Risk assessment method and device and computer equipment

Abstract

The invention relates to a risk assessment method and device and computer equipment, and the method comprises the steps: obtaining risk data affecting the quality safety of the equipment in a pre-established collection mode; performing key asset identification on the target equipment based on the risk data to obtain a key asset identification result; according to the risk data and the key asset identification result, the risk analysis result is determined, the actual risk condition faced by the equipment can be reflected from different angles through information of multiple aspects such as the risk data influencing the quality safety of the equipment, and the one-sidedness possibly brought by a single data source is avoided. Key asset identification is carried out on the target equipment based on the rich risk data, and the key part in the equipment can be determined more accurately. Recognition results of the key assets are in-depth analysis of equipment risks, and key influence objects of the risks can be clearly determined. And the risk analysis result is determined according to the risk data and the key asset identification result, so that the evaluation accuracy is further improved.

Description

Technical Field

[0001] The present application relates to the technical field of quality safety of intelligent devices, and in particular to a risk assessment method, apparatus and computer equipment. Background Art

[0002] With the rapid development of smart device technology, various smart home appliances have emerged, bringing great convenience and efficiency to people's daily lives. However, while smart devices are widely used, there are also some potential problems.

[0003] For cognitively vulnerable groups, including the elderly, children, and those with cognitive impairments, the use of smart devices may be associated with quality and safety risks. Current smart device risk assessment technology often only analyzes data from a single dimension, resulting in inaccurate risk assessment results. Summary of the Invention

[0004] Based on this, it is necessary to provide a risk assessment method, device and computer equipment that can improve the accuracy of assessment in response to the above technical problems.

[0005] In a first aspect, the present application provides a risk assessment method, the method comprising:

[0006] Use pre-established collection methods to obtain risk data that affects equipment quality and safety;

[0007] Based on the risk data, key assets of the target equipment are identified to obtain key asset identification results. The key asset identification results are used to characterize the impact of the risk data on the target equipment.

[0008] Determine risk analysis results based on risk data and key asset identification results; risk analysis results are used to improve network security disposal decisions for target devices.

[0009] In one embodiment, the risk data includes abnormal behavior data, device status data, and device risk data; the collection method includes multi-dimensional sensor collection, traffic monitoring collection, and log record mining device collection; using a pre-established collection method, obtaining risk data includes:

[0010] Use multi-dimensional sensor collection to obtain abnormal behavior data;

[0011] Using traffic monitoring and collection methods, the traffic data and operation logs of the target device are collected and processed to obtain device status data;

[0012] Use log record mining to determine device risk data.

[0013] In one embodiment, the above-mentioned method of acquiring abnormal behavior data using multi-dimensional sensor collection includes:

[0014] Classify the user profiles of device users based on their cognitive level and obtain multiple cognitive type groups;

[0015] Use multi-dimensional sensors to obtain abnormal operating behaviors of target devices;

[0016] Abnormal behavior data is determined based on abnormal operating behaviors and various cognitive type groups; the abnormal behavior data is used to characterize the protection behavior, abuse behavior, and overclocking behavior of various cognitive type groups towards the target device.

[0017] In one embodiment, the log record mining method is used to determine device risk data, including:

[0018] Using a preset interaction channel to obtain behavioral habit data and usage habit data of a group of people using the device; the preset interaction channel includes at least one of an imaging interaction port, a voice interaction interface, and an optical interaction sensor interface;

[0019] Conduct device impact analysis on behavioral habit data and usage habit data to obtain device risk data.

[0020] In one embodiment, the key asset identification of the target device based on the risk data is performed to obtain the key asset identification result, including:

[0021] Based on abnormal behavior data, the affected assets of the target device are determined; the affected assets are used to assess the risk level of the target device when facing abnormal behavior.

[0022] Determine the key assets of the target device based on device status data and key business requirements; key assets are used to assess the core value of the target device; key assets include at least one of key components, key firmware, communication channels, and configuration files;

[0023] Based on the device risk data, device-related assets of the target device are determined; the device-related assets include at least one of hardware devices, software systems, and data resources.

[0024] In one embodiment, determining key assets based on device status data and key business requirements includes:

[0025] A machine learning algorithm is used to perform status analysis and processing on the equipment status data to obtain a status type; the status type includes normal operation, abnormal operation, and equipment failure;

[0026] Identify key assets of target devices based on status type and key business requirements.

[0027] In one embodiment, determining the device-related assets of the target device based on the device risk data includes:

[0028] A preset analysis method is used to perform qualitative identification processing on the equipment risk data to obtain a qualitative identification result; the preset analysis method includes at least one of an expert survey method, an environmental analysis method, and a scenario analysis method; the qualitative identification result is used to characterize the external non-subjective risks faced by the target equipment;

[0029] Use quantitative analysis methods to quantify equipment risk data and obtain quantitative results; quantitative analysis methods are used to analyze the probability of risk occurrence and the degree of impact;

[0030] Determine the equipment-related assets of the target device based on the qualitative identification results and quantitative results.

[0031] In one embodiment, the risk analysis result includes a first analysis result, a second analysis result, and a third analysis result; and determining the risk analysis result based on the risk data and the key asset identification result includes:

[0032] Based on the abnormal behavior data, the abnormal operation impact analysis is performed on the key asset identification results to obtain a first analysis result;

[0033] Based on the equipment status data, the key asset identification results are analyzed and processed to determine the impact of the equipment operation status, thereby obtaining a second analysis result;

[0034] Based on the equipment risk data, risk analysis is performed on the key asset identification results to obtain a third analysis result.

[0035] In a second aspect, the present application also provides a risk assessment device. The device comprises:

[0036] The data acquisition module is used to obtain risk data that affects equipment quality and safety using a pre-established collection method;

[0037] The asset identification module is used to identify key assets of the target device based on the risk data and obtain key asset identification results; the key asset identification results are used to characterize the impact of the risk data on the target device;

[0038] The result determination module is used to determine the risk analysis results based on the risk data and key asset identification results; the risk analysis results are used to improve the network security disposal decision-making of the target device.

[0039] In a third aspect, the present application further provides a computer device. The computer device includes a memory and a processor. The memory stores a computer program. When the processor executes the computer program, the following steps are performed:

[0040] Use pre-established collection methods to obtain risk data that affects equipment quality and safety;

[0041] Based on the risk data, key assets of the target equipment are identified to obtain key asset identification results. The key asset identification results are used to characterize the impact of the risk data on the target equipment.

[0042] Determine risk analysis results based on risk data and key asset identification results; risk analysis results are used to improve network security disposal decisions for target devices.

[0043] In a fourth aspect, the present application further provides a computer-readable storage medium. The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the following steps:

[0044] Use pre-established collection methods to obtain risk data that affects equipment quality and safety;

[0045] Based on the risk data, key assets of the target equipment are identified to obtain key asset identification results. The key asset identification results are used to characterize the impact of the risk data on the target equipment.

[0046] Determine risk analysis results based on risk data and key asset identification results; risk analysis results are used to improve network security disposal decisions for target devices.

[0047] In a fifth aspect, the present application further provides a computer program product. The computer program product includes a computer program that, when executed by a processor, implements the following steps:

[0048] Use pre-established collection methods to obtain risk data that affects equipment quality and safety;

[0049] Based on the risk data, key assets of the target equipment are identified to obtain key asset identification results. The key asset identification results are used to characterize the impact of the risk data on the target equipment.

[0050] Determine risk analysis results based on risk data and key asset identification results; risk analysis results are used to improve network security disposal decisions for target devices.

