Real-time circulation monitoring methods and platforms in trusted data spaces

Abstract

This invention discloses a real-time data circulation monitoring method and platform in a trusted data space, relating to the fields of data management and security technology. The method includes: constructing a trusted data space based on data circulation needs and monitoring data circulation in real time using a regulatory instruction console to obtain real-time monitoring data. Then, risk identification is performed on this monitoring data, a circulation risk coefficient is calculated, and compared with a preset risk threshold. When the risk coefficient reaches or exceeds the threshold, the system generates a circulation risk warning signal. This solves the technical problem of the lack of real-time monitoring and risk warning mechanisms for the entire data circulation process in existing trusted data spaces, achieving the technical effect of real-time monitoring and dynamic early warning of the trusted data space.

Description

Technical Field

[0001] This application relates to the fields of data management and security technology, and in particular to a method and platform for real-time circulation monitoring in trusted data spaces. Background Technology

[0002] With the widespread application of data across various industries, the security and controllability of data circulation have become increasingly important issues. In fields such as finance and healthcare, data flow not only requires efficient processing but also must ensure its security and compliance. However, existing traditional data circulation management systems mostly focus on data storage and access control, lacking real-time monitoring and risk warning mechanisms for the entire data circulation process. They are unable to comprehensively address the risks that may arise when data flows across platforms and departments, such as data leakage, tampering, or misuse. To solve this problem, the Trusted Data Space has emerged, providing a secure environment to ensure the trustworthiness of data during circulation. However, existing Trusted Data Space systems still face problems such as lagging monitoring mechanisms and the inability to identify and respond to potential risks in real time, especially in complex data circulation processes. Therefore, how to achieve real-time monitoring and dynamic risk identification of data circulation within the Trusted Data Space has become a critical issue that urgently needs to be addressed.

[0003] At present, there is a technical problem in the relevant technologies that there is a lack of real-time monitoring and risk warning mechanisms for the entire data circulation process in the trusted data space. Summary of the Invention

[0004] This application solves the technical problem of the lack of real-time monitoring and risk warning mechanisms for the entire data circulation process in existing trusted data spaces by providing a real-time circulation monitoring method and platform in trusted data spaces.

[0005] This application provides a method for real-time circulation monitoring in a trusted data space, including:

[0006] Based on data circulation needs, a trusted data space is constructed; according to the regulatory instruction console, the trusted data space is monitored in real time to obtain real-time circulation monitoring data; risk identification is performed based on the real-time circulation monitoring data to obtain a circulation risk coefficient; it is determined whether the circulation risk coefficient is greater than or equal to the circulation risk threshold; if the circulation risk coefficient is greater than or equal to the circulation risk threshold, a circulation risk warning signal is generated according to the regulatory instruction console.

[0007] This application also provides a real-time circulation monitoring platform in trusted data spaces, including:

[0008] The system includes: a data space construction module for constructing a trusted data space based on data circulation needs; a real-time monitoring module for monitoring the trusted data space in real time according to a regulatory instruction console to obtain real-time circulation monitoring data; a risk identification module for identifying risks based on the real-time circulation monitoring data to obtain a circulation risk coefficient; a risk coefficient judgment module for determining whether the circulation risk coefficient is greater than or equal to a circulation risk threshold; and a warning signal generation module for generating a circulation risk warning signal according to the regulatory instruction console if the circulation risk coefficient is greater than or equal to the circulation risk threshold.

[0009] The proposed real-time circulation monitoring method and platform in the trusted data space first constructs a trusted data space based on data circulation needs and then monitors the data circulation in real time using a regulatory instruction console to obtain real-time monitoring data. Next, risk identification is performed on this monitoring data, a circulation risk coefficient is calculated, and compared with a preset risk threshold. When the risk coefficient reaches or exceeds the threshold, the system generates a circulation risk warning signal, achieving the technical effect of real-time monitoring and dynamic early warning of the trusted data space. Attached Figure Description

[0010] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings of the embodiments of the present invention will be briefly described below. Flowcharts are used in this application to illustrate the operations performed by the platform according to the embodiments of the present application. It should be understood that the preceding or following operations are not necessarily performed precisely in sequence. Instead, various steps can be processed in reverse order or simultaneously as needed. Furthermore, other operations can be added to these processes, or one or more steps can be removed from these processes.

[0011] Figure 1 A flowchart illustrating the real-time circulation monitoring method in a trusted data space provided in this application embodiment;

[0012] Figure 2 This is a schematic diagram of the structure of a real-time circulation monitoring platform in a trusted data space provided in an embodiment of this application.

