Enterprise environment risk evaluation method and system based on big data

Abstract

The invention relates to the technical field of enterprise evaluation, in particular to an enterprise environment risk evaluation method and system based on big data, and the method comprises the steps: obtaining the application frequency of a single instruction according to a historical log of a sending terminal corresponding to the single instruction, obtaining the average application frequency of each instruction of the single sending terminal within a preset reference time, the risk category of the single instruction is comprehensively determined according to the application frequency and the average application frequency, and the data transmission mode is determined according to the risk condition of the instruction, so that the data security is improved, and the data transmission efficiency is improved.

Description

Technical Field

[0001] The present invention relates to the field of enterprise evaluation technology, and in particular to an enterprise environmental risk evaluation method and system based on big data. Background Art

[0002] As society attaches great importance to information and data, data has become extremely valuable. The core assets and confidential information of enterprises (such as business plans, customer data, research and development results, etc.) are the key to their survival and development. Abnormal data transmission patterns may mean that these important information are being illegally obtained or leaked. Timely discovery can avoid huge economic losses and competitive disadvantages.

[0003] The purpose of enterprise environmental risk assessment is to detect abnormal data transmission patterns in a timely manner so that preventive measures can be taken in advance.

[0004] Chinese patent application publication number: CN116938483A, discloses a secure data transmission method and a secure data transmission network, the method is applied to a secure data transmission network, the method includes: a seed node obtains the security data to be transmitted, and sends the security data to some nodes; some nodes directly or indirectly send the security data to the remaining nodes except some nodes in a plurality of nodes; the remaining nodes obtain a message list from some nodes, and when the security data list is inconsistent with the security data in the remaining nodes, re-obtain the security data in some nodes, the message list is used to record the security data information received in some nodes; it can be seen that the above technical solution has the following problems: it is impossible to analyze the instruction risk situation of the sending terminal according to the operating characteristics of each sending terminal of the enterprise, and it is impossible to specifically determine the data transmission method based on the risk situation, which affects the security of the data and thus affects the data transmission efficiency. Summary of the invention

[0005] To this end, the present invention provides an enterprise environmental risk assessment method and system based on big data, which is used to overcome the problem that the prior art cannot specifically analyze the instruction risk situation of the sending terminal according to the operating characteristics of each sending terminal of the enterprise, and cannot specifically determine the data transmission method according to the risk situation, which affects the security of the data and further affects the data transmission efficiency.

[0006] In one aspect, the present invention provides a method for evaluating enterprise environmental risks based on big data, comprising: S1, for an instruction of a single sending terminal, obtain the application frequency of the instruction in the historical log of the single sending terminal; S2, determining the risk category of a single instruction based on the application frequency and the average application frequency of each instruction of a single sending terminal within a preset reference time; S3, determining a processing method for a single instruction based on the risk category, and determining the number of sub-packets of the data sent by the sending terminal based on the average data occupancy of each time node of the sending terminal within a preset monitoring period; Or, based on the interactive transmission parameters and average application frequency between the receiving terminal and the sending terminal of a single instruction, determine the risk assessment parameters for the single instruction, and divide the abnormality category of the sending terminal based on the risk assessment parameters, and determine based on the abnormality category whether to adjust the copy amount of the subpackaged data to a corresponding value, adjust the preset monitoring time to a corresponding value, or determine the generated interference data string and adjust the data amount of the interference data string to a corresponding value; S4, the data to be transmitted corresponding to the instruction is divided into packets for transmission.

[0007] Furthermore, in S1, obtaining the application frequency of a single instruction in a history log of a single sending terminal includes: Get the ratio of the number of applications of a single instruction in the history log to the total number of instructions to get the application frequency.

[0008] Furthermore, in S2, the process of determining the risk category of a single instruction based on the application frequency and the average application frequency of each instruction of a single sending terminal within a preset reference time includes: If the application frequency is less than or equal to the first preset application frequency, the single instruction is determined as a high risk category; If the application frequency is less than or equal to the second preset application frequency and greater than the first preset application frequency, the risk category of the single instruction is determined in combination with the average application frequency; If the application frequency is greater than the second preset application frequency, the single instruction is determined as a weak risk category; The process of determining the risk category of individual directives in combination with the average frequency of application includes: If the average application frequency is less than or equal to the preset average application frequency, the single instruction is determined as a high risk category; If the average application frequency is greater than the preset average application frequency, the single instruction is determined to be a weak risk category.

