Network security risk assessment system for optimizing digital society

Abstract

The invention discloses a network security risk assessment system for optimizing digital society, and particularly relates to the field of network security, comprising an assessment data acquisition module, a dynamic model training module, a context awareness module, a multi-dimensional analysis module, a decision response module, a risk comprehensive assessment module and a continuous improvement and feedback module. According to the network security risk assessment system for optimizing the digital society, through quantitative analysis of data set features, understanding of an existing situation is deepened, prediction accuracy of future possible occurrence conditions is improved, and a decision path is optimized; by ensuring that the decision-making process is based on static data, a dynamically changing environment is flexibly adapted, and challenges caused by uncertainty are effectively coped with; decisions and response effects transmitted by the risk comprehensive evaluation module are fed back to a training model in the dynamic model training module, the accuracy and response speed of the training model are further optimized, the performance of the context awareness module can be continuously improved, and the context awareness module is more intelligent and high in adaptability.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and more specifically, to a network security risk assessment system for optimizing a digital society. Background Art

[0002] With the deepening of digital transformation and the rapid development of Internet technology, the Internet has become the basic infrastructure for the operation of modern society, which has a profound impact on personal life, business operations and even national security. However, with the popularization of the Internet, network security risks have become increasingly prominent. Various types of network attacks have occurred frequently, and data leakage, system paralysis and other problems have seriously threatened the security of information assets. In this context, the network security risk assessment system is particularly important. It can help organizations and institutions to identify and quantify potential network threats in a timely manner, so as to take effective measures to reduce risks.

[0003] Research on network user behavior analysis and modeling technology has brought revolutionary changes to the field of network security. Through deep learning, big data analysis and artificial intelligence algorithms, we can more accurately identify normal and abnormal user behavior patterns, thereby early warning of possible network attacks or data leaks. In addition, the application of smart governance enables network security strategies to be dynamically adjusted according to real-time network conditions, improving response speed and efficiency. This technology not only enhances the security protection capabilities of enterprises and organizations, but also promotes the construction of a network security ecosystem, providing users with a more secure and reliable network environment.

[0004] However, there are still some shortcomings in its actual use, such as the balance between privacy protection and data security. In the process of collecting and analyzing user data, how to ensure that personal privacy is not violated while effectively monitoring network threats requires more sophisticated policy and regulatory guidance; the accuracy and adaptability of the model need to be improved. Due to the complexity and variability of the network environment, existing models may find it difficult to capture all types of attack behaviors, especially when facing new threats. The generalization ability and update speed of the model need to be strengthened; resource consumption is also a problem. Large-scale data processing and analysis often require high-performance computing resources, which may be a considerable expense for small businesses and organizations. Therefore, continuous technological innovation and optimization remain important tasks in this field. Summary of the invention

[0005] In order to overcome the above-mentioned defects of the prior art, the present invention provides a network security risk assessment system for optimizing the digital society, and solves the problems raised in the above-mentioned background technology through the following scheme.

[0006] To achieve the above object, the present invention provides the following technical solutions:

[0007] A cybersecurity risk assessment system for optimizing a digital society, comprising:

[0008] Assessment data collection module: used to collect and classify user behavior data in the network and build a network security risk assessment data information set;

[0009] Dynamic model training module: used to analyze and evaluate the network security risk assessment data information set transmitted by the data acquisition module, build a training model, and transmit it to the situational awareness module and the multi-dimensional analysis module;

[0010] Context awareness module: used to analyze the data trained by the training model in the dynamic model training module, build a context awareness model, and transmit it to the multi-dimensional analysis module;

[0011] Multi-dimensional analysis module: used to analyze the data information selected by the training model in the dynamic model training module and the situation information transmitted in the situation awareness module, generate a multi-dimensional data set, and transmit it to the decision-making corresponding module, including the desensitization clustering unit and the association rule unit;

[0012] Decision response module: used to analyze the multi-dimensional data set transmitted by the multi-dimensional analysis module, generate a decision function, and transmit it to the comprehensive risk assessment module;

[0013] Comprehensive risk assessment module: used to comprehensively analyze the decision data transmitted by the decision response module, build a comprehensive risk assessment model, generate a comprehensive risk assessment report, and transmit it to the continuous improvement and feedback module;

[0014] Continuous Improvement and Feedback Module: It is used to optimize response decisions and issue early warnings to back-end personnel based on the comprehensive risk assessment report transmitted by the comprehensive risk assessment module.

