A cybersecurity management method and system for digital assets

Abstract

The present application provides a network security management method and system for digital assets, including: obtaining a digital asset list and business process documents, using natural language processing technology to identify keywords in the documents, constructing a correlation map between digital assets and business processes, and discovering potential correlations; extracting business process nodes directly connected to each digital asset from the correlation map, generating an asset business impact range report, and displaying the many-to-many mapping relationship between assets and businesses in a matrix form; during the review process, dynamically presenting the correlation and quantitative indicators between assets, risks, and business processes through visualization technology, including risk heat maps, impact degree scatter plots, etc., to provide all parties with an intuitive information transmission channel; after reaching a consensus during the review, the qualitative impact analysis of the business department and the quantitative loss estimation of the technical department are integrated into the business impact analysis results using a fuzzy comprehensive evaluation method to obtain a comprehensive business impact level.

Description

Technical Field

[0001] The present invention relates to the field of information technology, and in particular to a network security management method and system for digital assets. Background Art

[0002] In the cybersecurity risk management of digital assets, the business impact analysis of security risks is a key but easily overlooked link. Although security risk assessment can identify the threats and vulnerabilities faced by digital assets, it is difficult to accurately judge the severity and priority of risks without in-depth analysis of the potential impact of these risks on business operations. To conduct an effective business impact analysis, it is first necessary to comprehensively sort out the complex relationship between digital assets and business processes, which is itself a very time-consuming and labor-intensive task. In practice, the information held by different departments is often incomplete, and business and technical personnel lack understanding of each other's fields, resulting in inaccurate identified relationships and omissions of important links. At the same time, business impact analysis requires quantitative assessment of the losses caused by security incidents, but many indirect losses are difficult to quantify, such as reputation damage and customer loss. Moreover, there is no unified standard for how to weigh different types of losses. These difficulties have led to superficial business impact analysis and failed to provide strong support for subsequent security strategy formulation and resource allocation. Summary of the invention

[0003] The present invention provides a digital asset-oriented network security management method, which mainly includes:

[0004] Obtain a list of digital assets and business process documents, use natural language processing technology to identify keywords in the documents, build a relationship map between digital assets and business processes, and discover potential associations; extract business process nodes directly connected to each digital asset from the relationship map, generate a digital asset business impact range report, and display the many-to-many mapping relationship between digital assets and businesses in a matrix format; use a rule-based reasoning engine to determine the business interruption impact level of each digital asset based on one or more preset multi-dimensional indicators including business interruption time threshold, impact range threshold, data sensitivity, and business criticality, and form a preliminary business impact analysis result; associate the preliminary business impact analysis results with the business impact range report, and conduct preliminary business impact analysis on digital assets with high risk levels and large business impact ranges; Digital assets trigger the joint review mechanism of the business department and the technical department, and automatically generate the review agenda and related materials; during the review process, the relationship and quantitative indicators between assets, risks, and business processes are dynamically presented through visualization technology, including risk heat maps and impact degree scatter plots, providing an intuitive information transmission channel for all parties; after the review reaches a consensus, the qualitative impact analysis of the business department and the quantitative loss estimation of the technical department are integrated into the business impact analysis results using the fuzzy comprehensive evaluation method to obtain a comprehensive business impact level; based on the comprehensive business impact level of digital assets and the known security risk level, the hierarchical analysis method is used to determine the risk disposal priority, and based on the preset risk disposal rule base, corresponding security reinforcement measures are recommended to form a complete digital asset security risk disposal plan.

[0005] The present invention provides a network security management system for digital assets, which mainly includes: a digital asset and business process association analysis module, which is used to construct an association relationship map and generate an impact range report; a preliminary business impact analysis module, which is used to determine the business interruption impact level of digital assets based on multi-dimensional indicators; a joint review mechanism trigger module, which is used to associate security risk assessment results and automatically generate review materials; a visual decision support module, which is used to dynamically present the association and quantitative indicators between assets, risks, and business processes; a comprehensive assessment and risk disposal module, which is used to integrate qualitative and quantitative analysis and recommend security reinforcement measures. The technical solution provided by the embodiment of the present invention may include the following beneficial effects:

[0006] The present invention discloses a network security management method for digital assets. The method constructs a correlation relationship map between digital assets and business processes through natural language processing technology, and generates an asset business impact range report. Multidimensional indicators are used to judge the business interruption impact level of digital assets, and it is associated with the security risk assessment results. For high-risk and high-impact assets, a joint review mechanism of business and technical departments is triggered, and relevant information is dynamically presented through visualization technology. The fuzzy comprehensive evaluation method is used to integrate qualitative and quantitative analysis results to obtain a comprehensive business impact level. Finally, the hierarchical analysis method is used to determine the risk disposal priority, and security reinforcement measures are recommended to form a complete risk disposal plan. The present invention realizes the comprehensive assessment and precise management of digital asset security risks, and effectively improves the risk prevention and control capabilities of enterprises in the process of digital transformation. BRIEF DESCRIPTION OF THE DRAWINGS

[0007] Figure 1 The present invention is a flowchart of a digital asset-oriented network security management method.

[0008] Figure 2 A schematic diagram of a digital asset-oriented network security management method and system of the present invention.

[0009] Figure 3 This is another schematic diagram of a digital asset-oriented network security management method and system of the present invention.