[0009] Furthermore, in S3, the process of determining a processing method for a single instruction based on the risk category includes: If the risk category is a weak risk category, the number of sub-packets of the data sent by the sending terminal is determined based on the average data occupancy of each time node of the sending terminal within the preset monitoring time; If the risk category is a strong risk category, the risk assessment parameters for the single instruction are determined based on the interactive transmission parameters and the average application frequency between the receiving terminal and the sending terminal of the single instruction, and the abnormal category of the sending terminal is divided based on the risk assessment parameters. Based on the abnormal category, it is determined to adjust the copy amount of the subpackaged data to the corresponding value, adjust the preset monitoring time to the corresponding value, or determine the generated interference data string and adjust the data amount of the interference data string to the corresponding value.

[0010] Further, the number of sub-packets of the data sent by the sending terminal is determined based on the average data occupancy of each time node of the sending terminal within a preset monitoring time, wherein: The number of subpackets of the data sent by the sending terminal determined based on the average data occupancy is proportional to the average data occupancy.

[0011] Furthermore, based on the interactive transmission parameters and the average application frequency of the receiving terminal and the sending terminal of the single instruction, the process of determining the risk assessment parameters for the single instruction includes: Determine the interactive transmission parameter between the receiving terminal and the sending terminal of a single instruction, obtain the number of data interactions between the receiving terminal and the sending terminal in the historical log of the sending terminal, and calculate the ratio of the number of data interactions to the total number of instructions in the historical log to obtain the interactive transmission parameter; Solve the ratio of the average interactive transmission parameter of each receiving terminal corresponding to the sending terminal in the historical log to the interactive transmission parameter of the receiving terminal corresponding to a single instruction to obtain the interactive comparison parameter; Calculate the ratio of the average application frequency of each instruction in the history log to the average application frequency corresponding to a single instruction to obtain an application comparison parameter; The interactive comparison parameters and the application comparison parameters are respectively assigned corresponding weight coefficients and summed up to obtain the risk assessment parameters.

[0012] Furthermore, in S3, the process of classifying the abnormality category of the sending terminal based on the risk assessment parameter includes: If the risk assessment parameter is less than or equal to the first preset assessment parameter, the sending terminal is determined as a first-level abnormal category; If the risk assessment parameter is less than or equal to the second preset assessment parameter and greater than the first preset assessment parameter, the sending terminal is determined as a secondary abnormal category; If the risk assessment parameter is greater than the second preset assessment parameter, the sending terminal is determined as a third-level abnormal category; Determine how to handle the data to be transmitted based on the exception category, including: If the sending terminal is of the first-level abnormal category, the replication amount of the sub-packaged data is adjusted to the corresponding value based on the risk assessment parameters; If the sending terminal is of the secondary abnormal category, the preset monitoring duration is adjusted to the corresponding value based on the application frequency; If the transmitting terminal is of the third level abnormal category, the generated interference data string is determined and the data volume of the interference data string is adjusted to a corresponding value based on the average application frequency.

[0013] Further, the replication amount of the sub-packaged data is adjusted to a corresponding value based on the risk assessment parameter, wherein: The amount of replication of subcontracted data determined based on the risk assessment parameters is proportional to the risk assessment parameters; The data volume of the interfering data string is adjusted to a corresponding value based on the average application frequency, where: The data amount of the generated interference data string determined based on the average application frequency is inversely proportional to the average application frequency.

[0014] Furthermore, the preset monitoring duration is adjusted to a corresponding value based on the application frequency, wherein: The preset monitoring duration determined based on the application frequency is inversely proportional to the application frequency.

[0015] On the other hand, the present invention also provides an enterprise environmental risk assessment system using the above-mentioned enterprise environmental risk assessment method based on big data, comprising: A monitoring module, used to obtain instruction information when the sending terminal sends an instruction, and determine the receiving terminal based on the instruction information; A query module, which is connected to the monitoring module and is used to obtain, for a single instruction, the application frequency of the instruction in the historical log of a single sending terminal, obtain the average application frequency of each instruction of a single sending terminal within a preset reference time, and obtain the interactive transmission parameters between the receiving terminal and the sending terminal of a single instruction; A processing module, connected to the query module, for determining a risk assessment parameter for a single instruction based on an average application frequency and an interactive transmission parameter; An analysis module, which is connected to the query module and the processing module respectively, is used to determine the risk category of a single instruction based on the application frequency and the average application frequency, and determine the processing method for the single instruction based on the risk category, including: Determine the number of subpackets of the data sent by the sending terminal based on the average data occupancy of each time node of the sending terminal within a preset monitoring time; Or, based on the interactive transmission parameters and average application frequency between the receiving terminal and the sending terminal of a single instruction, determine the risk assessment parameters for the single instruction, and divide the abnormality category of the sending terminal based on the risk assessment parameters, and determine based on the abnormality category whether to adjust the copy amount of the subpackaged data to a corresponding value, adjust the preset monitoring time to a corresponding value, or determine the generated interference data string and adjust the data amount of the interference data string to a corresponding value; A transmission module is connected to the analysis module and is used to transmit data based on the determination result of the analysis module.

