A method and system for security risk assessment of digital assets

Abstract

The present application provides a method and system for security risk assessment of digital assets, including: obtaining the unique identification and ownership record of digital assets, determining the key points of risk assessment, the key points including the encrypted storage, transaction history and circulation mechanism of digital assets; for each key point, identifying the identity authentication, access control and data encryption security factors therein, and using probabilistic statistical methods to perform security compliance verification on the privacy protection and compliance requirements of digital assets; through the Monte Carlo simulation method, generating multiple combinations of cross-chain compatibility and value assessment factors of digital assets, simulating security incidents and their consequences under different scenarios, and calculating the probability of occurrence and loss impact of each scenario; based on the optimized risk assessment model, evaluating the overall security risk of digital assets, identifying the key links with the highest risk, and evaluating their potential loss impact.

Description

Technical Field

[0001] The present invention relates to the field of information technology, and in particular to a security risk assessment method and system for digital assets. Background Art

[0002] In the security management of digital assets, we are faced with the technical challenge of how to effectively evaluate and control security risks while ensuring asset uniqueness and ownership. This involves multiple vulnerable links such as encrypted storage, transaction history, and circulation mechanisms. First of all, it is necessary to establish a comprehensive risk assessment model that not only considers basic security factors such as identity authentication, access control, and data encryption, but also incorporates uncertain factors such as cross-chain compatibility and compliance requirements. However, in this complex model construction process, how to balance the accuracy and computational efficiency of the model becomes a key issue. At the same time, when using machine learning algorithms to optimize risk assessment models, how to ensure that the model can adapt to the rapidly changing digital asset environment, identify emerging security threats in a timely manner, and avoid overfitting and underfitting problems is also the key to long-term effective assessment and control of security risks. Summary of the invention

[0003] The present invention provides a digital asset security risk assessment method, which mainly includes:

[0004] Obtain unique identification and ownership records of digital assets and determine key points of risk assessment, including encrypted storage, transaction history and circulation mechanism of digital assets;

[0005] For each key point, identify the security factors, including identity authentication, access control and data encryption; use probabilistic statistical methods to verify the privacy protection and compliance requirements of digital assets;

[0006] Through the Monte Carlo simulation method, multiple combinations of cross-chain compatibility and value assessment factors of digital assets are generated, security incidents and their consequences under different scenarios are simulated, and the probability of occurrence and loss impact of each scenario are calculated;

[0007] The circulation mechanism and transaction history of digital assets are combined with the simulation results of security factors to construct a risk assessment model. The risk assessment model uses the weighted average method to integrate the simulation results of the circulation mechanism, transaction history and security factors. The weight is determined according to the impact of each factor on the risk.

[0008] Use machine learning algorithms to train and optimize risk assessment models. Machine learning algorithms include one of decision trees, support vector machines, or neural networks. Use security audit and anomaly monitoring data to improve the risk assessment model's ability to predict and identify unknown security events.

[0009] Based on the optimized risk assessment model, the overall security risk of digital assets is assessed, the key links with the highest risks are identified, and their potential loss impact is assessed.

[0010] The present invention provides a digital asset security risk assessment system, which mainly includes:

[0011] Digital asset identification module, used to obtain unique identification and ownership records and determine key points for risk assessment;

[0012] Security factor analysis module, used to identify key points of identity authentication, access control and data encryption security factors;

[0013] Stochastic modeling module, used for probabilistic statistical modeling of random factors required for privacy protection and compliance;

[0014] Scenario simulation module, used to generate multiple factor combinations and simulate security incidents and their consequences in different scenarios;

[0015] The risk assessment model building module is used to integrate circulation mechanisms, transaction history and security factors to build a comprehensive assessment model;

[0016] The model optimization and application module is used to train and optimize models, assess overall security risks, identify key links and evaluate impacts.

[0017] The technical solution provided by the present invention may include the following beneficial effects:

[0018] The present invention discloses a risk assessment method for digital assets. By obtaining the unique identification and ownership record of digital assets, the key points of risk assessment are determined, including encrypted storage, transaction history and circulation mechanism. For these key points, the security factors of identity authentication, access control and data encryption are identified, and the random factors of privacy protection and compliance requirements are verified by probabilistic statistical methods. Through the Monte Carlo simulation method, multiple cross-chain compatibility and value assessment factor combinations are generated, security events and their consequences under different scenarios are simulated, and the probability of occurrence and loss impact of each scenario are calculated. The inherent properties of the circulation mechanism and transaction history are combined with the simulation results of the security factors to construct a comprehensive risk assessment model, and the weighted average method is used to integrate the simulation results of each factor, and the weight is determined according to the degree of influence of each factor on the risk. The risk assessment model is trained and optimized by a machine learning algorithm, and the model's prediction and identification capabilities for unknown security events are improved by using security audit and abnormal monitoring data. Finally, the overall security risk of digital assets is evaluated, the key links with the highest risk are identified, and their potential loss impact is evaluated. The present invention effectively improves the security and risk management capabilities of digital assets. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 The present invention is a flowchart of a method for assessing security risks of digital assets.

[0020] Figure 2 A schematic diagram of a digital asset security risk assessment method and system according to the present invention.

[0021] Figure 3 This is another schematic diagram of a digital asset security risk assessment method and system of the present invention.

[0022] Figure 4 It is a structural schematic diagram of a digital asset security risk assessment system of the present invention. DETAILED DESCRIPTION

[0023] In order to make the purpose, technical solutions and advantages of the present invention more clear, the present invention is described in detail below with reference to the accompanying drawings and specific embodiments.

[0024] like Figure 1-4 In this embodiment, a digital asset security risk assessment system may specifically include:

[0025] Step S101, obtain the unique identification and ownership record of the digital asset, and determine the key points of risk assessment, which include the encrypted storage, transaction history and circulation mechanism of the digital asset.

