Real-time circulation monitoring method and platform in trusted data space

Abstract

The invention discloses a real-time circulation monitoring method and platform in a credible data space, and relates to the technical field of data management and safety, and the method comprises the steps: building the credible data space based on a data circulation demand, and combining a supervision instruction console to monitor the data circulation condition in real time, and obtaining real-time monitoring data. Then, carrying out risk identification on the monitoring data, calculating a circulation risk coefficient, and comparing the circulation risk coefficient with a preset risk threshold value; when the risk coefficient reaches or exceeds a threshold value, the system generates a circulation risk early warning signal. The technical problem that an existing credible data space lacks a real-time monitoring and risk early warning mechanism for the whole data circulation process is solved, and the technical effects of real-time monitoring and dynamic early warning of the credible data space are achieved.

Description

Technical Field

[0001] The present application relates to the field of data management and security technology, and in particular to a real-time circulation monitoring method and platform in a trusted data space. Background Art

[0002] With the widespread application of data in various industries, the security and controllability of data circulation have become increasingly important issues. In the fields of finance, medicine, etc., data flow not only needs to be processed efficiently, but also must ensure its security and compliance. However, the existing traditional data circulation management systems mostly focus on data storage and access control, but lack real-time monitoring and risk warning mechanisms for the entire process of data circulation, and cannot fully respond to the risks that may arise when data flows across platforms and departments, such as data leakage, tampering or abuse. In order to solve this problem, the trusted data space came into being, which provides a secure environment to ensure the credibility of data during circulation. However, the existing trusted data space system still faces the problem of lagging monitoring mechanism and inability to identify and respond to potential risks in real time, especially in complex data circulation processes. Therefore, how to achieve real-time monitoring of data circulation and dynamic risk identification in the trusted data space has become a key issue that needs to be solved urgently.

[0003] At the current stage, relevant technologies have the technical problem of lack of real-time monitoring and risk warning mechanism for the entire process of data circulation in the trusted data space. Summary of the invention

[0004] This application solves the technical problem of the lack of real-time monitoring and risk warning mechanism for the entire data circulation process in the existing trusted data space by providing a real-time circulation monitoring method and platform in the trusted data space.

[0005] The present application provides a real-time circulation monitoring method in a trusted data space, including: Based on the data circulation demand, a trusted data space is constructed; according to the supervision instruction console, the trusted data space is monitored in real time to obtain real-time circulation monitoring data; based on the real-time circulation monitoring data, risk identification is performed to obtain a circulation risk coefficient; it is determined whether the circulation risk coefficient is greater than / equal to the circulation risk threshold; if the circulation risk coefficient is greater than / equal to the circulation risk threshold, a circulation risk warning signal is generated according to the supervision instruction console.

[0006] This application also provides a real-time circulation monitoring platform in a trusted data space, including: A data space construction module, the data space construction module is used to construct a trusted data space based on data circulation requirements; a real-time monitoring module, the real-time monitoring module is used to monitor the trusted data space in real time according to the supervision instruction console, and obtain real-time circulation monitoring data; a risk identification module, the risk identification module is used to identify risks according to the real-time circulation monitoring data and obtain a circulation risk coefficient; a risk coefficient judgment module, the risk coefficient judgment module is used to judge whether the circulation risk coefficient is greater than / equal to the circulation risk threshold; an early warning signal generation module, the early warning signal generation module is used to generate a circulation risk early warning signal according to the supervision instruction console if the circulation risk coefficient is greater than / equal to the circulation risk threshold.

[0007] The real-time circulation monitoring method and platform in the trusted data space proposed in this application first builds a trusted data space based on data circulation requirements, and monitors data circulation in real time in combination with the supervision command console to obtain real-time monitoring data. Then, the risk of these monitoring data is identified, the circulation risk coefficient is calculated, and compared with the preset risk threshold. When the risk coefficient reaches or exceeds the threshold, the system will generate a circulation risk warning signal, achieving the technical effect of real-time monitoring and dynamic warning of the trusted data space. BRIEF DESCRIPTION OF THE DRAWINGS

[0008] In order to more clearly illustrate the technical solution of the embodiment of the present invention, the accompanying drawings of the embodiment of the present invention will be briefly introduced below. A flow chart is used in this application to illustrate the operations performed by the platform according to the embodiment of the present application. It should be understood that the previous or following operations are not necessarily performed precisely in order. On the contrary, various steps can be processed in reverse order or simultaneously as needed. At the same time, other operations can also be added to these processes, or one or more operations can be removed from these processes.

[0009] Figure 1 A flowchart of a real-time circulation monitoring method in a trusted data space provided by an embodiment of the present application; Figure 2 A schematic diagram of the structure of a real-time circulation monitoring platform in a trusted data space provided in an embodiment of the present application.