[0016] Compared with the prior art, the beneficial effects of the present invention lie in obtaining the application frequency for a single instruction based on the historical log of the sending terminal corresponding to a single instruction, obtaining the average application frequency of each instruction of a single sending terminal within a preset reference time, comprehensively determining the risk category of a single instruction based on the application frequency and the average application frequency, determining the data transmission method based on the risk situation of the instruction, thereby improving data security and improving data transmission efficiency.

[0017] Furthermore, the application frequency is obtained. The application frequency characterizes the usage of a single sending terminal for a single instruction. When the application frequency is greater than the second preset application frequency, the instruction is a regular instruction of the sending terminal, and the risk is relatively low in this case. When the application frequency is less than or equal to the second preset application frequency and greater than the first preset application frequency, it is impossible to determine whether the operator has abnormal risks based solely on the application frequency. In this case, the average application frequency of each instruction of a single sending terminal within the preset reference time is obtained to comprehensively determine whether the operator has an abnormality. When the average application frequency is less than or equal to the preset average application frequency, the operator's instructions in a short period of time are all low-probability abnormal instructions. In this case, the single instruction is determined as a high-risk category. The instruction risk situation of the sending terminal is analyzed in a targeted manner based on the actual operation of the enterprise's sending terminal. While accurately dividing the risk categories of instructions, the data transmission efficiency is further improved.

[0018] Furthermore, data is transmitted to the receiving terminal in a packet transmission manner. The number of packets of data sent by the sending terminal is determined based on the average data of each time node within the preset monitoring period. The sending parameters are determined based on actual conditions to improve the randomness of the sending parameters. Each packet is flexibly encrypted independently, which increases the complexity of data encryption, effectively improving the security of data and reducing the risk of data leakage.

[0019] Furthermore, when the risk category of the instruction is a strong risk category, for sensitive instructions, based on the interactive transmission parameters and average application frequency between the receiving terminal and the sending terminal of a single instruction, the risk assessment parameters for a single instruction are determined, and the abnormal category of the sending terminal is divided based on the risk assessment parameters. The interactive transmission parameters characterize the degree of association between the receiving terminal and the sending terminal, and whether the receiving terminal is a trusted terminal. The average application frequency characterizes the trustworthiness of the sending terminal. The risk assessment parameters are solved, and the risk assessment parameters characterize the abnormal situation of the instruction. According to the risk assessment parameters, the sending terminal corresponding to a single instruction is rated for the abnormal category, and the sensitive data is processed specifically according to the abnormal category, and the subpackaging method is flexibly selected, which improves the security of the data while improving the data transmission efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1This is a flowchart of the steps of the enterprise environmental risk assessment method based on big data according to an embodiment of the present invention; Figure 2 This is a module block diagram of an enterprise environmental risk assessment system based on big data according to an embodiment of the present invention; Figure 3 A logical decision diagram of a risk category of a single instruction based on application frequency according to an embodiment of the present invention; Figure 4 This is a logic decision diagram for determining the risk category of a single instruction based on the average application frequency according to an embodiment of the present invention. DETAILED DESCRIPTION

[0021] In order to make the objects and advantages of the present invention more clearly understood, the present invention is further described below in conjunction with embodiments; it should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0022] The preferred embodiments of the present invention are described below with reference to the accompanying drawings. It should be understood by those skilled in the art that these embodiments are only used to explain the technical principles of the present invention and are not intended to limit the protection scope of the present invention.

[0023] It should be noted that, in the description of the present invention, terms such as "up", "down", "left", "right", "inside" and "outside" indicating directions or positional relationships are based on the directions or positional relationships shown in the drawings. This is merely for the convenience of description and does not indicate or imply that the device or element must have a specific orientation, be constructed and operated in a specific orientation. Therefore, it cannot be understood as a limitation on the present invention.