[0013] Figure labeling: Data space construction module 10, real-time monitoring module 20, risk identification module 30, risk coefficient judgment module 40, early warning signal generation module 50. Detailed Implementation

[0014] The above description is merely an overview of the technical solution of this application. In order to better understand the technical means of this application and to implement it in accordance with the contents of the specification, and to make the above and other objects, features and advantages of this application more obvious and understandable, specific embodiments of this application are given below.

[0015] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description of this application will be provided in conjunction with the accompanying drawings. The described embodiments should not be considered as limitations on this application. All other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0016] In the following description, references to "some embodiments" describe a subset of all possible embodiments. However, it is understood that "some embodiments" can be the same or different subsets of all possible embodiments and can be combined with each other without conflict. The terms "first" and "second" are used merely to distinguish similar objects and do not represent a specific ordering of objects. The terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion. For example, a process, method, platform, product, or server that includes a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or modules not explicitly listed or inherent to these processes, methods, products, or devices. Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only.

[0017] This application provides a method for real-time circulation monitoring in a trusted data space, such as... Figure 1 As shown, the method includes:

[0018] Step S100: Based on data circulation needs, construct a trusted data space. Specifically, first, analyze the data circulation needs, clarifying the data sources, destinations, types, and intended uses. For example, in e-commerce companies, data sources cover multiple business systems, destinations are data analysis departments, and the types are diverse, used for precision marketing, etc. Next, based on the results, select technologies and design the architecture, choosing appropriate encryption algorithms, multi-factor authentication, and role-based access control models, and planning the topology. Then, build the basic environment, deploying server clusters, network and security protection equipment, and configuring encryption and authentication facilities. Afterwards, integrate and import data from different data sources. Structured data undergoes ETL processing, while unstructured data is stored in a dedicated system and indexed, adhering to security and privacy principles. Finally, conduct comprehensive testing and verification, covering functional, performance, and security testing, such as using JMeter for performance testing and Nessus for vulnerability detection, to ensure the trusted data space operates stably, securely, and efficiently to meet circulation needs.

[0019] In one possible implementation, a trusted data space is constructed based on data circulation needs. Step S100 further includes step S110, which involves identifying the characteristics of the data circulation needs according to a three-tiered mechanism to determine the data circulation path. Specifically, the three-tiered mechanism is as follows: the data provider is responsible for the source supply of data; the data user is the final application subject of the data; and the data service provider undertakes intermediate service functions such as data organization and transmission coordination in data circulation. Based on this mechanism, feature identification of data circulation needs is carried out, and the characteristics of the data resources possessed by the data provider are analyzed in detail, including the size of the data, the frequency of data updates, and the sensitivity of the data. For example, if the data provider is a financial institution, the customer account data it provides is highly sensitive and updated frequently. At the same time, the data usage scenarios and demand intensity of the data users are considered. For example, the data user of an e-commerce company may need to obtain a large amount of customer transaction data in real time for precision marketing and order processing. In addition, the service scope and capabilities of the data service provider in data circulation are clarified, such as its data transmission bandwidth limit and data format conversion capabilities. Through comprehensive analysis of these multiple factors, the data circulation path from the provider to the user is accurately determined.

[0020] Step S120: Collect topology parameters based on the data flow path to obtain flow path topology data. Specifically, after determining the data flow path, topology parameters are collected for that path. From a network perspective, the network latency between each node in the path is measured. This is particularly crucial for scenarios with high real-time data transmission requirements, such as the transmission of financial transaction data. Network bandwidth parameters are recorded to determine the maximum data transmission rate in different segments, ensuring that data transmission is not interrupted or stalled due to insufficient bandwidth. The number and type of nodes in the path are statistically analyzed. Nodes may include data servers, data relay stations, etc. Different types of nodes have different functions and performance characteristics. For example, the storage capacity and processing power of a data server will affect the temporary storage and initial processing of data. In addition, the type of data transmission protocol in the flow path should also be considered. Different transmission protocols differ in terms of security and efficiency. For example, using SSL / TLS protocols can enhance the confidentiality of data transmission. By comprehensively collecting these topology parameters, a detailed and accurate data foundation is provided for building a trusted data space.

[0021] Step S130: Construct the trusted data space based on the circulation path topology data. Specifically, the trusted data space is constructed based on the collected circulation path topology data. First, the data storage area and data processing module layout in the trusted data space are rationally planned according to the number and type of nodes. For example, for nodes with large storage capacity requirements, a large-capacity storage device array is configured, and the data storage organization structure is optimized, such as using distributed storage technology to improve data reliability and read / write efficiency. For the data processing module, corresponding computing resources are allocated according to the processing capacity of the nodes to ensure that the data can be fully and efficiently processed during the processing. In terms of network architecture, a high-speed and stable data transmission channel is constructed based on network latency and bandwidth parameters, and redundant links are set to improve network fault tolerance and prevent data circulation interruption due to single point of failure. At the same time, corresponding protocol parsing and encryption / decryption modules are deployed in the trusted data space according to the transmission protocol type to ensure the secure transmission and storage of data within the space. Through the above steps, a trusted data space that can meet the data circulation requirements and has high reliability and security is constructed.