[0010] Figure 4 It is a structural schematic diagram of a network security management system for digital assets of the present invention. DETAILED DESCRIPTION

[0011] In order to further understand the content of the present invention, the present invention is described in detail in conjunction with the accompanying drawings and embodiments. The present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It is understood that the specific embodiments described herein are only used to explain the relevant inventions, rather than to limit the invention. It is also necessary to explain that, for ease of description, only the parts related to the invention are shown in the accompanying drawings.

[0012] like Figure 1-4 In this embodiment, a network security management system for digital assets may specifically include:

[0013] S101. Obtain a list of digital assets and business process documents, use natural language processing technology to identify keywords in the documents, build a relationship map between digital assets and business processes, and discover potential relationships.

[0014] Obtain the enterprise's digital asset list and business process documents, perform data preprocessing on the documents, including using a Chinese word segmentation tool to perform word segmentation on the documents, and using a stop word list to remove stop words in the word segmentation results to obtain structured text data; convert the structured text data into a data format suitable for keyword extraction; use a keyword extraction algorithm to identify keywords that can characterize the subject of the document from the converted data; based on the extracted keywords, calculate the co-occurrence frequency and mutual information correlation index between the keywords, and construct a correlation relationship matrix between the keywords; use the keywords as nodes and the correlation relationships between the keywords as edges to construct a correlation relationship map between digital assets and business processes, and the weights of the edges are calculated based on the correlation between the keywords. The correlation index is determined; in the association relationship map, a community discovery algorithm is used to identify closely related keyword communities, and the keyword communities are mapped to potential association relationships between digital assets and business processes, wherein a keyword in the keyword community represents a group of digital assets that have a close connection with the business process; a business value analysis is performed on the mined potential association relationships, and the business rationality and explainability of each group of association relationships are evaluated in combination with business scenarios and domain knowledge, and high-value association relationships that can provide reference for business decisions and process optimization are screened out; the screened high-value association relationships are applied to business process optimization and digital transformation decisions, digital assets with problems or bottlenecks in the business process are identified, resource allocation is adjusted, business processes are optimized, and operational efficiency is improved.

[0015] Specifically, first, the enterprise's digital asset list and business process documents are obtained from the enterprise's digital management system, and the documents are segmented using the jieba Chinese word segmentation tool. The stop words in the segmentation results are removed using the Harbin Institute of Technology stop word list to obtain structured text data. Then, the structured text data is converted into a data format suitable for the TextRank keyword extraction algorithm. Next, the TextRank algorithm is used to identify keywords that can represent the document topic from the converted data, such as identifying keywords such as "customer information", "order management", and "transaction time". According to the extracted keywords, the co-occurrence frequency and mutual information correlation index between the keywords are calculated to construct the correlation relationship matrix between the keywords. For example, the co-occurrence frequency of "customer information" and "order management" is 8, the co-occurrence frequency of "order management" and "transaction time" is 6, and the mutual information correlation index is 7 and 5 respectively. The keywords are used as nodes and the correlation between the keywords as edges to construct the correlation relationship map between digital assets and business processes. The weight of the edge is determined according to the correlation index between the keywords. In the association graph, the Louvain community discovery algorithm is used to identify closely related keyword communities, and the keyword communities are mapped to potential associations between digital assets and business processes. For example, keywords such as "customer information", "order management", and "deal time" are divided into a community, which means that there is a close connection between customer management and order fulfillment processes. The business value analysis of the mined potential associations is carried out, and the business rationality and explainability of each group of associations are evaluated in combination with business scenarios and domain knowledge, and high-value associations that can provide reference for business decisions and process optimization are screened out. For example, through analysis, it is found that the association between customer information management and order fulfillment processes can help enterprises optimize order processing efficiency and improve customer satisfaction, so it is identified as a high-value association. Finally, the selected high-value associations are applied to business process optimization and digital transformation decisions. For example, it is identified that the slow response speed of the order management system is a bottleneck affecting order processing efficiency. The performance of the order management system is improved by optimizing the system architecture and upgrading the hardware configuration, thereby optimizing the entire order fulfillment process and improving operational efficiency.

[0016] S102. Extract the business process nodes directly connected to each digital asset from the association relationship map, generate an asset business impact range report, and display the many-to-many mapping relationship between assets and businesses in a matrix form.

[0017] Obtain a digital asset and business association relationship map, use the NetworkX library to process and analyze the association relationship map, and identify the digital asset nodes and business process nodes in the association relationship map; obtain all business process nodes directly connected to each of the digital asset nodes through depth-first search and breadth-first search algorithms; construct a digital asset-business mapping matrix based on the connection relationship between the digital asset nodes and the business process nodes, and use the TF-IDF algorithm to calculate the association strength between the digital asset nodes and the business process nodes in the digital asset-business mapping matrix; perform hierarchical clustering analysis on the digital asset-business mapping matrix, using the linkage function of the scipy library to implement it, and divide the digital asset nodes and business process nodes into several impact range clusters according to the clustering results; for each of the impact range clusters, count the number and type of digital asset nodes and business process nodes in the cluster type attributes, generate the feature vector of the impact range cluster; use the decision tree algorithm to train and predict the feature vector of the impact range cluster, use the DecisionTreeClassifier of the scikit-learn library to build a decision tree model, judge and mark the impact level of a part of the impact range cluster as training data, train the decision tree model, use the trained model to predict the feature vectors of the remaining impact range clusters, and obtain the impact level of the impact range cluster; fill in the preset impact range report template according to the impact level of each impact range cluster, and use the Jinja2 template engine to generate a business impact range report of the digital asset; summarize the business impact range reports of all digital assets, generate a digital asset business impact analysis report, and use the Matplotlib and Seaborn visualization libraries to draw a many-to-many mapping relationship diagram between digital assets and businesses and an impact range distribution diagram.