[0024] In addition, it should be noted that in the description of the present invention, unless otherwise clearly specified and limited, the terms "installed", "connected", and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal communication of two components. For those skilled in the art, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0025] See also Figure 1 As shown, it is a flowchart of the steps of the enterprise environmental risk assessment method based on big data in an embodiment of the present invention; an enterprise environmental risk assessment method based on big data in an embodiment of the present invention includes: S1, for an instruction of a single sending terminal, obtain the application frequency of the instruction in the historical log of the single sending terminal; S2, determining the risk category of a single instruction based on the application frequency and the average application frequency of each instruction of a single sending terminal within a preset reference time; S3, determining a processing method for a single instruction based on the risk category, and determining the number of sub-packets of the data sent by the sending terminal based on the average data occupancy of each time node of the sending terminal within a preset monitoring period; Or, based on the interactive transmission parameters and average application frequency between the receiving terminal and the sending terminal of a single instruction, determine the risk assessment parameters for the single instruction, and divide the abnormality category of the sending terminal based on the risk assessment parameters, and based on the abnormality category, determine whether to adjust the copy amount of the subpackaged data to a corresponding value, adjust the preset monitoring time to a corresponding value, or determine the generated interference data string and adjust the data amount of the interference data string to a corresponding value.

[0026] Specifically, for each sub-packet data, a number of data packets are randomly selected for replication and transmission, and the replication amount of the sub-packet data is the proportion of the number of the selected data packets to the total number of the sub-packet data; S4, the data to be transmitted corresponding to the instruction is divided into packets for transmission.

[0027] Specifically, the application frequency for a single instruction is obtained based on the historical log of the sending terminal corresponding to a single instruction, and the average application frequency of each instruction of a single sending terminal within a preset reference time is obtained. The risk category of the single instruction is comprehensively determined based on the application frequency and the average application frequency. The data transmission method is determined based on the risk situation of the instruction, which improves data security and improves data transmission efficiency.

[0028] See also Figure 2 As shown, it is a module block diagram of an enterprise environmental risk assessment system based on big data according to an embodiment of the present invention; an enterprise environmental risk assessment system based on big data according to an embodiment of the present invention includes: A monitoring module, used to obtain instruction information when the sending terminal sends an instruction, and determine the receiving terminal based on the instruction information; A query module, which is connected to the monitoring module and is used to obtain, for a single instruction, the application frequency of the instruction in the historical log of a single sending terminal, obtain the average application frequency of each instruction of a single sending terminal within a preset reference time, and obtain the interactive transmission parameters between the receiving terminal and the sending terminal of a single instruction; A processing module, connected to the query module, for determining a risk assessment parameter for a single instruction based on an average application frequency and an interactive transmission parameter; An analysis module, which is connected to the query module and the processing module respectively, is used to determine the risk category of a single instruction based on the application frequency and the average application frequency, and determine the processing method for the single instruction based on the risk category, including: Determine the number of subpackets of the data sent by the sending terminal based on the average data occupancy of each time node of the sending terminal within a preset monitoring time; Or, based on the interactive transmission parameters and average application frequency between the receiving terminal and the sending terminal of a single instruction, determine the risk assessment parameters for the single instruction, and divide the abnormality category of the sending terminal based on the risk assessment parameters, and determine based on the abnormality category whether to adjust the copy amount of the subpackaged data to a corresponding value, adjust the preset monitoring time to a corresponding value, or determine the generated interference data string and adjust the data amount of the interference data string to a corresponding value; A transmission module is connected to the analysis module and is used to transmit data based on the determination result of the analysis module.

[0029] Specifically, in S1, obtaining the application frequency of a single instruction in the history log of a single sending terminal includes: Get the ratio of the number of applications of a single instruction in the history log to the total number of instructions to get the application frequency.

[0030] Specifically, the process of obtaining the average application frequency of each instruction of a single sending terminal within a preset reference time is to obtain each instruction of a single sending terminal within the preset reference time, obtain the application frequency of each instruction respectively, and solve the average value to obtain the average application frequency.

[0031] See also Figure 3 As shown, it is a logical decision diagram of the risk category of a single instruction based on the application frequency according to an embodiment of the present invention. In S2 of the present invention, the process of determining the risk category of a single instruction based on the application frequency and the average application frequency of each instruction of a single sending terminal within a preset reference time includes: If the application frequency is less than or equal to the first preset application frequency, the single instruction is determined as a high risk category; If the application frequency is less than or equal to the second preset application frequency and greater than the first preset application frequency, the risk category of the single instruction is determined in combination with the average application frequency; If the application frequency is greater than the second preset application frequency, the single instruction is determined as a weak risk category.

[0032] See also Figure 4 As shown, it is a logical decision diagram for determining the risk category of a single instruction based on the average application frequency according to an embodiment of the present invention. In S2 of the present invention, the process of determining the risk category of a single instruction in combination with the average application frequency includes: If the average application frequency is less than or equal to the preset average application frequency, the single instruction is determined as a high risk category; If the average application frequency is greater than the preset average application frequency, the single instruction is determined to be a weak risk category.

