is greater than or equal to the preset threshold, the event is judged to have a high risk and is a high-risk event.

[0024] Preferably, the steps of constructing a behavior chain based on the screened high-risk events are:

[0025] Collect and record relevant operational behaviors before and after high-risk events during the detection period;

[0026] Connect the relevant operational behaviors collected before and after the high-risk events to form a behavior chain;

[0027] Screen and filter each operation behavior on the behavior chain to exclude normal batch operations and operations that conform to normal working modes.

[0028] Preferably, the steps of finding out the causal relationship through correlation analysis of the behavior chain and generating a complete event chain are:

[0029] Conduct causal analysis on the behavior chain to determine the relationships between various operation behaviors. Use graph analysis algorithms to construct the relationships between various operation behaviors into an event chain.

[0030] Preferably, the step of performing traceability marking according to the traceability coefficient is:

[0031] The traceability coefficient is compared with the traceability threshold. If the traceability coefficient is less than the traceability threshold, the behavior chain is determined to be untraceable; if the traceability coefficient is greater than or equal to the traceability threshold, the behavior chain is determined to be traceable, and the event chain is recorded as a traceable chain.

[0032] Technical effects and advantages of the present invention:

[0033] 1. Collect multi-source data, evaluate the event anomaly index based on the multi-source data, and screen out high-risk events based on the event anomaly index. Multi-source data collection covers information from multiple dimensions such as network traffic, user behavior, and system logs, allowing the system to more comprehensively capture the characteristics of security events. This multi-dimensional analysis improves the coverage of threat detection and can identify potential threats that may be missed by a single data source; the event anomaly index is calculated through a comprehensive evaluation of multi-source data, which can identify more complex attack patterns and effectively reduce false positives and false negatives. The signals provided by different data sources refer to each other when calculating the event anomaly index, which can more accurately locate abnormal behaviors and thus screen out real high-risk events.

[0034] 2. Build a behavior chain based on the selected high-risk events. By building a behavior chain, the causal relationship and correlation between high-risk events can be clarified. The behavior chain can help the security team trace the attack path, thereby identifying the attacker's potential behavior patterns and intrusion path; the construction of the behavior chain can link separate high-risk events together, thereby reducing the possibility of false positives, helping the analysis system to more accurately distinguish normal activities from potential attacks, and improving the accuracy of detection.

[0035] 3. Through correlation analysis of the behavior chain, find out the cause and effect relationship and generate a complete chain of events. A complete chain of events can help the security team trace back to the source of the attack and analyze the attacker's intrusion path and means. After identifying the cause and effect relationship, it can be clear which operations are triggered by which events, thereby revealing the overall logic of the attack and helping to prevent similar attacks from happening again; through the complete chain of events obtained through correlation analysis, it can be seen how each step of the attack is promoted, thereby helping the security team understand the attacker's intentions. Such a cause and effect relationship reveals the strategy and goals behind the attack, allowing the team to carry out more targeted protection.

[0036] 4. By constructing the event chain, calculate the traceability coefficient of the event chain, and mark the traceability according to the traceability coefficient. The traceability coefficient calculated by the event anomaly index can identify chains with greater traceability value, which enables the security team to clearly identify the key nodes, associated paths and causal relationships in the event, quickly lock the source of the attack, and thus improve the accuracy and comprehensiveness of the traceability analysis, helping the team to efficiently track malicious operations. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 It is the overall structure diagram of the present invention. DETAILED DESCRIPTION

[0038] The technical solution of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the present invention. In addition, the forms of the various structures recorded in the following embodiments are merely illustrative. The artificial intelligence-based data security risk assessment system involved in the present invention is not limited to the various structures recorded in the following embodiments. All other implementations obtained by ordinary technicians in this field without making creative work belong to the scope of protection of the present invention.

[0039] The present invention provides a data security risk assessment system based on artificial intelligence, the system comprising:

[0040] An abnormal event marking module is used to collect multi-source data, including traffic data, user behavior data and log data, evaluate the multi-source data to obtain an event abnormality index, screen out high-risk events according to the event abnormality index, and mark the high-risk events. The marking is to assign a unique identifier to each screened high-risk event so as to track and associate them in subsequent steps;

[0041] In this embodiment, it should be specifically explained that the step of obtaining the event abnormality index based on multi-source data evaluation is:

[0042] Obtain traffic data from multiple sources and calculate the traffic anomaly coefficient based on the traffic data. The traffic data in the event refers to the detailed information of the data packets transmitted in the network within a specific time period. Traffic data can reflect the patterns and characteristics of network activities. By analyzing this data, the difference between normal traffic and abnormal traffic can be identified, thus providing an important basis for network security monitoring. The calculation of the traffic anomaly coefficient is based on this data, which helps to assess potential security risks in the network, such as network attacks, data leaks or other malicious behaviors.

