Marketing data security risk assessment system

Abstract

The invention discloses a marketing data security risk assessment system. The system comprises a data acquisition module which is used for acquiring data from a target system; the risk assessment module is used for performing data security risk comparison according to a preset rule and assessing the compliance and security of the data processing activity; and the risk management module is used for formulating risk management measures and risk disposal plans according to the assessment result of the risk assessment module, and improving the data security protection level. Through the systematized method, the data security protection level of an energy internet marketing service system and a new generation power consumption information acquisition system can be effectively evaluated and improved, and the requirements of laws and regulations and related systems are met.

Description

Technical Field

[0001] The present invention relates to the technical field of security assessment, and in particular to a marketing data security risk assessment system. Background Art

[0002] The safety management of power operating enterprises is characterized by multiple systems, multiple aspects, and complex application environments. The marketing data security system must coordinate the complex relationships among its components, and the various systems must be combined and operated in an orderly manner, and should be able to achieve the goal of reducing safety risks and ensuring stable market operation. However, the multi-system characteristics currently existing in the power marketing industry make it impossible for the safety management process to correspond to compliance results. Market compliance events often occur in the form of event chains. With the updating and improvement of various laws, regulations, departmental regulations, and industry rules, marketing safety compliance management has its own reaction chain due to the lag effect, and there are also organizational defects that are penetrated. When multiple levels of organizational defects appear simultaneously or sequentially on an event triggering factor, non-compliant events will lose their multi-level blocking barriers and occur.

[0003] Risk causation theory is widely used in accident control and production safety control. It mainly emphasizes the analysis of the causes of the final failure results in a complex environment, thereby strengthening the risk control of key links and ensuring system safety and process safety. In the control of power marketing data security compliance risk, the cause of power market compliance risk is defined as: the key risk factors that cause non-compliance incidents in the power market. Compliance risk is related to the frequency of compliance incidents and the losses caused to the market. The generation of compliance risk is directly related to market organization and management, human errors and transaction system failures, which is highly consistent with the risk causation theory.

[0004] Currently, the power industry is in urgent need of effective dynamic prevention and control technology for compliance of marketing data, which requires first solving the problem of risk assessment in the field of power marketing data risk prevention and control technology. Summary of the invention

[0005] In view of the above shortcomings of the prior art, the present invention provides the following technical solution: a marketing data security risk assessment system, comprising:

[0006] Data acquisition module: used to collect data from the target system;

[0007] Risk assessment module: used to compare data security risks according to preset rules and evaluate the compliance and security of data processing activities;

[0008] Risk management module: used to formulate risk management measures and risk disposal plans based on the assessment results of the risk assessment module to improve the level of data security protection.

[0009] Furthermore, the target system includes an energy Internet marketing service system and an electricity consumption information system.

[0010] Furthermore, the data collected by the data acquisition module from the target system includes: computer network information, safety operation response and data risk control related data.

[0011] Furthermore, the preset rules include data security regulations, personal information protection regulations and data security management measures.

[0012] Furthermore, the risk assessment module includes a historical data submodule, a data synchronization module and a data comparison module.

[0013] Furthermore, the historical data submodule is used to store preset rules, prediction results, risk management measures and risk disposal planning data;

[0014] The data synchronization module is used to synchronize the data collected from the target system to the data comparison module in real time;

[0015] The data comparison module is used to compare the data synchronized by the data synchronization module with the data stored in the historical data submodule one by one, so as to improve the efficiency of risk assessment, ensure that risk assessment plays a role in prediction and early warning, and achieve the goal of preventing risks before they occur.

[0016] Further, the data comparison module is used to parse the first data synchronized by the data synchronization module and the second data stored in the historical data submodule, respectively, to obtain first parsed data and second parsed data, respectively; map the first parsed data to a first DOM tree, and use a first data structure to store the first DOM tree; map the second parsed data to a second DOM tree, and use a second data structure to store the second DOM tree; compare whether the composition structures of the first data and the second data are consistent, and if so, compare the composition objects of the first data and the second data to determine the difference points; if not, use the parts with different composition structures as the difference points.

[0017] Furthermore, the data comparison module is used to decompile the first data and the second data into corresponding first assembly language codes and second assembly language codes, respectively; determine the difference code in the first assembly language code and the second assembly language code based on the difference point, and encapsulate the difference code in the first assembly language code and the second assembly language code into a first independent function and a second independent function, respectively; use multiple test variables to test the first and second independent functions, if the output results of the first and second independent functions are consistent, it is considered that the functions of the first update package and the second update package are consistent, otherwise, they are not consistent.

[0018] Furthermore, the operation of the data comparison module testing the first and second independent functions through multiple test variables is: using multiple test variables in the first memory space to test the first independent function, and saving the test results in a first test vector, using the same multiple test variables in the second memory space to test the second independent function, and saving the test results in a second test vector, and judging whether the output results are consistent based on the first test vector and the second test vector.