[0051] The aforementioned risk assessment method, apparatus, and computer equipment utilize a pre-established collection method to acquire risk data affecting equipment quality and safety. Based on this risk data, key asset identification is performed on the target equipment to obtain key asset identification results. Risk analysis results are determined based on the risk data and key asset identification results. By leveraging multiple aspects of information, including risk data affecting equipment quality and safety, the actual risk situation facing the equipment can be reflected from different perspectives, avoiding the potential bias inherent in a single data source. Key asset identification of target equipment based on this rich set of risk data allows for more accurate identification of key components within the equipment. These key asset identification results provide an in-depth analysis of equipment risks, helping to clarify the key impactors of the risk. Determining risk analysis results based on risk data and key asset identification results further improves the accuracy of the assessment. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] Figure 1 is an application environment diagram of a risk assessment method in one embodiment;

[0053] Figure 2 1 is a flow chart of a risk assessment method according to an embodiment;

[0054] Figure 3 A schematic diagram of a process for obtaining risk data in one embodiment;

[0055] Figure 4 A schematic diagram of a process for obtaining multiple cognitive type groups in one embodiment;

[0056] Figure 5 A schematic diagram of a process for determining device risk data in one embodiment;

[0057] Figure 6 A schematic diagram of a process for obtaining key asset identification results in one embodiment;

[0058] Figure 7 A schematic diagram of a process for determining key assets in one embodiment;

[0059] Figure 8 A schematic diagram of a process for determining device-related assets of a target device in one embodiment;

[0060] Figure 9 is a structural block diagram of a risk assessment device in one embodiment;

[0061] Figure 10 FIG. 1 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0062] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0063] The risk assessment method provided in the embodiment of the present application can be applied to Figure 1 In the application environment shown. Among them, the terminal 102 communicates with the server 104 through the network. The data storage system can store the data that the server 104 needs to process. The data storage system can be integrated on the server 104, or it can be placed on the cloud or other network servers. The terminal obtains risk data that affects the quality and safety of the equipment; based on the risk data, it identifies the key assets of the target equipment and obtains the key asset identification results; based on the risk data and the key asset identification results, it determines the risk analysis results. Among them, the terminal 102 can be but is not limited to various personal computers, laptops, smart phones, tablets, Internet of Things devices and portable wearable devices. The Internet of Things devices can be smart speakers, smart TVs, smart air conditioners, smart car-mounted devices, etc. Portable wearable devices can be smart watches, smart bracelets, head-mounted devices, etc. The server 104 can be implemented as an independent server or a server cluster consisting of multiple servers.

[0064] In an exemplary embodiment, Figure 2 As shown, this application provides a risk assessment method, which is applied to Figure 1 The following steps are used as an example to illustrate the terminal in the figure:

[0065] S201, using a pre-established collection method to obtain risk data that affects equipment quality and safety.

[0066] Among them, risk data refers to various data that can reflect the quality and safety risks of equipment.

[0067] The embodiments of the present application install multiple sensors on the device to monitor the device's operating status in real time and collect device status data. For example, a temperature sensor can monitor the device's operating temperature, and a pressure sensor can monitor pressure changes within the device. Simultaneously, network monitoring technology is used to obtain the device's network traffic data and analyze abnormal behavior data. For example, network traffic monitoring tools can detect whether the device has abnormal network connection or data transmission behavior. Furthermore, device risk data is extracted by analyzing the device's historical fault records and security events.

[0068] Another implementation of the present application, in addition to sensor monitoring and network monitoring, can establish a data sharing mechanism with equipment manufacturers, maintenance service providers, and other organizations to obtain information such as equipment production quality data and maintenance records. For example, the manufacturer can provide quality inspection data from the equipment during the production process, and the maintenance service provider can provide maintenance history and fault diagnosis reports. This data can supplement risk data, further enrich the source of risk data, and improve the accuracy of risk assessments.

[0069] S202: Based on the risk data, key asset identification is performed on the target device to obtain a key asset identification result.

[0070] Key assets refer to the parts of the target device that have a significant impact on the device's quality and safety, such as communication protocols, system configuration information, key components, key firmware, communication channels, configuration files, hardware devices, software systems, and data resources. Damage to key assets may seriously affect the overall functionality of the device. Key asset identification results are used to characterize the impact of risk data on the target device.

[0071] The embodiments of the present application identify key assets such as critical components, important software systems, and key data resources in a device based on risk data. For example, if the risk data indicates that a specific component of a device frequently fails or is attacked, then this component can be identified as a key asset. Simultaneously, the potential impact of the risk data on these key assets is analyzed. For example, if the device status data indicates that the device temperature is too high, which may affect the performance of key components, the extent of this impact can be assessed.

[0072] Another embodiment of the present application employs an artificial intelligence algorithm, such as a machine learning algorithm or a deep learning algorithm, to conduct in-depth analysis of risk data and automatically identify key assets in target devices. For example, a machine learning algorithm can be trained on a large amount of risk data to establish a key asset identification model. This model can automatically identify key assets in a device based on the input risk data and assess the impact of the risk data on these key assets. This approach can improve the accuracy and efficiency of key asset identification and reduce the workload of manual analysis.

[0073] S203: Determine the risk analysis results based on the risk data and key asset identification results.

[0074] Among them, the risk analysis results are used to improve the network security disposal decisions of the target devices.

[0075] The embodiment of the present application determines the risk analysis result based on the risk data and the key asset identification results. The risk analysis results are used to improve the network security disposal decision-making of the target device. Taking into account the risk data and the impact on key assets, the severity of the risk, the probability of occurrence and the possible losses are assessed. For example, if the key asset identification result shows that a key component is under serious risk threat, and the risk data shows that the probability of such risk occurrence is high, then the severity of the risk can be assessed as high. At the same time, it provides a scientific basis for making network security disposal decisions for the device. For example, if the risk analysis result shows that the device is at risk of network attack, then corresponding network security protection measures can be formulated, such as installing a firewall, encrypting data transmission, etc.

[0076] Another implementation method of the present application involves incorporating an expert system into the system, inviting experts in the device field to review and evaluate the risk analysis results. Experts can adjust and optimize the risk analysis results based on their experience and expertise. For example, experts may find that certain risks are underestimated or overestimated, and thus revise the risk analysis results. Furthermore, based on the experts' opinions and suggestions, the risk analysis results can be adjusted and optimized to improve their accuracy and reliability, providing strong support for making more scientific and reasonable network security decisions.

[0077] The aforementioned risk assessment method, apparatus, and computer equipment utilize a pre-established collection method to acquire risk data affecting equipment quality and safety. Based on this risk data, key asset identification is performed on the target equipment to obtain key asset identification results. Risk analysis results are determined based on the risk data and key asset identification results. By leveraging multiple aspects of information, including risk data affecting equipment quality and safety, the actual risk situation facing the equipment can be reflected from different perspectives, avoiding the potential bias inherent in a single data source. Key asset identification of target equipment based on this rich set of risk data allows for more accurate identification of key components within the equipment. These key asset identification results provide an in-depth analysis of equipment risks, helping to clarify the key impactors of the risk. Determining risk analysis results based on risk data and key asset identification results further improves the accuracy of the assessment.

[0078] In an exemplary embodiment, based on the above embodiment, see Figure 3 The risk data in the embodiment of the present application includes abnormal behavior data, device status data, and device risk data; the collection methods include multi-dimensional sensor collection, traffic monitoring collection, and log record mining device collection; the embodiment of the present application involves using a pre-established collection method, and the process of obtaining risk data includes:

[0079] S301, using a multi-dimensional sensor collection method to obtain abnormal behavior data.

[0080] Abnormal behavior data refers to data generated by behaviors that significantly deviate from normal device usage patterns or expected user behavior. It typically reflects abnormal operations or usage that could potentially pose risks to device quality and safety. For cognitively vulnerable groups (such as those with cognitive impairment, physical disabilities, pregnant women, the elderly, and adolescents), abnormal behavior data may include incorrect installation, incorrect operation, frequent device restarts, repeated input of the same command, aggressive device manipulation, and dependency on specific functions. For general users, abnormal behavior data may include improper protection (such as overprotection leading to poor device heat dissipation), abuse (such as exceeding the specified device operating conditions), and overclocking. In this consumer behavior study, sensors, cameras, and other devices were used to non-invasively collect data on the operational behavior of cognitively vulnerable groups using smart devices. First, user profiling was conducted based on the identity, behavioral, psychological characteristics, and interests of low-cognition smart product consumers. Users were categorized by cognitive level into groups with cognitive impairment, physical disabilities, pregnant women, the elderly, and adolescents. Based on these consumer group characteristics, typical abnormal operational behaviors were extracted. Table 1 shows the behaviors of typical consumer groups when using smart products.

[0081] Table 1

[0082]

[0083] The embodiments of this application utilize multi-dimensional sensor acquisition to acquire abnormal behavior data. By deploying multiple sensors around the device, such as cameras that can record user actions on the device, and temperature and pressure sensors that can detect physical changes in the device under abnormal operation, abnormal user behavior data can be acquired. For example, if a user violently operates the device, the pressure sensor may detect abnormal pressure values; if a user performs an incorrect installation, the camera can record the process.