[0010] Explanation of the accompanying drawings: data space construction module 10, real-time monitoring module 20, risk identification module 30, risk coefficient judgment module 40, warning signal generation module 50. DETAILED DESCRIPTION

[0011] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below.

[0012] In order to make the objectives, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings. The described embodiments should not be regarded as limiting the present application. All other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of this application.

[0013] In the following description, reference is made to "some embodiments", which describe a subset of all possible embodiments, but it is understood that "some embodiments" may be the same subset or different subsets of all possible embodiments, and may be combined with each other without conflict, and the terms "first\second" involved are merely to distinguish similar objects and do not represent a specific ordering of objects. The terms "including" and "having" and any variations are intended to cover non-exclusive inclusions, for example, a process, method, platform, product, or server that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or modules that are not clearly listed or inherent to these processes, methods, products, or devices. Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those generally understood by technicians in the technical field of this application. The terms used herein are for the purpose of describing the embodiments of the present application only.

[0014] The present application embodiment provides a real-time circulation monitoring method in a trusted data space, such as Figure 1 As shown, the method includes: Step S100, based on the data circulation demand, build a trusted data space. Specifically, first analyze the data circulation demand, clarify the data source, destination, type and purpose of use, such as the data source of e-commerce enterprises covers multiple business systems, the destination is the data analysis department, the type is diverse and used for precision marketing, etc. Then, according to the results, carry out technology selection and architecture design, select appropriate encryption algorithms, multi-factor authentication and role-based access control models, and plan the topology structure. Then build the basic environment, deploy server clusters, network and security protection equipment, and configure encryption and authentication facilities. After that, the data from different data sources are integrated and imported, the structured data is processed by ETL, and the unstructured data is stored and indexed by a special system, and the security and privacy principles are followed. Finally, comprehensive testing and verification, covering functional, performance and security testing, such as using JMeter to measure performance and Nessus to check vulnerabilities, ensure that the trusted data space runs stably, safely and efficiently to meet the circulation needs.

[0015] In a possible implementation, based on the data circulation demand, a trusted data space is constructed, and step S100 further includes step S110, which performs feature identification on the data circulation demand according to the three-power separation mechanism to determine the data circulation path. Specifically, the three-power separation mechanism is as follows: the data provider is responsible for the source supply of data, the data user is the final application subject of the data, and the data service provider undertakes intermediate service functions such as data sorting and transmission coordination in the data circulation. According to this mechanism, feature identification work is carried out on the data circulation demand, and the data resource characteristics owned by the data provider are analyzed in detail, including the size of the data, the frequency of data update, the sensitivity of the data, etc. For example, if the data provider is a financial institution, the customer account data it provides is extremely sensitive and updated frequently. At the same time, the data usage scenario and demand intensity of the data user are considered. For example, the data user of an e-commerce company may need to obtain a large amount of customer transaction data in real time for precision marketing and order processing. In addition, the service scope and capabilities of the data service provider in data circulation are clarified, such as the bandwidth limit of its data transmission and the ability to convert data formats. Through the comprehensive analysis of these multiple factors, the circulation path of data from the provider to the user is accurately determined.

[0016] Step S120, topological parameters are collected according to the data flow path to obtain the flow path topological data. Specifically, after determining the data flow path, the topological parameters are collected for the path. Starting from the network level, the network delay between each node in the path is measured, which is particularly critical for scenarios with high real-time requirements for data transmission, such as the transmission of financial transaction data. Record the network bandwidth parameters and clarify the maximum rate at which data can be transmitted in different sections to ensure that data transmission will not be stuck or interrupted due to insufficient bandwidth. The number and type of nodes in the statistical path are calculated. The nodes may include data servers, data transfer stations, etc. Different types of nodes have different functions and performance characteristics. For example, the storage capacity and processing power of the data server will affect the temporary storage and preliminary processing of the data. In addition, attention should also be paid to the type of transmission protocol of the data in the flow path. Different transmission protocols differ in security, efficiency, etc. For example, the use of SSL / TLS protocol can enhance the confidentiality of data transmission. Through the comprehensive collection of these topological parameters, a detailed and accurate data foundation is provided for building a trusted data space.

[0017] Step S130, construct the trusted data space according to the circulation path topology data. Specifically, the trusted data space is constructed according to the collected circulation path topology data. First, the data storage area and data processing module layout in the trusted data space are reasonably planned according to the number and type of nodes. For example, for nodes with large storage capacity requirements, a large-capacity storage device array is configured, and the organizational structure of data storage is optimized, such as using distributed storage technology to improve data reliability and read and write efficiency. For the data processing module, the corresponding computing resources are allocated according to the processing capacity of the node to ensure that the data can be fully and efficiently calculated during the processing process. In terms of network architecture, a high-speed and stable data transmission channel is constructed according to network delay and bandwidth parameters, and redundant links are set to improve the fault tolerance of the network to prevent single point failures from causing data flow interruption. At the same time, the corresponding protocol parsing and encryption and decryption modules are deployed in the trusted data space according to the transmission protocol type to ensure the safe transmission and storage of data in the space. Through the above steps, a trusted data space that can meet the data flow requirements and has high reliability and security is constructed.