[0022] In one possible implementation, the data circulation demand is characterized based on the separation of powers mechanism to determine the data circulation path. Step S110 further includes step S111, whereby the separation of powers mechanism includes a data provider, a data user, and a data service provider. Specifically, the data provider, as the data source, needs to organize its own data, establish a management system to ensure storage security, backup and recovery, and deliver data as required; the data service provider acts as a bridge, receiving data and preprocessing it, including cleaning, format conversion and adaptation, ensuring transmission security, monitoring transmission status, and providing caching services; the data user clarifies its needs according to business objectives, uses data in compliance with regulations, records the management and usage process, and can also provide feedback to optimize the data circulation system. Under this separation of powers mechanism, each party performs its respective duties to promote data circulation.

[0023] Step S200: According to the regulatory instruction console, the trusted data space is monitored in real time to obtain real-time circulation monitoring data. Specifically, based on the regulatory instruction console, monitoring tools such as network traffic monitors, data access loggers, and data integrity verifiers are first deployed and configured at key nodes and transmission links in the trusted data space to build a monitoring system. Subsequently, each tool collects data at a prescribed frequency. The network traffic monitor captures network data packet information, the data access logger records access operation details, the data integrity verifier verifies whether the data has been tampered with, and the data acquisition center integrates multi-source data. Finally, the original data is deduplicated, erroneous data is corrected or filtered, and the format is unified. After cleaning and optimization, accurate, complete, and uniformly formatted real-time circulation monitoring data is obtained for subsequent risk identification and analysis.

[0024] Step S300: Risk identification is performed based on the real-time circulation monitoring data to obtain the circulation risk coefficient. Specifically, the real-time circulation monitoring data is first cleaned and standardized to remove noise and duplicate data and unify the encoding format. Next, the data circulation contract terms are analyzed in depth, and the monitoring data is compared with them. A default risk assessment model is used to quantify the default risk coefficient based on the severity and frequency of default. Simultaneously, security risks are considered from multiple dimensions such as data transmission, storage, and access permissions. A security risk assessment model is used to quantify the security risk coefficient based on security vulnerabilities. Finally, default and security risk weights are set according to the characteristics of the data circulation business. A weighted calculation method is used: the default risk weight multiplied by the default risk coefficient, plus the security risk weight multiplied by the security risk coefficient, yields the circulation risk coefficient, comprehensively reflecting the overall risk level.

[0025] In one possible implementation, risk identification is performed based on the real-time circulation monitoring data to obtain a circulation risk coefficient. Step S300 further includes step S310, where data cleaning is performed on the real-time circulation monitoring data to obtain circulation monitoring results. Specifically, data cleaning is first performed on the real-time circulation monitoring data. Obviously erroneous data, such as abnormal values ​​caused by monitoring equipment malfunctions or transmission interference, must be removed, as abnormal data may severely affect the accuracy of subsequent analysis. Next, duplicate data records are processed to prevent repeated calculations of the same data event. Data formats also need to be standardized to ensure smooth integration of data from different sources and in different formats in subsequent analysis. For example, time data is uniformly adjusted to a standard timestamp format, and the data encoding method is standardized. Through these data cleaning steps, relatively accurate, standardized, and non-redundant circulation monitoring results are obtained, providing a reliable data foundation for subsequent risk identification.

[0026] Step S320: Identify default risks based on the circulation monitoring results to obtain a circulation default risk coefficient. Specifically, default risk identification is performed based on the obtained circulation monitoring results. A detailed interpretation of the various clauses stipulated in the data circulation contract is conducted, including the scope of data use permissions, usage period, and data processing restrictions. The data usage behavior and data flow information in the monitoring results are compared with the contract clauses one by one. If it is found that the data user exceeds the scope of use stipulated in the contract, such as using data intended for internal analysis for commercial promotion, or continuing to use data beyond the usage period stipulated in the contract, a default risk is determined. Then, a default risk assessment model is constructed based on factors such as the nature, severity, and frequency of the default behavior. For example, serious violations of data confidentiality clauses are assigned higher risk scores, while minor over-the-scope data use is assigned relatively lower scores. Combined with the number of defaults, the circulation default risk coefficient is calculated through the model. This coefficient can quantitatively reflect the degree of default risk in data circulation.