[0043] Obtain user behavior data from multi-source data, and calculate the user behavior anomaly coefficient based on the user behavior data. The user behavior data in the event refers to the various operations and activities of users in the system or application recorded within a specific period of time. These data can reflect the user's behavior patterns and habits. By analyzing the user behavior data, the difference between normal and abnormal behavior can be identified, thereby providing an important basis for security monitoring and risk assessment. The calculation of the user behavior anomaly coefficient is based on these data, which helps to timely detect potential security threats, such as account theft, internal abuse or other improper behavior, thereby ensuring the security of the system and data;

[0044] Obtain the number of error logs and warning logs corresponding to the log data in the multi-source data, and calculate the log anomaly coefficient based on the number of error logs and warning logs corresponding to the log data. The calculation formula is: , where LE is the log anomaly coefficient, num c Indicates the number of error logs corresponding to the log data, num j Indicates the number of warning logs corresponding to the log data;

[0045] The log anomaly coefficient can help security teams quickly identify potential security threats in the system. When the number of error logs or warning logs increases suddenly, this may indicate an attack, system failure, or abnormal operation. Timely detection of these anomalies can facilitate a rapid response. By monitoring the log anomaly coefficient, organizations can assess the overall health of the system. If the log anomaly coefficient continues to be higher than normal, it may indicate potential problems in the system, such as software failures, configuration errors, or resource bottlenecks. Changes in the log anomaly coefficient can be used for trend analysis to help the team identify long-standing problems or potential risks. For example, if the number of error logs increases over time, the system may need to be analyzed and optimized in depth.

[0046] The event anomaly index is calculated based on the traffic anomaly coefficient, user behavior anomaly coefficient, and log anomaly coefficient. The calculation formula is: , where EX is the event anomaly index, AT is the traffic anomaly coefficient, and the degree of traffic anomaly is closely related to the overall anomaly degree of the event. When the traffic anomaly coefficient increases, it usually indicates that the data flow pattern in the network has changed significantly, which may involve abnormal packet rate, bandwidth usage, traffic peak and session frequency. This phenomenon may indicate potential security threats, such as malicious attacks, data leakage or network abuse. Therefore, monitoring and analyzing the changes in the traffic anomaly coefficient can provide real-time alerts for the security team to help them identify and respond to abnormal events in a timely manner and reduce potential risks. At the same time, as a comprehensive performance of the traffic anomaly coefficient, the event anomaly index can reflect the overall security situation of the system at a higher level, prompting organizations to implement security policies and resource allocation more effectively to protect data security and system integrity. AB is the user behavior anomaly coefficient. The degree of user behavior anomaly directly affects the degree of overall event anomaly. When the user behavior anomaly coefficient increases, it usually indicates that a user's activity pattern has deviated significantly, such as frequent login attempts, abnormal access time or unusual operation behavior. This deviation may reflect potential security risks, such as account theft, malicious internal behavior or other unauthorized operations. Therefore, monitoring changes in the user behavior anomaly coefficient provides an important early warning signal for the security team, helping them to identify and respond to possible security threats in a timely manner. LE is represented by the log anomaly coefficient. Abnormal activities in the system log are closely related to the degree of abnormality of the overall event. When the log anomaly coefficient rises, it usually indicates that certain operations or event records in the system show abnormal patterns, such as frequent error logs, unauthorized access records, or abnormal system calls. Such log anomalies may indicate potential security threats, such as malicious attacks, internal abuse, system failures, or compliance issues. Therefore, by monitoring changes in the log anomaly coefficient, the security team can capture possible abnormal behaviors in a timely manner and take corresponding countermeasures. a1, a2, and a3 are represented as the weight coefficients of the traffic anomaly coefficient, user behavior anomaly coefficient, and log anomaly coefficient. The specific values ​​of a1, a2, and a3 are determined by professionals according to actual conditions. For example, a1, a2, and a3 can be 0.4, 0.2, and 0.4.

[0047] In this embodiment, it should be specifically explained that the step of calculating the flow anomaly coefficient according to the flow data is:

[0048] Obtain traffic data from multi-source data, including packet rate, bandwidth usage, traffic peak, and session frequency, and calculate the traffic anomaly coefficient based on the traffic data. The calculation formula is: , where AT is the traffic anomaly coefficient, sl is the packet rate, dl is the bandwidth usage, hl is the session frequency, lf is the traffic peak, and ln is the logarithmic function with base e. It represents the logarithmic processing of the peak flow rate, and 1 is added to ensure that the result is a positive value.