[0018] In a possible implementation, the data circulation demand is characterized and the data circulation path is determined according to the three-power separation mechanism. Step S110 further includes step S111. The three-power separation mechanism includes data providers, data users, and data service providers. Specifically, as the source of data, the data provider needs to sort out its own data and establish a management system to ensure storage security, backup and recovery, and data delivery as required; the data service provider plays a bridging role and pre-processes the data after receiving it, including cleaning, format conversion and adaptation, ensuring transmission security, monitoring transmission status, and providing cache services; the data user defines the needs according to business goals, uses data in compliance, and records the management and use process, and can also provide feedback to optimize the data circulation system. Under this three-power separation mechanism, each party performs its duties to promote data circulation.

[0019] Step S200, according to the supervision command console, the trusted data space is monitored in real time to obtain real-time circulation monitoring data. Specifically, according to the supervision command console, first deploy and configure monitoring tools such as network traffic monitors, data access log recorders, and data integrity verifiers at key nodes and transmission links in the trusted data space to build a monitoring system; then each tool collects data at a regular frequency, the network traffic monitor captures network data packet information, the data access log recorder records access operation details, the data integrity verifier verifies whether the data has been tampered with, and the data collection center integrates multi-source data; finally, the original data is deduplicated, the erroneous data is corrected or filtered, and the format is unified. After cleaning and optimization, accurate, complete, and unified format real-time circulation monitoring data is obtained for subsequent risk identification and analysis.

[0020] Step S300, perform risk identification based on the real-time circulation monitoring data to obtain the circulation risk coefficient. Specifically, first clean and normalize the real-time circulation monitoring data, remove noise and duplicate data, and unify the format encoding. Then, deeply analyze the terms of the data circulation contract, compare the monitoring data with it, and quantify the default risk coefficient based on the severity and frequency of default through the default risk assessment model. At the same time, consider security risks from multiple dimensions such as data transmission, storage and access rights, and use the security risk assessment model to quantify the security risk coefficient in combination with security vulnerabilities. Finally, set the default and security risk weights according to the characteristics of the data circulation business, and use a weighted calculation method to multiply the default risk weight by the default risk coefficient plus the security risk weight by the security risk coefficient to obtain the circulation risk coefficient, which fully reflects the overall risk level.

[0021] In a possible implementation, risk identification is performed based on the real-time circulation monitoring data to obtain a circulation risk coefficient, and step S300 further includes step S310, in which data cleaning is performed based on the real-time circulation monitoring data to obtain a circulation monitoring result. Specifically, data cleaning is first performed on the real-time circulation monitoring data. It is necessary to remove obviously erroneous data, such as abnormal values ​​caused by monitoring equipment failure or transmission interference, as abnormal data may seriously affect the accuracy of subsequent analysis. Then, duplicate data records are processed to prevent repeated calculations of the same data event. It is also necessary to unify the data format so that data from different sources and in different formats can be smoothly connected in subsequent analysis. For example, the time data is uniformly adjusted to a standard timestamp format, and the encoding method of the data is standardized. Through these data cleaning steps, a relatively accurate, standardized and non-redundant circulation monitoring result is obtained, providing a reliable data basis for subsequent risk identification.

[0022] Step S320, identify the default risk according to the circulation monitoring results, and obtain the circulation default risk coefficient. Specifically, identify the default risk according to the obtained circulation monitoring results. Detailed interpretation of the various clauses stipulated in the data circulation contract, including the scope of authority for data use, the period of use, the restrictions on data processing, etc. Compare the data usage behavior, data flow and other information in the monitoring results with the contract terms one by one. If it is found that the data user exceeds the scope of use stipulated in the contract, such as using data only for internal analysis for commercial promotion, or still using data outside the period of use stipulated in the contract, it is determined that there is a default risk. Then, a default risk assessment model is constructed based on factors such as the nature and severity of the default behavior and the frequency of default. For example, a serious violation of the data confidentiality clause is given a higher risk score, while a minor use of data beyond the scope is given a relatively low score. Combined with the number of defaults, the circulation default risk coefficient is calculated through the model, which can quantitatively reflect the degree of default risk in data circulation.