[0033] Specifically, the first preset application frequency Q1 is selected within the interval [0.08, 0.1], and the second preset application frequency Q2 is selected within the interval [0.25, 0.45].

[0034] Specifically, the preset average application frequency F is selected within the interval [0.2, 0.28].

[0035] Specifically, the application frequency is obtained. The application frequency characterizes the usage of a single sending terminal for a single instruction. When the application frequency is greater than the second preset application frequency, the instruction is a regular instruction of the sending terminal, and the risk is relatively low in this case. When the application frequency is less than or equal to the second preset application frequency and greater than the first preset application frequency, it is impossible to determine whether the operator has abnormal risks based solely on the application frequency. In this case, the average application frequency of each instruction of a single sending terminal within the preset reference time is obtained to comprehensively determine whether the operator has an abnormality. When the average application frequency is less than or equal to the preset average application frequency, the operator's instructions in a short period of time are all low-probability abnormal instructions. In this case, the single instruction is determined as a high-risk category. The instruction risk situation of the sending terminal is analyzed in a targeted manner based on the actual operation of the enterprise's sending terminal. While accurately dividing the risk categories of instructions, the data transmission efficiency is further improved.

[0036] Specifically, in S3, the process of determining the handling method for a single instruction based on the risk category includes: If the risk category is a weak risk category, the number of sub-packets of the data sent by the sending terminal is determined based on the average data occupancy of each time node of the sending terminal within the preset monitoring time; If the risk category is a strong risk category, the risk assessment parameters for the single instruction are determined based on the interactive transmission parameters and the average application frequency between the receiving terminal and the sending terminal of the single instruction, and the abnormal category of the sending terminal is divided based on the risk assessment parameters. Based on the abnormal category, it is determined to adjust the copy amount of the subpackaged data to the corresponding value, adjust the preset monitoring time to the corresponding value, or determine the generated interference data string and adjust the data amount of the interference data string to the corresponding value.

[0037] Specifically, data is transmitted to the receiving terminal in a packet transmission manner. The number of packets of data sent by the sending terminal is determined based on the average data of each time node within the preset monitoring period. The sending parameters are determined based on actual conditions to improve the randomness of the sending parameters. Each packet is flexibly and independently encrypted, which increases the complexity of data encryption, effectively improving data security and reducing the risk of data leakage.

[0038] Specifically, the number of subpackets of the data sent by the sending terminal is determined based on the average data occupancy of each time node of the sending terminal within a preset monitoring time, wherein: The number of subpackets of the data sent by the sending terminal determined based on the average data occupancy is proportional to the average data occupancy.

[0039] In this implementation, optionally, comparing the average data occupancy with a first preset occupancy and a second preset occupancy; If the average data occupancy is less than or equal to the first preset occupancy, the number of sub-packets is adjusted to 1.11 times the initial number of sub-packets; If the average data occupancy is less than or equal to the second preset occupancy and greater than the first preset occupancy, the number of subpackets is adjusted to 1.21 times the initial number of subpackets; If the average data occupancy is greater than the second preset occupancy, the number of sub-packets is adjusted to 1.31 times the initial number of sub-packets; The first preset occupancy is 4714.29 bps, and the second preset occupancy is 7571.43 bps.

[0040] Specifically, the preset monitoring time is less than the preset reference time, the preset reference time is selected within the interval [20, 30], and the preset reference time is selected within the interval [0.167, 0.333], and the unit is min.

[0041] Specifically, there is no limitation on the process of obtaining the average data occupancy of each time node of the sending terminal within the preset monitoring period. It can be obtained by selecting specific monitoring tools, including Wireshark, the resource monitor that comes with the operating system, or a programmed monitoring function, etc., and randomly selecting several time nodes within the preset monitoring period. Optionally, the interval duration of each time node can be the same, and the data occupancy of the sending terminal is collected. The data occupancy of each time node collected is recorded, and the average value is solved to obtain the average data occupancy. This will not be repeated.

[0042] Specifically, after the determination of the number of sub-packets is completed, the data to be transmitted to the receiving terminal is transmitted in sub-packets according to the instruction.

[0043] Specifically, each sub-package data is encrypted independently, which increases the complexity of data encryption.