[0018] Specifically, first, obtain the association relationship data between digital assets and business from the enterprise's Configuration Management Database (CMDB), and use the NetworkX library to convert the data into a graph model. Through the depth-first search algorithm, starting from the digital asset nodes, traverse the graph to obtain the set of business process nodes directly connected to each digital asset node. According to the connection relationship between digital asset nodes and business process nodes, construct a digital asset-business mapping matrix. The matrix dimension is the number of digital assets * the number of business processes. Use the TF-IDF algorithm to calculate the value of each element in the matrix, representing the association strength between digital assets and business processes, with a value range of 0 to 1. For example, the TF-IDF value of a certain digital asset node and the order management process is 8, and the TF-IDF value with the logistics distribution process is 6. Next, perform hierarchical clustering analysis on the digital asset-business mapping matrix. Use the linkage function of the scipy library and the "ward" method to calculate the distance between nodes and generate a clustering dendrogram. According to the clustering results, using the association strength threshold of 7 as the standard, divide the digital asset nodes and business process nodes into several impact scope clusters. For each impact scope cluster, count attributes such as the number of digital asset nodes, the number of business process nodes, the distribution of digital asset types, and the distribution of business process types within the cluster to generate a feature vector for the impact scope cluster. The vector dimension is 10. Use the decision tree algorithm to train and predict the feature vectors of the impact scope clusters. Extract 30% of the impact scope cluster samples from the historical data as the training data for the decision tree model. According to the size relationship between the sample impact scope value t0 and the preset impact scope threshold t, label the impact degree level (large, small). For example, when t0 > t, label the impact degree as large; when t0 < t, label the impact degree as small. Use the Gini index as the division criterion to construct a decision tree and predict the remaining 70% of the impact scope cluster samples to output the impact degree level. Finally, according to the impact degree level of each impact scope cluster, fill in the preset Jinja2 impact scope report template to generate an HTML format report document. Summarize the impact scope reports of all digital assets to generate a digital asset business impact analysis report, and use the Matplotlib and Seaborn libraries to draw visualization charts, including the Sankey diagram of the many-to-many mapping relationship between digital assets and business, the pie chart of the impact scope cluster distribution, etc., to intuitively display the analysis results. For example, in the digital asset-business mapping relationship diagram, the connection arc widths between the CRM system and the customer management process and the order management process are 8, and the connection arc widths between the ERP system and the financial management process and the supply chain management process are 6. The impact scope cluster distribution diagram shows that the high impact scope cluster accounts for 35%, the medium impact scope cluster accounts for 45%, and the low impact scope cluster accounts for 20%. Through digital asset business impact analysis, enterprises can comprehensively evaluate the impact of digital assets on business operations, formulate targeted risk prevention and emergency response strategies, and ensure business continuity and stability.

[0019] S103. Use a rule-based reasoning engine to determine the business interruption impact level of each digital asset based on preset business interruption time thresholds, impact scope thresholds, data sensitivity, business criticality and other multi-dimensional indicators, and form preliminary business impact analysis results.

[0020] A1. Obtain multidimensional indicator data including one or more of the preset business interruption time threshold, impact range threshold, data sensitivity and business criticality as input for rule-based reasoning; for each digital asset, input its multidimensional indicator data into a pre-built decision tree model; A2. At each node of the decision tree, compare the indicator values ​​of the current digital asset with the judgment condition of the node. If the condition is met, enter the corresponding child node and continue to judge; if the condition is not met, enter another child node until the leaf node is reached to obtain the business interruption impact level of the digital asset; A3. For each digital asset's business interruption impact level judgment result, associate it with the unique identifier of the digital asset to form a business impact analysis result record; A4. Repeat steps A2 and A3 until completion. A5. Determine the business interruption impact level of all digital assets and obtain the business impact analysis result records of all digital assets; A5. Use a pivot table or group aggregation method to summarize the business impact analysis result records according to the identification information of the digital assets, and generate a business impact analysis report with digital assets as the dimension as the preliminary analysis result; A5. Use the Apriori algorithm to mine the business impact analysis results, discover the association rules between digital assets, and find out the core digital assets whose impact on key business processes exceeds the preset threshold; A6. Combine the association rules mined by the Apriori algorithm with the preliminary business impact analysis report to generate a final business impact analysis report, presenting the business interruption impact level of each digital asset and the association relationship between digital assets, and provide decision support for business continuity management.