[0049] Traffic anomaly coefficients can be used to detect potential security threats in the network. When the packet rate or traffic peak increases abnormally, it may indicate the presence of network attacks or malicious traffic. Timely identification of these abnormal traffic can help security teams respond quickly and take necessary protective measures; traffic anomaly coefficients help evaluate the health of network performance. By monitoring bandwidth utilization and session frequency, network bottlenecks or overload problems can be identified, thereby providing a basis for optimizing and adjusting network resources and improving overall network performance; when the traffic anomaly coefficient is abnormal, network administrators can deeply analyze specific traffic data and quickly locate the root cause of the problem, such as identifying traffic anomalies caused by a certain application or service. This troubleshooting capability can reduce the impact of system failures on business operations; the calculation of traffic anomaly coefficients can help establish a baseline for normal traffic, thereby providing a reference for subsequent traffic analysis. By comparing with the baseline, abnormal traffic patterns can be effectively identified, thereby improving the accuracy of monitoring.

[0050] In this embodiment, it should be specifically explained that the step of calculating the user behavior abnormality coefficient according to the user behavior data is:

[0051] Obtain user behavior data, including login frequency, number of failed login attempts, and session duration, and calculate the user behavior abnormality coefficient based on the user behavior data. The calculation formula is: , where AB represents the user behavior abnormality coefficient, dp represents the login frequency, which is the number of times a user logs in within a certain period of time. An abnormally high login frequency may indicate brute force or account theft, sd represents the number of failed login attempts, and consecutive failed login attempts may indicate that an attacker is trying to gain access rights. ht represents the session duration, which indicates whether the duration of the user session is abnormal. For example, an extremely short session time may indicate unauthorized access.

[0052] The user behavior anomaly coefficient can help identify potential security threats. For example, frequent failed login attempts may indicate the risk of brute force attacks or account theft. By monitoring changes in the anomaly coefficient, the security team can take timely measures to prevent unauthorized access; analyzing the user behavior anomaly coefficient can help understand the user's normal usage patterns. If a user's behavior deviates significantly from its historical record, it may indicate that the account has been abused or operated abnormally, thus providing a warning signal to the security team; by monitoring the user behavior anomaly coefficient, the organization can evaluate the rationality of user permissions. For example, if a user's session lasts too long and logs in frequently, it may be necessary to review the user's permissions to ensure that they do not have access beyond the normal range.

[0053] In this embodiment, it should be specifically explained that the step of screening out high-risk events according to the event abnormality index is:

[0054] The event anomaly index is compared with the preset threshold. If the event anomaly index is less than the preset threshold, the event is judged to have a low risk and is not a high-risk event; if the event anomaly index is greater than or equal to the preset threshold, the event is judged to have a high risk and is a high-risk event.

[0055] Behavior chain building module, used to build behavior chains based on the screened high-risk events;

[0056] In this embodiment, it should be specifically explained that the steps of constructing a behavior chain based on the screened high-risk events are:

[0057] Collect and record relevant operational behaviors before and after the high-risk event within the detection time period, and the detection time period can be 30 seconds before and after each;

[0058] The collected related operation behaviors before and after the high-risk event are linked together to form a behavior chain, which includes the timestamp, operation type, user information and related resources of each operation;

[0059] Screen and filter each operation behavior on the behavior chain to exclude normal batch operations and operations that conform to normal working modes.

[0060] By building a behavior chain, the causal relationship and association between high-risk events can be clarified. The behavior chain can help the security team trace the attack path, thereby identifying the attacker's potential behavior patterns and intrusion path; the construction of the behavior chain can link separate high-risk events together, thereby reducing the possibility of false positives. For example, some single events may be isolated anomalies, but if they are connected in series with other events to form a chain, they may mean a more serious threat. The behavior chain can help the analysis system more accurately distinguish between normal activities and potential attacks, and improve the accuracy of detection; the behavior chain provides a framework for the tracing analysis of events, making it easier for the security team to find the source and understand the full picture of the attack. By tracing the behavior chain, you can clearly understand the attacker's entry point, the victim system, and the subsequent operation steps, so as to formulate a more effective response strategy, speed up the handling of the incident, and prevent further losses.