[0026] Obtain the unique identification and ownership record of digital assets, and ensure the uniqueness and authenticity of ownership of digital assets through blockchain technology. Using the obtained unique identification and ownership record, conduct a security assessment on the encrypted storage method of digital assets, and use the AES encryption algorithm and multi-copy distributed storage technology to improve the storage security of digital assets. Based on the results of the security assessment, optimize the encryption storage solution of digital assets, select encryption algorithms with higher security strength, such as the national secret SM4 algorithm, and use key segmentation and key rotation mechanisms to further enhance the tamper-proof ability of digital assets. Apply the optimized encryption storage solution to the storage of digital assets, obtain the transaction history of digital assets, and use SQL database query statements to extract key information such as transaction time, amount, and counterparty. Group transaction data using the K-means clustering algorithm to identify different transaction patterns. Calculate the frequency and amount ratio of each transaction pattern, perform risk scoring on the transaction pattern, and identify potential abnormal transaction behaviors. Analyze the circulation path of digital assets, extract the source address, target address, and intermediate address of asset transfer, and construct the topological structure of the asset circulation network. Use the community discovery algorithm to calculate the importance weight of each address and identify key nodes in the asset circulation network.

[0027] Specifically, obtain the unique identifier and ownership record of digital assets. For example, for an NFT artwork, its unique identifier can be its TokenID, and the ownership record can be stored on the blockchain to record who the current owner of the NFT is. Doing so can clearly define the ownership of digital assets and prevent assets from being stolen or traded repeatedly. Perform a security assessment on the encrypted storage method of digital assets. For example, assess whether the storage method of private keys is secure and whether technologies such as multi-signatures are used. If the assessment result is lower than the preset threshold, for example, it is found that the private key is stored on a single-point server with low security, then the encryption storage solution needs to be optimized. For example, a hardware wallet can be used to store private keys, or multi-signature technology can be used to improve security. This can effectively prevent private keys from being stolen and ensure the security of digital assets. Obtain the transaction history of digital assets. For example, obtain all transaction records of a certain NFT artwork, including information such as the buyer, seller, transaction time and price of each transaction. Use a clustering algorithm to group transaction history records and identify different transaction patterns. For example, transactions can be divided into ordinary transactions, batch transactions, and large transactions according to transaction amount and frequency. Calculate the risk score of each transaction pattern. For example, large transactions and frequent transactions may have higher risk scores. Determine whether there is abnormal transaction behavior. For example, if an account conducts multiple large transactions in a short period of time, this may be identified as abnormal transaction behavior and requires further investigation. This can effectively identify illegal activities such as financial crimes and theft. Extract the source address, destination address, and intermediate address in the circulation process of digital assets. For example, track all transaction paths from the creator to the final holder of an NFT artwork, including all wallet addresses involved in the transaction. Construct the circulation network topology of digital assets. For example, each wallet address is regarded as a node, and the transaction is regarded as an edge between the nodes to construct a network graph. The community discovery algorithm is used to calculate the importance weight of each address in the circulation network topology. For example, identify key nodes with a large number of transactions, a large number of connected addresses, and a large transaction amount in the network. Identify key nodes. For example, if an address frequently participates in large transactions and has transactions with multiple addresses, the address may be identified as a key node.

[0028] Step S102, for each key point, identify the security factors therein, wherein the security factors include identity authentication, access control and data encryption; and use probabilistic statistical methods to perform security compliance verification on the privacy protection and compliance requirements of digital assets.

[0029] Obtain security factor information and preprocess the obtained security factor information, wherein the preprocessing includes data cleaning, feature selection and feature extraction; based on the identity authentication information obtained after preprocessing, use the identity authentication algorithm to determine the legitimacy of the user's identity, and the identity authentication algorithm includes password-based identity authentication, biometric-based identity authentication and digital certificate-based identity authentication; if the identity is legitimate, access is allowed, otherwise access is denied; based on the access control information obtained after preprocessing, use a role-based access control method to determine the user's access rights to digital assets, wherein the correspondence between roles and permissions is predefined, and the user's permissions are determined based on his or her role; if there is permission, the operation is allowed, otherwise the operation is denied; for sensitive data, the AES symmetric encryption algorithm is used for encryption processing, and the key length of the AES algorithm is 128 or 256 bits; security assessments are performed on the three aspects of identity authentication, access control and data encryption, respectively, using a manual scoring method Calculate the scores of each indicator and the evaluation score, and perform weighted summation of the evaluation scores of the three aspects to obtain the security evaluation score; among them, the weight of the identity authentication factor is 4, the weight of the access control factor is 4, and the weight of the data encryption factor is 2; obtain the privacy protection and compliance requirements of digital assets, adopt data desensitization and data access authorization measures for privacy protection and compliance control, and use quantitative indicators to evaluate the effectiveness of privacy protection and compliance; quantitative indicators include the proportion of desensitized data and the coverage of authorized access; compare the security evaluation score with the preset security compliance threshold to determine whether it meets the preset security compliance threshold requirements; if the security evaluation score meets the preset security compliance threshold requirements, and the privacy protection and compliance indicators also meet the requirements, then complete the security compliance verification; otherwise, adjust the identity authentication strength, access control granularity and data encryption algorithm according to the security evaluation score and quantitative indicators, and re-perform the security evaluation until the security compliance verification is completed.