[0044] Specifically, the process of determining the risk assessment parameters for a single instruction based on the interactive transmission parameters and average application frequency between the receiving terminal and the sending terminal of a single instruction includes: Determine the interactive transmission parameter between the receiving terminal and the sending terminal of a single instruction, obtain the number of data interactions between the receiving terminal and the sending terminal in the historical log of the sending terminal, and calculate the ratio of the number of data interactions to the total number of instructions in the historical log to obtain the interactive transmission parameter; Solve the ratio of the average interactive transmission parameter of each receiving terminal corresponding to the sending terminal in the historical log to the interactive transmission parameter of the receiving terminal corresponding to a single instruction to obtain the interactive comparison parameter; Calculate the ratio of the average application frequency of each instruction in the history log to the average application frequency corresponding to a single instruction to obtain an application comparison parameter; The interactive comparison parameters and the application comparison parameters are respectively assigned corresponding weight coefficients and summed up to obtain the risk assessment parameters.

[0045] Specifically, the corresponding weight coefficient of the interactive comparison parameter is the interactive weight coefficient, which is 0.65, and the corresponding weight coefficient of the application comparison parameter is the application weight coefficient, which is 0.35, and the assignment method is multiplication.

[0046] Specifically, when the risk category of the instruction is a strong risk category, for sensitive instructions, based on the interactive transmission parameters and average application frequency between the receiving terminal and the sending terminal of a single instruction, the risk assessment parameters for a single instruction are determined, and the abnormal category of the sending terminal is divided based on the risk assessment parameters. The interactive transmission parameters characterize the degree of association between the receiving terminal and the sending terminal, and whether the receiving terminal is a trusted terminal. The average application frequency characterizes the trustworthiness of the sending terminal. The risk assessment parameters are solved, and the risk assessment parameters characterize the abnormal situation of the instruction. According to the risk assessment parameters, the sending terminal corresponding to a single instruction is rated for the abnormal category. According to the abnormal category, sensitive data is processed specifically and the subpackaging method is flexibly selected, which improves the security of the data while thereby improving the data transmission efficiency.

[0047] Specifically, in S3, the process of classifying the abnormality category of the sending terminal based on the risk assessment parameter includes: If the risk assessment parameter is less than or equal to the first preset assessment parameter, the sending terminal is determined as a first-level abnormal category; If the risk assessment parameter is less than or equal to the second preset assessment parameter and greater than the first preset assessment parameter, the sending terminal is determined as a secondary abnormal category; If the risk assessment parameter is greater than the second preset assessment parameter, the sending terminal is determined as a third-level abnormal category; Determine how to handle the data to be transmitted based on the exception category, including: If the sending terminal is of the first-level abnormal category, the replication amount of the sub-packaged data is adjusted to the corresponding value based on the risk assessment parameters; If the sending terminal is of the secondary abnormal category, the preset monitoring duration is adjusted to the corresponding value based on the application frequency; If the transmitting terminal is of the third level abnormal category, the generated interference data string is determined and the data volume of the interference data string is adjusted to a corresponding value based on the average application frequency.

[0048] Specifically, the first preset evaluation parameter P1 is selected within the interval [1.97, 2.33], and the second preset evaluation parameter P2 is selected within the interval [4.66, 5.25].

[0049] Specifically, the replication amount of sub-packaged data is adjusted to a corresponding value based on the risk assessment parameter, where: The amount of replication of subcontracted data determined based on the risk assessment parameters is proportional to the risk assessment parameters; The data volume of the interfering data string is adjusted to a corresponding value based on the average application frequency, where: The data amount of the generated interference data string determined based on the average application frequency is inversely proportional to the average application frequency.

[0050] In this implementation, optionally, Comparing the risk assessment parameter with a first preset assessment comparison threshold and a second preset assessment comparison threshold; If the risk assessment parameter is less than or equal to the first preset assessment comparison threshold, the replication amount of the sub-package data is adjusted to 1.12 times the initial replication amount; If the risk assessment parameter is less than or equal to the second preset assessment comparison threshold and greater than the first preset assessment comparison threshold, the replication amount of the sub-package data is adjusted to 1.23 times the initial replication amount; If the risk assessment parameter is greater than the second preset assessment comparison threshold, the replication amount of the sub-package data is adjusted to 1.32 times the initial replication amount; The first preset evaluation comparison threshold is 0.3P1, and the second preset evaluation comparison threshold is 0.7P1.

[0051] In this implementation, optionally, comparing the average application frequency with a first preset application comparison threshold and a second preset application comparison threshold; If the average application frequency is less than or equal to the first preset application comparison threshold, the data volume of the interference data string is adjusted to 1.33 times the initial data volume; If the average application frequency is less than or equal to the second preset application comparison threshold and greater than the first preset application comparison threshold, adjusting the data volume of the interference data string to 1.25 times the initial data volume; If the average application frequency is greater than the second preset application comparison threshold, the data volume of the interference data string is adjusted to 1.12 times the initial data volume; The first preset application comparison threshold is 0.62F, and the second preset application comparison threshold is 0.75F.