[0084] Another embodiment of the present application is that, in addition to deploying sensors around a device, sensors on a wearable device can also be used to interact with the device to obtain user behavior data. For example, a smart bracelet worn by a user can detect the user's hand movements. When the user operates the device, the bracelet's sensor data can be combined with the device's sensor data to more accurately determine whether the user's operating behavior is abnormal.

[0085] S302: Using a flow monitoring and collection method, the flow data and operation logs of the target device are collected and processed to obtain device status data.

[0086] Equipment status data reflects the equipment's operating status and performance at a specific moment. It can be collected and monitored in a variety of ways to assess the equipment's quality, safety, and operational stability.

[0087] The embodiment of the present application adopts a flow monitoring and collection method to collect and process the flow data and operation logs of the target device to obtain device status data. The flow monitoring tool is used to monitor the network flow of the device in real time, and analyze the size, direction, protocol and other information of the flow to determine whether the network connection status of the device is normal. At the same time, the operation log of the device is analyzed to record key events such as the device's operation instructions and operating status changes. For example, if the flow suddenly increases or an abnormal network connection occurs, it may mean that there is a security risk to the device; frequent erroneous instructions in the operation log may reflect problems with the device's software system.

[0088] Another embodiment of the present application utilizes artificial intelligence algorithms to analyze traffic data and operation logs. For example, a machine learning algorithm can be trained on large amounts of traffic data and operation logs to establish a device status prediction model. This model can predict the future status of a device based on current traffic data and operation logs, identifying potential risks in advance.

[0089] S303: Determine device risk data by using log record mining.

[0090] Equipment risk data refers to information that indicates potential quality and safety risks to a device. This data is primarily determined through analysis of historical equipment failure records, security incidents, log mining, and other potential risk factors. Historical failure records include the type, frequency, cause, and repair history of past equipment failures. By analyzing historical failure records, weaknesses and potential risk points can be identified, providing insights for preventing similar failures from recurring.

[0091] Security incidents: Records of security incidents such as network attacks, malware infections, and data leaks. These incidents reflect the network security risk of the device and require appropriate security measures to mitigate the risk.

[0092] Risk Information in Log Records: This tool analyzes the device's system and application logs, including error messages, warnings, and abnormal event records, to identify potential risks. For example, frequent occurrences of specific error codes in system logs may indicate a software vulnerability or hardware failure; abnormal behavior in application logs may indicate a security risk in the application.

[0093] External risk factors: In addition to factors inherent to the device itself, these include risks in the physical environment (such as electromagnetic interference, temperature and humidity fluctuations), and supply chain risks (such as component quality issues and supplier reliability). These external risk factors can also impact the quality and safety of the device and require assessment and management.

[0094] When smart devices receive unusual user input signals or interference signals from the physical environment, they can assess the impact of abnormal user input on smart consumer products. This solution utilizes the imaging interaction port, voice interaction interface, and optical interaction sensor to collect and record user behavior and usage data. When collecting user behavior data, this solution primarily focuses on sensor data, voice recognition data, and camera data. Sensors are devices that sense and convert measured information into electrical signals or other forms of information at a specific sampling frequency, outputting information that meets the requirements of information transmission, processing, storage, display, recording, and control. These sensors enable electronic devices to possess human senses of touch, vision, and hearing, and are characterized by miniaturization, digitization, intelligence, multifunctionality, and networking. They are the primary link in achieving automatic detection and control. The sensors on the smart device side described in this solution include temperature sensors, pressure sensors, flow sensors, and other sensors. Table 2 lists the types and typical products of smart device sensors.

[0095] Table 2

[0096]

[0097] The present embodiment uses log mining to identify device risk data. By deeply mining the device's system logs, application logs, and other data, and analyzing the error messages and warnings contained in the logs, the present embodiment identifies the risks the device may face. For example, if a specific error code frequently appears in the system log, it may indicate a device component failure or a security vulnerability.

[0098] Another implementation method of the present application involves establishing a log data sharing platform to integrate and analyze log data from multiple devices. By comparing and analyzing large amounts of device log data, common risk issues can be identified, providing a more comprehensive reference for device risk assessment. Furthermore, big data analysis techniques can be used to mine log data, improving the accuracy and reliability of risk data.

[0099] The embodiments of this application utilize multiple methods, including multi-dimensional sensor data collection, flow monitoring data collection, and log record mining equipment data collection, to acquire risk data from different perspectives and comprehensively reflect the quality and safety risk status of the equipment. By mutually verifying and complementing various data collection methods, the accuracy of risk data can be improved, providing a reliable basis for subsequent risk assessment and decision-making. Methods such as flow monitoring data collection and log record mining can obtain real-time equipment status and risk information, promptly identify potential risk issues, and improve the safety and stability of the equipment.

[0100] In an exemplary embodiment, based on the above embodiment, see Figure 4 The embodiment of the present application relates to a process of acquiring abnormal behavior data using a multi-dimensional sensor acquisition method, including the following steps:

[0101] S401: Classify the user profiles of the device users based on their cognitive levels to obtain multiple cognitive type groups.

[0102] The cognitive level refers to the user's ability to understand, operate, and maintain the device. Users with different cognitive levels may exhibit different behavioral patterns when using the device.

[0103] This embodiment of the application categorizes device users into different groups based on factors related to their familiarity with the device, operational skills, safety awareness, and other cognitive level factors. For example, these groups can be divided into cognitively impaired groups, physically disabled groups, pregnant women, elderly people, teenagers, and people with average cognitive levels. By categorizing users, we can better understand the behavioral characteristics and needs of different groups, providing a foundation for subsequent collection and analysis of abnormal behavior data.

[0104] Another embodiment of the present application is that in addition to classification based on cognitive level, comprehensive classification can also be performed based on factors such as the user's occupation and usage scenario. For example, users who use equipment in an industrial production environment can be classified according to their job position and operating procedures; users who use equipment in a home environment can be classified according to their family role and usage habits. This can more accurately understand the behavioral characteristics of different user groups in specific scenarios and improve the pertinence and effectiveness of abnormal behavior data.

[0105] S402: Acquire abnormal operation behavior of the target device using a multi-dimensional sensor.

[0106] Among them, abnormal operating behavior refers to operating behavior that is inconsistent with the normal use specifications of the equipment, including improper protection behavior, abuse behavior and overclocking behavior.

[0107] The embodiments of the present application utilize multi-dimensional sensors to detect abnormal operating behavior of the target device. These sensors, such as cameras installed around or connected to the device, can record user actions, while temperature and pressure sensors can detect physical changes in the device under abnormal operation. For example, if a user violently operates the device, the pressure sensor may detect abnormal pressure values; if a user incorrectly installs the device, the camera can record the process.

[0108] Another embodiment of the present application combines artificial intelligence image recognition technology and sensor data analysis algorithms to automatically identify abnormal user operations. For example, deep learning algorithms analyze camera images to identify incorrect user operations; data analysis algorithms process sensor data to detect abnormal physical changes in the device. This improves the efficiency and accuracy of detecting abnormal operations and reduces the workload of manual analysis.

[0109] S403: Determine abnormal behavior data based on the abnormal operation behavior and each cognitive type group.

[0110] Among them, abnormal behavior data is used to characterize the protection behavior, abuse behavior and overclocking behavior of each cognitive type group towards the target device.

[0111] The embodiments of this application categorize and organize the collected abnormal operating behaviors, and determine abnormal behavior data for different groups based on the cognitive type group to which the users belong. For example, people with cognitive impairments may exhibit abnormal behaviors such as frequent incorrect operations and reliance on specific functions; while teenagers may exhibit abuse and overclocking behaviors. By analyzing abnormal behavior data from different groups, we can better understand the risk status of devices in different user groups and provide a basis for developing targeted risk prevention measures.

[0112] Another embodiment of the present application involves establishing an abnormal behavior database to store and manage abnormal behavior data for groups with different cognitive types. Big data analytics techniques are used to mine and analyze the abnormal behavior database to identify behavioral pattern differences and common issues among different groups. For example, data analysis can reveal that certain groups are more likely to exhibit specific types of abnormal behavior, allowing for targeted user education and training activities to improve users' device safety awareness and operational skills.