[0030] Specifically, identity authentication, access control and data encryption are important links to ensure the security of digital assets. Obtaining information about these security factors and preprocessing them is the first step in conducting a security assessment. For example, collect the user's login password, biometric data (such as fingerprints, facial recognition information), digital certificate information, and the user's role and permission information. Clean these data to remove invalid data and noise data. Then perform feature selection and extraction, for example, extract features such as password length, complexity, uniqueness of biometrics, and validity period of digital certificates. According to the preprocessed identity authentication information, use a suitable identity authentication algorithm to determine the legitimacy of the user's identity. For example, for password-based identity authentication, the bcrypt algorithm can be used to encrypt the password entered by the user and compare it with the stored encrypted password. For biometric-based identity authentication, fingerprint recognition or facial recognition algorithms can be used to compare the user's biometrics with the templates stored in the database. For digital certificate-based identity authentication, the validity and integrity of the certificate can be verified, and the certificate can be checked to see if it has been revoked. If the identity authentication passes, the user is allowed to access the system, otherwise access is denied. For example, if the user enters the correct password and biometric information, and the digital certificate is valid, the user is allowed to log in. If the user enters the wrong password or biometric information, or the digital certificate expires or is revoked, the user is denied login. This can effectively prevent unauthorized users from accessing the system. Based on the preprocessed access control information, a role-based access control method is used to determine the user's access rights to digital assets. The correspondence between roles and permissions is predefined. For example, the "administrator" role is defined to have read and write permissions for all digital assets, and the "ordinary user" role only has read permissions for some digital assets. Based on the user's role, the operation permissions for digital assets are determined. For example, the administrator can create, modify, and delete digital assets, while ordinary users can only view digital assets. If the user has the corresponding permissions, the operation is allowed, otherwise the operation is denied. This can effectively control the user's access to digital assets and prevent unauthorized access. For sensitive data, the AES symmetric encryption algorithm is used for encryption processing, and the key length can be 128 bits or 256 bits. For example, sensitive data such as the user's private key and transaction records are encrypted and stored. The longer the key length, the higher the encryption strength. Choosing the right key length can balance security and performance. For example, for data with higher security requirements, a 256-bit key length can be used; for data with lower security requirements, a 128-bit key length can be used. This can effectively protect sensitive data from being stolen or tampered with. Security assessments are conducted on identity authentication, access control, and data encryption, and the scores of each indicator are calculated using a manual scoring method. The evaluation scores of the three aspects are weighted and summed to obtain a comprehensive security assessment score.For example, the weight of the authentication factor is 4, the weight of the access control factor is 4, and the weight of the data encryption factor is 2. Assuming that the authentication score is 90 points, the access control score is 80 points, and the data encryption score is 70 points, the comprehensive score is (90*4+80*4+70*2) / (4+4+2)=82 points. This can comprehensively consider the impact of various security factors and obtain a more comprehensive security assessment result. Obtain the privacy protection and compliance requirements of digital assets. Use measures such as data desensitization and data access authorization to perform privacy protection and compliance control. For example, desensitize the user's personal identity information and only retain necessary information. For example, replace the ID number with the hash value of the ID number. The user information obtained has been obtained with the user's consent and complies with the provisions of relevant laws and policies. Authorize the user's access rights and only allow the user to access data within their authorized scope. Use quantitative indicators to evaluate the effectiveness of privacy protection and compliance. For example, calculate the proportion of desensitized data and the coverage of authorized access. The proportion of desensitized data is greater than or equal to 85%, which meets the requirements and indicates the effectiveness of privacy protection. If the coverage rate of authorized access is greater than or equal to 95%, it indicates that the compliance control effect meets the requirements. Compare the security assessment score with the privacy protection and compliance indicators to determine whether the preset security compliance threshold requirements are met. For example, the preset security compliance threshold is 80 points. If the comprehensive security assessment score is 82 points, and the privacy protection and compliance indicators also meet the requirements, the security compliance verification is completed. If the security assessment score is less than 80 points, or the privacy protection and compliance indicators do not meet the requirements, it is necessary to adjust the identity authentication strength, access control granularity, and data encryption algorithm based on the security assessment score and quantitative indicators, and re-perform the security assessment until the security compliance verification is completed. For example, the complexity of identity authentication can be increased, such as increasing the password length and adding more types of biometric recognition; the granularity of access control can be refined, such as setting different access rights for different data types; a stronger encryption algorithm can be used, such as the AES-256 encryption algorithm.

[0031] Step S103, through the Monte Carlo simulation method, generate multiple combinations of digital asset cross-chain compatibility and value assessment factors, simulate security incidents and their consequences under different scenarios, and calculate the probability of occurrence and loss impact of each scenario.

[0032] According to the pre-established knowledge base of cross-chain compatibility and value assessment factors of digital assets, the knowledge base is constructed by crawling public data such as industry reports and papers, and manually annotating according to unified annotation principles, and then cross-examination by multiple people. The knowledge base contains information such as attribute characteristics, cross-chain compatibility indicators, and value assessment indicators of various digital assets. On this basis, the Monte Carlo simulation method is used to select key factors from the knowledge base, and the value range of each key factor is set according to historical data and experience, and then 1,000 groups of factor combinations are randomly generated within its value range. Each factor combination represents a possible cross-chain interaction scenario of digital assets. For each factor combination, reasoning is performed through the pre-constructed security event knowledge graph. The knowledge graph is obtained by summarizing the historical cross-chain security events of digital assets, and contains the basic information, cause mechanism, impact consequences, and countermeasures of various security events. The rule-based causal reasoning method and cosine similarity calculation method are used to determine the type of security events and their consequences that may occur under the current factor combination. According to the probability information of historical events summarized in the knowledge graph of security events, the naive Bayes method is used to quantify the probability of each security event scenario. At the same time, the hierarchical analysis method is used to build a digital asset cross-chain security loss assessment model, and the weights of indicators such as economic losses and reputation impact are determined by manual scoring. The comprehensive loss value of each scenario is quantified through the digital asset cross-chain security loss assessment model. The multiple security event scenarios obtained by simulation are sorted according to the product of the probability of occurrence and the loss value, thereby determining the main security risks faced by the cross-chain interaction of digital assets.