[0015] Preferably, the calculation model of the dynamic model is specifically expressed as:

[0016]

[0017] Where: Q(s,a) represents the value function of the dynamic model; s t Represented as the network status information set at time t; a t It is represented as the set of information about the executed operation at time t; α is represented as the updated state value; r t+1 is represented by the feedback set at time t+1; β is represented by the current state value; a' is represented by the updated execution operation set; s t+1 Represented as the network state set at time t+1.

[0018] Preferably, the computing model of the context awareness is specifically expressed as:

[0019]

[0020] in: Represented as the optimal situation type; Represented as an existing situation type; It is expressed as a context classification function.

[0021] Preferably, the calculation model of the context classification function is specifically expressed as:

[0022]

[0023] in: Expressed as the transpose of the value function.

[0024] Preferably, the calculation model of the desensitization clustering is specifically expressed as:

[0025]

[0026] Where: D 1 represents the clustering information set after desensitization clustering; k represents the number of network status information; j represents the data of each network status information; d i The data points representing the confidence of the network status; N j The number of data points that represent the confidence in the state of the network.

[0027] Preferably, the calculation model of the association rule is specifically expressed as:

[0028]

[0029] Among them: B 2 Expressed as predicted value; Represented as the optimal situation at time t; It is expressed as an associated value containing the value Q; Expressed as the association value of the optimal situation at time t.

[0030] Preferably, the calculation model of the decision response is specifically expressed as:

[0031]

[0032] Where: G(D,U) represents the decision function of the D data set under the situation U; E(D) represents the indicator function of the positive data set; E(D u ) is represented as the indicator function for the negative data set.

[0033] Preferably, the calculation model for the comprehensive risk assessment is specifically expressed as:

[0034]

[0035] Where: G represents the type of decision response; E represents the consequence of the decision response; P(G|E) represents the evaluation function of decision G while ensuring result E; P(E|G) represents the evaluation function of result E after decision G; P(E|G) represents the evaluation function of decision G while ensuring result E; P(G) represents the evaluation function of decision G; P(E) represents the evaluation function of result E.

[0036] Technical effects and advantages of the present invention:

[0037] 1. This invention deepens the understanding of the existing situation through quantitative analysis of the characteristics of the data set, improves the accuracy of predictions of possible future situations, and optimizes the decision-making path;

[0038] 2. The present invention effectively addresses the challenges brought by uncertainty by ensuring that the decision-making process is based on static data and flexibly adapts to the dynamically changing environment;

[0039] 3. The present invention further optimizes the accuracy and response speed of the training model by feeding back the decision and response effects transmitted by the comprehensive risk assessment module to the training model in the dynamic model training module, which helps to continuously improve the performance of the situational awareness module, making it more intelligent and adaptable. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 It is a schematic diagram of the overall structure of the present invention. DETAILED DESCRIPTION

[0041] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0042] As attached Figure 1 A network security risk assessment system for optimizing the digital society is shown, including an assessment data collection module, a dynamic model training module, a situational awareness module, a multi-dimensional analysis module, a decision response module, a comprehensive risk assessment module, and a continuous improvement and feedback module.

[0043] The evaluation data acquisition module is used to collect and classify user behavior data in the network and construct a network security risk evaluation data information set.

[0044] The network security risk assessment data information set to be assessed is recorded as the information set to be assessed collected at time t:

[0045] Φ={Φ 1, Φ 2 , Φ 3 , Φ 4}

[0046] Where: Φ 1 Represented as a network data flow information set; Φ 2 Represented as a system log information set; Φ 3 Represented as a user behavior data information set; Φ 4 Represented as a threat information set.

[0047] The network data flow information set includes the number of data packets, the size of the data packet, the destination IP address, the source IP address, the port number, the protocol type requested for access, the timestamp of sending, and the timestamp of receiving.

[0048] The system log information set includes a security log, an error log, an application log, and a system warning.