[0113] The embodiments of the present application, by classifying and processing user profiles of device users and combining them with multi-dimensional sensors to collect abnormal operating behaviors, can comprehensively and accurately obtain abnormal behavior data for groups with different cognitive types, providing rich information for equipment quality and safety risk assessment. By identifying abnormal behavior data based on the behavioral characteristics of different cognitive types, more targeted risk prevention measures can be formulated to improve the effectiveness of equipment quality and safety management. By utilizing artificial intelligence technology and big data analysis technology, abnormal operating behaviors can be automatically identified, the potential value of abnormal behavior data can be explored, and the efficiency and accuracy of data collection and analysis can be improved.

[0114] In an exemplary embodiment, based on the above embodiment, see Figure 5 The embodiment of the present application involves determining device risk data by using log record mining, including the following steps:

[0115] S501: Acquire behavioral habit data and usage habit data of device users using a preset interactive channel.

[0116] Among them, the preset interaction channel includes at least one of an imaging interaction port, a voice interaction interface and an optical interaction sensor interface.

[0117] The embodiment of the present application adopts a preset interaction channel to obtain behavioral habit data and usage habit data of the device users; the preset interaction channel includes at least one of an imaging interaction port, a voice interaction interface, and an optical interaction sensor interface.

[0118] Through imaging interaction ports, such as cameras and other image acquisition devices, we record images of user interactions with devices and analyze their movements, facial expressions, and other information to obtain behavioral habit data. For example, we can analyze the user's gestures and movement frequency when operating the device to understand their operating habits. Furthermore, image information can be used to determine the environment in which the device is used and obtain usage habit data.

[0119] Through voice interaction interfaces, such as microphones, users' voice commands and communication information can be captured. Voice content analysis can help us understand users' needs and usage habits for the device. It can also detect changes in users' emotions during device use, which can be used as part of behavioral habit data.

[0120] Through optical interaction sensor interfaces, such as optical sensors, we can obtain information about user interactions with devices and changes in ambient light. For example, by detecting changes in light intensity around a device, we can understand how the device is used in different lighting environments and use it as usage data.

[0121] Another embodiment of the present application is that, in addition to the aforementioned preset interaction channels, behavioral and usage data can be comprehensively acquired by combining sensor data from the device and network log data. For example, data from sensors such as the device's built-in accelerometer and gyroscope can be used to analyze the user's movement and operation habits of the device; combined with the device's network access logs, the user's usage of the device in different network environments can be understood.

[0122] S502: Perform device impact analysis on the behavior habit data and the usage habit data to obtain device risk data.

[0123] The present embodiment comprehensively analyzes the acquired behavioral and usage data to assess the impact of these habits on device quality and safety. For example, if a user frequently uses a device in high-temperature and high-humidity environments, the risk of device failure may increase; if a user frequently performs certain operations, it may cause increased wear and tear on certain device components, thereby affecting the performance and lifespan of the device.

[0124] By building a risk assessment model and using behavioral and usage data as input, we can predict the risks a device may face. For example, we can use machine learning algorithms to build a risk prediction model that predicts the probability of device failure within a certain period of time based on user behavioral and usage data.

[0125] Another implementation method of the present application involves introducing an expert system, inviting experts in the device field to analyze and evaluate behavioral and usage data. Based on their experience and expertise, these experts can determine the impact of user behavioral and usage habits on device quality and safety, and provide corresponding risk prevention recommendations. Simultaneously, combining expert opinions with the results of a risk assessment model, device risk data is determined, improving its accuracy and reliability.

[0126] The embodiments of the present application acquire behavioral and usage data of device users through multiple pre-set interactive channels, enabling a more comprehensive understanding of potential risk factors during device use and providing richer information for device quality and safety risk assessment. By performing device impact analysis on behavioral and usage data, combined with expert systems and risk assessment models, the accuracy and reliability of device risk data can be improved. Real-time acquisition of user behavioral and usage data allows for the timely identification of potential risk issues and provides timely decision-making support for device quality and safety management.

[0127] In an exemplary embodiment, based on the above embodiment, see Figure 6The embodiment of the present application relates to a process of identifying key assets of a target device based on risk data and obtaining a key asset identification result, including the following steps:

[0128] S601: Determine affected assets of a target device based on abnormal behavior data.

[0129] The affected assets are used to assess the risk level of the target device when facing abnormal behavior. The affected assets include at least one of communication protocols, system configuration information, data packets, and file servers.

[0130] This embodiment of the present application identifies affected assets of a target device based on abnormal behavior data. The abnormal behavior data is analyzed to determine which device assets may be affected by the abnormal behavior. For example, if the abnormal behavior data indicates frequent user errors, this may affect the device's communication protocol, system configuration information, and other components. By identifying these affected assets, the risk level of the target device in the event of abnormal behavior can be assessed.

[0131] Another embodiment of the present application utilizes artificial intelligence algorithms to conduct in-depth analysis of abnormal behavior data and automatically identify affected assets. For example, a machine learning algorithm can be trained on a large amount of abnormal behavior data to establish an affected asset identification model. This model can automatically identify potentially affected assets within a target device based on the input abnormal behavior data.

[0132] When conducting risk analysis for quality and safety issues caused by abnormal operations, key considerations include the operability, stability, financial integrity, and privacy of the affected device. When a device is attacked by an external attacker, the integrity, confidentiality, availability, and authorization of the smart device system software may be compromised, and the operating status (including availability and operability) of the smart device system hardware may also be affected. Table 3 lists the quality and safety attributes of smart device terminal systems.

[0133] Table 3

[0134]

[0135] S602: Determine key assets of the target device based on the device status data and key business requirements.

[0136] Among them, key assets are used to evaluate the core value of the target device; key assets include at least one of key components, key firmware, communication channels and configuration files.

[0137] The embodiments of the present application determine the key assets of a target device based on device status data and key business requirements. Key assets in a target device are determined by comprehensively considering the device status data and key business requirements. Key assets include key components, key firmware, communication channels, and configuration files. For example, if the device status data indicates that the operating status of a component is critical to the overall performance of the device, and the component plays a key role in a key business, then the component can be identified as a key asset.

[0138] Another implementation method of the present application involves introducing an expert system, where experts in the equipment field are invited to identify the key assets of the target equipment based on equipment status data and key business requirements. Experts can accurately identify the key parts of the equipment based on their experience and expertise. Furthermore, combining data analysis with expert opinions improves the accuracy and reliability of key asset identification.

[0139] Based on the impact of abnormal behaviors and external attackers' behaviors on the quality and safety attributes of smart device terminal systems, key asset analysis and identification are performed, as shown in Table 4:

[0140] Table 4

[0141]

[0142] S603: Determine device-related assets of the target device based on the device risk data.

[0143] Among them, equipment-related assets include at least one of hardware equipment, software systems and data resources.

[0144] This embodiment of the present application identifies the device-related assets of a target device based on device risk data. The device risk data is analyzed to identify the device-related assets of the target device. Device-related assets include hardware devices, software systems, and data resources. For example, if the device risk data indicates a hardware failure risk, the corresponding hardware device can be identified as a device-related asset. By identifying device-related assets, a comprehensive understanding of the device's overall risk profile can be obtained.

[0145] Another embodiment of the present application involves establishing a risk assessment matrix, analyzing and correlating device risk data with hardware devices, software systems, and data resources, and identifying device-related assets. For example, the device risk data is categorized and evaluated based on the risk assessment matrix to determine which hardware devices, software systems, and data resources may be affected by the risk, thereby identifying device-related assets.

[0146] By comprehensively analyzing risk data, the embodiments of this application can accurately identify key assets and affected assets in target devices, providing an accurate basis for device risk management. Taking into account multiple aspects of information, including abnormal behavior data, device status data, and device risk data, the method can comprehensively identify key assets and related assets of a device, improving the comprehensiveness of device risk management. By introducing artificial intelligence algorithms and expert systems, as well as establishing a risk assessment matrix, the flexibility and adaptability of the method are enhanced, enabling it to meet the key asset identification needs of different types of equipment.

[0147] In an exemplary embodiment, based on the above embodiment, see Figure 7 The embodiment of the present application relates to determining key assets based on device status data and key business requirements, including the following steps:

[0148] S701: Use a machine learning algorithm to perform status analysis on the device status data to obtain a status type.

[0149] The status type includes one of normal operation, abnormal operation and equipment failure.