[0033] Specifically, the construction of the knowledge base is the basis of the entire process. A knowledge base containing digital asset attribute characteristics, cross-chain compatibility indicators, and value assessment indicator information can be pre-built. For example, information such as blockchain type, consensus mechanism, transaction speed, market value, etc. of mainstream digital assets, as well as indicators such as interoperability and security between different blockchains can be collected. Data such as historical prices, trading volumes, and volatility of digital assets can also be collected for value assessment. The purpose of building a knowledge base is to provide data support for subsequent simulation and analysis. Using the Monte Carlo simulation method, key factors can be selected from the knowledge base, and at least one set of factor combinations can be randomly generated within the preset value range of each key factor. Each factor combination represents a cross-chain interaction scenario of digital assets. For example, assuming that the factors of interest are "blockchain type", "transaction speed", and "security", the values ​​of "blockchain type" can be set to "public chain", "private chain", and "alliance chain", the values ​​of "transaction speed" can be set to "high", "medium", and "low", and the values ​​of "security" can be set to "high", "medium", and "low" according to the data in the knowledge base. Then, multiple groups of factor combinations can be randomly generated, such as (public chain, high, low), (private chain, medium, high), etc., each group of combinations represents a possible cross-chain interaction scenario. Doing so can simulate various possible cross-chain interaction scenarios for comprehensive security risk assessment. The security event knowledge graph contains the basic information, cause mechanism, impact consequences and countermeasures of various security events. For example, it can contain information on security events such as "51% attack", "double-spending attack", "smart contract vulnerability", as well as the causes of these events, possible consequences (such as economic losses, reputation damage) and corresponding countermeasures. The purpose of constructing the security event knowledge graph is to provide a knowledge basis for subsequent security event reasoning. Using the rule-based causal reasoning method and the cosine similarity calculation method, the type of security event and its consequences that occur under the current factor combination can be determined. For example, assuming that the current factor combination is (public chain, high, low), it can be inferred according to the rules in the security event knowledge graph that "51% attack" is prone to occur under the conditions of public chain, high transaction speed and low security. At the same time, the similarity between the current factor combination and various security events in the knowledge graph can be calculated to further determine possible security events and their consequences. The naive Bayes method can quantify the probability of occurrence of each security event scenario. For example, based on historical data, it can be calculated that under the conditions of public chain, high transaction speed and low security, the probability of "51% attack" is 1, the probability of "double flower attack" is 0.5, and the probability of "smart contract vulnerability" is 0.1. This can quantify the risk of each security event scenario. The hierarchical analysis method can be used to construct a cross-chain security loss assessment model for digital assets. For example, indicators such as economic loss and reputation impact can be manually scored to determine the weight of each indicator.Then, the comprehensive loss value of each scenario can be quantified based on the economic losses and reputational impact that each security incident scenario may cause, and the digital asset cross-chain security loss assessment model can be used to quantify the comprehensive loss value of each scenario. For example, a "51% attack" may cause an economic loss of 1 million yuan and serious reputational damage, with a comprehensive loss value of 90 points; a "double-spending attack" may cause an economic loss of 500,000 yuan and certain reputational damage, with a comprehensive loss value of 60 points, etc. This can quantify the loss of each security incident scenario. According to the product of the probability of occurrence and the loss value of each security incident scenario, the security incident scenarios can be ranked to determine the main security risks faced by digital asset cross-chain interactions. For example, the probability of a "51% attack" is 1, the loss value is 90 points, and its risk value is 9; the probability of a "double-spending attack" is 0.5, the loss value is 60 points, and its risk value is 3. Therefore, a "51% attack" is the main security risk.

[0034] Step S104, combining the circulation mechanism and inherent properties of the transaction history of the digital asset with the simulation results of the security factors to construct a comprehensive risk assessment model. The risk assessment model uses a weighted average method to integrate the simulation results of the circulation mechanism, transaction history and security factors, and the weights are determined according to the degree of impact of each factor on the risk.

[0035] Obtain the circulation mechanism data, transaction history data and security factor data of digital assets. Preprocess the acquired data, including using Lagrange interpolation method to handle missing values, using box plot method to detect and replace outliers, and using Z-Score method to standardize data. Perform exploratory analysis and visualization on the preprocessed data, use basic features of statistical data such as histograms and scatter plots, use Pearson correlation coefficient to analyze the correlation between variables, and identify potential patterns and trends. According to the results of exploratory analysis, determine the input parameters and probability distribution function of Monte Carlo simulation. Use triangular distribution function to simulate circulation mechanism, transaction history and security factors, generate 10,000 simulation paths by random sampling, calculate the risk value under each path, use 95% quantile as risk metric, and obtain risk distribution. For the circulation mechanism risk results, transaction history risk results and security risk results obtained by simulation, use hierarchical analysis method to determine the influence weight of each factor on comprehensive risk. Construct a risk assessment model with three risk factor levels: target layer (comprehensive risk), criterion layer (circulation mechanism risk, transaction history risk, security risk), and scheme layer (various risk indicators). A pairwise comparison matrix is ​​constructed using the 1-9 scaling method, and the weight vector is calculated and the consistency check is performed using CR. Each risk result is weighted averaged according to the weight to obtain a comprehensive risk assessment value. Based on historical data and the quantile method, a threshold for the comprehensive risk assessment value is preset. When the comprehensive risk assessment value exceeds the threshold, the digital asset is judged to have a high risk level. For high-risk digital assets, a risk warning model is constructed based on circulation and transaction data. The random forest method is used for data sampling, and the principal component analysis method is used to extract key risk indicators. The logistic regression algorithm is selected to train and optimize the model, the model performance is evaluated using AUC, and the warning triggering situation is monitored in real time. According to the warning results of the risk warning model, corresponding risk control measures are taken, such as suspending transactions, adjusting limits, and notifying users.