[0049] The user behavior data information set includes login time, login location, number of login attempts, access frequency, access resources and operation commands.

[0050] The threat information set includes patch status, known malicious IP addresses, known malicious domain names, and malware samples.

[0051] The dynamic model training module is used to analyze the network security risk assessment data information set transmitted by the evaluation data acquisition module, build a training model, and transmit it to the situational awareness module and the multi-dimensional analysis module.

[0052] The calculation model of the dynamic model is specifically expressed as follows:

[0053]

[0054] Where: Q(s,a) represents the value function of the dynamic model; s t Represented as the network status information set at time t; a t It is represented as the set of information about the executed operation at time t; α is represented as the updated state value; r t+1 is represented by the feedback set at time t+1; β is represented by the current state value; a' is represented by the updated execution operation set; s t+1 Represented as the network state set at time t+1.

[0055] The network status information set is used to describe the situation of the network environment, and the relevant information in the network security risk assessment data information set transmitted by the evaluation data acquisition module includes the number of data packets of the current network traffic, the size of the data packets of the current network traffic, the source IP address of the data packets of the current network traffic, and the destination IP address of the data packets of the current network traffic; login time, operation frequency, error log, security software status, and known malicious IP addresses.

[0056] The execution operation information set is used to perform tasks on the information transmitted by the evaluation data acquisition module, including adjusting firewall rules, isolating suspicious hosts or networks, sending security alerts, performing security scans or updating security policies, adjusting thresholds of security devices, and updating system patches or security software.

[0057] The update status value and the current status value are 0 or 1. When the information is not updated, the status value is 0; when there is updated information, the status value is 1.

[0058] The feedback set is used to store feedback information obtained by the value function from the network status information set after performing the operation task, including positive feedback for successfully preventing attacks or abnormal behaviors, negative feedback due to false alarms or overreactions, continuous feedback for protecting assets from damage, and economic verification of system operation efficiency and resource consumption.

[0059] The context awareness module is used to analyze the data trained by the training model in the dynamic model training module, construct a context awareness model, and transmit it to the multi-dimensional analysis module.

[0060] The computing model of the context awareness is specifically expressed as follows:

[0061]

[0062] in: Represented as the optimal situation type; Represented as an existing situation type; It is expressed as a scenario classification function.

[0063] The calculation model of the context classification function is specifically expressed as follows:

[0064]

[0065] in: Expressed as the transpose of the value function.

[0066] The situational awareness module uses the results of the model output to identify abnormal activities or potential threat patterns on the network; by considering information such as the current load of the network, system resource usage, user activity patterns, etc., it evaluates the health status and potential risks of the network.

[0067] The multi-dimensional analysis module is used to analyze the data information selected by the training model in the dynamic model training module and the situational information transmitted in the situational awareness module, generate a multi-dimensional data set, and transmit it to the decision-making corresponding module.

[0068] The multi-dimensional analysis module includes a desensitizing clustering unit and an association rule unit.

[0069] The desensitized clustering unit is used to cluster the context information selected by the training model in the dynamic model training module to minimize the transmission of each data information point to the context perception module.

[0070] The calculation model of the desensitization clustering is specifically expressed as follows:

[0071]

[0072] Where: D 1 represents the clustering information set after desensitization clustering; k represents the number of network status information; j represents the data of each network status information; d i The data points representing the confidence of the network status; N j The number of data points that represent the confidence in the state of the network.

[0073] The desensitizing clustering unit can reduce data sensitivity and protect privacy by clustering key data information points selected in the dynamic model training module with the context information transmitted by the context awareness module, which helps to improve the generalization ability and prediction accuracy of the model while protecting user data privacy.

[0074] The association rule unit is used to perform association prediction on the value calculated by the training model in the dynamic model training module and the situation type transmitted by the situation perception module to generate a prediction value.

[0075] The calculation model of the association rule is specifically expressed as follows:

[0076]

[0077] Among them: B 2 Expressed as predicted value; Represented as the optimal situation at time t; It is expressed as an associated value containing the value Q; Expressed as the association value of the optimal situation at time t.

[0078] The association rule unit can predict the possible value performance in a specific situation by analyzing the correlation between the model output generated in the dynamic model training module and the situation type in the situation perception module, and understand and prepare for various possible situations in advance.