[0150] The embodiments of the present application utilize machine learning algorithms, such as classification and clustering algorithms, to analyze device status data. By learning from large amounts of device status data, the algorithms can automatically identify different operating states of the device and classify them as normal operation, abnormal operation, or device failure. For example, the device's status type can be determined based on parameters such as temperature, pressure, and current, as well as the device's operation logs and alarm information.

[0151] Another implementation method of the present application is to combine machine learning algorithms with expert systems for state analysis. Experts in the device field can analyze and determine the device state data based on their experience and expertise to determine the device's state type. The expert's judgment results can also be used as training data for the machine learning algorithm, continuously improving the algorithm's accuracy and reliability.

[0152] S702: Determine the key assets of the target device based on the status type and key business requirements.

[0153] This embodiment of the application combines the device's status type and key business requirements to identify the device components that have the greatest impact on key business operations as key assets. For example, if a device is in an abnormal operating state and the key business requires a high level of communication channels for the device, then the communication channels may be identified as key assets. Simultaneously, the processes and requirements of key business operations are analyzed to determine the role and importance of key assets in the key business operations.

[0154] Another embodiment of the present application involves establishing a key asset assessment model, using equipment status data, key business requirements, and other data as inputs, and determining key assets through model calculations. For example, methods such as the Analytic Hierarchy Process (AHP) and the Fuzzy Comprehensive Evaluation Method can be used to establish the key asset assessment model. Based on the model's assessment results, the priority and importance of key assets are determined, providing a basis for equipment risk management and resource allocation.

[0155] The embodiments of the present application, through the combination of machine learning algorithms and expert systems, as well as methods such as establishing a key asset assessment model, can accurately determine the status type and key assets of the equipment, providing an accurate basis for risk management and resource allocation of the equipment. Taking into account the equipment status data and key business needs, it is possible to comprehensively identify the key assets of the equipment and improve the comprehensiveness and pertinence of equipment risk management. The method has strong adaptability and can be flexibly adjusted and optimized according to different types of equipment and key business needs to meet the needs of determining key assets of equipment in different scenarios.

[0156] In an exemplary embodiment, based on the above embodiment, see Figure 8 The embodiment of the present application relates to determining device-related assets of a target device based on device risk data, including the following steps:

[0157] S801: Use a preset analysis method to perform qualitative identification processing on the equipment risk data to obtain a qualitative identification result. Use a quantitative analysis method to perform risk quantification processing on the equipment risk data to obtain a quantitative result.

[0158] Among them, the preset analysis method includes at least one of the expert investigation method, environmental analysis method and scenario analysis method; the qualitative identification results are used to characterize the external non-subjective risks faced by the target equipment; and the quantitative analysis method is used to analyze the probability and impact of the risk.

[0159] Pre-situation analysis: A method used to qualitatively identify and process equipment risk data. Expert surveys assess risk using expert experience and knowledge. Environmental analysis analyzes the impact of the equipment's external environment on it. Scenario analysis assesses the risks faced by equipment by assuming different risk scenarios.

[0160] Qualitative identification results: The results obtained after processing the device risk data through a preset analysis method are used to characterize the external non-subjective risks faced by the target device, that is, risks that are not affected by the subjective intentions of the device user.

[0161] Quantitative analysis method: a method used to quantify equipment risk data, by analyzing the probability of risk occurrence and the degree of impact, and quantifying the risk.

[0162] The embodiment of the present application uses a preset analysis method to perform qualitative identification processing on the equipment risk data to obtain a qualitative identification result. The preset analysis method includes at least one of an expert survey method, an environmental analysis method, and a scenario analysis method.

[0163] Expert Survey Method: Invite experts in the equipment field to analyze and assess equipment risk data based on their experience and expertise. Experts can identify the external, non-subjective risks facing the target equipment by analyzing historical equipment failure records, security incidents, and external environmental factors. For example, experts can assess the potential risk of technological obsolescence based on factors such as the industry in which the equipment operates and technological development trends.

[0164] Environmental analysis: Analyzes the impact of the device's external environment, including the physical, social, and regulatory environments. For example, consider the operational risks of the device in environments with high temperature, high humidity, or strong electromagnetic interference, or analyze the impact of changes in policies and regulations on the device.

[0165] Scenario analysis: This method assesses the risk profile of a device under various scenarios by assuming different risk scenarios. For example, it can analyze the device's vulnerability and response capabilities under scenarios such as natural disasters, cyberattacks, and supply chain disruptions.

[0166] Another implementation method: In addition to the aforementioned pre-defined analysis method, big data analysis techniques can be combined to mine and analyze large amounts of device risk data to identify potential risk patterns and trends. For example, data mining algorithms can be used to analyze device failure records to identify patterns and potential causes of failures. Big data analysis of network security incidents can also be used to predict the potential cyberattack risks faced by devices.

[0167] Risk quantification: Quantitative analysis is used to quantify equipment risk data and obtain quantitative results. Quantitative analysis is used to analyze the probability of risk occurrence and the extent of its impact.

[0168] By establishing a risk assessment model, using equipment risk data as input, the probability of risk occurrence and the extent of its impact can be calculated. For example, probabilistic statistical methods can be used to calculate the probability of different risk events based on the equipment's historical failure data and safety incident records. Furthermore, the extent of the risk impact can be determined by assessing the impact of risk events on equipment performance, functionality, and safety.

[0169] Another implementation approach involves introducing a machine learning algorithm to train device risk data and establish a risk prediction model. This model can automatically predict the probability and impact of a risk based on the input device risk data, improving the accuracy and efficiency of risk quantification.

[0170] S802: Determine the device-related assets of the target device based on the qualitative identification result and the quantitative result.

[0171] Among them, the quantitative results are obtained by processing the equipment risk data through quantitative analysis method, which reflects the specific quantitative value of the risk.

[0172] This embodiment of the present application identifies the device-related assets of the target device based on qualitative identification results and quantitative results. Taking both qualitative and quantitative results into consideration, assets with a greater impact on device risk are identified as device-related assets. For example, if qualitative identification results indicate that the device faces a high external environmental risk, and quantitative results indicate a high probability of occurrence and a high degree of impact of this risk, then hardware devices related to the external environment (such as protective housings and cooling systems) can be identified as device-related assets.

[0173] Another embodiment of the present application involves establishing a risk-asset correlation matrix and analyzing the correlation between qualitative and quantitative identification results and the various asset components of the equipment. This matrix analysis can identify which asset components are most closely associated with specific risks, thereby identifying equipment-related assets. Furthermore, equipment-related assets can be prioritized based on the importance of the risk and the criticality of the asset, providing a decision-making basis for risk management and resource allocation.

[0174] The embodiments of this application process equipment risk data through a variety of preset analysis methods and quantitative analysis methods, which can comprehensively and accurately identify the risks faced by the equipment and provide a sufficient basis for determining equipment-related assets. By utilizing technical means such as expert experience, big data analysis, and machine learning, the accuracy of risk identification and quantification is improved, thereby enabling more accurate determination of equipment-related assets. Determining equipment-related assets based on the specific risk status of the equipment makes risk management and resource allocation more targeted, improving the efficiency and effectiveness of equipment management.

[0175] In an exemplary embodiment, based on the above embodiments, the risk analysis results of the embodiments of the present application include a first analysis result, a second analysis result, and a third analysis result; the risk analysis results are determined based on the risk data and the key asset identification results, including: based on the abnormal behavior data, performing abnormal operation impact analysis on the key asset identification results to obtain a first analysis result; based on the equipment status data, performing equipment operation status impact analysis on the key asset identification results to obtain a second analysis result; based on the equipment risk data, performing risk analysis on the key asset identification results to obtain a third analysis result.

[0176] Among them, the first analysis result: the result obtained by performing abnormal operation impact analysis on the key asset identification results based on abnormal behavior data, which reflects the impact of abnormal behavior on key assets.

[0177] Second analysis result: The result obtained by performing equipment operation status impact analysis on the key asset identification results based on the equipment status data, which reflects the degree of impact of the equipment operation status on the key assets.

[0178] The third analysis result: The result obtained by performing risk analysis on the key asset identification results based on the equipment risk data reflects the degree of impact of various risks faced by the equipment on key assets.