[0023] Step S330, security risk identification is performed according to the circulation monitoring results to obtain the circulation security risk coefficient. Specifically, the circulation monitoring results are used to identify security risks. From the data transmission level, check whether high-intensity encryption technology is used in the data transmission process, such as whether the encryption algorithm recommended by the industry is used and whether the key length is sufficient, whether there are signs of hacker attacks or eavesdropping on the transmission channel, such as abnormal network traffic fluctuations or a large number of connection requests from unknown sources, which may indicate transmission security risks. In terms of data storage, the physical security of the storage device is evaluated, such as whether there is a complete access control system, fire and water protection measures, and the logical security of the storage device, including whether the access control list is reasonably set, whether there are permission loopholes, etc. By comprehensively considering these multi-level security factors such as data transmission and storage, a security risk assessment model is constructed, and corresponding scores are assigned according to factors such as the severity of security risks and the scale of data leakage that may be caused, and then the circulation security risk coefficient is calculated. This coefficient can intuitively reflect the level of security risks in the data circulation process.

[0024] Step S340, calculate the circulation risk coefficient according to the circulation default risk coefficient and the circulation safety risk coefficient. Specifically, after obtaining the circulation default risk coefficient and the circulation safety risk coefficient, set the weights of the two according to the actual needs and characteristics of the data circulation business. For example, if the data business has extremely high requirements for data compliance, such as financial data business, then the weight of the circulation default risk coefficient may be relatively large; if the data business is extremely sensitive to data security, such as medical data business, then the weight of the circulation safety risk coefficient may be more prominent. Suppose the circulation default risk coefficient is A, and its weight is a; the circulation safety risk coefficient is B, and its weight is b, and a+b=1. Through the weighted calculation method C=a*A+b*B, that is, the circulation risk coefficient, the two coefficients are comprehensively integrated to obtain a circulation risk coefficient that can comprehensively reflect the overall risk status of data circulation, providing a key basis for the comprehensive assessment and decision-making of data circulation risks.

[0025] In one possible implementation, the default risk is identified based on the circulation monitoring results to obtain the circulation default risk coefficient, and step S320 further includes step S321, extracting the data circulation contract based on the data circulation demand. Specifically, first, a comprehensive and meticulous analysis of the data circulation demand is carried out. The core elements such as the source, destination, data type, data volume and purpose of data use are clarified. For example, in a project involving financial data sharing, it is necessary to determine which financial institution provides the data, which third-party institutions will use the data for what kind of financial analysis or business development, whether the data is structured transaction records or unstructured customer feedback information, and what the total amount of data is. Based on these detailed demand information, the matching data circulation contract is accurately located in the pre-built contract library. The contract library may contain many different types of data circulation template contracts suitable for different scenarios. By comparing the requirements with the key elements of the contract template, a specific data circulation contract that conforms to the actual situation of this data circulation is extracted. The contract will clearly stipulate the rights and obligations of the data provider and user, the scope of use of the data, the period of use, the data quality requirements, the definition of breach of contract and the penalty clauses, and other important contents, providing a key basis for the subsequent identification of breach of contract risks.

[0026] Step S322, construct a circulation default risk identification model. Specifically, when constructing the circulation default risk identification model, a variety of factors are considered comprehensively. First, determine the input variables of the model, which will be extracted based on the data circulation contract and the circulation monitoring results. Select key terms such as the scope of data usage rights, usage period restrictions, data confidentiality requirements, etc. from the data circulation contract as part of the model input; extract the actual operation information of the data user from the circulation monitoring results, such as data access frequency, data transmission destination, data usage duration, etc. Then, determine the algorithm architecture of the model based on the characteristics of the data and business logic. For example, if the data usage behavior has a strong temporal nature, consider using a recurrent neural network (RNN) algorithm to capture the dynamic changes in data usage behavior; if the characteristics of the data are relatively independent and simple, traditional machine learning algorithms such as logistic regression and decision trees can be used. During the model building process, the model also needs to be trained and optimized, and a large amount of historical data circulation cases should be collected, including normal circulation cases and default cases. These case data should be divided into training sets and test sets, and the model should be trained using the training set. By adjusting the parameters and structure of the model, the model can achieve a higher accuracy and recall rate on the test set, ensuring that the model can accurately identify default risk behavior and effectively quantify the degree of risk.

[0027] Step S323, input the data circulation contract and the circulation monitoring results into the circulation default risk identification model to generate the circulation default risk coefficient. Specifically, the extracted data circulation contract and circulation monitoring results are input into the circulation default risk identification model according to the input format specified by the model. The model first pre-processes the input data, converts the text terms in the data circulation contract into structured data that the model can understand, such as converting the terms such as the scope of use rights and the period of use into numerical or categorical data; cleans and normalizes the data usage behavior data in the circulation monitoring results, removes noise data and outliers, and makes the data meet the input requirements of the model. Then, the model performs in-depth analysis and calculation on the input data based on the algorithm constructed internally and the parameters obtained by training. For example, the model will compare the actual operation of the data user with the provisions in the data circulation contract. If it is found that the data user is still frequently accessing the data beyond the authorized time range, or transferring the data to a destination outside the contract, the model will calculate the circulation default risk coefficient based on the severity and frequency of these breaches, combined with the weight distribution determined during the model training process. This coefficient will intuitively reflect the size of the default risk during the data circulation process in the form of a numerical value. The higher the coefficient, the greater the default risk, providing a quantitative risk assessment basis for the supervision and decision-making of data circulation.