[0036] Specifically, the digital asset risk assessment and early warning program aims to evaluate the risk level of digital assets by analyzing multiple factors such as the circulation mechanism, transaction history and security of digital assets, and to monitor and warn high-risk assets in real time so as to take risk control measures in a timely manner. First, it is necessary to obtain relevant data on digital assets. For example, data such as the circulation volume, transaction frequency, price fluctuations, historical attack events, etc. of a certain digital asset can be obtained from channels such as blockchain browsers and exchange APIs. These data are the basis for risk assessment. After obtaining the data, the data needs to be preprocessed to ensure the quality and consistency of the data. For example, if the circulation volume data at certain time points is missing, the Lagrange interpolation method can be used to supplement it. For outliers in the transaction history data, such as a single transaction amount that is too large or too small, the box plot method can be used to detect and replace it. In order to eliminate the impact of the dimensions between different indicators, the Z-Score method can be used to standardize the data and convert it into standard normal distribution data with a mean of 0 and a standard deviation of 1. Next, exploratory data analysis is performed. Histograms can be used to observe data distribution. For example, by observing the histogram of transaction amount, the concentration range and dispersion of transaction amount can be understood. Scatter plots can be used to analyze the relationship between variables. For example, by drawing a scatter plot of price fluctuations and transaction volume, it can be observed whether there is a positive or negative correlation between them. In addition, the Pearson correlation coefficient can be used to analyze the linear correlation between variables. For example, by calculating the correlation coefficient between circulation and price fluctuations, the degree of correlation between them can be quantified. Through these analyses, potential patterns and trends can be identified to provide input parameters for subsequent Monte Carlo simulations. Based on the results of exploratory analysis, the parameters and probability distribution function of Monte Carlo simulation can be determined. For example, if the histogram of circulation approximates a triangular distribution, a triangular distribution function can be used to simulate circulation. Assuming that the minimum value of circulation is 1 million, the most likely value is 2 million, and the maximum value is 3 million, the parameters of the triangular distribution can be set to (100, 200, 300). Similarly, a probability distribution function can be selected based on the data characteristics of transaction history and security factors. Generate multiple simulation paths through random sampling, for example, generate 1,000 paths, each path represents a possible future scenario. Calculate the risk value under each path. For example, a price fluctuation of more than 10% can be defined as a risk event, and the probability of a risk event occurring under each path is calculated. Finally, use the quantile as a risk measure. For example, calculate the 95% quantile of the risk value as the circulation mechanism risk result. Similarly, the transaction history risk results and security risk results can be obtained. In order to comprehensively evaluate the risks of digital assets, the hierarchical analysis method is used to determine the weight of each factor on the comprehensive risk.A three-layer hierarchical risk assessment model can be constructed: the target layer is the comprehensive risk of digital assets, the criterion layer is the circulation mechanism risk, transaction history risk and security risk, and the scheme layer is empty. A pairwise comparison matrix is ​​constructed through manual scoring. For example, if the scorer believes that the importance of the circulation mechanism risk is twice that of the transaction history risk, the corresponding matrix element is 2. Calculate the weight vector and perform consistency check to ensure the rationality of the weight distribution. Weighted average each risk result according to the weight to obtain a comprehensive risk assessment value. For example, assuming that the circulation mechanism risk result is 8, the transaction history risk result is 6, and the security risk result is 7, their weights are 4, 3, 3 respectively, then the comprehensive risk assessment value is 8*4+6*3+7*3=73. Determine the risk level of the digital asset according to the preset threshold. For example, if the comprehensive risk assessment value is greater than 7, the digital asset is considered to be a high-risk asset. For high-risk digital assets, a risk warning model needs to be constructed. First, data sampling is performed based on circulation and transaction data, for example, data sampling is performed using the random forest method. Then, use principal component analysis to extract key risk indicators, such as price volatility, trading volume change rate, etc. Select the logistic regression algorithm to train the risk warning model, and use AUC to evaluate the model performance. Monitor the warning triggering situation in real time. For example, when the risk probability predicted by the model exceeds a certain threshold, the warning is triggered. According to the warning results of the risk warning model, take corresponding risk control measures. For example, if the warning shows that the risk of a certain digital asset is too high, the transaction of the asset can be suspended, or the transaction limit can be adjusted, and the user can be notified in time.

[0037] Step S105, as Figure 2 As shown, a machine learning algorithm is used to train and optimize the risk assessment model. The machine learning algorithm includes a decision tree, a support vector machine or a neural network. Security audit and abnormal monitoring data are used to improve the risk assessment model's ability to predict and identify unknown security events.

[0038] Obtain security audit logs and anomaly monitoring logs, parse and clean the log data, and extract key feature fields such as timestamp, user ID, operation type, resource path, etc. Standardize and normalize the extracted features to construct structured feature vectors. Based on business scenarios, annotate feature vectors to distinguish normal and abnormal behaviors, and form training and test data sets. Use the training data set to train the risk assessment model, optimize the model hyperparameters through grid search and other methods, and use cross-validation to evaluate the model performance. Continuously adjust the model structure and hyperparameters until the model reaches the expected evaluation indicators on the test data set. Deploy the optimized risk assessment model to the production environment and receive the parsed security audit log and anomaly monitoring log data in real time. The model predicts the new data and calculates the risk score. Set the threshold of the risk score based on business needs and historical data. When the score exceeds the threshold, it is judged as a high-risk event. For the identified high-risk events, automatically generate a risk report to record key information such as the time of the event, the users involved, and the risk level. Send the risk report to the pre-configured security managers through channels such as corporate WeChat, SMS, and email. At the same time, trigger the predetermined emergency response process, such as restricting user permissions and forcing offline, to contain risks in a timely manner. Continuously collect security audit logs and abnormal monitoring logs in the production environment, regularly analyze and annotate the data, and form a new training data set. Use the new training data to retrain and optimize the risk assessment model so that it can adapt to the ever-changing business scenarios and attack methods. In order to evaluate the actual effect of the model, compare the model's prediction results with the actual security incidents, and calculate the model's accuracy, recall rate and other evaluation indicators. According to the advantages and disadvantages of the model, adjust the feature engineering method, optimize the algorithm parameters, and improve the model's risk identification ability. At the same time, monitor the changing trend of the model performance indicators. When the indicators drop to the preset threshold, trigger the model retraining process to ensure the continued effectiveness of the model.