[0179] Furthermore, factors of the same type have different impacts on assets, and the difficulty of implementation can be divided into four levels. As shown in Table 5, the factors affecting implementation and their specific descriptions are shown in Table 6:

[0180] Table 5

[0181]

[0182] Table 6

[0183]

[0184] As shown in Table 7, after obtaining the risk level of the smart device system, it is necessary to form a corresponding risk management strategy based on the device assets and corresponding risk scenarios. The current risk management strategies include avoidance, mitigation, transfer and retention.

[0185] Table 7

[0186]

[0187] In this embodiment of the present application, based on the device status data, an impact analysis of the device operating status is performed on the key asset identification results to obtain a second analysis result. The device status data is analyzed to determine the impact of the device operating status on the key assets. For example, if the device status data indicates that the device is in an abnormal operating state, this may affect key components, communication channels, and other components of the key assets. By analyzing the correlation between the device status data and the key asset identification results, the degree of impact of the device operating status on the key assets is assessed to obtain the second analysis result.

[0188] This embodiment of the present application performs a risk analysis on the key asset identification results based on the device risk data to obtain a third analysis result. The device risk data is analyzed to determine the impact of various risks faced by the device on the key assets. For example, if the device risk data indicates that the device has a hardware failure risk or a security vulnerability risk, this may affect the hardware devices, software systems, and other components of the key assets. By analyzing the correlation between the device risk data and the key asset identification results, the degree of impact of the device risk on the key assets is assessed, resulting in the third analysis result.

[0189] Another implementation method involves establishing a risk assessment model, using equipment risk data and key asset identification results as inputs. The model then calculates a third analysis result. For example, the risk assessment model can be established using methods such as the Analytic Hierarchy Process (AHP) or the Fuzzy Comprehensive Evaluation Method (Fuzzy Comprehensive Evaluation Method). Based on the model's assessment results, the impact and priority of equipment risks on key assets are determined, providing a basis for risk management decisions.

[0190] The embodiments of this application comprehensively consider risk data and key asset identification results, enabling a comprehensive analysis of the impact of various risks faced by equipment on key assets, providing comprehensive information for equipment risk management. By combining artificial intelligence algorithms, condition monitoring systems, and risk assessment models, the accuracy and reliability of risk analysis are improved. The introduction of real-time condition monitoring systems and risk prediction models enables timely detection of changes in equipment risks and key assets, providing timely decision-making support for risk management.

[0191] In an exemplary embodiment, based on the above embodiment, the method of the embodiment of the present application further includes the following steps:

[0192] Step 1: Classify the user profiles of the device users based on their cognitive level to obtain multiple cognitive type groups; use multi-dimensional sensors to obtain abnormal operating behaviors of the target device; and determine abnormal behavior data based on the abnormal operating behaviors and each cognitive type group;

[0193] Step 2: Use traffic monitoring and collection to collect and process the traffic data and operation logs of the target device to obtain device status data;

[0194] Step 3: Use the preset interaction channels to obtain behavioral and usage habit data of device users; perform device impact analysis on the behavioral and usage habit data to obtain device risk data;

[0195] Step 4: Determine the affected assets of the target device based on the abnormal behavior data;

[0196] Step 5: Use machine learning algorithms to analyze and process the device status data to obtain the status type. Based on the status type and key business requirements, determine the key assets of the target device.

[0197] Step 6: Use the preset analysis method to perform qualitative identification processing on the equipment risk data to obtain qualitative identification results; use the quantitative analysis method to perform risk quantification processing on the equipment risk data to obtain quantitative results; based on the qualitative identification results and quantitative results, determine the equipment-related assets of the target equipment;

[0198] Step 7: Based on the abnormal behavior data, perform abnormal operation impact analysis on the key asset identification results to obtain the first analysis result in the risk analysis results; based on the equipment status data, perform equipment operation status impact analysis on the key asset identification results to obtain the second analysis result in the risk analysis results; based on the equipment risk data, perform risk analysis on the key asset identification results to obtain the third analysis result in the risk analysis results.

[0199] It should be understood that, although the various steps in the flowcharts involved in the various embodiments described above are displayed in sequence according to the instructions of the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and these steps can be executed in other orders. Moreover, at least a portion of the steps in the flowcharts involved in the various embodiments described above can include multiple steps or multiple stages, and these steps or stages are not necessarily executed and completed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a portion of steps or stages in other steps.

[0200] Based on the same inventive concept, embodiments of the present application also provide a risk assessment device for implementing the aforementioned risk assessment method. The solution provided by this device is similar to the solution described in the aforementioned method. Therefore, the specific limitations of one or more risk assessment device embodiments provided below can be found in the above-described limitations of the risk assessment method and will not be further elaborated here.

[0201] In one embodiment, Figure 9 As shown, a risk assessment device 900 is provided, comprising:

[0202] The data acquisition module 901 is used to acquire risk data affecting equipment quality and safety using a pre-established acquisition method;

[0203] The asset identification module 902 is used to identify key assets of the target device based on the risk data and obtain a key asset identification result; the key asset identification result is used to represent the impact of the risk data on the target device;

[0204] The result determination module 903 is used to determine the risk analysis result based on the risk data and the key asset identification result; the risk analysis result is used to improve the network security disposal decision of the target device.

[0205] In one embodiment, the risk data includes abnormal behavior data, device status data, and device risk data; the collection method includes multi-dimensional sensor collection, traffic monitoring collection, and log record mining device collection; the data acquisition module includes:

[0206] An abnormal data acquisition unit is used to acquire abnormal behavior data using a multi-dimensional sensor acquisition method;

[0207] The device status acquisition unit is used to collect and process the flow data and operation logs of the target device by using the flow monitoring collection method to obtain the device status data;

[0208] The risk data determination unit is used to determine the device risk data by mining log records.

[0209] In one embodiment, the abnormal data acquisition unit includes:

[0210] The classification subunit is used to classify the user profiles of the device users based on their cognitive levels to obtain multiple cognitive type groups;

[0211] A behavior acquisition subunit, used to acquire abnormal operation behaviors of target devices using multi-dimensional sensors;

[0212] The data determination subunit is used to determine abnormal behavior data based on abnormal operation behavior and various cognitive type groups; the abnormal behavior data is used to characterize the protection behavior, abuse behavior and overclocking behavior of various cognitive type groups towards the target device.

[0213] In one embodiment, the risk data determination unit includes:

[0214] a data acquisition subunit, configured to acquire behavioral habit data and usage habit data of a group of device users through a preset interaction channel; the preset interaction channel includes at least one of an imaging interaction port, a voice interaction interface, and an optical interaction sensor interface;

[0215] The analysis subunit is used to perform device impact analysis on the behavior habit data and usage habit data to obtain device risk data.

[0216] In one embodiment, the asset identification module includes:

[0217] The affected asset determination unit is used to determine the affected assets of the target device based on the abnormal behavior data; the affected assets are used to assess the risk level of the target device when facing abnormal behavior.

[0218] A key asset determination unit is used to determine the key assets of the target device based on the device status data and key business requirements; the key assets are used to evaluate the core value of the target device; the key assets include at least one of key components, key firmware, communication channels, and configuration files;

[0219] The related asset determination unit is used to determine the device-related assets of the target device based on the device risk data; the device-related assets include at least one of hardware devices, software systems and data resources.

[0220] In one embodiment, the key asset determination unit includes:

[0221] A type determination subunit is used to perform state analysis and processing on the equipment state data using a machine learning algorithm to obtain a state type; the state type includes one of normal operation, abnormal operation and equipment failure;

[0222] The key asset determination subunit is used to determine the key assets of the target device based on the status type and key business requirements.

[0223] In one embodiment, the related asset determination unit includes:

[0224] The qualitative identification subunit is used to perform qualitative identification processing on the equipment risk data using a preset analysis method to obtain a qualitative identification result; the preset analysis method includes at least one of an expert survey method, an environmental analysis method, and a scenario analysis method; the qualitative identification result is used to characterize the external non-subjective risk faced by the target equipment;

[0225] The quantification subunit is used to quantify the risk data of equipment using quantitative analysis methods to obtain quantitative results; the quantitative analysis method is used to analyze the probability of risk occurrence and the degree of impact;

[0226] The asset determination subunit is used to determine the device-related assets of the target device based on the qualitative identification results and the quantitative results.