[0027] Step S330: Based on the circulation monitoring results, security risks are identified to obtain a circulation security risk coefficient. Specifically, security risks are identified using the circulation monitoring results. From the data transmission perspective, it is checked whether high-strength encryption technology is used during data transmission, such as whether industry-recommended encryption algorithms are used and whether the key length is sufficient. It is also checked whether there are signs of hacker attacks or eavesdropping on the transmission channel, such as abnormal network traffic fluctuations or a large number of connection requests from unknown sources, all of which may indicate transmission security risks. Regarding data storage, the physical security of storage devices is assessed, such as whether there are adequate access control systems, fire and water protection measures, and the logical security of storage devices, including whether access control lists are reasonably set and whether there are any permission vulnerabilities. By comprehensively considering these multi-layered security factors related to data transmission and storage, a security risk assessment model is constructed. Corresponding scores are assigned based on the severity of security risks and the potential scale of data leakage, thereby calculating the circulation security risk coefficient. This coefficient can intuitively reflect the level of security risks during data circulation.

[0028] Step S340: Calculate the circulation risk coefficient based on the circulation default risk coefficient and the circulation security risk coefficient. Specifically, after obtaining the circulation default risk coefficient and the circulation security risk coefficient, set their weights according to the actual needs and characteristics of the data circulation business. For example, if the data business has extremely high requirements for data compliance, such as financial data business, then the weight of the circulation default risk coefficient may be relatively large; if the data business is extremely sensitive to data security, such as medical data business, then the weight of the circulation security risk coefficient may be more prominent. Let the circulation default risk coefficient be A, and its weight be a; let the circulation security risk coefficient be B, and its weight be b, and a+b=1. Through the weighted calculation method C=a*A+b*B, i.e., the circulation risk coefficient, the two coefficients are comprehensively integrated to obtain a circulation risk coefficient that can comprehensively reflect the overall risk status of data circulation, providing a key basis for the comprehensive assessment and decision-making of data circulation risks.

[0029] In one possible implementation, default risk is identified based on the circulation monitoring results to obtain a circulation default risk coefficient. Step S320 further includes step S321, extracting a data circulation contract based on the data circulation requirements. Specifically, firstly, a comprehensive and detailed analysis of the data circulation requirements is conducted. Core elements such as the data source, destination, data type, data volume, and intended use are clearly defined. For example, in a project involving financial data sharing, it is necessary to determine which financial institution provides the data, which third-party institutions will use the data for what kind of financial analysis or business development, whether the data is structured transaction records or unstructured customer feedback information, and the approximate total amount of data. Based on this detailed requirement information, a matching data circulation contract is precisely located in a pre-built contract library. The contract library may contain numerous data circulation template contracts of different types applicable to different scenarios. By comparing the key elements of the requirements with those of the contract templates, specific data circulation contracts that conform to the actual situation of this data circulation can be extracted. These contracts will clearly define the rights and obligations of the data provider and the user, the scope of data use, the duration of use, data quality requirements, and the definition and penalty clauses for breach of contract, providing a key basis for subsequent identification of breach of contract risks.

[0030] Step S322: Construct a circulation default risk identification model. Specifically, multiple factors are considered when constructing the circulation default risk identification model. First, the input variables of the model are determined, which will be extracted based on data circulation contracts and circulation monitoring results. Key clauses such as the scope of data usage rights, usage period restrictions, and data confidentiality requirements are selected from the data circulation contracts as part of the model's input; actual operational information of data users, such as data access frequency, data transmission destination, and data usage duration, is extracted from the circulation monitoring results. Then, the algorithm architecture of the model is determined according to the characteristics of the data and business logic. For example, if the data usage behavior has strong temporal characteristics, a recurrent neural network (RNN) algorithm can be considered to capture the dynamic changes in data usage behavior; if the data features are relatively independent and simple, traditional machine learning algorithms such as logistic regression and decision trees can be used. During the model building process, it is also necessary to train and optimize the model, collect a large number of historical data circulation cases, including normal circulation cases and default cases, divide these case data into training sets and test sets, use the training set to train the model, and adjust the model's parameters and structure to achieve a high accuracy and recall rate on the test set, ensuring that the model can accurately identify default risk behaviors and effectively quantify the degree of risk.

[0031] Step S323: Input the data circulation contract and the circulation monitoring results into the circulation default risk identification model to generate the circulation default risk coefficient. Specifically, the extracted data circulation contract and circulation monitoring results are input into the circulation default risk identification model according to the input format specified by the model. The model first preprocesses the input data, converting the textual terms in the data circulation contract into structured data that the model can understand, such as converting terms like the scope of use and the duration of use into numerical or categorical data; it also cleans and normalizes the data usage behavior data in the circulation monitoring results to remove noise and outliers, ensuring the data meets the model's input requirements. Then, the model performs in-depth analysis and calculations on the input data based on its internally constructed algorithm and trained parameters. For example, the model compares the actual operations of the data user with the provisions in the data circulation contract. If it finds that the data user is frequently accessing data outside the authorized time frame or transferring data to destinations outside the contract, the model will calculate the circulation default risk coefficient based on the severity and frequency of these default behaviors, combined with the weight allocation determined during model training. This coefficient will intuitively reflect the magnitude of default risk in the data circulation process in numerical form. The higher the coefficient, the greater the default risk, providing a quantitative risk assessment basis for the supervision and decision-making of data circulation.