[0052] Specifically, the preset monitoring duration is adjusted to a corresponding value based on the application frequency, where: The preset monitoring duration determined based on the application frequency is inversely proportional to the application frequency; In this implementation, optionally, Comparing the application frequency with a first preset frequency comparison threshold and a second preset frequency comparison threshold; If the application frequency is less than or equal to the first preset frequency comparison threshold, the preset monitoring duration is adjusted to 1.28 times the initial monitoring duration; If the application frequency is less than or equal to the second preset frequency comparison threshold and greater than the first preset frequency comparison threshold, the preset monitoring duration is adjusted to 1.21 times the initial monitoring duration; If the application frequency is greater than the second preset frequency comparison threshold, the preset monitoring duration is adjusted to 1.13 times the initial monitoring duration; The first preset frequency comparison threshold is 0.31Q2, and the second preset frequency comparison threshold is 0.52Q2.

[0053] Specifically, when the adjustment for the preset monitoring time is completed, the selected node is adjusted to 1.11 times the initial selected node.

[0054] Specifically, after the corresponding processing method of the data to be transmitted is completed, the data to be transmitted is packetized and transmitted according to the adjusted parameters.

[0055] So far, the technical solutions of the present invention have been described in conjunction with the preferred embodiments shown in the accompanying drawings. However, it is easy for those skilled in the art to understand that the protection scope of the present invention is obviously not limited to these specific embodiments. Without departing from the principle of the present invention, those skilled in the art can make equivalent changes or substitutions to the relevant technical features, and the technical solutions after these changes or substitutions will fall within the protection scope of the present invention.

[0056] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A method for enterprise environmental risk assessment based on big data, characterized in that: include: S1, for an instruction of a single sending terminal, obtain the application frequency of the instruction in the historical log of the single sending terminal; S2, determining the risk category of a single instruction based on the application frequency and the average application frequency of each instruction of a single sending terminal within a preset reference time; S3, determining a processing method for a single instruction based on the risk category, and determining the number of sub-packets of the data sent by the sending terminal based on the average data occupancy of each time node of the sending terminal within a preset monitoring period; Or, based on the interactive transmission parameters and average application frequency between the receiving terminal and the sending terminal of a single instruction, determine the risk assessment parameters for the single instruction, and divide the abnormality category of the sending terminal based on the risk assessment parameters, and determine based on the abnormality category whether to adjust the copy amount of the subpackaged data to a corresponding value, adjust the preset monitoring time to a corresponding value, or determine the generated interference data string and adjust the data amount of the interference data string to a corresponding value; S4, the data to be transmitted corresponding to the instruction is divided into packets for transmission.

2. The enterprise environmental risk assessment method based on big data according to claim 1 is characterized in that: In S1, obtaining the application frequency of a single instruction in the history log of a single sending terminal includes: Get the ratio of the number of applications of a single instruction in the history log to the total number of instructions to get the application frequency.

3. The enterprise environmental risk assessment method based on big data according to claim 2 is characterized in that: In S2, the process of determining the risk category of a single instruction based on the application frequency and the average application frequency of each instruction of a single sending terminal within a preset reference time includes: If the application frequency is less than or equal to the first preset application frequency, the single instruction is determined as a high risk category; If the application frequency is less than or equal to the second preset application frequency and greater than the first preset application frequency, the risk category of the single instruction is determined in combination with the average application frequency; If the application frequency is greater than the second preset application frequency, the single instruction is determined as a weak risk category; The process of determining the risk category of individual directives in combination with the average frequency of application includes: If the average application frequency is less than or equal to the preset average application frequency, the single instruction is determined as a high risk category; If the average application frequency is greater than the preset average application frequency, the single instruction is determined to be a weak risk category.

4. The enterprise environmental risk assessment method based on big data according to claim 3 is characterized in that: In S3, the process of determining the handling method for a single instruction based on the risk category includes: If the risk category is a weak risk category, the number of sub-packets of the data sent by the sending terminal is determined based on the average data occupancy of each time node of the sending terminal within the preset monitoring time; If the risk category is a strong risk category, the risk assessment parameters for the single instruction are determined based on the interactive transmission parameters and the average application frequency between the receiving terminal and the sending terminal of the single instruction, and the abnormal category of the sending terminal is divided based on the risk assessment parameters. Based on the abnormal category, it is determined to adjust the copy amount of the subpackaged data to the corresponding value, adjust the preset monitoring time to the corresponding value, or determine the generated interference data string and adjust the data amount of the interference data string to the corresponding value.