[0021] Specifically, first, obtain multi-dimensional indicator data such as the business interruption time threshold, impact range threshold, data sensitivity, and business criticality of each digital asset from the enterprise's configuration management database (CMDB). For example, the business interruption time threshold of a database is 5 minutes, the impact range threshold is 50%, the data sensitivity is 8, and the business criticality is 9. Input these indicator data into the pre-trained decision tree model, which is built based on the CART algorithm, uses the "Gini coefficient" as the division standard, and the maximum depth of the tree is 5. The decision tree judges the indicator data at each node. For example, the judgment condition of the root node is "business interruption time threshold ≤ 10 minutes". If the condition is met, enter the left child node, otherwise enter the right child node until reaching the leaf node. The leaf node represents the business interruption impact level, which is divided into three levels: "high", "medium", and "low". Associate the impact level judgment result of each digital asset with its unique identifier (such as asset number) to form a business impact analysis result record. Use the pivot table function of the Pandas library to summarize the result records according to the asset number to generate a business impact analysis report with digital assets as the dimension. Next, the Apriori algorithm is used to mine association rules between digital assets. The minimum support is set to 0.5 and the minimum confidence is set to 8. The association rule "Database A failure → Database B failure (support = 0.7, confidence = 8.5)" is obtained, indicating that database A and database B are core assets and have a greater impact on business operations. The association rules mined by the Apriori algorithm are merged into the business impact analysis report to form a complete analysis result, providing a decision-making basis for business continuity management.

[0022] S104. Associate the preliminary business impact analysis results with the business impact scope report. For digital assets with high risk levels and large business impact scopes, trigger the joint review mechanism of the business department and the technical department, and automatically generate the review agenda and related materials.

[0023] Obtain preliminary business impact analysis results and business impact scope report, extract business impact level and impact scope attributes of each digital asset; use Apriori association rule mining algorithm to analyze the correlation between business impact level and impact scope, and obtain a list of digital assets with high risk level and large business impact scope; for the list of digital assets with high risk level and large business impact scope, match the list of business departments and technical departments related to each high-risk digital asset from the preset business department and technical department information library; according to the matched business department and technical department list corresponding to each digital asset, combined with the preset review agenda template, automatically fill in the relevant department information, and generate a joint review agenda for each digital asset, the content of the joint review agenda includes reviewing the digital asset. The risk status, impact scope assessment and response measures of digital assets; for the joint review agenda of each digital asset, according to the keywords in the joint review agenda, use the TF-IDF algorithm to retrieve the TopN materials with the highest relevance to the agenda content from the preset material library to form a review material collection for the digital asset; send the joint review agenda and the screened related material collection generated for each digital asset to the relevant business department and technical department corresponding to the digital asset to trigger the joint review process of the digital asset; after the joint review of each digital asset is completed, according to the risk response measures determined in the review results, update the risk response measure attribute field of the digital asset in the system, and record the review resolution at the same time to form a review report for the digital asset and archive it.

[0024] Specifically, the business impact level and impact range attributes of each digital asset are extracted from the preliminary business impact analysis results and the business impact range report. For example, the business impact level of database A is "high" and the impact range is "large". The extracted digital asset attribute data is input into the Apriori association rule mining algorithm, and the minimum support is set to 0.5 and the minimum confidence is set to 8. The association rule "large impact range → high business impact level (support = 0.7, confidence = 8.5)" is obtained, indicating that digital assets with large impact ranges usually have high business impact levels. According to the mined association rules, a list of digital assets with "large" impact ranges and "high" business impact levels is screened out. For each digital asset in the list, the relevant departments are matched from the preset business department and technical department information database. For example, the business department corresponding to database A is "Business Department 1" and the technical department is "IT Department". According to the matching results, combined with the preset meeting agenda template, the relevant department information is automatically filled in to generate the joint meeting agenda for the digital asset. The agenda includes reviewing the risk status of the switch, impact range assessment and response measures. For the joint review agenda of the switch, the TF-IDF algorithm is used to retrieve the top 5 materials with the highest relevance to the agenda content from the preset material library to form the review material collection of the switch. The generated joint review agenda and the selected relevant material collection are automatically sent to the relevant personnel of the Business Department 1 and IT Department through the email system to trigger the joint review process of the switch. After the review is completed, according to the risk response measures determined in the review results (such as regular inspections, configuration optimization, etc.), the risk response measure attribute field of the switch in the CMDB is automatically updated through the configuration management system. At the same time, the review resolution is recorded in the review report database in JSON format, and the document generation service is called to automatically generate a review report document in PDF format according to the review resolution and store it in the archive management system.

[0025] S105. During the review process, the relationship and quantitative indicators between assets, risks and business processes are dynamically presented through visualization technology, including risk heat maps, impact degree scatter plots, etc., to provide an intuitive information transmission channel for all parties.

[0026] Obtain data related to digital assets and risks, and calculate the correlation and impact index for each digital asset and risk; input the correlation and impact index data of the digital assets and risks into Tableau software; use the K-means clustering algorithm to group the digital assets and risks to obtain the grouping results of digital assets and risks; generate a risk heat map showing the distribution of different digital assets and risks based on the grouping results; calculate the criticality of each digital asset and risk in the business process; generate an impact scatter plot based on the impact index through Tableau's data mapping function; create a dashboard in Tableau, superimpose and fuse the risk heat map and the impact scatter plot to obtain a comprehensive Combined risk visualization map; judge and mark the risk level in the comprehensive risk visualization map according to preset thresholds; connect to real-time data sources and automatically update the comprehensive risk visualization map according to data changes. For high-risk areas identified in the comprehensive risk visualization map, use Tableau's custom annotation function to automatically generate risk explanations; send the risk explanations to relevant responsible persons through email or message push functions; collect feedback during the risk assessment review process and extract key information through text analysis; convert the key information into structured feature variables; optimize the calculation model of risk correlation and impact based on the feature variables; adjust the design of Tableau visualization graphics based on the feedback.