[0079] The multi-dimensional data set is denoted as B, and the calculation model is specifically expressed as:

[0080] The decision response module is used to analyze the multi-dimensional data set transmitted by the multi-dimensional analysis module, generate a decision function, and transmit it to the comprehensive risk assessment module.

[0081] The calculation model of the decision response is specifically expressed as follows:

[0082]

[0083] Where: G(D,U) represents the decision function of the D data set under the situation U; E(D) represents the indicator function of the positive data set; E(D u ) is represented as the indicator function for the negative data set.

[0084] The decision function is represented as a rule-based algorithm under scenario U, which receives a multidimensional data set as input and generates a decision action plan as output, maximizing the target benefit while considering potential risks; the indicator function is used to determine whether the data set satisfies the decision function, and the indicator function of the positive data set is used to identify data points that meet expectations; the indicator function of the negative data set is used to identify data points that do not meet expectations, by quantifying the characteristics of the data set in order to more accurately understand and predict future scenarios.

[0085] The positive data set is represented by historical data points that are consistent with the expected results. When building a decision function, the positive data set helps to identify and learn the situational characteristics of positive results; the negative data set is represented by data points corresponding to unexpected results. The negative data set identifies situations and patterns that should be avoided to avoid known risks and traps.

[0086] The decision response module can generate accurate and adaptable decision functions by processing and parsing the complex data sets transmitted by the multi-dimensional analysis module, and then submit these decision functions to the comprehensive risk assessment module for further analysis; by constructing indicator functions for positive and negative data sets in specific situations, it can reflect the data characteristics in different situations and provide a data-driven basis for decision-making; by distinguishing between positive and negative data sets, it can more accurately measure the potential benefits and risks of decisions, promote the transparency and traceability of decisions, and facilitate subsequent risk assessment and continuous improvement.

[0087] The comprehensive risk assessment module is used to comprehensively analyze the decision data transmitted by the decision response module, build a comprehensive risk assessment model, generate a comprehensive risk assessment report, and transmit it to the continuous improvement and feedback module.

[0088] The calculation model of the comprehensive risk assessment is specifically expressed as follows:

[0089]

[0090] Where: G represents the type of decision response; E represents the consequence of the decision response; P(G|E) represents the evaluation function of decision G while ensuring result E; P(E|G) represents the evaluation function of result E after decision G; P(E|G) represents the evaluation function of decision G while ensuring result E; P(G) represents the evaluation function of decision G; P(E) represents the evaluation function of result E.

[0091] The comprehensive risk assessment module can build an accurate risk assessment model, generate detailed risk reports, and optimize the decision-making process by deeply analyzing and integrating the data provided by the decision response module; it can evaluate the impact of decisions and results in specific situations by quantitatively analyzing the types and consequences of decision responses; it can identify and quantify the evaluation functions of post-decision results and the decision evaluation functions under the premise of ensuring the results, enhance the predictability and controllability of decisions, promote the transparency of risk information, and strengthen internal communication and collaboration; continuously adjust and optimize risk assessment strategies through feedback mechanisms to enhance overall risk management capabilities; establish a risk early warning system, take preventive measures in a timely manner, and reduce losses and negative impacts.

[0092] The continuous improvement and feedback module is used to optimize response decisions and issue early warnings to back-end personnel based on the comprehensive risk assessment report transmitted by the comprehensive risk assessment module.

[0093] The continuous improvement and feedback module receives data information from the comprehensive risk assessment module, identifies key risk indicators and trends, and factors that may affect system stability and user satisfaction; when the analysis results show potential risks or abnormal behaviors, the continuous improvement and feedback module issues an early warning to the back-end personnel to ensure timely response and intervention; the continuous improvement and feedback module re-inputs the responses of the back-end personnel and the feedback of the users into the dynamic model training module, continuously adjusts the training model according to historical data and new feedback, and performs continuous optimization and improvement.

[0094] The continuous improvement and feedback module can analyze risk assessment data to extract key risk indicators, provide decision makers with a clear perspective, help them quickly locate problems and take action, and promote the evolution of the system to higher security standards; by re-inputting the processed feedback information into the dynamic model training module, it can continuously optimize the model's predictive ability and response mechanism, continuously iterate and self-learn, and enhance the intelligence level of the situational awareness module, so that it can make more accurate and quick judgments when facing unknown threats, thereby protecting network assets from harm.