[0032] In one possible implementation, security risk identification is performed based on the circulation monitoring results to obtain a circulation security risk coefficient. Step S330 further includes step S331, loading the circulation monitoring sample set and the circulation security risk sample set. Specifically, firstly, the circulation monitoring sample set and the circulation security risk sample set are loaded. The circulation monitoring sample set is a collection of actual data samples obtained through comprehensive monitoring of a large number of past data circulation scenarios. These samples cover circulation behavior information under various conditions such as different network environments, different data users, and different data types, including monitoring data such as data transmission rate, access frequency, and data volume changes. The circulation security risk sample set contains relevant data samples that have been identified as having security risks. These samples record in detail the data characteristics when security events such as data leakage, data tampering, and unauthorized access occur, such as abnormal network traffic patterns, unauthorized access source IP addresses, and signs of data encryption being cracked. The collection and organization of these sample sets is the foundation for building an accurate circulation security risk identification model. By integrating data samples from multiple sources and scenarios, the model can learn more comprehensive and representative data circulation security characteristics.

[0033] Step S332: Data is partitioned based on the circulation monitoring sample set and the circulation security risk sample set to obtain a circulation security risk training set and a circulation security risk test set. Specifically, data is partitioned based on the circulation monitoring sample set and the circulation security risk sample set to obtain these two sets. A reasonable data partitioning strategy is adopted, such as randomly dividing the sample data into two parts according to a certain ratio (commonly 70%-80% for the training set and 20%-30% for the test set). During the partitioning process, it is necessary to ensure that both the training set and the test set fully represent the feature distribution of the entire sample set. For example, different types of data security risks (such as data leakage risk, data tampering risk, etc.) should be represented in appropriate proportions in both the training set and the test set. At the same time, the balance of different data circulation scenarios (such as different industries, different data scales, etc.) in the two sets should also be considered. The purpose of this partitioning is to enable the neural network to learn a wide range of accurate security risk feature patterns during training, while the test set can effectively test the model's generalization ability on unseen data, avoiding overfitting and ensuring the accuracy and reliability of the model.

[0034] Step S333: Train and test the neural network using the circulation security risk training set and the circulation security risk test set to generate a circulation security risk identification model. Specifically, train and test the neural network using the divided circulation security risk training set and circulation security risk test set to generate a circulation security risk identification model. First, construct the neural network architecture, determining the number of layers, the number of neurons in each layer, and activation functions based on the characteristics of the data and the needs of security risk identification. For example, if the data features are complex and contain many nonlinear relationships, a multilayer perceptron (MLP) network can be used with nonlinear activation functions such as ReLU. During training, input the training set data into the neural network, and continuously adjust the network weights and biases through the backpropagation algorithm to gradually reduce the error between the network's output (such as the predicted probability of security risk) and the true label (whether there is a security risk) in the training set. After training for a certain number of epochs, use the test set to test the trained model and evaluate its performance metrics, such as accuracy, recall, and F1 score. If the model performance does not meet expectations, the architecture and training parameters (such as learning rate and batch size) of the neural network are adjusted and optimized, and the training and testing are repeated until a model with good performance and the ability to accurately identify circulation security risks is generated.

[0035] Step S334: Input the circulation monitoring results into the circulation security risk identification model to obtain the circulation security risk coefficient. Specifically, the circulation monitoring results are input into the generated circulation security risk identification model to obtain the circulation security risk coefficient. Before input, the circulation monitoring results undergo necessary preprocessing, such as data cleaning to remove noise and data normalization to map data features to specific intervals, to ensure the data meets the model's input requirements. After receiving the processed circulation monitoring results, the model analyzes and calculates the data based on its internally learned security risk feature patterns and weight parameters, outputting a value representing the degree of circulation security risk, i.e., the circulation security risk coefficient. For example, if the model detects abnormal network traffic fluctuations during data transmission that are similar to known data leakage security risk samples, the model may output a high security risk coefficient, indicating a significant security risk in the current data circulation; conversely, if the data circulation behavior conforms to a normal security pattern, the model will output a low security risk coefficient, indicating that the data circulation is in a relatively safe state. This coefficient provides a quantitative assessment basis for the security management and decision-making of data circulation.