[0027] Specifically, the asset list and risk list data are obtained from the asset management system and risk assessment system, and the cosine similarity algorithm is used to calculate the correlation between each asset and risk, with a value range of 0 to 1. At the same time, according to the importance level of the asset and the impact range of the risk, the analytic hierarchy process AHP is used to calculate the impact index of each asset and risk, with a value range of 0 to 5. The calculated asset and risk correlation and impact index data are imported into the Tableau software through the ODBC connector. In Tableau, the K-means clustering algorithm is selected, the number of clusters k is set to 4, the maximum number of iterations is 100, and the convergence threshold is 0.01, and the assets and risks are grouped and clustered. The clustering results show that assets and risks are divided into four groups: high correlation and high impact, high correlation and low impact, low correlation and high impact, and low correlation and low impact. Based on the clustering results, a risk heat map is drawn, and different colors represent different risk levels, such as red for high risk, yellow for medium risk, and green for low risk. The PageRank algorithm is used to calculate the importance of each asset and risk in the business process network, with a value range of 0 to 1. According to the impact index, a bubble chart is generated through Tableau's data mapping function. The size of the bubble represents the impact, and the color of the bubble represents the risk level. Create a dashboard in Tableau, superimpose and fuse the risk heat map and the impact bubble map at a ratio of 80% and 20% to form a comprehensive risk visualization. For each area in the comprehensive risk visualization, the risk level is judged according to the preset risk threshold. For example, the area with an impact index greater than 4 and a correlation greater than 8 is marked as high risk, and a red warning mark is generated. The asset management system and risk assessment system are used as real-time data sources, set to refresh every 30 minutes, and automatically update the comprehensive risk visualization according to data changes. For the high-risk areas identified in the comprehensive risk visualization, Tableau's custom annotation function is used to automatically match and generate risk explanations from the risk knowledge base, such as "a large number of databases are concentrated in this area, and there are serious vulnerability risks." Send the risk explanation to the asset owner and risk manager through email or instant messaging push function. Collect feedback during the risk assessment review process, use the BERT model for text classification, extract key information such as risk description, probability of occurrence, and scope of impact, and map it into structured feature variables. Based on feature variables, machine learning algorithms such as SVM or random forest are used to optimize the original risk association and impact calculation models to improve the accuracy of risk assessment. Based on the visual design suggestions in the feedback, the layout and color matching of Tableau visualization graphics are optimized to improve the aesthetics and readability of risk visualization.

[0028] S106. After reaching a consensus during the review, the qualitative impact analysis of the business department and the quantitative loss estimate of the technical department are integrated into the business impact analysis results using the fuzzy comprehensive evaluation method to obtain a comprehensive business impact level.

[0029] Obtain the qualitative impact analysis results and quantitative loss estimation results agreed upon in the review; use natural language processing technology to extract key information from the qualitative impact analysis results and quantitative loss estimation results, and convert the key information into structured data; based on the structured data, semantically expand the qualitative impact keywords to obtain the expanded qualitative impact description; perform rationality verification on the numerical value of the quantitative loss to obtain the verified quantitative loss estimate; construct an evaluation index system that includes the expanded qualitative impact description and the verified quantitative loss estimate; use the hierarchical analysis method to determine the weight of each indicator in the evaluation index system; obtain the opinions of the business department and the technical department on the evaluation index system The evaluation data is used to form a multidimensional evaluation matrix; the LOF anomaly detection algorithm is used to identify outliers in the multidimensional evaluation matrix; the outliers are corrected to obtain a corrected multidimensional evaluation matrix; the TOPSIS method is used to comprehensively evaluate the corrected multidimensional evaluation matrix to obtain a comprehensive evaluation value of each scheme; the business impact level to which the comprehensive evaluation value belongs is determined according to a preset evaluation level standard; a business impact analysis report is automatically generated according to the business impact level, the business impact analysis report includes a qualitative impact description, a quantitative loss estimation and a comprehensive rating result and corresponding countermeasure suggestions; the business impact analysis report is pushed to relevant business continuity management personnel.

[0030] Specifically, during the review process, we collected qualitative descriptions of the business impact from all parties through brainstorming and Delphi methods, such as "system interruption will lead to an increase in customer complaints and damage to the company's reputation", and collected quantitative loss estimation data, such as "every one-hour system interruption will cause a direct economic loss of 500,000 yuan". We used the BERT model to extract keywords from the collected qualitative descriptions, extracted keywords such as "customer complaints" and "reputation damage", and performed semantic expansion based on the WordNet knowledge base to obtain extended descriptions such as "decline in user satisfaction" and "negative impact on brand image". We performed a rationality check on the quantitative loss data and eliminated outliers that exceeded 3 times the standard deviation of the historical loss amount. We constructed an evaluation index system that included qualitative indicators such as "customer satisfaction" and "brand reputation" and quantitative indicators such as "economic loss amount" and "system recovery time". We used the analytic hierarchy process (AHP) to calculate the weights of each indicator. The weights of customer satisfaction, brand reputation, economic loss amount, and system recovery time were 3, 3, 25, and 15, respectively. Scores of various indicators are collected from business departments and IT departments to form a multi-dimensional evaluation matrix. The LOF anomaly detection algorithm based on Mahalanobis distance is used to identify anomaly scores that deviate from the mean score by more than 2 standard deviations. The mean is used to replace the anomaly value to obtain a revised evaluation matrix. The TOPSIS method is used to calculate the comprehensive evaluation value of each solution. According to the preset evaluation level standard, a comprehensive evaluation value greater than 5 indicates extremely high business impact, 5-5 indicates high impact, 5-5 indicates moderate impact, 5-5 indicates low impact, and less than 5 indicates extremely low impact. A business impact analysis report is automatically generated, including a qualitative description of the impact of business interruption, quantitative loss estimation, comprehensive rating results, and corresponding risk disposal suggestions, such as "It is recommended to restore key systems within XX time to reduce customer churn", etc., and is automatically sent to the person in charge of business continuity management through the OA system.