[0028] In a possible implementation, security risk identification is performed according to the circulation monitoring results to obtain the circulation security risk coefficient. Step S330 further includes step S331, loading the circulation monitoring sample set and the circulation security risk sample set. Specifically, first, the circulation monitoring sample set and the circulation security risk sample set are loaded. The circulation monitoring sample set is an actual data sample collected by comprehensively monitoring a large number of data circulation scenarios in the past. These samples cover the circulation behavior information of data in various situations such as different network environments, different data users, and different data types, such as data transmission rate, access frequency, data volume change and other monitoring data. The circulation security risk sample set contains relevant data samples that have been determined to have security risks. These samples record in detail the data characteristics when security events such as data leakage, data tampering, and illegal access occur, such as abnormal network traffic patterns, illegal access source IP addresses, and signs of data encryption being cracked. The collection and organization of these sample sets is the basis for building an accurate circulation security risk identification model. By integrating data samples from multiple sources and multiple scenarios, the model can learn more comprehensive and representative data circulation security features.

[0029] Step S332, data is divided according to the circulation monitoring sample set and the circulation safety risk sample set to obtain a circulation safety risk training set and a circulation safety risk test set. Specifically, data is divided according to the circulation monitoring sample set and the circulation safety risk sample set to obtain a circulation safety risk training set and a circulation safety risk test set. A reasonable data division strategy is adopted, such as randomly dividing the sample data into two parts according to a certain proportion (commonly 70%-80% for training set and 20%-30% for test set). In the division process, it is necessary to ensure that both the training set and the test set can fully represent the characteristic distribution of the entire sample set. For example, different types of data security risks (such as data leakage risk, data tampering risk, etc.) must be reflected in the training set and the test set in a corresponding proportion, and the balance of different data circulation scenarios (such as different industries, different data scales, etc.) in the two sets must also be considered. The purpose of this division is to enable the neural network to learn a wide range of accurate security risk feature patterns during the training process, and the test set can effectively test the generalization ability of the model on unseen data to avoid overfitting of the model, thereby ensuring the accuracy and reliability of the model.

[0030] Step S333, training and testing the neural network according to the circulation safety risk training set and the circulation safety risk test set to generate a circulation safety risk identification model. Specifically, the neural network is trained and tested according to the circulation safety risk training set and the circulation safety risk test set obtained by division to generate a circulation safety risk identification model. First, the neural network architecture is constructed, and the number of layers of the network, the number of neurons in each layer, and the activation function and other parameters are determined according to the characteristics of the data and the needs of safety risk identification. For example, if the data features are relatively complex and there are many nonlinear relationships, a multi-layer perceptron (MLP) network can be used and nonlinear activation functions such as ReLU can be used. During the training process, the training set data is input into the neural network, and the weights and biases of the network are continuously adjusted through the back propagation algorithm, so that the error between the output result of the network (such as the predicted safety risk probability) and the true label (whether there is a safety risk) in the training set is gradually reduced. After a certain number of training rounds (epochs), the trained model is tested using the test set to evaluate the performance indicators of the model, such as accuracy, recall rate, F1 value, etc. If the model performance does not meet expectations, the architecture and training parameters of the neural network (such as learning rate, batch size, etc.) will be adjusted and optimized, and training and testing will be performed again until a model with good performance is generated that can accurately identify circulation safety risks.

[0031] Step S334, input the circulation monitoring results into the circulation security risk identification model to obtain the circulation security risk coefficient. Specifically, the circulation monitoring results are input into the generated circulation security risk identification model to obtain the circulation security risk coefficient. Before input, the circulation monitoring results are preprocessed as necessary, such as data cleaning to remove noise data, data normalization to map data features to a specific interval, etc., so that the data meets the input requirements of the model. After the model receives the processed circulation monitoring results, it analyzes and calculates the data according to the security risk feature pattern and weight parameters learned internally, and outputs a numerical value representing the degree of circulation security risk, that is, the circulation security risk coefficient. For example, if the model detects that there is an abnormal network traffic fluctuation during the data transmission process and it is similar to the known data leakage security risk sample characteristics, the model may output a higher security risk coefficient, indicating that the current data circulation has a greater security risk; conversely, if the data circulation behavior conforms to the normal security mode, the model will output a lower security risk coefficient, indicating that the data circulation is in a relatively safe state. This coefficient provides a quantitative evaluation basis for the security management and decision-making of data circulation.