[0039] Specifically, security audit logs and anomaly monitoring logs record various activities that occur in the system and are important data sources for security risk assessment. For example, security audit logs may contain information such as user login, file access, and database operations, while anomaly monitoring logs record events that deviate from normal behavior patterns, such as a user who attempts to log in multiple times in a short period of time and fails, or a certain IP address accesses sensitive files. Parsing these log data and extracting key feature fields is the first step in risk assessment. Key feature fields include timestamp, user ID, operation type, and resource path. For example, a log record shows that user "user123" accessed the file " / etc / passwd" at 10:00:00 on October 27, 2024, then the timestamp is "2024-10-2710:00:00", the user ID is "user123", the operation type is "file access", and the resource path is " / etc / passwd". Extracting these fields can convert the original log into structured data for subsequent analysis. In order to eliminate the impact of the dimensions between different feature fields, it is necessary to standardize and normalize the extracted feature fields to construct a structured feature vector. For example, the timestamp can be converted to the number of seconds from a certain reference time, the user ID can be converted to a digital ID, the operation type can be converted to a digital code, and the resource path can be converted to a digital hash value. In order to train and evaluate the risk assessment model, the feature vector needs to be labeled and divided into normal behavior and abnormal behavior. This needs to be combined with business scenario information. For example, on a file server, it is normal for a user to read a configuration file, while trying to modify a system file may be an abnormal behavior. Security experts can label these behaviors based on experience and rules to construct training data sets and test data sets. Decision tree algorithm and support vector machine algorithm are commonly used machine learning algorithms that can be used to build risk assessment models. The decision tree algorithm classifies data through a series of judgment rules. For example, if the user accesses the system directory and the operation type is "write", it is judged as abnormal behavior. The support vector machine algorithm separates different categories of data by finding the optimal hyperplane. The risk assessment model can be trained using the training data set to obtain the trained risk assessment model. The goal of the training process is to adjust the model parameters so that it can accurately distinguish between normal and abnormal behaviors. The trained risk assessment model is deployed to the production environment, which can receive the parsed security audit log and abnormal monitoring log data in real time, and predict the new data to obtain the risk score. For example, the model predicts that the risk score of an event is 8, which means that there is an 80% probability that the event is abnormal behavior. The preset risk score threshold is used to determine whether the event is a high-risk event. For example, if the threshold is set to 7, events with a risk score greater than 7 will be judged as high-risk events. For high-risk events, the system automatically generates a risk report, including the time of the event, the users involved, and the risk level.For example, a risk report may show: "On October 27, 2024 at 10:05:00, user 'user123' attempted to modify system files, risk level: high". The risk report will be sent to pre-configured security managers through preset communication channels, for example, by notifying the security manager via email or SMS. The system will trigger a predetermined emergency response process, such as controlling the permissions of the users involved, suspending their accounts, or restricting their network access. In order to maintain the accuracy and effectiveness of the model, it is necessary to continuously collect security audit logs and anomaly monitoring logs in the production environment, analyze and annotate the logs regularly, obtain new training data sets, and use the new training data sets to retrain and optimize the risk assessment model. This ensures that the model can adapt to new threats and attack methods. For example, if a new attack method is discovered, it can be marked as abnormal behavior by analyzing the relevant log data, and added to the training data set to retrain the model so that it can recognize this new attack. Doing so can improve the detection capability of the model and detect potential security risks in a timely manner.

[0040] Step S106, Figure 3 As shown, based on the optimized risk assessment model, the overall security risk of digital assets is assessed, the key links with the highest risks are identified, and their potential loss impact is assessed.

[0041] Obtain security data of digital assets, including asset value, vulnerability information, attack event records, and deployment of protective measures; conduct risk assessment of digital assets based on security data using a preset risk assessment indicator system, including asset value, number of known vulnerabilities, vulnerability severity, attack event frequency, and coverage of existing protective measures; preprocess security data, including data cleaning, feature selection, and data normalization, to obtain feature vectors of the risk assessment model; input the feature vectors into a pre-trained risk assessment model, and use a decision tree algorithm and a support vector machine algorithm to obtain a risk score for the digital asset; map the risk score to the corresponding risk level based on a preset risk level threshold; if the risk level is high, use a general vulnerability scoring system to calculate the vulnerability impact of the digital asset, and estimate the potential economic losses caused by the attack in combination with the asset value ; For digital assets with high risk levels, match the pre-established vulnerability library and best practice knowledge base to automatically generate risk prevention and control suggestions, including system patch updates, access permission control, security configuration reinforcement and intrusion detection rule optimization; transmit risk assessment results and risk prevention and control suggestions to the information technology operation and maintenance platform through the application program interface, trigger the work order process in the information technology operation and maintenance platform, and automatically fill the risk prevention and control suggestions into the work order processing plan; if the information of the digital asset changes or the vulnerability of the digital asset is updated, the real-time risk assessment of the digital asset is triggered; obtain the risk rectification results of the digital asset, re-acquire the security data of the digital asset, conduct a secondary risk assessment, compare the secondary risk assessment results with the initial risk assessment results, and obtain the risk score change rate of the digital asset; use the risk score change rate as a feedback indicator to optimize the risk assessment model.

[0042] Specifically, according to the type and characteristics of digital assets, a risk assessment indicator system is established, and corresponding risk assessment dimensions and weights are set for different assets. The assessment dimensions may include asset value, number of known vulnerabilities, severity of vulnerabilities, frequency of attack events, coverage of existing protective measures, etc. According to the established indicator system, through automated means such as asset management systems, vulnerability scanning tools, and security event monitoring platforms, the security data of each digital asset, including asset value, vulnerability information, attack event records, deployment of protective measures, etc., are collected as input for risk assessment. The collected asset security data is preprocessed, including data cleaning, feature selection, and data normalization. Key features such as asset value, vulnerability severity, and attack frequency are selected to construct the feature vector of the risk assessment model. The risk assessment model is trained using the Python Scikit-learn library, decision tree, and support vector machine algorithms. The preprocessed asset security data is divided into training sets and test sets, and the model hyperparameters are optimized using grid search and cross-validation methods to improve the accuracy of risk judgment. The trained risk assessment model is used to predict the security data of each digital asset to obtain a risk score. According to business needs and historical data, set risk level thresholds, such as the low risk score range is [0,30], the medium risk is [30,60], and the high risk is [60,100], and map the risk score to the corresponding risk level. For critical assets with high risk levels, assess the impact of attacks on them, such as data leakage and business interruption. Use CVSS (Common Vulnerability Scoring System) to calculate the impact of vulnerabilities, and estimate potential economic losses in combination with asset value to quantify risk impact. For the vulnerabilities and threats of high-risk assets, match the vulnerability library and best practice knowledge base to automatically generate risk prevention and control suggestions including system patch updates, access control, security configuration reinforcement, intrusion detection rule optimization, etc. The asset risk assessment results and prevention and control suggestions are transmitted to the company's existing IT operation and maintenance platform or security management platform in JSON format through the API interface. Trigger the work order process in the operation and maintenance platform, and automatically fill the risk prevention and control suggestion content into the work order processing plan, and assign relevant personnel to track risk rectification. Establish a regular trigger mechanism for risk assessment, such as automatic triggering on the 1st of each month. At the same time, trigger real-time assessment when asset information changes and vulnerability situations are updated. After the risk rectification is completed, asset data is collected again, a second risk assessment is conducted, the second assessment results are compared with the first assessment results, and the risk score change rate is calculated. The risk change rate is used as a feedback indicator to continuously optimize the risk assessment model and form a closed loop of risk perception and prevention and control.