[0061] The causal chain generation module is used to find possible causal relationships and generate a complete event chain through correlation analysis of the behavior chain;

[0062] A complete chain of events can help security teams trace back to the source of an attack and analyze the attacker's intrusion path and means. After identifying the cause-and-effect relationship, it is possible to clarify which operations are triggered by which events, thereby revealing the overall logic of the attack. This precise tracing is particularly critical for quickly understanding the attacker's initial entry and methods, which helps prevent similar attacks from happening again; the complete chain of events obtained through correlation analysis can show how each step of the attack is carried out, thereby helping the security team understand the attacker's intentions. For example, an attacker may first steal data, then perform privilege escalation operations, and finally cover up the traces and escape. Such a cause-and-effect relationship reveals the strategy and goals behind the attack, allowing the team to carry out more targeted protection; some complex attacks are implemented step by step through multiple steps, and a single step may seem harmless or inconspicuous. The event chain generated by correlation analysis can splice these scattered events into a complete attack process, thereby revealing more complex multi-stage attacks.

[0063] In this embodiment, it should be specifically explained that the steps of finding possible causal relationships through correlation analysis of the behavior chain and generating a complete event chain are as follows:

[0064] Conduct causal analysis on the behavior chain to determine the relationship between various operation behaviors. For example, whether a login behavior triggers the subsequent file download, whether sensitive data is accessed through privilege escalation;

[0065] Using graph analysis algorithms, the relationships between various operation behaviors are constructed into an event chain.

[0066] The graph analysis algorithm is a technique for building and analyzing graph structures from nodes (events or operations) and edges (the relationships between them), and is often used to identify and visualize causal relationships in complex systems. When building causal chains, traversal algorithms such as depth-first search (DFS) or breadth-first search (BFS) can be used to explore direct and indirect connections between events. By calculating indicators such as graph connectivity, path length, and centrality, key nodes and potential threats can be revealed, facilitating in-depth understanding and response to complex event sequences.

[0067] The traceability chain screening module is used to calculate the traceability coefficient of the event chain through the constructed event chain. The calculation formula is: , where AC is the traceability coefficient, n is the number of events in the event chain, EX i is the event anomaly index of the ith event in the event chain, and is marked as traceable according to the traceability coefficient.

[0068] The cumulative value of the event anomaly index reflects the comprehensive risk level in the entire chain. A high traceability coefficient indicates that there are significant anomalies in multiple events in the chain, indicating that the chain may contain important attack paths or associated behaviors, and therefore has more value for traceability analysis; by summing the anomaly index, the degree of abnormal aggregation of each event in the chain can be measured. If the anomaly index of all events in the chain is high, it means that there may be a close connection between these events, forming a continuous attack chain, which makes it easier to find the source of the attack or key nodes through traceability analysis; a chain with a high traceability coefficient indicates that the events in the chain have strong abnormal characteristics, and traceability analysis resources can be concentrated on these chains, which helps to track the attack path more efficiently and reduce resource waste; a chain with a low traceability coefficient may contain noise events or irrelevant events. By summing the anomaly index to screen out high-priority chains, false alarms caused by the anomaly index of individual isolated events can be avoided, and the accuracy of traceability analysis can be improved.

[0069] The traceability coefficient can reflect the traceability possibility and importance of the event chain, helping the security team to identify chains that are more worthy of priority investigation. This tag provides the team with a clear priority sorting, allowing it to concentrate resources more efficiently, prioritize high-risk chains, and avoid excessive attention to low-risk chains, thereby improving the overall security response efficiency; the traceability coefficient calculated by the event anomaly index can identify chains with greater traceability value. This allows the security team to clearly identify the key nodes, associated paths, and causal relationships in the event, quickly lock the source of the attack, and thus improve the accuracy and comprehensiveness of the traceability analysis, helping the team to efficiently track malicious operations; the traceability tag can help the security team allocate resources reasonably. Marking chains with high traceability coefficients can ensure that more resources and analysis time are allocated first, effectively improving the speed of incident response. This mechanism avoids waste of resources and shortens the response time from identification to processing.

[0070] In this embodiment, it should be specifically explained that the step of performing traceability marking according to the traceability coefficient is:

[0071] The traceability coefficient is compared with the traceability threshold. If the traceability coefficient is less than the traceability threshold, the behavior chain is determined to be untraceable; if the traceability coefficient is greater than or equal to the traceability threshold, the behavior chain is determined to be traceable, and the event chain is recorded as a traceable chain.

[0072] The traceability module is used to trace the event chain marked as a traceable chain, locate the risk source, and handle the risk source through the security team.

[0073] By accurately tracing the source to find the starting point of the attack or the main intrusion node, the security team can quickly take measures to isolate or repair the risk source to prevent the attack from spreading further or causing more serious damage to the system. Rapid control can reduce the scope of system damage, protect sensitive data and key assets, and reduce potential losses; during the tracing process, the security team can analyze and repair weak links in the system. Thorough repair and strengthening of risk sources can effectively prevent attackers from repeatedly invading by exploiting the same vulnerabilities or paths, thereby improving the security and stability of the system and forming a stronger security protection barrier; the tracing process can reveal the attacker's technology, strategies and behavior patterns, forming valuable threat intelligence. This information can be used to analyze and update existing defense strategies, enabling security teams to better prevent similar attacks.