[0019] Furthermore, it also includes a report generation module for generating a data security risk assessment report for the marketing business system, so as to meet the requirements of the data security law and relevant company regulations.

[0020] Compared with the prior art, the present invention has the following beneficial effects:

[0021] The present invention adopts a systematic method, adopts a data collection and real-time comparison method, which can effectively evaluate and improve the data security protection level of the energy Internet marketing service system and the new generation of electricity consumption information collection system, and meet the requirements of laws, regulations and related systems. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 It is a schematic diagram of the marketing data security risk assessment system of the present invention.

[0023] Figure 2 It is a schematic diagram of the structure of the risk assessment module of the marketing data security risk assessment system of the present invention. DETAILED DESCRIPTION

[0024] According to one embodiment of the present invention, a technical solution for a marketing data security risk assessment system is provided: Figure 1 As shown, the marketing data security risk assessment system includes:

[0025] Data collection module 110: used to collect data from the target system and transmit the collected data to the database through the API interface.

[0026] The target system includes various systems involved in power marketing, such as the energy Internet market system and the electricity consumption information collection system of the new generation of users (including regional, factory, property, enterprise and other customers). Preferably, for example: the target system is the energy Internet marketing service system and the electricity consumption information system.

[0027] Preferably, the relevant data collected from the target system by the data collection module 110 may include, for example, user information, transaction records, system logs, etc.

[0028] Preferably, the data collected from the target system by the data acquisition module include: computer network information, security operation response and data related to data risk control. The security assessment methods for these data include but are not limited to document inspection, personnel interviews, system demonstration and evaluation verification and other methods, assessing the compliance of the marketing professional business system in various data processing activities, assessing the important laws and regulations involved, management measures, key technical measures and judgment criteria, and clarifying the compliance of the assessed matters. Among them, important management measures include: formulating and implementing key data security management measures to ensure the compliance of data processing activities. Key technical measures include: using advanced technical means, such as encryption technology, access control, etc., to improve the level of data security protection.

[0029] Preferably, in the security assessment method, the document verification includes: reviewing relevant documents to ensure the compliance of data processing activities.

[0030] Personnel interviews include: understanding the actual situation of data processing activities through interviews with relevant personnel.

[0031] System demonstration and evaluation verification include: evaluating the security and compliance of the system through system demonstration and evaluation verification.

[0032] Risk assessment module 120: used to compare data security risks according to preset rules and assess the compliance and security of data processing activities;

[0033] Preferably, the preset rules include data security regulations, personal information protection regulations and data security management measures.

[0034] Preferably, the risk assessment module includes a historical data submodule 121 , a data synchronization module 122 and a data comparison module 123 .

[0035] Preferably, the historical data submodule is used to store preset rules, prediction results, risk management measures and risk disposal planning data;

[0036] The data synchronization module is used to synchronize the data collected from the target system to the data comparison module in real time;

[0037] The data comparison module is used to compare the data synchronized by the data synchronization module with the data stored in the historical data submodule one by one, so as to improve the efficiency of risk assessment, ensure that risk assessment plays a role of prediction and early warning, and achieve the goal of preventing risks before they occur. This is one of the outstanding inventive points of the present invention.

[0038] Preferably, the data comparison module 123 is used to parse the first data synchronized by the data synchronization module and the second data stored in the historical data submodule respectively, to obtain first parsed data and second parsed data respectively; map the first parsed data to a first DOM tree, and store the first DOM tree using a first data structure; map the second parsed data to a second DOM tree, and store the second DOM tree using a second data structure; compare whether the composition structures of the first data and the second data are consistent, and if so, compare the composition objects of the first data and the second data to determine the difference; if not, use the parts with different composition structures as the difference.

[0039] Preferably, the data comparison module is used to decompile the first data and the second data into corresponding first assembly language codes and second assembly language codes, respectively; determine the difference code in the first assembly language code and the second assembly language code based on the difference point, and encapsulate the difference code in the first assembly language code and the second assembly language code into a first independent function and a second independent function, respectively; use multiple test variables to test the first and second independent functions, if the output results of the first and second independent functions are consistent, it is considered that the functions of the first update package and the second update package are consistent, otherwise, they are not consistent.

[0040] Preferably, the data comparison module tests the first and second independent functions through multiple test variables, and its specific operations may preferably be: using multiple test variables in the first memory space to test the first independent function, and saving the test results in a first test vector, using the same multiple test variables in the second memory space to test the second independent function, and saving the test results in a second test vector, and judging whether the output results are consistent based on the first test vector and the second test vector.

[0041] Furthermore, the operation of setting the first memory space and the second memory space in the memory based on the number of variables and the number of code lines in the first assembly language code and the second assembly language code is:

[0042]

[0043] Among them, Mspace 1 、Mspace 2 Respectively represent the size of the first and second memory spaces, varnum 1 , varnum 2 Respectively represent the number of variables in the first and second assembly language codes, linenum 1 、linenum 2Respectively represent the number of lines of code in the first and second assembly language codes, packet 1 、packet 2 Respectively represent the size of the first and second data.