[0036] In one possible implementation, the circulation risk coefficient is calculated based on the circulation default risk coefficient and the circulation security risk coefficient. Step S340 further includes step S341, setting the circulation default risk weight and the circulation security risk weight. Specifically, the circulation default risk weight and the circulation security risk weight are set first. This process requires a comprehensive assessment of multiple factors. From the perspective of the data's nature, if the data involves highly sensitive information, such as customer fund data in the financial sector or patient privacy data in the medical field, the security risk weight may be set relatively high because the consequences of data leakage due to security vulnerabilities would be extremely serious. Conversely, if the data compliance is subject to stricter regulatory requirements, such as data usage scenarios in certain industries that are strictly constrained by laws and regulations, the default risk weight may occupy a larger proportion. At the same time, the enterprise or organization's own data strategy and business priorities must also be considered. If an enterprise is currently committed to expanding business cooperation and data sharing is relatively frequent, it may pay more attention to the prevention and control of default risks, and correspondingly increase the default risk weight; conversely, if an enterprise is vigorously strengthening the construction of data security infrastructure and improving security protection capabilities, the security risk weight may be given more emphasis. Through in-depth analysis and weighing of these factors, reasonable values ​​for circulation default risk weight and circulation security risk weight are determined. For example, in a certain financial data circulation scenario, the circulation default risk weight is set to 0.4 and the circulation security risk weight is set to 0.6 after evaluation.

[0037] Step S342: Based on the circulation default risk weight and the circulation security risk weight, the circulation default risk coefficient and the circulation security risk coefficient are weighted and calculated to generate the circulation risk coefficient. Specifically, based on the determined circulation default risk weight and circulation security risk weight, the circulation default risk coefficient and the circulation security risk coefficient are weighted and calculated to generate the circulation risk coefficient. Assume the circulation default risk coefficient is... The circulation safety risk coefficient is The risk weight for circulation default is The risk weight for circulation safety is Then the circulation risk coefficient For example, if a circulation default risk coefficient is derived from a data circulation monitoring session... =0.3, circulation safety risk coefficient =0.5, according to the previously set weights. , So, the circulation risk coefficient 0.4 0.3 + 0.6 0.5 = 0.42. This weighted calculation method organically combines default risk and security risk to obtain a quantitative indicator that comprehensively reflects the overall risk status of data circulation—the circulation risk coefficient. This provides an important basis for data circulation management decisions, enabling relevant parties to take timely risk response measures based on the coefficient, such as adjusting data circulation strategies, strengthening security protection measures, or re-examining data circulation contracts.

[0038] Step S400: Determine whether the circulation risk coefficient is greater than or equal to the circulation risk threshold. Specifically, the setting of the circulation risk threshold needs to comprehensively consider factors such as data sensitivity, industry environment and regulatory requirements, enterprise data management strategies and risk preferences. For sensitive data, strictly regulated industries, and stable enterprises, the threshold is often lower. The calculated circulation risk coefficient is then compared with the set threshold. If the circulation risk coefficient is greater than or equal to the threshold, it indicates a high risk in data circulation, such as potential misuse or exploitation of security vulnerabilities, requiring immediate activation of the risk response mechanism. If the circulation risk coefficient is less than the threshold, data circulation is relatively safe and controllable, but due to dynamic environmental changes, continuous monitoring is still necessary to prevent the risk from escalating beyond the threshold.

[0039] Step S500: If the circulation risk coefficient is greater than or equal to the circulation risk threshold, a circulation risk warning signal is generated according to the regulatory instruction console. Specifically, when the circulation risk coefficient is obtained and compared with the circulation risk threshold, if the circulation risk coefficient is greater than or equal to the threshold, it indicates that the data circulation process faces significant risks, such as data leakage, illegal use, or integrity breaches. At this time, the regulatory instruction console generates a targeted circulation risk warning signal based on factors such as the degree of risk exceeding the threshold, the type of risk, and the specific circulation process. Subsequently, the signal is sent to the terminal devices of relevant personnel of the data provider, user, and service provider via email, SMS, and warning push applications, and is prominently displayed on the console's visual interface so that all parties are promptly informed and can take corresponding measures, such as the data provider suspending transmission, the data service provider investigating vulnerabilities, and the data user reviewing and rectifying, thereby reducing the negative impact of risks and ensuring the security, stability, and compliance of data circulation.

[0040] This application's embodiment constructs a trusted data space based on data circulation needs and combines this with a regulatory instruction console to monitor data circulation in real time, acquiring real-time monitoring data. Then, risk identification is performed on this monitoring data, a circulation risk coefficient is calculated, and compared with a preset risk threshold. When the risk coefficient reaches or exceeds the threshold, the system generates a circulation risk warning signal, achieving the technical effect of real-time monitoring and dynamic early warning of the trusted data space.