[0227] In one embodiment, the risk analysis result includes a first analysis result, a second analysis result, and a third analysis result; and the result determination module includes:

[0228] A first result determination unit is configured to perform abnormal operation impact analysis on the key asset identification result based on the abnormal behavior data to obtain a first analysis result;

[0229] A second result determination unit is configured to perform an equipment operation status impact analysis on the key asset identification result based on the equipment status data to obtain a second analysis result;

[0230] The third result determination unit is configured to perform risk analysis on the key asset identification result based on the equipment risk data to obtain a third analysis result.

[0231] Each module in the risk assessment device described above may be implemented in whole or in part through software, hardware, or a combination thereof. Each module may be embedded in or independent of a processor in a computer device in hardware form, or may be stored in a computer device memory in software form, so that the processor can call and execute the corresponding operations of each module.

[0232] In one embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as follows: Figure 10 As shown. The computer device includes a processor, memory, an input / output interface, a communication interface, a display unit, and an input device. The processor, memory, and input / output interface are connected via a system bus, and the communication interface, display unit, and input device are connected to the system bus via the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores an operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and external devices. The communication interface of the computer device is used to communicate with external terminals via wired or wireless means, and the wireless means can be achieved via Wi-Fi, mobile cellular networks, NFC (near-field communication), or other technologies. When executed by the processor, the computer program implements a risk assessment method. The display unit of the computer device is used to produce a visually visible image and can be a display screen, a projection device, or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a button, trackball or touchpad set on the computer device casing, or an external keyboard, touchpad or mouse.

[0233] Those skilled in the art will understand that Figure 10 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0234] In one embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, the following steps are implemented:

[0235] Use pre-established collection methods to obtain risk data that affects equipment quality and safety;

[0236] Based on the risk data, key assets of the target equipment are identified to obtain key asset identification results. The key asset identification results are used to characterize the impact of the risk data on the target equipment.

[0237] Determine risk analysis results based on risk data and key asset identification results; risk analysis results are used to improve network security disposal decisions for target devices.

[0238] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0239] Use multi-dimensional sensor collection to obtain abnormal behavior data;

[0240] Using traffic monitoring and collection methods, the traffic data and operation logs of the target device are collected and processed to obtain device status data;

[0241] Use log record mining to determine device risk data.

[0242] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0243] Classify the user profiles of device users based on their cognitive level and obtain multiple cognitive type groups;

[0244] Use multi-dimensional sensors to obtain abnormal operating behaviors of target devices;

[0245] Abnormal behavior data is determined based on abnormal operating behaviors and various cognitive type groups; the abnormal behavior data is used to characterize the protection behavior, abuse behavior, and overclocking behavior of various cognitive type groups towards the target device.

[0246] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0247] Using a preset interaction channel to obtain behavioral habit data and usage habit data of a group of people using the device; the preset interaction channel includes at least one of an imaging interaction port, a voice interaction interface, and an optical interaction sensor interface;

[0248] Conduct device impact analysis on behavioral habit data and usage habit data to obtain device risk data.

[0249] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0250] Based on abnormal behavior data, the affected assets of the target device are determined; the affected assets are used to assess the risk level of the target device when facing abnormal behavior.

[0251] Determine the key assets of the target device based on device status data and key business requirements; key assets are used to assess the core value of the target device; key assets include at least one of key components, key firmware, communication channels, and configuration files;

[0252] Based on the device risk data, device-related assets of the target device are determined; the device-related assets include at least one of hardware devices, software systems, and data resources.

[0253] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0254] A machine learning algorithm is used to perform status analysis and processing on the equipment status data to obtain a status type; the status type includes normal operation, abnormal operation, and equipment failure;

[0255] Identify key assets of target devices based on status type and key business requirements.

[0256] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0257] A preset analysis method is used to perform qualitative identification processing on the equipment risk data to obtain a qualitative identification result; the preset analysis method includes at least one of an expert survey method, an environmental analysis method, and a scenario analysis method; the qualitative identification result is used to characterize the external non-subjective risks faced by the target equipment;

[0258] Use quantitative analysis methods to quantify equipment risk data and obtain quantitative results; quantitative analysis methods are used to analyze the probability of risk occurrence and the degree of impact;

[0259] Determine the equipment-related assets of the target device based on the qualitative identification results and quantitative results.

[0260] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0261] Based on the abnormal behavior data, the abnormal operation impact analysis is performed on the key asset identification results to obtain a first analysis result;

[0262] Based on the equipment status data, the key asset identification results are analyzed and processed to determine the impact of the equipment operation status, thereby obtaining a second analysis result;

[0263] Based on the equipment risk data, risk analysis is performed on the key asset identification results to obtain a third analysis result.

[0264] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the following steps are implemented:

[0265] Use pre-established collection methods to obtain risk data that affects equipment quality and safety;

[0266] Based on the risk data, key assets of the target equipment are identified to obtain key asset identification results. The key asset identification results are used to characterize the impact of the risk data on the target equipment.

[0267] Determine risk analysis results based on risk data and key asset identification results; risk analysis results are used to improve network security disposal decisions for target devices.

[0268] In one embodiment, when the computer program is executed by a processor, the following steps are further implemented:

[0269] Use multi-dimensional sensor collection to obtain abnormal behavior data;

[0270] Using traffic monitoring and collection methods, the traffic data and operation logs of the target device are collected and processed to obtain device status data;

[0271] Use log record mining to determine device risk data.

[0272] In one embodiment, when the computer program is executed by a processor, the following steps are further implemented:

[0273] Classify the user profiles of device users based on their cognitive level and obtain multiple cognitive type groups;

[0274] Use multi-dimensional sensors to obtain abnormal operating behaviors of target devices;

[0275] Abnormal behavior data is determined based on abnormal operating behaviors and various cognitive type groups; the abnormal behavior data is used to characterize the protection behavior, abuse behavior, and overclocking behavior of various cognitive type groups towards the target device.

[0276] In one embodiment, when the computer program is executed by a processor, the following steps are further implemented:

[0277] Using a preset interaction channel to obtain behavioral habit data and usage habit data of a group of people using the device; the preset interaction channel includes at least one of an imaging interaction port, a voice interaction interface, and an optical interaction sensor interface;

[0278] Conduct device impact analysis on behavioral habit data and usage habit data to obtain device risk data.

[0279] In one embodiment, when the computer program is executed by a processor, the following steps are further implemented:

[0280] Based on abnormal behavior data, the affected assets of the target device are determined; the affected assets are used to assess the risk level of the target device when facing abnormal behavior.

[0281] Determine the key assets of the target device based on device status data and key business requirements; key assets are used to assess the core value of the target device; key assets include at least one of key components, key firmware, communication channels, and configuration files;

[0282] Based on the device risk data, device-related assets of the target device are determined; the device-related assets include at least one of hardware devices, software systems, and data resources.

[0283] In one embodiment, when the computer program is executed by a processor, the following steps are further implemented:

[0284] A machine learning algorithm is used to perform status analysis and processing on the equipment status data to obtain a status type; the status type includes normal operation, abnormal operation, and equipment failure;

[0285] Identify key assets of target devices based on status type and key business requirements.

[0286] In one embodiment, when the computer program is executed by a processor, the following steps are further implemented:

[0287] A preset analysis method is used to perform qualitative identification processing on the equipment risk data to obtain a qualitative identification result; the preset analysis method includes at least one of an expert survey method, an environmental analysis method, and a scenario analysis method; the qualitative identification result is used to characterize the external non-subjective risks faced by the target equipment;

[0288] Use quantitative analysis methods to quantify equipment risk data and obtain quantitative results; quantitative analysis methods are used to analyze the probability of risk occurrence and the degree of impact;

[0289] Determine the equipment-related assets of the target device based on the qualitative identification results and quantitative results.

[0290] In one embodiment, when the computer program is executed by a processor, the following steps are further implemented:

[0291] Based on the abnormal behavior data, the abnormal operation impact analysis is performed on the key asset identification results to obtain a first analysis result;

[0292] Based on the equipment status data, the key asset identification results are analyzed and processed to determine the impact of the equipment operation status, thereby obtaining a second analysis result;

[0293] Based on the equipment risk data, risk analysis is performed on the key asset identification results to obtain a third analysis result.

[0294] In one embodiment, a computer program product is provided, comprising a computer program, which, when executed by a processor, implements the following steps:

[0295] Use pre-established collection methods to obtain risk data that affects equipment quality and safety;

[0296] Based on the risk data, key assets of the target equipment are identified to obtain key asset identification results. The key asset identification results are used to characterize the impact of the risk data on the target equipment.