[0095] Secondly: In the drawings of the embodiments disclosed in the present invention, only the structures related to the embodiments disclosed in the present invention are involved, and other structures can refer to the general design. In the absence of conflict, the same embodiment and different embodiments of the present invention can be combined with each other;

[0096] Finally: The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A cybersecurity risk assessment system for optimizing digital society, characterized in that: include: Assessment data collection module: used to collect and classify user behavior data in the network and build a network security risk assessment data information set; Dynamic model training module: used to analyze and evaluate the network security risk assessment data information set transmitted by the data acquisition module, build a training model, and transmit it to the situational awareness module and the multi-dimensional analysis module; Context awareness module: used to analyze the data trained by the training model in the dynamic model training module, build a context awareness model, and transmit it to the multi-dimensional analysis module; Multi-dimensional analysis module: used to analyze the data information selected by the training model in the dynamic model training module and the situation information transmitted in the situation awareness module, generate a multi-dimensional data set, and transmit it to the decision-making corresponding module, including the desensitization clustering unit and the association rule unit; Decision response module: used to analyze the multi-dimensional data set transmitted by the multi-dimensional analysis module, generate a decision function, and transmit it to the comprehensive risk assessment module; Comprehensive risk assessment module: used to comprehensively analyze the decision data transmitted by the decision response module, build a comprehensive risk assessment model, generate a comprehensive risk assessment report, and transmit it to the continuous improvement and feedback module; Continuous Improvement and Feedback Module: It is used to optimize response decisions and issue early warnings to back-end personnel based on the comprehensive risk assessment report transmitted by the comprehensive risk assessment module.

2. A network security risk assessment system for optimizing a digital society according to claim 1, characterized in that: The calculation model of the dynamic model is specifically expressed as follows: Where: Q(s,a) represents the value function of the dynamic model; s t Represented as the network status information set at time t; a t It is represented as the set of information about the executed operation at time t; α is represented as the updated state value; r t+1 is represented by the feedback set at time t+1; β is represented by the current state value; a' is represented by the updated execution operation set; s t+1 Represented as the network state set at time t+1.

3. A network security risk assessment system for optimizing a digital society according to claim 1, characterized in that: The computing model of the context awareness is specifically expressed as follows: in: Represented as the optimal situation type; Represented as an existing situation type; It is expressed as a scenario classification function.

4. A network security risk assessment system for optimizing a digital society according to claim 1, characterized in that: The calculation model of the context classification function is specifically expressed as follows: in: Expressed as the transpose of the value function.

5. A network security risk assessment system for optimizing a digital society according to claim 1, characterized in that: The calculation model of the desensitization clustering is specifically expressed as follows: Where: D1 represents the clustering information set after desensitization clustering; k represents the number of network status information; j represents the data of each network status information; d i The data points representing the confidence of the network status; N j The number of data points that represent the confidence in the state of the network.

6. A network security risk assessment system for optimizing a digital society according to claim 1, characterized in that: The calculation model of the association rule is specifically expressed as follows: Among them: B2 represents the predicted value; Represented as the optimal situation at time t; It is expressed as an associated value containing the value Q; Expressed as the association value of the optimal situation at time t.

7. A network security risk assessment system for optimizing a digital society according to claim 1, characterized in that: The calculation model of the decision response is specifically expressed as follows: Where: G(D,U) represents the decision function of the D data set under the situation U; E(D) represents the indicator function of the positive data set; E(D u ) is represented as the indicator function for the negative data set.

8. A network security risk assessment system for optimizing a digital society according to claim 1, characterized in that: The calculation model of the comprehensive risk assessment is specifically expressed as follows: Where: G represents the type of decision response; E represents the consequence of the decision response; P(G|E) represents the evaluation function of decision G while ensuring result E; P(E|G) represents the evaluation function of result E after decision G; P(E|G) represents the evaluation function of decision G while ensuring result E; P(G) represents the evaluation function of decision G; P(E) represents the evaluation function of result E.

Images