[0044] The present invention adopts As one of the parameters, it is ensured that no memory leak or memory overflow occurs during the test of the corresponding independent function, thus ensuring the reliability of the test result. This is another outstanding inventive point of the present invention.

[0045] The risk assessment module compares data differences one by one in real time, effectively improving the efficiency of risk assessment, ensuring that the safety risk assessment plays a role in prediction and early warning, and achieving the goal of preventing problems before they occur. This solves the problem of lagging marketing safety compliance management in the prior art, which is one of the creative contributions made by the present invention to the prior art based on the risk causation theory.

[0046] Risk management module 130: used to formulate risk management measures and risk disposal plans according to the assessment results of the risk assessment module to improve the level of data security protection. For example, it may include: important management measures, formulate and implement key data security management measures to ensure the compliance of data processing activities. Key technical measures, adopt advanced Internet, Internet of Things, artificial intelligence and other technical means, such as encryption technology, access control, etc., to improve the level of data security protection.

[0047] Preferably, it also includes a report generation module 140 for generating a marketing business system data security risk assessment report. The report content may include, for example, assessment results, risk points, rectification measures and suggestions, etc., meeting the requirements of the data security law and relevant company regulations.

[0048] The present invention carries out data security risk assessment for energy Internet marketing, especially power marketing service systems and new generation power consumption information collection systems, conducts risk verification on the compliance and security of marketing data processing activities, identifies weak links and risk points, and takes targeted rectification and improvement measures to meet the requirements of laws, regulations and relevant systems. According to the requirements of the Data Security Law, the Personal Information Protection Law, and the State Grid Corporation and other data security regulations and management measures, refer to the data security risk analysis method, carry out data security protection improvement analysis from multiple angles and factors such as assets, threats, and current situations, formulate risk management measures and risk disposal plans based on the results of the analysis, which will help to further improve the level of data security protection.

[0049] The technical features of the above embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0050] The above-mentioned embodiments only express several implementation methods of the present invention, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for ordinary technicians in this field, several variations and improvements can be made without departing from the concept of the present invention, and these all belong to the protection scope of the present invention. Therefore, the protection scope of the patent of the present invention shall be subject to the attached claims.

Claims

1. A marketing data security risk assessment system, characterized in that: include: Data acquisition module: used to collect data from the target system; Risk assessment module: used to compare data security risks according to preset rules and evaluate the compliance and security of data processing activities; Risk management module: used to formulate risk management measures and risk disposal plans based on the assessment results of the risk assessment module.

2. The system according to claim 1, characterized in that: The target system includes an energy Internet marketing service system and an electricity consumption information system.

3. The system according to claim 2, characterized in that: The data collected by the data acquisition module from the target system includes: computer network information, safety operation response and data risk control related data.

4. The system according to claim 1, characterized in that: The preset rules include data security laws and regulations, personal information protection laws and regulations, and data security management measures.

5. The system according to claim 1, characterized in that: The risk assessment module includes a historical data submodule, a data synchronization module and a data comparison module.

6. The system according to claim 5, characterized in that: The historical data submodule is used to store preset rules, prediction results, risk management measures and risk disposal planning data; The data synchronization module is used to synchronize the data collected from the target system to the data comparison module in real time; The data comparison module is used to compare the data synchronized by the data synchronization module with the data stored in the historical data submodule one by one.

7. The system according to claim 6, characterized in that: The data comparison module is used to respectively analyze the first data synchronized by the data synchronization module and the second data stored in the historical data submodule to obtain first analyzed data and second analyzed data respectively; Mapping the first parsed data into a first DOM tree, and using a first data structure to store the first DOM tree; Mapping the second parsed data into a second DOM tree, and using a second data structure to store the second DOM tree; Comparing whether the composition structures of the first data and the second data are consistent, and if so, comparing the composition objects of the first data and the second data to determine the difference; If not, the parts with different composition structures are taken as the difference points.

8. The system according to claim 7, characterized in that: The data comparison module is used to decompile the first data and the second data into corresponding first assembly language codes and second assembly language codes respectively; determine the difference code in the first assembly language code and the second assembly language code based on the difference point, and encapsulate the difference code in the first assembly language code and the second assembly language code into a first independent function and a second independent function respectively; use multiple test variables to test the first and second independent functions, if the output results of the first and second independent functions are consistent, it is considered that the functions of the first update package and the second update package are consistent, otherwise, they are not consistent.

9. The system according to claim 8, characterized in that: The operation of the data comparison module to test the first and second independent functions through multiple test variables is as follows: using multiple test variables in the first memory space to test the first independent function, and saving the test results in a first test vector, using the same multiple test variables in the second memory space to test the second independent function, and saving the test results in a second test vector, and judging whether the output results are consistent based on the first test vector and the second test vector.

10. The system according to any one of claims 1 to 9, characterized in that: It also includes a report generation module for generating a data security risk assessment report for the marketing business system.

Images