[0031] S107. Based on the comprehensive business impact level and security risk level of digital assets, use the analytic hierarchy process to determine the risk management priority, and recommend corresponding security reinforcement measures based on the preset risk management rule base to form a complete digital asset security risk management plan.

[0032] The comprehensive business impact level and security risk level of the digital assets are obtained and used as the judgment matrix of the hierarchical analysis method; the relative importance of different indicators is determined by pairwise comparison, and the risk disposal priority vector of each digital asset is calculated; the risk disposal priority vector values ​​are sorted from high to low to determine the order of risk disposal; the corresponding security reinforcement measures are matched in the preset risk-measure mapping table according to the comprehensive business impact level and security risk level of the digital assets; if at least two of the security reinforcement measures are matched, the CART classification decision tree algorithm is used for screening, and the key attributes of digital asset value, implementation cost and protection capability are used as decision nodes to generate decision rules to obtain the optimal combination of measures for the digital assets; the screened security reinforcement measures are sorted according to the risk disposal priority to generate an initial digital asset security risk disposal plan; the initial digital asset security risk disposal plan is optimized by using the ant colony algorithm, with the comprehensive benefit maximization as the objective function and the resource consumption upper limit as the constraint condition, and the optimal disposal plan combination is searched through multiple iterations of the pheromone update mechanism; the optimized digital asset security risk disposal plan is formatted, key information is extracted, and a standardized output document is generated to form a final complete plan.

[0033] Specifically, the comprehensive business impact level and security risk level of digital assets are obtained through the CMDB asset management system, and used as the judgment matrix of the hierarchical analysis method. Using the Saaty1-9 scaling method, the relative importance of different indicators is determined by pairwise comparison, the maximum eigenvalue and corresponding eigenvector of the judgment matrix are calculated, and consistency test is performed to obtain the risk disposal priority vector of each digital asset. The order of risk disposal is determined by sorting the risk disposal priority vector values ​​from high to low. In the preset risk-measure mapping table, the comprehensive business impact level and security risk level are divided into three levels: high, medium, and low, forming 9 combinations, and each combination corresponds to 2-3 security reinforcement measures. If multiple measures are matched, the CART classification decision tree algorithm is used for screening, with the three key attributes of asset value, implementation cost, and protection capability as decision nodes, and the optimal division attribute is selected through the Gini index to generate decision rules to obtain the optimal combination of measures for the digital asset. The screened security reinforcement measures are sorted according to the risk disposal priority to generate the initial digital asset security risk disposal plan. The ant colony algorithm is used to optimize the initial plan, with the maximization of comprehensive benefits as the objective function and the upper limit of resource consumption as the constraint condition. Parameters such as pheromone concentration and volatility coefficient are set, and the pheromone update mechanism is iterated multiple times to search for the optimal combination of disposal solutions. The optimized disposal plan is formatted, key information such as asset name, risk level, disposal measures, priority, estimated cost, etc. is extracted, and a standardized JSON format output document is generated to form the final digital asset security risk disposal plan, which is pushed to the operation and maintenance management platform through the API interface.

[0034] The above are only preferred embodiments of the present invention, and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A network security management method for digital assets, characterized in that: The method comprises: Obtain digital asset lists and business process documents, use natural language processing technology to identify keywords in the documents, build a relationship map between digital assets and business processes, and discover potential connections; Extract the business process nodes directly connected to each digital asset from the association relationship map, generate a digital asset business impact scope report, and display the many-to-many mapping relationship between digital assets and businesses in a matrix form; Use a rule-based reasoning engine to determine the business interruption impact level of each digital asset based on one or more preset indicators including business interruption time threshold, impact scope threshold, data sensitivity, and business criticality, and form a preliminary business impact analysis result; The preliminary business impact analysis results are linked to the business impact scope report. For digital assets with high risk levels and large business impact scopes, a joint review mechanism between the business and technical departments is triggered, and the review agenda and related materials are automatically generated. During the review process, visualization technology is used to dynamically present the relationship and quantitative indicators between digital assets, risks, and business processes, including risk heat maps and impact degree scatter plots, providing an intuitive information transmission channel for all parties; After reaching a consensus in the review, the qualitative impact analysis of the business department and the quantitative loss estimation of the technical department are integrated into the business impact analysis results using the fuzzy comprehensive evaluation method to obtain a comprehensive business impact level; According to the comprehensive business impact level of digital assets and the known security risk level, the hierarchical analysis method is used to determine the risk management priority, and corresponding security reinforcement measures are recommended based on the preset risk management rule base to form a complete digital asset security risk management plan.