[0032] In a possible implementation, the circulation risk coefficient is calculated according to the circulation default risk coefficient and the circulation safety risk coefficient, and step S340 further includes step S341, setting the circulation default risk weight and the circulation safety risk weight. Specifically, the circulation default risk weight and the circulation safety risk weight are set first. This process requires comprehensive and comprehensive judgment of multiple factors. From the nature of the data, if the data involves highly sensitive information, such as customer fund data in the financial field, patient privacy data in the medical field, etc., the security risk weight may be set relatively high, because once a security vulnerability occurs and leads to data leakage, the consequences will be extremely serious. If the compliance of the data is subject to stricter regulatory requirements, such as data usage scenarios that are strictly constrained by laws and regulations in certain specific industries, the default risk weight may occupy a larger proportion. At the same time, the data strategy and business focus of the enterprise or organization itself need to be considered. If the enterprise is currently committed to expanding business cooperation and data sharing is relatively frequent, it may pay more attention to the prevention and control of default risks and increase the default risk weight accordingly; on the contrary, if the enterprise is vigorously strengthening the construction of data security infrastructure and improving security protection capabilities, the security risk weight may be given priority consideration. Through in-depth analysis and weighing of these factors, reasonable values ​​of circulation default risk weight and circulation safety risk weight are determined. For example, in a certain financial data circulation scenario, after evaluation, the circulation default risk weight is set to 0.4 and the circulation safety risk weight is set to 0.6.

[0033] Step S342, according to the circulation default risk weight and the circulation safety risk weight, weighted calculation is performed on the circulation default risk coefficient and the circulation safety risk coefficient to generate the circulation risk coefficient. Specifically, according to the determined circulation default risk weight and circulation safety risk weight, weighted calculation is performed on the circulation default risk coefficient and the circulation safety risk coefficient to generate the circulation risk coefficient. Assume that the circulation default risk coefficient is , the circulation safety risk factor is , the circulation default risk weight is , the circulation safety risk weight is , then the circulation risk coefficient For example, if the circulation default risk coefficient is obtained in a data circulation monitoring =0.3, circulation safety risk factor =0.5, according to the weight set previously , , then the circulation risk coefficient 0.4 0.3+0.6 0.5=0.42. Through this weighted calculation method, the default risk and security risk are organically combined to obtain a quantitative indicator that can comprehensively and comprehensively reflect the overall risk status of data circulation - the circulation risk coefficient, which provides an important basis for management decisions on data circulation, so that relevant parties can take corresponding risk response measures in a timely manner according to the coefficient, such as adjusting data circulation strategies, strengthening security protection measures or re-examining data circulation contracts.

[0034] Step S400, determine whether the circulation risk coefficient is greater than / equal to the circulation risk threshold. Specifically, the setting of the circulation risk threshold needs to comprehensively consider factors such as data sensitivity, industry environment and regulatory requirements, enterprise data management strategies and risk preferences. For sensitive data, strictly regulated industries and stable enterprises, the threshold is often lower. Then compare the calculated circulation risk coefficient with the set threshold. If the circulation risk coefficient is greater than or equal to the threshold, it indicates that there is a high risk in data circulation, such as possible breach of contract or exploitation of security vulnerabilities, and the risk response mechanism needs to be activated immediately; if the circulation risk coefficient is less than the threshold, the data circulation is relatively safe and controllable, but due to dynamic changes in the environment, continuous monitoring is still required to prevent the risk from rising and exceeding the threshold.

[0035] Step S500, if the circulation risk coefficient is greater than / equal to the circulation risk threshold, a circulation risk warning signal is generated according to the regulatory instruction console. Specifically, when the circulation risk coefficient is obtained and compared with the circulation risk threshold, if the circulation risk coefficient is greater than or equal to the threshold, it indicates that the data circulation link faces greater risks, such as data leakage, illegal use or integrity destruction. At this time, the regulatory instruction console comprehensively generates a targeted circulation risk warning signal based on factors such as the degree of risk coefficient excess, risk type and specific circulation links, and then sends the signal to the terminal devices of the relevant persons in charge of the data provider, user and service provider via e-mail, text message, warning push application, etc., and highlights it on the visual interface of the console so that all parties can be informed in time and take corresponding measures, such as the data provider suspending transmission, the data service provider checking for loopholes, and the data user reviewing and rectifying, thereby reducing the negative impact of risks and ensuring the security, stability and compliance of data circulation.

[0036] The embodiment of the present application adopts the method of constructing a trusted data space based on data circulation requirements, and monitoring the data circulation in real time in combination with the supervision command console to obtain real-time monitoring data. Then, the risk of these monitoring data is identified, the circulation risk coefficient is calculated, and compared with the preset risk threshold. When the risk coefficient reaches or exceeds the threshold, the system will generate a circulation risk warning signal, achieving the technical effect of real-time monitoring and dynamic warning of the trusted data space.