[0074] Finally: The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

[0075] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. The data security risk assessment system based on artificial intelligence is characterized by: The system comprises: The abnormal event marking module is used to collect multi-source data, including traffic data, user behavior data and log data, obtain the event abnormality index based on the multi-source data evaluation, screen out high-risk events based on the event abnormality index, and mark the high-risk events; Behavior chain building module, used to build behavior chains based on the screened high-risk events; The causal chain generation module is used to find out the causal relationship and generate a complete event chain through correlation analysis of the behavior chain; The traceability chain screening module is used to calculate the traceability coefficient of the event chain through the constructed event chain. The calculation formula is: , where AC is the traceability coefficient, n is the number of events in the event chain, EX i is the event anomaly index of the ith event in the event chain, and is marked as traceable according to the traceability coefficient; The traceability module is used to trace the event chain marked as a traceable chain, locate the risk source, and handle the risk source through the security team; The step of obtaining the event abnormality index based on multi-source data evaluation is as follows: Obtain flow data from multiple sources, and calculate flow anomaly coefficients based on the flow data; Obtain user behavior data from multi-source data, and calculate the user behavior abnormality coefficient based on the user behavior data; Obtain the number of error logs and warning logs corresponding to the log data in the multi-source data, and calculate the log anomaly coefficient based on the number of error logs and warning logs corresponding to the log data. The calculation formula is: , where LE is the log anomaly coefficient, num c Indicates the number of error logs corresponding to the log data, num j Indicates the number of warning logs corresponding to the log data; The event anomaly index is calculated based on the traffic anomaly coefficient, user behavior anomaly coefficient, and log anomaly coefficient. The calculation formula is: , where EX represents the event anomaly index, AT represents the traffic anomaly coefficient, AB represents the user behavior anomaly coefficient, LE represents the log anomaly coefficient, and a1, a2, and a3 represent the weight coefficients of the traffic anomaly coefficient, the user behavior anomaly coefficient, and the log anomaly coefficient; The step of calculating the flow anomaly coefficient according to the flow data is as follows: Obtain traffic data from multi-source data, including packet rate, bandwidth usage, traffic peak, and session frequency, and calculate the traffic anomaly coefficient based on the traffic data. The calculation formula is: , where AT represents the traffic anomaly coefficient, sl represents the packet rate, dl represents the bandwidth utilization, hl represents the session frequency, and lf represents the traffic peak value; The step of calculating the user behavior abnormality coefficient based on the user behavior data is as follows: Obtain user behavior data, including login frequency, number of failed login attempts, and session duration, and calculate the user behavior abnormality coefficient based on the user behavior data. The calculation formula is: , where AB represents the user behavior abnormality coefficient, dp represents the login frequency, sd represents the number of failed login attempts, and ht represents the session duration; The steps of performing traceability marking according to the traceability coefficient are as follows: The traceability coefficient is compared with the traceability threshold. If the traceability coefficient is less than the traceability threshold, the behavior chain is determined to be untraceable; if the traceability coefficient is greater than or equal to the traceability threshold, the behavior chain is determined to be traceable, and the event chain is recorded as a traceable chain.

2. The data security risk assessment system based on artificial intelligence according to claim 1 is characterized in that: The steps of screening out high-risk events according to the event abnormality index are: Compare the event anomaly index with the preset threshold. If the event anomaly index is less than the preset threshold, the event is judged to have low risk and not a high-risk event. If the event abnormality index is greater than or equal to the preset threshold, the event is judged to be a high-risk event.

3. The data security risk assessment system based on artificial intelligence according to claim 1, characterized in that: The steps of constructing the behavior chain based on the screened high-risk events are: Collect and record relevant operational behaviors before and after high-risk events during the detection period; Connect the relevant operational behaviors collected before and after high-risk events to form a behavior chain; Screen and filter each operation behavior on the behavior chain to exclude normal batch operations and operations that conform to normal working modes.

4. The data security risk assessment system based on artificial intelligence according to claim 1, characterized in that: The steps of finding out the causal relationship through correlation analysis of the behavior chain and generating a complete event chain are as follows: Conduct causal analysis on the behavior chain to determine the relationships between various operation behaviors. Use graph analysis algorithms to construct the relationships between various operation behaviors into an event chain.

Images