2. The method according to claim 1, characterized in that Obtain digital asset lists and business process documents, use natural language processing technology to identify keywords in the documents, build a relationship map between digital assets and business processes, and discover potential relationships, including: Obtain the enterprise's digital asset list and business process documents, and perform data preprocessing on the documents, including using Chinese word segmentation tools to segment the documents, and using a stop word list to remove stop words in the segmentation results to obtain structured text data; Converting the structured text data into a data format suitable for keyword extraction; A keyword extraction algorithm is used to identify keywords that can represent the topic of the document from the converted data; According to the extracted keywords, the co-occurrence frequency and mutual information correlation index between the keywords are calculated, and the correlation matrix between the keywords is constructed; Keywords are used as nodes, and the relationships between keywords are used as edges to construct a relationship graph between digital assets and business processes. The weight of the edge is determined based on the correlation index between keywords. In the association graph, a community discovery algorithm is used to identify closely related keyword communities, and the keyword communities are mapped to potential associations between digital assets and business processes. The keywords in a keyword community represent a group of digital assets that are closely connected to the business process. Conduct business value analysis on the potential relationships discovered, evaluate the business rationality and explainability of each set of relationships based on business scenarios and domain knowledge, and select high-value relationships that can provide reference for business decision-making and process optimization; Apply the screened high-value relationships to business process optimization and digital transformation decisions, identify digital assets with problems or bottlenecks in business processes, adjust resource allocation, optimize business processes, and improve operational efficiency.

3. The method according to claim 1, characterized in that Extract the business process nodes directly connected to each digital asset from the association relationship map, generate a digital asset business impact scope report, and display the many-to-many mapping relationship between digital assets and businesses in a matrix form, including: Obtain the digital asset and business relationship graph, use the NetworkX library to process and analyze the relationship graph, and identify the digital asset nodes and business process nodes in the relationship graph; Through depth-first search and breadth-first search algorithms, obtain all business process nodes directly connected to each digital asset node; According to the connection relationship between digital asset nodes and business process nodes, a digital asset-business mapping matrix is ​​constructed. The element values ​​in the digital asset-business mapping matrix use the TF-IDF algorithm to calculate the association strength between digital asset nodes and business process nodes; Perform hierarchical clustering analysis on the digital asset-business mapping matrix, using the linkage function of the scipy library to divide digital asset nodes and business process nodes into several impact range clusters based on the clustering results; For each impact range cluster, count the number and type attributes of digital asset nodes and business process nodes in the cluster to generate a feature vector for the impact range cluster; The decision tree algorithm is used to train and predict the feature vectors of the impact range clusters. The DecisionTreeClassifier of the scikit-learn library is used to build a decision tree model. The impact levels of some impact range clusters are judged and labeled as training data. The decision tree model is trained and the trained model is used to predict the feature vectors of the remaining impact range clusters to obtain the impact level of the impact range clusters. According to the impact level of each impact range cluster, fill in the preset impact range report template and use the Jinja2 template engine to generate the business impact range report of the digital asset; Summarize the business impact scope reports of all digital assets, generate a digital asset business impact analysis report, and use Matplotlib and Seaborn visualization libraries to draw a many-to-many mapping relationship diagram between digital assets and businesses and an impact scope distribution diagram.

4. The method according to claim 1, characterized in that: Using a rule-based reasoning engine, the business interruption impact level of each digital asset is determined based on one or more preset indicators, including business interruption time threshold, impact scope threshold, data sensitivity, and business criticality, to form preliminary business impact analysis results, including: A1. Obtain one or more indicator data including a preset business interruption time threshold, impact scope threshold, data sensitivity, and business criticality as input for rule-based reasoning; for each digital asset, input its indicator data into a pre-built decision tree model; A2. At each node of the decision tree, compare the current digital asset's various indicator values ​​with the node's judgment conditions. If the conditions are met, enter the corresponding child node and continue to make judgments; If the condition is not met, enter another child node until reaching the leaf node to obtain the business interruption impact level of the digital asset; A3. For each digital asset, the business interruption impact level determination result is associated with the unique identifier of the digital asset to form a business impact analysis result record; A4. Repeat steps A2 and A3 until the business interruption impact level of all digital assets is determined, and business impact analysis result records of all digital assets are obtained; A5. Use pivot tables or group aggregation methods to summarize the business impact analysis result records based on the identification information of digital assets, and generate a business impact analysis report based on digital assets as the dimension as the preliminary analysis result; A6. Use the Apriori algorithm to mine the business impact analysis results, discover the association rules between digital assets, and find out the core digital assets whose impact on key business processes exceeds the preset threshold; A7. Combine the association rules mined by the Apriori algorithm with the preliminary business impact analysis report to generate a final business impact analysis report, presenting the business interruption impact level of each digital asset and the association relationship between digital assets, providing decision support for business continuity management.