[0041] In the above text, refer to Figure 1 A method for real-time flow monitoring in a trusted data space according to embodiments of the present invention is described in detail. Next, reference will be made to... Figure 2 A real-time circulation monitoring platform in a trusted data space according to an embodiment of the present invention is described.

[0042] The real-time data flow monitoring platform in the trusted data space according to embodiments of the present invention solves the technical problem of the lack of real-time monitoring and risk warning mechanisms for the entire data flow process in existing trusted data spaces, achieving the technical effect of real-time monitoring and dynamic early warning of the trusted data space. The real-time data flow monitoring platform in the trusted data space includes: a data space construction module 10, a real-time monitoring module 20, a risk identification module 30, a risk coefficient judgment module 40, and an early warning signal generation module 50.

[0043] The data space construction module 10 is used to build a trusted data space based on data circulation needs.

[0044] The real-time monitoring module 20 is used to monitor the trusted data space in real time according to the regulatory instruction console, and obtain real-time circulation monitoring data.

[0045] The risk identification module 30 is used to identify risks based on the real-time circulation monitoring data and obtain the circulation risk coefficient.

[0046] The risk coefficient judgment module 40 is used to determine whether the circulation risk coefficient is greater than or equal to the circulation risk threshold.

[0047] The early warning signal generation module 50 is used to generate a circulation risk early warning signal according to the regulatory instruction console if the circulation risk coefficient is greater than or equal to the circulation risk threshold.

[0048] The specific configuration of the data space construction module 10 will be described in detail below. As mentioned above, based on data circulation requirements, a trusted data space is constructed. The data space construction module 10 further includes: a feature recognition unit, which is used to perform feature recognition on the data circulation requirements using a three-tiered system to determine the data circulation path; a topology parameter acquisition unit, which is used to acquire topology parameters through the path to obtain circulation path topology data; and a trusted data space construction unit, which is used to collect data and construct the trusted data space.

[0049] The separation of powers mechanism identifies the characteristics of the data circulation demand and determines the data circulation path. The characteristic identification unit further includes a sub-unit of the separation of powers mechanism, which is used to identify the data provider, data user and data service provider in the separation of powers mechanism.

[0050] The specific configuration of the risk identification module 30 will be described in detail below. As mentioned above, the risk identification module 30 further includes: a data cleaning unit, which cleans data based on the real-time circulation monitoring data to obtain circulation monitoring results; a default risk identification unit, which identifies default risks based on the circulation monitoring results to obtain a circulation default risk coefficient; a security risk identification unit, which identifies security risks based on the circulation monitoring results to obtain a circulation security risk coefficient; and a circulation risk coefficient calculation unit, which calculates the circulation risk coefficient based on the circulation default risk coefficient and the circulation security risk coefficient.

[0051] The default risk identification unit, which identifies default risks based on the circulation monitoring results and obtains a circulation default risk coefficient, further includes: a data circulation contract extraction subunit, which extracts data circulation contracts based on the data circulation requirements; a risk identification model construction subunit, which constructs a circulation default risk identification model; and a circulation default risk coefficient generation subunit, which inputs the data circulation contracts and the circulation monitoring results into the circulation default risk identification model to generate the circulation default risk coefficient.

[0052] The system includes a security risk identification unit that identifies security risks based on the circulation monitoring results to obtain circulation security risk coefficients. The security risk identification unit further comprises: a sample set loading subunit, used to load a circulation monitoring sample set and a circulation security risk sample set; a data partitioning subunit, used to partition data based on the circulation monitoring sample set and the circulation security risk sample set to obtain a circulation security risk training set and a circulation security risk test set; a circulation security risk identification model generation subunit, used to train and test a neural network based on the circulation security risk training set and the circulation security risk test set to generate a circulation security risk identification model; and a circulation security risk coefficient acquisition subunit, used to input the circulation monitoring results into the circulation security risk identification model to obtain the circulation security risk coefficients.

[0053] The circulation risk coefficient is calculated based on the circulation default risk coefficient and the circulation security risk coefficient. The circulation risk coefficient calculation unit further includes: a weight setting subunit, which is used to set the circulation default risk weight and the circulation security risk weight; and a weighted calculation subunit, which is used to perform a weighted calculation on the circulation default risk coefficient and the circulation security risk coefficient based on the circulation default risk weight and the circulation security risk weight to generate the circulation risk coefficient.

[0054] The real-time circulation monitoring platform in the trusted data space provided in the embodiments of the present invention can execute the real-time circulation monitoring method in the trusted data space provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0055] Although this application makes various references to certain modules in the platform according to the embodiments of this application, any number of different modules can be used and run on user terminals and / or servers. The various units and modules included are only divided according to functional logic, but are not limited to the above division, as long as the corresponding functions can be achieved; in addition, the specific names of each functional unit are only for easy distinction between each other and are not used to limit the scope of protection of this invention.