[0043] like Figure 4 As shown, an embodiment of the present invention also provides a digital asset security risk assessment system, which mainly includes:

[0044] Digital asset identification module, used to obtain unique identification and ownership records and determine key points for risk assessment;

[0045] Security factor analysis module, used to identify key points of identity authentication, access control and data encryption security factors;

[0046] Stochastic modeling module, used for probabilistic statistical modeling of random factors required for privacy protection and compliance;

[0047] Scenario simulation module, used to generate multiple factor combinations and simulate security incidents and their consequences in different scenarios;

[0048] The risk assessment model building module is used to integrate circulation mechanisms, transaction history and security factors to build a comprehensive assessment model;

[0049] The model optimization and application module is used to train and optimize models, assess overall security risks, identify key links and evaluate impacts.

[0050] The preferred embodiments of the present invention disclosed above are only used to help explain the present invention. The preferred embodiments do not describe all the details in detail, nor do they limit the invention to only specific implementation methods. Obviously, many modifications and changes can be made according to the content of this specification. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the present invention, so that those skilled in the art can understand and use the present invention well. The present invention is limited only by the claims and their full scope and equivalents.

Claims

1. A method for security risk assessment of digital assets, characterized in that: The method comprises: Obtain unique identification and ownership records of digital assets and determine key points of risk assessment, including encrypted storage, transaction history and circulation mechanism of digital assets; For each key point, identify the security factors, including identity authentication, access control and data encryption; use probabilistic statistical methods to verify the privacy protection and compliance requirements of digital assets; Through the Monte Carlo simulation method, multiple combinations of digital asset cross-chain compatibility and value assessment factors are generated to simulate security incidents and their consequences in different scenarios, and calculate the probability of occurrence and loss impact of each scenario; this also includes: obtaining a pre-built knowledge base containing various digital asset attribute characteristics and cross-chain compatibility indicators and value assessment indicator information; Using the Monte Carlo simulation method, key factors are selected from the knowledge base, and at least one set of factor combinations is randomly generated within the preset value range of each key factor. Each factor combination represents a cross-chain interaction scenario of digital assets. For each factor combination, reasoning is performed through a pre-built security event knowledge graph, which contains basic information, cause mechanisms, impact consequences, and response measures for various security events. Use rule-based causal reasoning and cosine similarity calculation methods to determine the type of security incidents and their consequences that occur under the current combination of factors; Based on the historical security incident probability information in the security incident knowledge graph, the naive Bayes method is used to quantify the probability of each security incident scenario; A hierarchical analysis method is used to construct a digital asset cross-chain security loss assessment model. The weights of economic loss and reputation impact indicators are determined through manual scoring, and the comprehensive loss value of each scenario is quantified through the digital asset cross-chain security loss assessment model. Sort security incident scenarios based on the product of probability of occurrence and loss value to determine the security risks faced by cross-chain interactions of digital assets; The circulation mechanism and transaction history of digital assets are combined with the simulation results of security factors to construct a risk assessment model. The risk assessment model uses a weighted average method to integrate the simulation results of the circulation mechanism, transaction history and security factors. The weight is determined according to the degree of influence of each factor on the risk. It also includes: obtaining the circulation mechanism data, transaction history data and security factor data of digital assets; Preprocess the data, including using Lagrange interpolation to handle missing values, using box plot method to detect and replace outliers, and using Z-Score method to standardize data; Conduct exploratory analysis on pre-processed data, using basic features of histogram and scatter plot statistics, and analyze correlations between variables using Pearson correlation coefficients to identify potential patterns and trends; Based on the results of exploratory analysis, the input parameters and probability distribution function of Monte Carlo simulation are determined, and the circulation mechanism, transaction history and security factors are simulated using the triangular distribution function. Multiple simulation paths are generated through random sampling, and the risk value under each path is calculated. The quantile is used as the risk metric to obtain the circulation mechanism risk results, transaction history risk results and security risk results. According to the risk results obtained by simulation, the hierarchical analysis method is used to determine the influence weight of each factor on the comprehensive risk, and the risk assessment model of the target layer, criterion layer and scheme layer is constructed. The weight vector is calculated through pairwise comparison matrix and consistency test is carried out. The risk results are weighted averaged according to their weights to obtain a comprehensive risk assessment value, and the risk level of the digital asset is determined based on the preset threshold; For high-risk digital assets, we build a risk warning model based on the circulation mechanism and historical transaction data, use the random forest method for data sampling, use the principal component analysis method to extract key risk indicators, select the logistic regression algorithm to train and optimize the risk warning model, evaluate the model performance, and monitor the warning triggering situation in real time; Take corresponding risk control measures based on the warning results of the risk warning model, including suspending transactions, adjusting limits and notifying users; Use machine learning algorithms to train and optimize risk assessment models. Machine learning algorithms include one of decision trees, support vector machines, or neural networks. Use security audit and anomaly monitoring data to improve the risk assessment model's ability to predict and identify unknown security events. Based on the optimized risk assessment model, the overall security risk of digital assets is assessed, the key links with the highest risks are identified, and their potential loss impact is assessed.

2. The method for security risk assessment of digital assets according to claim 1, characterized in that: The acquisition of unique identification and ownership records of digital assets and the determination of key points of risk assessment, including encrypted storage, transaction history and circulation mechanism of digital assets, include: Obtain unique identification and ownership records of digital assets, and conduct security assessments on the encrypted storage methods of digital assets; If the security assessment result is lower than the preset threshold, the encryption storage solution of digital assets will be optimized to improve the storage security of digital assets; Obtain the transaction history of digital assets, use clustering algorithms to group the transaction history records, and identify different transaction patterns; Calculate the risk score of each transaction pattern to determine whether there is abnormal transaction behavior; Extract the source address, target address and intermediate address in the circulation process of digital assets, and build the circulation network topology of digital assets; The community discovery algorithm is used to calculate the importance weight of each address in the circulation network topology and identify key nodes.