5. The method according to claim 1, characterized in that The preliminary business impact analysis results are linked to the business impact scope report. For digital assets with high risk levels and large business impact scopes, a joint review mechanism between the business and technical departments is triggered, and the review agenda and related materials are automatically generated, including: Obtain preliminary business impact analysis results and business impact scope reports, and extract the business impact level and impact scope attributes of each digital asset; The Apriori association rule mining algorithm is used to analyze the correlation between the business impact level and the impact scope, and a list of digital assets with high risk levels and large business impact scopes is obtained; For the list of digital assets with high risk levels and large business impact, match the list of business departments and technical departments related to each high-risk digital asset from the preset business department and technical department information database; According to the matched business and technical department lists corresponding to each digital asset, combined with the preset review agenda template, the relevant department information is automatically filled in to generate a joint review agenda for each digital asset. The content of the joint review agenda includes reviewing the risk status of the digital asset, impact scope assessment and response measures; For each digital asset's review agenda, the TF-IDF algorithm is used to retrieve the top N materials with the highest relevance to the agenda content from the preset material library based on the keywords in the review agenda, forming a review material collection for the digital asset; Send the joint review process and the selected related materials generated for each digital asset to the relevant business department and technical department corresponding to the digital asset, triggering the joint review process of the digital asset; After the joint review of each digital asset is completed, the risk response measure attribute field of the digital asset in the system is updated according to the risk response measures determined in the review results. At the same time, the review resolution is recorded to form a review report for the digital asset and archive it.

6. The method according to claim 1, characterized in that During the review process, visualization technology is used to dynamically present the associations and quantitative indicators between digital assets, risks, and business processes, including risk heat maps and impact degree scatter plots, providing all parties with an intuitive information transmission channel, including: Obtain data related to digital assets and risks, and calculate the correlation and impact indicators for each digital asset and risk; Input the correlation and impact indicator data of digital assets and risks into Tableau software; The K-means clustering algorithm is used to group digital assets and risks to obtain the grouping results of digital assets and risks; Based on the grouping results, a risk heat map is generated to show the distribution of different digital assets and risks; Calculate the criticality of each of the digital assets and risks in the business process; Based on the impact index, generate an impact scatter plot using Tableau’s data mapping function; Create a dashboard in Tableau, overlay and merge the risk heat map and impact scatter plot to obtain a comprehensive risk visualization map; Judge and mark the risk level in the comprehensive risk visualization map according to the preset threshold; Connect to real-time data sources to automatically update comprehensive risk visualizations based on data changes; For high-risk areas identified in the comprehensive risk visualization, Tableau’s custom annotation function is used to automatically generate risk explanations; Send risk explanations to relevant responsible persons via email or message push function; Collect feedback from the risk assessment review process and extract key information through text analysis; Convert key information into structured feature variables; Optimize the calculation model of risk correlation and impact degree according to characteristic variables; Based on feedback, the design of Tableau visualizations was adjusted.

7. The method according to claim 1, characterized in that After reaching a consensus in the review, the qualitative impact analysis of the business department and the quantitative loss estimation of the technical department are integrated into the business impact analysis results using the fuzzy comprehensive evaluation method to obtain a comprehensive business impact level, including: Obtain the qualitative impact analysis results and quantitative loss estimation results agreed upon during the review; Use natural language processing technology to extract key information from qualitative impact analysis results and quantitative loss estimation results, and convert the key information into structured data; Based on structured data, the qualitative impact keywords are semantically expanded to obtain the expanded qualitative impact description; Perform rationality check on the quantitative loss value to obtain a quantitative loss estimate after verification; Construct an evaluation index system that includes an expanded qualitative impact description and a verified quantitative loss estimate; The analytic hierarchy process is used to determine the weight of each indicator in the evaluation index system; Obtain the evaluation data of the business department and the technical department on the evaluation index system to form a multi-dimensional evaluation matrix; The LOF anomaly detection algorithm is used to identify outliers in the multidimensional evaluation matrix; The outliers are corrected to obtain a corrected multi-dimensional evaluation matrix; The TOPSIS method is used to comprehensively evaluate the modified multi-dimensional evaluation matrix to obtain the comprehensive evaluation value of the evaluation data; Determine the business impact level to which the comprehensive evaluation value belongs based on the preset evaluation level standards; Automatically generate a business impact analysis report based on the business impact level. The business impact analysis report includes qualitative impact description, quantitative loss estimation, comprehensive rating results and corresponding response measures; Push the business impact analysis report to relevant business continuity managers.

8. The method according to claim 1, characterized in that According to the comprehensive business impact level of digital assets and the known security risk level, the analytic hierarchy process is used to determine the risk treatment priority, and corresponding security reinforcement measures are recommended based on the preset risk treatment rule base to form a complete digital asset security risk treatment plan, including: Obtain the comprehensive business impact level and security risk level of digital assets and use them as the judgment matrix of the hierarchical analysis method; Determine the relative importance of different indicators through pairwise comparison and calculate the risk disposal priority vector of each digital asset; Determine the order of risk treatment by sorting the risk treatment priority vector values ​​from high to low; According to the comprehensive business impact level and security risk level of digital assets, the corresponding security reinforcement measures are matched in the preset risk-measure mapping table; If at least two security reinforcement measures are matched, the CART classification decision tree algorithm is used for screening, with the key attributes of digital asset value, implementation cost and protection capability as decision nodes, to generate decision rules and obtain the optimal combination of measures for digital assets; Sort the selected security reinforcement measures according to risk management priorities and generate an initial digital asset security risk management plan; The ant colony algorithm is used to optimize the initial digital asset security risk disposal plan, with the maximization of comprehensive benefits as the objective function and the upper limit of resource consumption as the constraint condition. The pheromone update mechanism is iterated multiple times to search for the optimal disposal plan combination; The optimized digital asset security risk disposal plan is formatted, key information is extracted, and standardized output documents are generated to form a final complete plan.

Images