[0056] The specific embodiments described above do not constitute a limitation on the scope of protection of this application. Those skilled in the art should understand that various modifications, combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this application should be included within the scope of protection of this application. In some cases, the actions or steps described in this application can be performed in a different order than that shown in the embodiments and still achieve the desired results. Furthermore, the processes depicted in the accompanying drawings do not necessarily require a specific or sequential order to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

Claims

1. A method for real-time flow monitoring in a trusted data space, characterized in that, The method comprises: Based on the data flow demand, a trusted data space is constructed, comprising: According to the three right allocation mechanism, the data flow demand is identified, the data flow path is determined, the three right allocation mechanism includes data provider, data user and data service provider, comprising: analyzing the data resource characteristics owned by the data provider, including the size of the data, the update frequency of the data, the sensitivity of the data, at the same time, considering the data usage scene and demand intensity of the data user, the service scope and ability of the data service provider in the data flow are determined, through comprehensive analysis, the flow path of the data from the provider to the user is determined; According to the data flow path, the topology parameter collection is carried out, and the flow path topology data is obtained, comprising: measuring the network delay between each node in the path, recording the network bandwidth parameter, determining the maximum rate of different path data transmission, counting the number and type of nodes in the path, the nodes include data server, data transfer station, and paying attention to the transmission protocol type of data in the flow path; According to the flow path topology data, the trusted data space is constructed; According to the supervision instruction console, the real-time monitoring of the trusted data space is carried out, and the real-time flow monitoring data is obtained; According to the real-time flow monitoring data, the risk identification is carried out, and the flow risk coefficient is obtained; Determine whether the flow risk coefficient is greater than / equal to the flow risk threshold value; If the flow risk coefficient is greater than / equal to the flow risk threshold value, according to the supervision instruction console, the flow risk early warning signal is generated.

2. The real-time flow-through monitoring method in a trusted data space as claimed in claim 1, wherein, According to the real-time flow monitoring data, the risk identification is carried out, and the flow risk coefficient is obtained, comprising: According to the real-time flow monitoring data, the data cleaning is carried out, and the flow monitoring result is obtained; According to the flow monitoring result, the default risk identification is carried out, and the flow default risk coefficient is obtained; According to the flow monitoring result, the security risk identification is carried out, and the flow security risk coefficient is obtained; According to the flow default risk coefficient and the flow security risk coefficient, the flow risk coefficient is calculated.

3. The real-time flow-through monitoring method in a trusted data space as claimed in claim 2, wherein, According to the flow monitoring result, the default risk identification is carried out, and the flow default risk coefficient is obtained, comprising: According to the data flow demand, the data flow contract is extracted; A flow default risk identification model is constructed; The data flow contract and the flow monitoring result are input into the flow default risk identification model, and the flow default risk coefficient is generated.

4. The real-time flow-through monitoring method in a trusted data space as claimed in claim 2, wherein, According to the flow monitoring result, the security risk identification is carried out, and the flow security risk coefficient is obtained, comprising: Load flow monitoring sample set and flow security risk sample set; According to the flow monitoring sample set and the flow security risk sample set, data division is carried out, and flow security risk training set and flow security risk test set are obtained; According to the flow security risk training set and the flow security risk test set, the neural network is trained and tested, and the flow security risk identification model is generated; The flow monitoring result is input into the flow security risk identification model, and the flow security risk coefficient is obtained.

5. The real-time flow-through monitoring method in a trusted data space as claimed in claim 2, wherein, According to the flow default risk coefficient and the flow security risk coefficient, the flow risk coefficient is calculated, comprising: A circulation default risk weight and a circulation security risk weight are set; The circulation default risk coefficient and the circulation security risk coefficient are calculated by weighting according to the circulation default risk weight and the circulation security risk weight, to generate the circulation risk coefficient.

6. A real-time flow-through monitoring platform in a trusted data space, characterized in that, The platform is used to implement the real-time circulation monitoring method in the trusted data space according to any one of claims 1-5, and the platform comprises: A data space construction module, which is used to construct a trusted data space based on data circulation demand; A real-time monitoring module, which is used to perform real-time monitoring on the trusted data space according to a supervision instruction console, to obtain real-time circulation monitoring data; A risk identification module, which is used to perform risk identification according to the real-time circulation monitoring data, to obtain a circulation risk coefficient; A risk coefficient judgment module, which is used to judge whether the circulation risk coefficient is greater than / equal to a circulation risk threshold value; An early warning signal generation module, which is used to generate a circulation risk early warning signal according to the supervision instruction console, if the circulation risk coefficient is greater than / equal to the circulation risk threshold value.

Images