3. The security risk assessment method for digital assets according to claim 1, characterized in that: For each key point, identify the security factors therein, including identity authentication, access control and data encryption; use probabilistic statistical methods to verify the privacy protection and compliance requirements of digital assets, including: Acquiring security factor information, and preprocessing the acquired security factor information, wherein the preprocessing includes data cleaning, feature selection, and feature extraction; According to the identity authentication information obtained after preprocessing, the identity authentication algorithm is used to judge the legitimacy of the user's identity. The identity authentication algorithm includes password-based identity authentication, biometric-based identity authentication and digital certificate-based identity authentication; If the identity is legitimate, access is allowed, otherwise access is denied; According to the access control information obtained after preprocessing, a role-based access control method is used to determine the user's access rights to digital assets, wherein the correspondence between roles and permissions is predefined, and the user's permissions are determined according to his role; If you have permission, the operation is allowed, otherwise the operation is denied; For sensitive data, the AES symmetric encryption algorithm is used for encryption. The key length of the AES algorithm is 128 or 256 bits; Security assessments are conducted on identity authentication, access control, and data encryption respectively. The scores of each indicator are calculated using a manual scoring method, and the evaluation scores are calculated. The evaluation scores of the three aspects are weighted and summed to obtain the security assessment score. Among them, the weight of the identity authentication factor is 4, the weight of the access control factor is 4, and the weight of the data encryption factor is 2; Obtain the privacy protection and compliance requirements of digital assets, adopt data desensitization and data access authorization measures to perform privacy protection and compliance control, and use quantitative indicators to evaluate the effectiveness of privacy protection and compliance; quantitative indicators include the proportion of desensitized data and the coverage of authorized access; Compare the security assessment score with the preset security compliance threshold to determine whether the preset security compliance threshold requirements are met; If the security assessment score meets the preset security compliance threshold requirements, and the privacy protection and compliance indicators also meet the requirements, the security compliance verification will be passed; otherwise, the identity authentication strength, access control granularity and data encryption algorithm will be adjusted based on the security assessment score and quantitative indicators, and the security assessment will be re-performed until the security compliance verification is passed.

4. The method for security risk assessment of digital assets according to claim 3, characterized in that: The risk assessment model is trained and optimized using a machine learning algorithm, including a decision tree, a support vector machine or a neural network, and the risk assessment model is improved by using security audit and abnormal monitoring data to predict and identify unknown security events, including: Obtain security audit logs and anomaly monitoring logs, parse and clean the log data, and extract key feature fields, including timestamp, user ID, operation type, and resource path; Standardize and normalize key feature fields to construct structured feature vectors; Obtain business scenario information and security expert knowledge, and annotate feature vectors based on the business scenario information and security expert knowledge to obtain training data sets and test data sets, which contain normal behaviors and abnormal behaviors; The risk assessment model is trained using the training data set to obtain a trained risk assessment model; Deploy the trained risk assessment model to the production environment and receive the parsed security audit log and anomaly monitoring log data in real time; Use the risk assessment model to predict new data and obtain a risk score; Obtain a preset risk score threshold, and compare the risk score with the risk score threshold; If the risk score is greater than the risk score threshold, it is considered a high-risk event; For high-risk events, risk reports are automatically generated, including the time of the event, the users involved, and the risk level; Send risk reports to pre-configured security managers via pre-set communication channels; Trigger the predetermined emergency response process and control the permissions of the users involved; Continuously collect security audit logs and anomaly monitoring logs in the production environment, regularly analyze and annotate the logs, and obtain new training data sets; Retrain and optimize the risk assessment model using new training datasets.

5. The method for security risk assessment of digital assets according to claim 4, characterized in that: According to the optimized risk assessment model, the overall security risk of digital assets is assessed, the key links with the highest risk are identified, and their potential loss impact is assessed, including: Obtain security data of digital assets, including asset value, vulnerability information, attack event records, and deployment of protective measures; Based on security data, digital assets are assessed for risk using a preset risk assessment indicator system, which includes asset value, number of known vulnerabilities, severity of vulnerabilities, frequency of attack events, and coverage of existing protection measures; Preprocess the safety data, including data cleaning, feature selection and data normalization, to obtain the feature vector of the risk assessment model; Input the feature vector into the pre-trained risk assessment model, and use the decision tree algorithm and support vector machine algorithm to obtain the risk score of the digital asset; According to the preset risk level threshold, the risk score is mapped to the corresponding risk level; If the risk level is high, the common vulnerability scoring system is used to calculate the impact of the vulnerability of the digital asset, and combined with the asset value, the potential economic losses caused by the attack are estimated; For digital assets with high risk levels, the system automatically generates risk prevention and control suggestions by matching the pre-established vulnerability database and best practice knowledge base. The risk prevention and control suggestions include system patch updates, access rights control, security configuration reinforcement, and intrusion detection rule optimization. The risk assessment results and risk prevention and control suggestions are transmitted to the information technology operation and maintenance platform through the application program interface, the work order process is triggered in the information technology operation and maintenance platform, and the risk prevention and control suggestions are automatically filled into the processing plan of the work order; If the information of digital assets changes or the vulnerability of digital assets is updated, a real-time risk assessment of digital assets will be triggered; Obtain the risk rectification results of digital assets, re-obtain the security data of digital assets, conduct a secondary risk assessment, compare the secondary risk assessment results with the initial risk assessment results, and obtain the risk score change rate of digital assets; The risk score change rate is used as a feedback indicator to optimize the risk assessment model.

6. A digital asset security risk assessment system for implementing the method described in any one of claims 1 to 5, characterized in that: The system comprises: Digital asset identification module, used to obtain unique identification and ownership records and determine key points for risk assessment; Security factor analysis module, used to identify key points of identity authentication, access control and data encryption security factors; Stochastic modeling module, used for probabilistic statistical modeling of random factors required for privacy protection and compliance; Scenario simulation module, used to generate multiple factor combinations and simulate security incidents and their consequences in different scenarios; The risk assessment model building module is used to integrate circulation mechanisms, transaction history and security factors to build a comprehensive assessment model; The model optimization and application module is used to train and optimize models, assess overall security risks, identify key links and evaluate impacts.

Images