5. The enterprise environmental risk assessment method based on big data according to claim 4 is characterized in that: The number of sub-packets of the data sent by the sending terminal is determined based on the average data occupancy of each time node of the sending terminal within the preset monitoring time, wherein: The number of subpackets of the data sent by the sending terminal determined based on the average data occupancy is proportional to the average data occupancy.

6. The enterprise environmental risk assessment method based on big data according to claim 5 is characterized in that: The process of determining the risk assessment parameters for a single instruction based on the interactive transmission parameters and average application frequency between the receiving terminal and the sending terminal of a single instruction includes: Determine the interactive transmission parameter between the receiving terminal and the sending terminal of a single instruction, obtain the number of data interactions between the receiving terminal and the sending terminal in the historical log of the sending terminal, and calculate the ratio of the number of data interactions to the total number of instructions in the historical log to obtain the interactive transmission parameter; Solve the ratio of the average interactive transmission parameter of each receiving terminal corresponding to the sending terminal in the historical log to the interactive transmission parameter of the receiving terminal corresponding to a single instruction to obtain the interactive comparison parameter; Calculate the ratio of the average application frequency of each instruction in the history log to the average application frequency corresponding to a single instruction to obtain an application comparison parameter; The interactive comparison parameters and the application comparison parameters are respectively assigned corresponding weight coefficients and summed up to obtain the risk assessment parameters.

7. The enterprise environmental risk assessment method based on big data according to claim 6 is characterized in that: In S3, the process of classifying the abnormality category of the sending terminal based on the risk assessment parameter includes: If the risk assessment parameter is less than or equal to the first preset assessment parameter, the sending terminal is determined as a first-level abnormal category; If the risk assessment parameter is less than or equal to the second preset assessment parameter and greater than the first preset assessment parameter, the sending terminal is determined as a secondary abnormal category; If the risk assessment parameter is greater than the second preset assessment parameter, the sending terminal is determined as a third-level abnormal category; Determine how to handle the data to be transmitted based on the exception category, including: If the sending terminal is of the first-level abnormal category, the replication amount of the sub-packaged data is adjusted to the corresponding value based on the risk assessment parameters; If the sending terminal is of the secondary abnormal category, the preset monitoring duration is adjusted to the corresponding value based on the application frequency; If the transmitting terminal is of the third level abnormal category, the generated interference data string is determined and the data volume of the interference data string is adjusted to a corresponding value based on the average application frequency.

8. The enterprise environmental risk assessment method based on big data according to claim 7 is characterized in that: The replication amount of sub-packaged data is adjusted to the corresponding value based on the risk assessment parameters, where: The amount of replication of subcontracted data determined based on the risk assessment parameters is proportional to the risk assessment parameters; The data volume of the interfering data string is adjusted to a corresponding value based on the average application frequency, where: The data amount of the generated interference data string determined based on the average application frequency is inversely proportional to the average application frequency.

9. The enterprise environmental risk assessment method based on big data according to claim 8 is characterized in that: Adjust the preset monitoring duration to the corresponding value based on the application frequency, where: The preset monitoring duration determined based on the application frequency is inversely proportional to the application frequency.

10. An enterprise environmental risk assessment system using the enterprise environmental risk assessment method based on big data as described in any one of claims 1 to 9, characterized in that: include: A monitoring module, used to obtain instruction information when the sending terminal sends an instruction, and determine the receiving terminal based on the instruction information; A query module, which is connected to the monitoring module and is used to obtain, for a single instruction, the application frequency of the instruction in the historical log of a single sending terminal, obtain the average application frequency of each instruction of a single sending terminal within a preset reference time, and obtain the interactive transmission parameters between the receiving terminal and the sending terminal of a single instruction; A processing module, connected to the query module, for determining a risk assessment parameter for a single instruction based on an average application frequency and an interactive transmission parameter; An analysis module, which is connected to the query module and the processing module respectively, is used to determine the risk category of a single instruction based on the application frequency and the average application frequency, and determine the processing method for the single instruction based on the risk category, including: Determine the number of subpackets of the data sent by the sending terminal based on the average data occupancy of each time node of the sending terminal within a preset monitoring time; Or, based on the interactive transmission parameters and average application frequency between the receiving terminal and the sending terminal of a single instruction, determine the risk assessment parameters for the single instruction, and divide the abnormality category of the sending terminal based on the risk assessment parameters, and determine based on the abnormality category whether to adjust the copy amount of the subpackaged data to a corresponding value, adjust the preset monitoring time to a corresponding value, or determine the generated interference data string and adjust the data amount of the interference data string to a corresponding value; A transmission module is connected to the analysis module and is used to transmit data based on the determination result of the analysis module.

Images