[0037] In the above, refer to Figure 1 The real-time circulation monitoring method in the trusted data space according to the embodiment of the present invention is described in detail. Figure 2 A real-time circulation monitoring platform in a trusted data space according to an embodiment of the present invention is described.

[0038] The real-time circulation monitoring platform in the trusted data space according to the embodiment of the present invention is used to solve the technical problem of the lack of real-time monitoring and risk warning mechanism for the entire process of data circulation in the existing trusted data space, and achieves the technical effect of real-time monitoring and dynamic warning of the trusted data space. The real-time circulation monitoring platform in the trusted data space includes: a data space construction module 10, a real-time monitoring module 20, a risk identification module 30, a risk coefficient judgment module 40, and an early warning signal generation module 50.

[0039] The data space construction module 10 is used to construct a trusted data space based on data circulation requirements.

[0040] The real-time monitoring module 20 is used to perform real-time monitoring on the trusted data space according to the supervision instruction console to obtain real-time circulation monitoring data.

[0041] The risk identification module 30 is used to perform risk identification based on the real-time circulation monitoring data to obtain a circulation risk coefficient.

[0042] The risk coefficient determination module 40 is used to determine whether the circulation risk coefficient is greater than / equal to a circulation risk threshold.

[0043] The warning signal generating module 50 is used to generate a circulation risk warning signal according to the supervision instruction console if the circulation risk coefficient is greater than / equal to the circulation risk threshold.

[0044] The specific configuration of the data space construction module 10 will be described in detail below. As described above, based on the data circulation demand, a trusted data space is constructed, and the data space construction module 10 further includes: a feature recognition unit, which is used for the three-power separation mechanism to perform feature recognition on the data circulation demand and determine the data circulation path; a topology parameter collection unit, which is used to collect topology parameters through the path and obtain the circulation path topology data; a trusted data space construction unit, which is used to collect data and construct the trusted data space.

[0045] Among them, the three-rights separation mechanism performs feature recognition on the data flow demand and determines the data flow path. The feature recognition unit further includes: a three-rights separation mechanism component sub-unit, and the three-rights separation mechanism component sub-unit is used for the three-rights separation mechanism including data providers, data users and data service providers.

[0046] The specific configuration of the risk identification module 30 will be described in detail below. As described above, risk identification is performed based on the real-time circulation monitoring data to obtain the circulation risk coefficient. The risk identification module 30 further includes: a data cleaning unit, the data cleaning unit is used to perform data cleaning based on the real-time circulation monitoring data to obtain the circulation monitoring results; a default risk identification unit, the default risk identification unit is used to perform default risk identification based on the circulation monitoring results to obtain the circulation default risk coefficient; a safety risk identification unit, the safety risk identification unit is used to perform safety risk identification based on the circulation monitoring results to obtain the circulation safety risk coefficient; a circulation risk coefficient calculation unit, the circulation risk coefficient calculation unit is used to calculate the circulation risk coefficient based on the circulation default risk coefficient and the circulation safety risk coefficient.

[0047] Among them, default risk identification is performed according to the circulation monitoring results to obtain a circulation default risk coefficient, and the default risk identification unit further includes: a data circulation contract extraction subunit, the data circulation contract extraction subunit is used to extract the data circulation contract according to the data circulation demand; a risk identification model construction subunit, the risk identification model construction subunit is used to construct a circulation default risk identification model; a circulation default risk coefficient generation subunit, the circulation default risk coefficient generation subunit is used to input the data circulation contract and the circulation monitoring results into the circulation default risk identification model to generate the circulation default risk coefficient.

[0048] Among them, safety risk identification is performed according to the circulation monitoring results to obtain a circulation safety risk coefficient, and the safety risk identification unit further includes: a sample set loading subunit, the sample set loading subunit is used to load the circulation monitoring sample set and the circulation safety risk sample set; a data division subunit, the data division subunit is used to perform data division according to the circulation monitoring sample set and the circulation safety risk sample set to obtain a circulation safety risk training set and a circulation safety risk test set; a circulation safety risk identification model generation subunit, the circulation safety risk identification model generation subunit is used to train and test the neural network according to the circulation safety risk training set and the circulation safety risk test set to generate a circulation safety risk identification model; a circulation safety risk coefficient acquisition subunit, the circulation safety risk coefficient acquisition subunit is used to input the circulation monitoring results into the circulation safety risk identification model to obtain the circulation safety risk coefficient.

[0049] Wherein, the circulation risk coefficient is calculated according to the circulation default risk coefficient and the circulation safety risk coefficient, and the circulation risk coefficient calculation unit further includes: a weight setting subunit, the weight setting subunit is used to set the circulation default risk weight and the circulation safety risk weight; a weighted calculation subunit, the weighted calculation subunit is used to perform weighted calculation on the circulation default risk coefficient and the circulation safety risk coefficient according to the circulation default risk weight and the circulation safety risk weight to generate the circulation risk coefficient.