[0297] Determine risk analysis results based on risk data and key asset identification results; risk analysis results are used to improve network security disposal decisions for target devices.

[0298] In one embodiment, when the computer program is executed by a processor, the following steps are further implemented:

[0299] Use multi-dimensional sensor collection to obtain abnormal behavior data;

[0300] Using traffic monitoring and collection methods, the traffic data and operation logs of the target device are collected and processed to obtain device status data;

[0301] Use log record mining to determine device risk data.

[0302] In one embodiment, when the computer program is executed by a processor, the following steps are further implemented:

[0303] Classify the user profiles of device users based on their cognitive level and obtain multiple cognitive type groups;

[0304] Use multi-dimensional sensors to obtain abnormal operating behaviors of target devices;

[0305] Abnormal behavior data is determined based on abnormal operating behaviors and various cognitive type groups; the abnormal behavior data is used to characterize the protection behavior, abuse behavior, and overclocking behavior of various cognitive type groups towards the target device.

[0306] In one embodiment, when the computer program is executed by a processor, the following steps are further implemented:

[0307] Using a preset interaction channel to obtain behavioral habit data and usage habit data of a group of people using the device; the preset interaction channel includes at least one of an imaging interaction port, a voice interaction interface, and an optical interaction sensor interface;

[0308] Conduct device impact analysis on behavioral habit data and usage habit data to obtain device risk data.

[0309] In one embodiment, when the computer program is executed by a processor, the following steps are further implemented:

[0310] Based on abnormal behavior data, the affected assets of the target device are determined; the affected assets are used to assess the risk level of the target device when facing abnormal behavior.

[0311] Determine the key assets of the target device based on device status data and key business requirements; key assets are used to assess the core value of the target device; key assets include at least one of key components, key firmware, communication channels, and configuration files;

[0312] Based on the device risk data, device-related assets of the target device are determined; the device-related assets include at least one of hardware devices, software systems, and data resources.

[0313] In one embodiment, when the computer program is executed by a processor, the following steps are further implemented:

[0314] A machine learning algorithm is used to perform status analysis and processing on the equipment status data to obtain a status type; the status type includes normal operation, abnormal operation, and equipment failure;

[0315] Identify key assets of target devices based on status type and key business requirements.

[0316] In one embodiment, when the computer program is executed by a processor, the following steps are further implemented:

[0317] A preset analysis method is used to perform qualitative identification processing on the equipment risk data to obtain a qualitative identification result; the preset analysis method includes at least one of an expert survey method, an environmental analysis method, and a scenario analysis method; the qualitative identification result is used to characterize the external non-subjective risks faced by the target equipment;

[0318] Use quantitative analysis methods to quantify equipment risk data and obtain quantitative results; quantitative analysis methods are used to analyze the probability of risk occurrence and the degree of impact;

[0319] Determine the equipment-related assets of the target device based on the qualitative identification results and quantitative results.

[0320] In one embodiment, when the computer program is executed by a processor, the following steps are further implemented:

[0321] Based on the abnormal behavior data, the abnormal operation impact analysis is performed on the key asset identification results to obtain a first analysis result;

[0322] Based on the equipment status data, the key asset identification results are analyzed and processed to determine the impact of the equipment operation status, thereby obtaining a second analysis result;

[0323] Based on the equipment risk data, risk analysis is performed on the key asset identification results to obtain a third analysis result.

[0324] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of relevant countries and regions.

[0325] Those skilled in the art will appreciate that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the above-mentioned embodiments. In particular, any reference to memory, database, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory. The databases involved in the various embodiments provided herein may include at least one of a relational database and a non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases.

[0326] The technical features of the above embodiments can be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0327] The above-described embodiments merely represent several implementation methods of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present application. It should be noted that a person of ordinary skill in the art may make various modifications and improvements without departing from the spirit of the present application, and these modifications and improvements fall within the scope of protection of the present application. Therefore, the scope of protection of the present application shall be determined by the appended claims.

Claims

1. A risk assessment method, characterized in that: The method comprises: Use pre-established collection methods to obtain risk data that affects equipment quality and safety; Based on the risk data, key asset identification is performed on the target device to obtain a key asset identification result; the key asset identification result is used to characterize the degree of influence of the risk data on the target device; A risk analysis result is determined based on the risk data and the key asset identification result; the risk analysis result is used to improve the network security disposal decision formed for the target device.

2. The method according to claim 1, characterized in that The risk data includes abnormal behavior data, device status data and device risk data; the collection method includes multi-dimensional sensor collection, flow monitoring collection and log record mining device collection; The risk data obtained by using a pre-established collection method includes: Acquire the abnormal behavior data by using the multi-dimensional sensor collection method; Using the flow monitoring and collection method, the flow data and operation log of the target device are collected and processed to obtain the device status data; The device risk data is determined by using the log record mining method.

3. The method according to claim 2, characterized in that The method of acquiring the abnormal behavior data by using the multi-dimensional sensor collection method includes: Based on the cognitive level, the user profiles of the device users are classified and processed to obtain multiple cognitive type groups; Using the multi-dimensional sensor to obtain abnormal operation behavior of the target device; The abnormal behavior data is determined according to the abnormal operation behavior and each of the cognitive type groups; the abnormal behavior data is used to characterize the protection behavior, abuse behavior and overclocking behavior of each of the cognitive type groups with respect to the target device.

4. The method according to claim 3, characterized in that The method of using the log record mining method to determine the device risk data includes: Using a preset interaction channel to obtain the behavior habit data and usage habit data of the device user group; the preset interaction channel includes at least one of an imaging interaction port, a voice interaction interface, and an optical interaction sensor interface; The behavior habit data and the usage habit data are subjected to equipment impact analysis to obtain the equipment risk data.

5. The method according to claim 2, characterized in that: The step of performing key asset identification on the target device based on the risk data to obtain a key asset identification result includes: Determine the affected assets of the target device based on the abnormal behavior data; the affected assets are used to assess the risk level of the target device when facing abnormal behavior; Based on the device status data and key business requirements, determine the key assets of the target device; the key assets are used to evaluate the core value of the target device; the key assets include at least one of key components, key firmware, communication channels and configuration files; Based on the device risk data, device-related assets of the target device are determined; the device-related assets include at least one of hardware devices, software systems, and data resources.

6. The method according to claim 5, characterized in that The determining of key assets based on the device status data and key business requirements includes: Using a machine learning algorithm to perform state analysis on the device state data to obtain a state type; the state type includes one of normal operation, abnormal operation and device failure; According to the state type and the key business requirement, key assets of the target device are determined.

7. The method according to claim 5, characterized in that The determining, based on the device risk data, device-related assets of the target device includes: A preset analysis method is used to perform qualitative identification processing on the equipment risk data to obtain a qualitative identification result; the preset analysis method includes at least one of an expert investigation method, an environmental analysis method, and a scenario analysis method; the qualitative identification result is used to characterize the external non-subjective risk faced by the target equipment; A quantitative analysis method is used to perform risk quantification processing on the equipment risk data to obtain a quantitative result; the quantitative analysis method is used to analyze the probability of risk occurrence and the degree of impact; The device-related assets of the target device are determined according to the qualitative identification result and the quantitative result.

8. The method according to claim 7, characterized in that The risk analysis results include a first analysis result, a second analysis result and a third analysis result; Determining the risk analysis result according to the risk data and the key asset identification result includes: Based on the abnormal behavior data, performing abnormal operation impact analysis processing on the key asset identification result to obtain the first analysis result; Based on the equipment status data, performing equipment operation status impact analysis processing on the key asset identification result to obtain the second analysis result; Based on the equipment risk data, risk analysis processing is performed on the key asset identification result to obtain the third analysis result.

9. A risk assessment device, characterized in that: The device comprises: A data acquisition module is used to acquire risk data that affects equipment quality and safety using a pre-established acquisition method; An asset identification module, used to identify key assets of a target device based on the risk data to obtain a key asset identification result; the key asset identification result is used to characterize the degree of influence of the risk data on the target device; A result determination module is used to determine a risk analysis result based on the risk data and the key asset identification result; the risk analysis result is used to improve the network security disposal decision of the target device.

10. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 8 are implemented.

Images