[0050] The real-time circulation monitoring platform in the trusted data space provided by the embodiment of the present invention can execute the real-time circulation monitoring method in the trusted data space provided by any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0051] Although the present application makes various references to certain modules in the platform according to the embodiments of the present application, any number of different modules may be used and run on the user terminal and / or server, and the various units and modules included are only divided according to functional logic, but are not limited to the above division, as long as the corresponding functions can be implemented; in addition, the specific names of the functional units are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of the present invention.

[0052] The above specific implementation manner does not constitute a limitation to the protection scope of the present application. It should be understood by those skilled in the art that various modifications, combinations and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present application should be included in the protection scope of the present application. In some cases, the actions or steps recorded in the present application can be performed in an order different from that in the embodiment and can still achieve the desired results. In addition, the process depicted in the accompanying drawings does not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

Claims

1. A real-time circulation monitoring method in a trusted data space, characterized in that: The method comprises: Build a trusted data space based on data circulation needs; According to the supervision instruction console, the trusted data space is monitored in real time to obtain real-time circulation monitoring data; Perform risk identification based on the real-time circulation monitoring data to obtain a circulation risk coefficient; Determining whether the circulation risk coefficient is greater than / equal to a circulation risk threshold; If the circulation risk coefficient is greater than / equal to the circulation risk threshold, a circulation risk warning signal is generated according to the supervision instruction console.

2. The real-time circulation monitoring method in a trusted data space as claimed in claim 1, characterized in that: Based on data circulation requirements, a trusted data space is built, including: According to the three-power separation mechanism, the characteristics of the data circulation demand are identified to determine the data circulation path; Collect topological parameters according to the data flow path to obtain flow path topological data; The trusted data space is constructed according to the circulation path topology data.

3. The real-time circulation monitoring method in a trusted data space as claimed in claim 2, characterized in that: The three-rights separation mechanism includes data providers, data users and data service providers.

4. The real-time circulation monitoring method in a trusted data space as claimed in claim 1, characterized in that: Risk identification is performed based on the real-time circulation monitoring data to obtain a circulation risk coefficient, including: Performing data cleaning according to the real-time circulation monitoring data to obtain circulation monitoring results; Identify the default risk according to the circulation monitoring results to obtain the circulation default risk coefficient; Perform safety risk identification based on the circulation monitoring results to obtain a circulation safety risk coefficient; The circulation risk coefficient is calculated according to the circulation default risk coefficient and the circulation safety risk coefficient.

5. The real-time circulation monitoring method in a trusted data space as claimed in claim 4, characterized in that: Default risk identification is performed based on the circulation monitoring results to obtain a circulation default risk coefficient, including: Extracting a data circulation contract according to the data circulation demand; Construct a circulation default risk identification model; The data circulation contract and the circulation monitoring results are input into the circulation default risk identification model to generate the circulation default risk coefficient.

6. The real-time circulation monitoring method in a trusted data space as claimed in claim 4, characterized in that: Safety risk identification is performed based on the circulation monitoring results to obtain a circulation safety risk coefficient, including: Load the circulation monitoring sample set and the circulation safety risk sample set; Performing data division according to the circulation monitoring sample set and the circulation safety risk sample set to obtain a circulation safety risk training set and a circulation safety risk test set; Training and testing the neural network according to the circulation safety risk training set and the circulation safety risk test set to generate a circulation safety risk identification model; The circulation monitoring results are input into the circulation safety risk identification model to obtain the circulation safety risk coefficient.

7. The real-time circulation monitoring method in a trusted data space as claimed in claim 4, characterized in that: Calculating the circulation risk coefficient according to the circulation default risk coefficient and the circulation safety risk coefficient includes: Set circulation default risk weight and circulation safety risk weight; According to the circulation default risk weight and the circulation safety risk weight, the circulation default risk coefficient and the circulation safety risk coefficient are weightedly calculated to generate the circulation risk coefficient.

8. Real-time circulation monitoring platform in trusted data space, characterized by: The platform is used to implement the real-time circulation monitoring method in a trusted data space according to any one of claims 1 to 7, and the platform includes: A data space construction module, wherein the data space construction module is used to construct a trusted data space based on data circulation requirements; A real-time monitoring module, which is used to monitor the trusted data space in real time according to the supervision instruction console to obtain real-time circulation monitoring data; A risk identification module, the risk identification module is used to perform risk identification based on the real-time circulation monitoring data to obtain a circulation risk coefficient; A risk coefficient judgment module, the risk coefficient judgment module is used to judge whether the circulation risk coefficient is greater than / equal to a circulation risk threshold; The warning signal generation module is used to generate a circulation risk warning signal according to the supervision instruction console if the circulation risk coefficient is greater than / equal to the circulation risk threshold.

Images